68e962c4706f6bcfae0e0a04f30b982ba4e5f1e954da2393b162cc37f7c36d7f

Sharing

Copy URL Twitter E-mail

General

Target
kodi.zip.7z
Size 125.0MB
Sample260730-p7ectsycmg
SHA256 68e962c4706f6bcfae0e0a04f30b982ba4e5f1e954da2393b162cc37f7c36d7f
MD5 1c7b58b0e58da3e9373fa9afcc8cc6af
SHA1 0b7e0bb306fd3b41a22f31e7df7715dc22106863
SHA512 f1f710683d5b8c098e2d9852ad71bedd3e937f646b95365257c262dfe0de9b2cbf4e713b5ce7cefdda7be9a068d395c3cbbdd14d28e89ebf5e940892d65ab4e9
SSDEEP 3145728:afoiQLa1J324B888ZJhoU+nhSLvEaakfAplA:A2CJ324BmJhoUYhSLvEalA
TLSH
T17D5833E89420C1DD950D870035EF73761D0FABE65D9F292D183DA6C2C9FC86CD28EA66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  kodi.zip.7z
- Size 125.0MB
- SHA256 68e962c4706f6bcfae0e0a04f30b982ba4e5f1e954da2393b162cc37f7c36d7f
- MD5 1c7b58b0e58da3e9373fa9afcc8cc6af
- SHA1 0b7e0bb306fd3b41a22f31e7df7715dc22106863
- SHA512 f1f710683d5b8c098e2d9852ad71bedd3e937f646b95365257c262dfe0de9b2cbf4e713b5ce7cefdda7be9a068d395c3cbbdd14d28e89ebf5e940892d65ab4e9
- SSDEEP 3145728:afoiQLa1J324B888ZJhoU+nhSLvEaakfAplA:A2CJ324BmJhoUYhSLvEalA
- TLSH
  T17D5833E89420C1DD950D870035EF73761D0FABE65D9F292D183DA6C2C9FC86CD28EA66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  kodi.zip
- Size 125.0MB
- SHA256 12a46d907dce6f9b9c0781a98b7abec421f5733be5d47cb1eb2848509f5e9bd8
- MD5 ac387a67feca9c370d485d539a815560
- SHA1 c8cc3b7ae59ebd5cf6733057f857cd88d2abd3af
- SHA512 ba326670bd07c6ac89bbc8b1ecd026433dec02806b7936c2186ac7811f299792c678878ca7e57196f84165915d6c2a31515f8c44b2eff9be3664cfa3da20310a
- SSDEEP 3145728:dUeNe7NzbStcX6Mxak19ku0PRK64uuRHh3zFF0VmMvZUO2:+tJUczgZrCHh3Tz
- TLSH
  T161583323491C4526C56390B8E6C6AB55900C0160D4BCBD9EAFACEBD177F72C5E3F262E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\application\Mouse.xml
- Size 897B
- SHA256 bd5dac971fb5be9bcaef906005ed778a9da1f5f3db1014f0508f1d5f50ec6a9a
- MD5 2e1628d49d713dc1898ec580e34f48a8
- SHA1 4f3abe012d75d069e145fa9ea6d243b6b25b07ef
- SHA512 d8ca89ea837073ec02eda27b90a75f6bae523ea2af93030613fc627d769fc63ce6a0fdb7929d52ebe067783094bd52369cd2187ab429c198d8cb681aa39f494b
- TLSH
  T14B1121BDA0F09E62079F437F8E4865167F0296EB9205302C34EE65923FD6186469F48F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\8Bitdo_Zero_GamePad_v05A0_p3232_16b_4a.xml
- Size 908B
- SHA256 4a2316068f85390a60ef27ff39e00b229229d1c633bc894355b0b17caf422322
- MD5 7a81b8cf790da44509c0c28ed72d6930
- SHA1 f12fd3ead99d6924890b7afcd7c5afab7e7f3e32
- SHA512 8885be858407f96494e5a4321efa798c2d240da55e510018a567accc6979a648542f8cb7a7934b4f567e45a5731e37dd51e9a93d9bfc173c8070989fced19667
- TLSH
  T1A3112DBED5F0CD3203D204BF6A8164066F81A7EB8258701C709F65A6AFC24460A8F1A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\DUALSHOCK_4_Wireless_Controller_v054C_p09CC_14b_6a.xml
- Size 1KB
