0dde84290edbc666f80e4edfce5ae4d745981edf7d4feee67a05b7df8b3e098b

Sharing

Copy URL Twitter E-mail

General

Target
Loader (2).rar
Size 17.9MB
Sample260801-ccnlssvfna
SHA256 0dde84290edbc666f80e4edfce5ae4d745981edf7d4feee67a05b7df8b3e098b
MD5 c734112c5fcee4f4be55217af1bf5a30
SHA1 2ce4ed0471f1f5a3961cc4c7945c7ac7b2af5b63
SHA512 ed0e295eda04382f3b7b923b9e9d88f761d4e90642012e617996a1918d446686e276b6a3f4bd8625b540872d7f9327fb93b4d26398488de9baa7b6f078e67399
SSDEEP 393216:zgwnFwPa8/uxi+nsXlv8CxDISdwnFwPa8/uxi+nsXlv8CxDISx:zgwnizG/nsBfhdwnizG/nsBfhx
TLSH
T11F17338E6B95645CA19BFE801DB648DF46AF32CD003D6768C49B3A75843CF830D85EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AI.bat
- Size 21B
- SHA256 a27dfbaad6bcabca81626926a49b08e675c3347cbacfe0f7f0de48f28ca692ec
- MD5 48fc0ce32cb3a75d37b8a23a5822573f
- SHA1 8d0cb4e471aaccd3e1a724808465d5d3cdb5314d
- SHA512 91924407e2fa0b3ba55ba9cd2159d33dd6d4ddd3dba8de8b41f5c481422383ed41e043682bdd94eaa2c3f5caa3740baa5673c766452b9b0ac580247f89954347
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Loader/best.onnx
- Size 10.0MB
- SHA256 f43891c74f64276df5549a84acbe34dddfc291fa8825c4b25cf177a07adf03f0
- MD5 a8d999a3caebec658d5c7fde319b2936
- SHA1 5cc4496a7033cd0b1d193d9036124e1f4e3f222d
- SHA512 84309a78f42f9d5d70805beb58ae0abdc25cf1e35aeb280ac005a7df038341b39a1f974f65da21fe32ca85b93d69568621021f57e345ffd4bd2bfd56f32f4e95
- SSDEEP 196608:iK+mOmVZIiQy58ZYTIEwdzyP/0TaOE/vrz3tjeTDZck7Rl1nAQhrCv7sTurRA+NX:0mr8ZYoNg/IaOGHd6T+kdl1nhWwTurRj
- TLSH
  T1A9B6338393B95FDEDA5F2DB773671C99978080BC0AB32981576FCD4D5B28D800386A8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Loader/configs/Best.json
- Size 167B
- SHA256 addbfeea204d1bca676dc8f99b1bab7dec8ee8ec80821e0a9c6c6cf2fca6bbcf
- MD5 53133422e6eca16187f3fad82a18086c
- SHA1 b2776ec0b0004d554ec1f88fe65c42a9dd434c74
- SHA512 384e004e17b380f72e881976e4e89ce636d95154b864dc5c7733dd5ee9686c0b4d8c4f661f44039dc7ed1b0649dd387e29675fe7dfe1a2e11e989e6e8fe3aac6
- TLSH
  T1D3C02B2FDA081CB255F4313218A12802C791C38B0410401B7F3490BC0F376CF70B8271
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Loader/configs/Rage.json
- Size 500B
- SHA256 563c4fd1523f2cc94fe2dccbe807000b718ff3a86cde6be462a20d30ee3c5598
- MD5 51f8610abf8fead79dc88a6284ea43f1
- SHA1 71efc466d4fa2a7144381ce2ed4489c0b074ee59
- SHA512 8369be8241a89cf7d3ab9b2a2053fd34b43c9d5bae43a4998e5f837f03a8e420f30294d6c1fb6eeca69a3b2ce4632e147d30a697fd38b5c3e0b2c6ff517b9605
- TLSH
  T157F0E5DBC8086C7735F9282E186BA805D361830F1165556F7AF4C39D0F397B77045620
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Loader/engine.cp310-win_amd64.pyd
- Size 154KB
- SHA256 6eabbf03a141d56bf6550249dd0e3686602678472f2589a576640aad254f0dee
- MD5 520fb06f8ae7cba1a449d7353fe7b2ad
- SHA1 781d89b3b33eab3424bf80a9ad18700802dffc50
- SHA512 b4e8e47cc97b6107f5f61579a1aac114c5f93bf70e094f74858e4dee93fdacdcb79f233ec72b326e0c74a490e0189ea58b455191f1c9bfc02cee0cb3ceebb6b6
- SSDEEP 3072:vzBGvz4l3NXj8ufDRta6zBNcValfiehmIPpOmjU8rao/kOENt:vzB6qXdN1zhmIPpOmjsoc9t