- SHA256 e322ce5a2dff0903d208e62a44f366420bfc125fe17e5ee54fcf1982bddacbdc
- MD5 5986b77a4e56da0b05e8a3a6b0340aa0
- SHA1 2cde239a4e82f68a8090d6807dfe6fad3593953c
- SHA512 639787a4e7896cfaafed70d789524770af208292174f7e5b2ab099a664cb1ab4cd25148e5b6fc84eab030c8eb985f7679d2b3ecf0e1de7d364e1d4398eadac39
- TLSH
  T1D43132BED5F0DD3307C600BFAA8598065F8296FB4319705D349E25A67FC25460ACF1AB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\GamePad_Pro_USB_v0428_p4001_10b_2a.xml
- Size 910B
- SHA256 1a7a791e3453cfe5960e3d1b049334f30d615e4f8a10cc3823f9d1ee887901a0
- MD5 642c0a2d7645735b93e170f3d397fd4d
- SHA1 6a145fc2e73cc8cd72b7106ea5755e4869ee2f69
- SHA512 2c9bb3dde58a11bc1d506572f4121e9c22ec0804901431d85a6e7aaf289c850d82a0cac03e5b8f4eb28cfc94836cce95d5f29d76fef8ae2c49009509282535c3
- TLSH
  T15911DEBEE1F0CE3303D200BF694564066F459BEB4269702C34CF61A26FC25420A8F1A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\Gamepad_F310_v046D_pC21D_15b_6a.xml
- Size 1KB
- SHA256 da4644218860b6bf52e2f89c7e87d8b0d1a964ac0c3f6041b9fb9ac3961face2
- MD5 9273966842518d5602ceac77f87425e4
- SHA1 740cea1c420a941773e9f5097c128532e4204952
- SHA512 95ffbb5bf22a7171e78167c3544cea707b5e70829730c035d900dd6d373cfe369c9dddc1c6f37b2dcf6a55b366818a3e36866d131b965b055c69f1d99d46b2dc
- TLSH
  T1D931DBBEE5F0CD2347C600BF994568026F819AEB431D705C719F65A2AFC25460ACF1A7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\Generic_USB_Joystick_v0079_p0006_12b_6a.xml
- Size 1KB
- SHA256 e6a02adabaf433af729eb0b0ea2a7f17b1d6d6851fc608a01d88c284b19ff5b0
- MD5 7e1d3dce5117b4700a45db73eb228d6c
- SHA1 0b05b60fd661f2c825fc44504bb7d730467f7c26
- SHA512 3a8a228b99af32d2588db37fc3100e8bbfa428cc45d16f60076ac1e90e34d90df2eb89babe64110d554d5f93ac35df195a56504a833b70cd8026e4068de58c26
- TLSH
  T19A113CBDD1F08E3207D300BF5946A40A2F95A7EB8318741C319F26A67FC25420A9F1A7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral8
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\Logitech_Dual_Action_v046D_pC216_12b_5a.xml
- Size 1KB
- SHA256 74d15a68e3c3632cbc3ebaafefff9d3c3e33fa7c87a80b55d11542e562c7538b
- MD5 54d56905d466a342a9c344db1823c10a
- SHA1 5b60e125333b7475ae5af92c8bbebd83e2f5f574
- SHA512 3eac16040a89fd280e21c119c5479600bdf127559ee4418ad1a14dc228a54b3491e38e3e374c4d2c58298bd45aa7315891c113b89fde3454946ed9916584947e
- TLSH
  T10A2119BEE1F0CE23479600BF9D8568026F815AEF8319701C74CF61A6AFC35420A8F19B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral9
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\PC_USB_Wired_Stick_8838_v0738_p8838_13b_4a.xml
- Size 1KB
- SHA256 1e2c47ac617faed1aa0d64f313db51dc5da4dbfca2e7ff7da8481622f7bcd4b0
- MD5 696ce51c7fe8316e0a8ff4b4d26a825e
- SHA1 43a0e2e35795bcbb53b05477fb8a5bb57d461e20
- SHA512 c9e8cf94c19d8000a5471e0beac58464661743a60990e9c992ff67abd6126a77e29d7b6f1643b2aea9a7d7a5c3673e7c65cb7ccb62e5c5c912512ad07acbcd7a