- TLSH
  T16BF3090762980098E57B91384C3F5913FAF3B5841B3567CF1AA0C5E66F82AA2B7FD741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Loader/install_all.bat
- Size 11KB
- SHA256 4d9cd3f319f8ece76e5df850052a3340e4d2d8c2b060c4200c26b28919017ed3
- MD5 1b87d1d1947c2770607c2287bb4a7155
- SHA1 7c80d26f8e3453d52230c529d5537433c2d0f59a
- SHA512 ac00d7c7fc2301e6147f309fca46c202ba10a02f0ff1131d2c36ca3f3eca30f6ae74b2c2e0e61354424c63c1079ebbffbe5e14c38c2532f41de19f372b25a723
- SSDEEP 96:ZrmM4j3eFi9xzkqwHr3rzLTHeRKu/TE/ou/YzpUFULE7tIa6EhdTvfTNsWxikmPG:v4jvxzkXHb/E8tIa6EhdTRxikM/fGV
- TLSH
  T19E32639B3568B57558D98366CF0921627346809F02A43CACB0FF81B45B01BD2B7FE173
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Loader/main.py
- Size 92KB
- SHA256 2a13173d1139225f59edd1c7346ae18a268af94b752e83338371d7e6254bd87a
- MD5 83dcbac8d77f4f506dbe387318e0f2ec
- SHA1 d52e7737472a73443d0a9d863b860be3569b165f
- SHA512 7d6ff293f273cb48e245a6f348fe8dcb0aa00cc9966ca6e4901f3fc24fb917e294cf1393c6c7047849f7178c25bc7a7fcf1609ca559c3b720015deb8b2e10a20
- SSDEEP 1536:54oYl+LpFjPzQsXJ+P6iPFw5+bLXST8RXrfFrHqo6/oBRA6WUhGvAdVojA:54oYlsliNtXXlrfFzZ6ABO6WUgvHE
- TLSH
  T1A29399855622E17E1B96CE192F43AECC6869D9EFD4C9E701F0C44A4FF4A873884E57C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Loader/pyarmor_runtime_000000/__init__.py
- Size 103B
- SHA256 8325a36ec8980dc74f7c3e942fe5a9919627b13a0135469f7393659376f63196
- MD5 fddd592609a35adf7cfbf46ce276640d
- SHA1 786b4b72d409ce0e5825f4e1d8a0c0994a9d0276
- SHA512 14e4d90df17cf8f9d8d1a6b2413dbd03e2676b3c4df603431408ce109761cbb20fae7321d0f43bbd0dfb25883a4e4d5e84bb151b1877f946268d13cee9898cb7
- TLSH
  T1C5B0120544F06EC7A23255CEC15B20B84B6974D33FC444608D5991708BC3405CCC1311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Loader/pyarmor_runtime_000000/__pycache__/__init__.cpython-310.pyc
- Size 213B
- SHA256 feb2dc21ddc9171a5b898ed87b16a3e112f13c10f4effaa0a4559cec01031ec7
- MD5 cb27b1252d17491fbd1bb7c7d6b27b12
- SHA1 158ec4bad94144194e2e845ac88d6e5b67a5bc5d
- SHA512 cc3c24b81b5c5e276632a6b1a7634824b29e79f7e7386ceac1fe14983778056ae40a430b7678a4daced97821a9fe9e8b255a66ea11343b4a0e4dcfee8ded9918
- TLSH
  T1ABD022834F535E83F0B9833F8470233827B0A8401ED390430E0C023D6BF93128810D41
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Loader/pyarmor_runtime_000000/pyarmor_runtime.pyd
- Size 620KB
- SHA256 da2a1bdd6146afa11cc90bab922a4b8c7111a4d9086b8f61740ea2d0089877f8
- MD5 7b5639e9de469d8b9679874d6a3a8144
- SHA1 f527063b7d6b04cd88baa2e7e58ea955f2379054
- SHA512 08ddc04c52bb6b7cfeabfa5773a43290aa3ee088d5185a499a6744076f534f486935156d1e141cc24d3ac5f251795fbbc7eb9adba13f1cee636a3e268e0f2fea
- SSDEEP 12288:gHnfttXpW0Bctjdcg7fUoPHuwYYnE2Q4hB:45ctjdcg7fUoPHuwYYn3z
- TLSH
  T1CDD4294BE5FA19D4E6B6E17C078BF2337C3ABA488160775B355CE3A127C4A5212D1F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  install reqs.bat
- Size 2KB
- SHA256 cd49e616363de67c2388b3ca29ee0646c7654c6147187fef62e12ceb21a0f31e
- MD5 98e55dfb0dc1cdd12e7298813d54658e