- TLSH
  T18D21EFBEE1F0CD2347C600BF6D4568026F819AFB4368705D30DF25A6AFC25420A8F1AB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\PLAYSTATION_R_3_Controller_v054C_p0268_19b_4a.xml
- Size 1KB
- SHA256 35d0d89a03db33c2dedc90056451bcc05bb02b1fdadf36a412a039fefb01ca8e
- MD5 c7955970292af67e07f1f8975de905ba
- SHA1 c9350e50590fbfaf552fa591d495130f1b2750c0
- SHA512 0569159321e075efbeb7e6a3d46971f934ad46692f29723788a51850aba985018dba87ac4908a2fb58b59582447c34a8e1e4f8c05a8761fab72159ddecfe05a7
- TLSH
  T10131F7BDE1F0CE3347C200BF994668066F819BEB4329705D708F65A6BFC2546468F197
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\PS_R__Ga_epad_v054C_p0268_19b_4a.xml
- Size 1KB
- SHA256 d9a7786d6a6daaf1b0ac3c45366a44346b4c01bedaa8ec84621a0dc6598f0c62
- MD5 e720ca08bd255bc0405ba23b0a65cda7
- SHA1 e77357876a896ddd128cd3f7f563fe4f952c15ec
- SHA512 9efe8b77989fe8b4cbf596673f44f8ce8e6f699441accacd54621dd727fb03d13946f92d0ad46a00aaef08e952456ae900fa8612ad6cc6472634b54694d495b1
- TLSH
  T18E310ABDE1F0CE33479200BF994664066F819BEB4329706D70CF65A6BFC2546068F197
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\USB_GamePad_v0E8F_p3013_16b_10a.xml
- Size 899B
- SHA256 84cdec3ceab6c14c6793f73ce08631d6fcdc2e008347a997e9aac5311c35462e
- MD5 a5f2d12d1a122df56e79d38cd10b32ac
- SHA1 0179b4d76a758e7be1bef4f6cf8849c92a57bb88
- SHA512 49529b8189a2b1c7f6178a8a85d2b9946fbf85401997250f936d94873391c000062151f7d5c4946ad5b11941121388ff01679e859535349c2e2dd0147422a861
- TLSH
  T1851144BED1F4CD3243D200BF5D8164062F4597EB4258701C749F35A6AFC25420A8F1A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\USB_Gamepad_v0079_p0011_10b_6a.xml
- Size 898B
- SHA256 47af80948ed3592cbca759117580d1e2ce132fe9410cc1f29cf38f0f7091180a
- MD5 5f377527ca380a013417410eade59b91
- SHA1 c0618f22c6fdc7974c28e0e61d5026def2a2aea1
- SHA512 69b0b3e87e3dde71ea6668fb8ad51abfc0b894a1765fa4a54bb80776327f94e72b38be70cd6e04e0c3c90be594f7b2eef80a70cda8fb46335e2ebe0e2ebb616e
- TLSH
  T18D1112BED5F4CE3343D200BF6D85A40A2F85A7EB4218701C34DF65A6AFC25420A8F1A7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\USB_Joystick_v0E8F_p0003_12b_5a.xml
- Size 1KB
- SHA256 ec6f0cf963a10b5a0dfee22037c6ed2d6699483203ce7206a5cb149fe362d74b
- MD5 4f21cb5568e2fed9283388e2a0cba0e9
- SHA1 c27bfa06eb0b224e4003839ea861b1ba60de8c03
- SHA512 69312dc3976aff216e24c66917656952ee377968bbf70e64b0af6051d3422e26de710e0a15158b60e2c0a2bd9fd2877fdf7e6fe939245ebdcccaf14e923aaeec
- TLSH
  T10221C9BEE1F0CE2347C600BF5D4564066F815AEF4359745C34CF65A6AFC25420A8F1A7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\Wireless_360_Controller_v045E_p028E_15b_6a.xml
- Size 1KB
- SHA256 6d701d43a3265935ce99ff4c23942215901b1deab140106bfca3a2a884eefad2
- MD5 2f32518973fd837067fb5bcd1669b97d
- SHA1 26760491c74ccf985c443c9cc0056045b60da18c
- SHA512 d4aaa7e3334e008ead11c69e63ac6e33c1a864a6a380b081abe6cc612ae7dca3b0a8887fcadd81ee940195d02d14081995de6c8ce745613701357cb35a8ef9d4
- TLSH
  T1EE31F8BEE5F0CD2347C600BF998568166F819AFB4319705C319F65A6BFC35420A8F2A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\Wireless_Controller_v054C_p09CC_14b_6a.xml
- Size 1KB
- SHA256 e0fd04a6b3f85b414ed830c1ff5ead3717350b84abd28ad2309a930a7994b232
- MD5 c573c7fca76325779bfe8e8b3fe48aa2
- SHA1 b95c88f791908b108dbae4346ecf8286600971c5
- SHA512 cdec7e10be0d2cb0696078d03941ed4ebe0930cc4d6f1e8ea1c3f7f7844c7934eae352a698cf87a40999c4ca65849f4d849aee929b805783f58ab016123bce8a
- TLSH
  T1F6312EBED5F0DD23078600BFA98598066F8196FB4319605D309E25A67FC35420ACF1AB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\Xbox_360_Wired_Controller_v045E_p028E_15b_6a.xml
- Size 1KB
- SHA256 29724cc36e60648e9ea9242ceda0d067a1fad62e6b46c9294063edd8a062c49d
- MD5 51ec90a26e37808da2b2b8c815b2ec7c
- SHA1 55122050028ce41258308653bc083c50c8c87aa8
- SHA512 274f553f98dc14e9483211dbed3fe5aa9ba05040fe51daaab7d31a26f8d68ebff17e31f241b936f666e44cb5383774ca5c5b60cdc5bf637c942e853830bd0ccb
- TLSH
  T10C310CBEE5F0CD2307C600BFAA4568166F819AFB4319705C319F65A6BFC25420ACF1A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\Xbox_360_Wired_Controller_v046D_pC21D_15b_6a.xml
- Size 1KB
- SHA256 ac9357a98b3ff7812b68624580fa1dd07e9dfe77c71534c33166891c8af2ac59
- MD5 bac639d88c16b660c655c49d6691de55
- SHA1 80cea5f69d45c43aa4349d6705e3e6fb34198b4b
- SHA512 6b72112cfc84cb5350a114737e5c6a80662c3def1cc36d933598940b16514dec8e088ba5d73222b0f0f35ab1f1e4d799fdacea3cebce7d1b3b2fd5a874b63686
- TLSH
  T175310CBEE5F0CD2347C600BFAA4568066F819AEB4319705C319F65A6BFC25420ACF1A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\Xbox_One_Wired_Controller_v045E_p02DD_15b_6a.xml
- Size 1KB
- SHA256 c1fbaf4277df6243ddfe8dc4f3ac8bfb99f26b4ea110cec4e2788fe0e333a009
- MD5 70d8201e545a43a90ae1bd3fbec3ad81
- SHA1 5ba61e6504f96536ba727ab84aac707f59ad654c
- SHA512 9bc81f09ec89d306737bf22d210b0d670bc17df7bfb5c879c164e199ef9f2fba1db05e626fd43f0a2a9f005cc52f42f66a3b892600bb984d620148c9374931b6
- TLSH
  T19431FBBEE5F0CD2307C600BFA94568166F819AEB4319705C319F65A6BFC25420ACF1A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\usb_gamepad____________v0810_pE501_10b_3a.xml
- Size 909B
- SHA256 1f4f52840e52d8914b3aeaf2b896a1736c0fe206cdc1491d675d9e2be29dff95
- MD5 daa1e56b2f065dcb5f1dbfb424602b2e
- SHA1 56a00dff33ff815a09ff0e6d9cfcb96776640a23
- SHA512 830847f9489061227db7bd0975e78b42d51193e10e771206cf213a8ada50d12c6a9de648cecfd96432f621f00d6748b69e8d0dbdbe85dee7fe27ba90739950f0
- TLSH
  T1E711EDBEE1F48D3243D200BF6E85640A6F45A7EB4758701C349F25A5AFC25460A8F1AB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\cocoa\usb_gamepad_v0810_pE501_10b_3a.xml