- SHA1 f29b7d57b7f62b71960514a0440b38dd5e677935
- SHA512 5dc61b65e175e6ab1c9f26f051e108953118350848d5dea33feab013260a6e9ddc2e849a46203c7368f460ad00668cf622fd180f78461afc59d196bacbb9df51
- TLSH
  T12B513D4B3228D1B95691C28ADF2A91827311629F52506DECF0BF45708F013D6FFBF5AA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution discovery ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral21 behavioral22
- Target
  main.py
- Size 81KB
- SHA256 1a8a2d3f5cd1d42f2fa26d0476e78b0c2e3649b8cceea09700fc8232584043b4
- MD5 de2492c7b786fc273df71d844e432389
- SHA1 a044d08dca4d0413f992005b75d45a8c1e07b265
- SHA512 5bd2faeb812a89cbd611918ff7e790d6800697eafa96396cd07ae0499605df89a7c2df9ed2deba54b1a8913253228e6708ac153518b32681fc334884ae150ad5
- SSDEEP 1536:3K6+SUaEoNoPidS0GCLYef8LukIhg0rrqEh76hukbSTb90PlaaY+iN9LSv:3KfooPidjTYef8LXIhzh7+Jg9Ma5+iNs
- TLSH
  T1688398855622E17E5B96CE182F43AEDC2969D9EFC4C9E301F0C44A4FE4A873C94E57C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  pyarmor_runtime_000000/__init__.py
- Size 103B
- SHA256 c8df08175ffe7bde77464051622c28cc025830526b66140279cc0be848f726cf
- MD5 6d4261ba2e77210d7e0287097b5b3354
- SHA1 9621731302b8844489de3b25c21c4bda90382bd6
- SHA512 e720a31686ad2f07340613175136d1edbb252090bbefb5226902ba241c17f887962d032fcb760b1b6876444f6c20982ea19dcd095b9a12d4bf320dff77ba509d
- TLSH
  T195B0120104506F97933050C9CA6221B843FA70C23FC048602E7521708BC7447CC8D222
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  pyarmor_runtime_000000/__pycache__/__init__.cpython-310.pyc
- Size 208B
- SHA256 6c4c84cd7a5b30d62f68801942ae0fc2c919f4c0acb860578bbbd92040ed5190
- MD5 54133b40f92ee9b440f5bca924834c52
- SHA1 e3bcd70ab5881c74b46bee3bf546e211b1d08e1a
- SHA512 d8e7bb6cd47b4b6c38c610e2e715a50555ca71748582495cb34aa6463d08be0ded4eae859b236c54a062fd1bd004aa0ab33a4ee8dcc716e25aaac9e32a820201
- TLSH
  T139D012874E564A87E579933FC43067382BB4B9452ED780431D0D02396BB6762CC60D41
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  pyarmor_runtime_000000/pyarmor_runtime.pyd
- Size 620KB
- SHA256 d234413a7843582174e28c11fffbcfc56cf7f28c2180b2d4628e1b22f21bd7eb
- MD5 62c302bbe3011ef6230b5d1538b46aab
- SHA1 a693c5b48df0d72f641bef0b89ab66940dac424f
- SHA512 397a6bc088d240e7d1b8d866600f3865f608f6e76b46c8cc790584a0b0acdd5e3380d33695fd7e67c187d4d6a4f200dacd785c6941d56465f03ab53480e2ae8f
- SSDEEP 12288:gHnfttXpW0Bctjdcg7fUoPHuwYYnE2O4hB:45ctjdcg7fUoPHuwYYn31
- TLSH
  T139D4294BE5FA19D4E6B6E17C078BF2337C3ABA488160775B355CE3A127C4A5212D1F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  run first.bat
- Size 2KB
- SHA256 8e82f55560ac970f6827a13597d8a03c3269a22db0b4347c46cf5cada55dae59
- MD5 19a222e6fa23f59742be6971e2c5916e
- SHA1 6daf5d404f70795448753f604506b89598a40d55
- SHA512 1c826ef284da58f172123cd6c5b912aebbdb209a28166b7cc96f75c8ec85e9819e8866253805951fbe68ac91afd8d7af945c91e451965fe4557660b4044a10f9
- TLSH
  T127513F12EE31D8703694CF6EDA9E7479F073026B26052C58F5BF429C1F09A2B657D322
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32