- Size 898B
- SHA256 e4c661d9cb28207ff923e4c188a89eec9328f83692c31bbffbe12d67625706f2
- MD5 f6ebd202d604d0450ac882eb8cb54ef0
- SHA1 d3686b764bff07a8b544900662ac28e496dacbca
- SHA512 f6908aff41d74aae7f9912219514a6479d66c6d7041590a9f6e386227ca86e519f41ec7ba0e7a4ba059a23a29e68d019902c43b4953acaaedb14dea76155143f
- TLSH
  T144112DBEE1F48D3243D200BF6D8164066F41A7EB4758701C349F25A5AFC25460A8F1AB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral22
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\darwinembedded\Extended_Gamepad_13b_4a.xml
- Size 1KB
- SHA256 a49a357b5716590482c2308c0ab3cd8bef013a82be868ee0ffad65a0a988b374
- MD5 6400751962562959ee621d58e686f6c4
- SHA1 06b3f4c2714af0afdda720252f0c5533023baacc
- SHA512 730b62e4618df0c3d2515a992c224d47293aa1db42b908e19eda6f6b8a2e1ea2f32f43d223255b4852e1395210503f8fbac68551f0ee9f474cda379fe6c46e39
- TLSH
  T17C21B7BEE1F0CE2347C600BF5E4568066F819AEB47197458308F61A6BFC25464A8F1AB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\darwinembedded\Extended_Gamepad_15b_4a.xml
- Size 1KB
- SHA256 9aec555966214c7895ceaced0fe13d068ac5aa24e2dba4942a36ac1f4e733343
- MD5 c89fed57f5edc2b551aa5456715cdb0a
- SHA1 7ea46f2886a666f9c714a73b354023f713729273
- SHA512 fd707af7d4701627b750f5414e9c173375e1e1b962f9e4385774712fbae1f40875f96529dbfefbfe852d2ec81c6606cb144694a2263e0c4fa1ede18ff0d7c771
- TLSH
  T17221C8BEE1F0CE33478600BF5E4564026F819AEB4319705830CF61A6BFC35464A8F197
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\darwinembedded\Extended_Gamepad_16b_4a.xml
- Size 1KB
- SHA256 b74f67b8c05f7db075fc247c7fb5df6787ee4d4fb30ff614b4b6f111e1c9ce95
- MD5 e627cd8a2cb4da275ef1a978209781d4
- SHA1 6759239d1eb69572b6d4998bbc44eabca70a4ec2
- SHA512 333b1bb9aac01f818aa7268a9eb4580a39974dfac2d105d36e765181f0c48536d262ec6898a558378c43c4717aefba7d018183afc0d9ced9169bb7d2d5904857
- TLSH
  T1DC21A5BEE1F0CE23478600BF5D4668026F819AEB4329705930CF65A6AFC25464A8F1A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\darwinembedded\Micro_Gamepad_6b.xml
- Size 533B
- SHA256 eebc1cdf1979eb87c6df8662b3465756739c2f3de90af35859c14fc8a85e4f77
- MD5 d0928e3f1c9409b7f4f14ec224846ef5
- SHA1 72baf4225f320d0dcc2dcb22f5bf072682a5af53
- SHA512 b78cb41511e54d728db81fd8e34d75219681f77d44b59d1a23a0d1fee2f944e9cfde562d5409068ea8bdc3203f9469b3627f3f05ffcb50806d4be418db1987e1
- TLSH
  T101F0FEBCE1F08E3203D204BF5A0260097F4587EB4628745831CF25E6AFC32420ACF1A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\directinput\4-PLAY_PORT.1_v16D0_p0D04_24b_1h_8a.xml
- Size 920B
- SHA256 285ec0c1732fdeae79aaaf473b783991cc1c0090fa28e9d26316c2c1213de059
- MD5 f413560df847bd7d3104ce6151c385db
- SHA1 405ee5c62cd5c174c55ba6b1a47aabf80938eda5
- SHA512 a4b0cc14202631c50f0648ab261318e84f58572aa8233258bb7210e69f0d83ad43c2f19585fdb4a95710331970c112b5f63fe8cc7d2e5bf993e5fe8c1e2e1463
- TLSH
  T17C1144BDE5F09E3203D244BF6986550A2F9597EB4218701C34DF25E66FC25420A8F1AB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\directinput\4_axis_16_button_joystick_v6666_p0667_16b_4a.xml
- Size 295B
- SHA256 636502b549bb59cf418dc8c022f14761f781543c32ca58592873b2a51a4117bc
- MD5 ef457a149f81cdceb3b6b8aa8acebf03
- SHA1 a0423f74a852d19933bfffbfec1e1b33fedcb6a0
- SHA512 fc65841e21d07368368a02e15bd001b87f798a70660f10169e98c1b204a6c4040cd6896cbe277f8bd3e276efc1e214a637bc16be898c34d1316e24b031696a33
- TLSH
  T191E0CDD2A1B49D230621156627D144086FA510AB9044150DFCAE3BD95F85C44024B05E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\directinput\Adaptoid_v06F7_p1_14b_2a.xml
- Size 1KB
- SHA256 497d1c7646e8de80575c9efe0fbec04e1aebcbddd508632f9cc6bd36b5121aba
- MD5 2e7a42dc745287802fe0e5822ba0da92
- SHA1 54604b13ffa42f43fe9c558267d33637c001d366
- SHA512 d3a3838ba7ab43dd549623daac0b18a8652bdc6c89026acc66c45e70da47e52ccff69b4804727c14b79df3ea0a47136148a6cebca08af6f466195dee7951e1c6
- TLSH
  T12211DABDE0F0CE2307C200BF594664066F819BEB4328711C358F21A2BFC66464A9F1A7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\directinput\Bluetooth_HID_Port_v05A0_p3232_16b_1h_6a.xml
- Size 926B
- SHA256 dc2407852730da91a36852922f185c30e006e706b494573707ebc1fcd11f00b5
- MD5 77fffa1dd6365b3ce183943e4e37f75e
- SHA1 073563f746875e6f8081dde7ed120f574e731930
- SHA512 638f36814be8f3c4c7e8e4c0a0817c4694471269132adc94d69951234558b9fddc427c9dc272daac0fbd4777734c502872a332b379bbef1e7b1651cd3e22c63a
- TLSH
  T1891121BEE5F08D3303D200BF6E8564496F4197EB4218711C349F25A5AFC25420A8F1AB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral30
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\directinput\GamePad_Pro_USB_v0428_p4001_10b_2a.xml
- Size 916B
- SHA256 39633c57bc1cdfd2a92e89eab89fec099d3c1b780d34acb0fd49756b6a597963
- MD5 99368fbdb9e37c66e0435be82648d56c
- SHA1 125696310a03cea8da1e18df1ba946e02386247a
- SHA512 fc3e757f5c8d750341dbdf32ba5694aa8a47c8f323c4abe15bd08dd5699147911aa2f647574366d904b31f1ccba40499f95c4a641370b3122d71aaa643ea1da8
- TLSH
  T10F11DEBEE1F0DE3303D200BF694564056F459BEF4219702C34DF61A26FC25420A8F1A7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31
- Target
  kodi\addons\peripheral.joystick\resources\buttonmaps\xml\directinput\Generic_USB_Joystick_v0079_p0006_12b_1h_5a.xml
- Size 1KB
- SHA256 84572c39dc24792d6886f31140ea7307ccc647f98539b15ee2f1b638b28bf798
- MD5 381b755bc754fbf54434fece31b4ed15
- SHA1 e199594a2116b31c36f6536fd8e256ebddbb0b2a
- SHA512 9be85bd8933acde86dbd6521ab643018ab74b08e4561436cdb0f69a94182a200849ec825547597c125a6778dcaf398f8835af71b33cb6c761d463ed50ad195db
- TLSH
  T16331C6BEE1F0CE2247C600BF9D4564066F819BEB4259702D71CF65A6BFC25460ACF1AB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32