05bd73c8f9b761a1617143f86bd3dfde5fa9feb62977c6dbd284bb11e4aca570

Sharing

Copy URL Twitter E-mail

General

Target
HYPESQUAD CHANGER.zip
Size 9KB
Sample260801-np8chsaa48
SHA256 05bd73c8f9b761a1617143f86bd3dfde5fa9feb62977c6dbd284bb11e4aca570
MD5 b5ff5e38917b91b0145e910afffc254f
SHA1 60711c4e029cd9889232dfb4053c338743f6c402
SHA512 033098f175a069d93e0cfcad74e656a11ddb4f6aca15e0d116425adeb305bd56008a0a838f211d84fc92f6c8133845118c593c1945c94807d1c44047cb152621
SSDEEP 192:cwp5wHnzBNG7FKFZwhCSM231VH2I0bkNQFl4Un4ZBUmdyUkeB+swxEx:cwpmHnzPG7iZwUSdlVWI0ANs4Un4ZnoG
TLSH
T1D1124AF5FB443C30CD4662785B0CC12ED257A60A733828DA6DF61A583D5DE106B3BA55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  HYPESQUAD CHANGER.zip
- Size 9KB
- SHA256 05bd73c8f9b761a1617143f86bd3dfde5fa9feb62977c6dbd284bb11e4aca570
- MD5 b5ff5e38917b91b0145e910afffc254f
- SHA1 60711c4e029cd9889232dfb4053c338743f6c402
- SHA512 033098f175a069d93e0cfcad74e656a11ddb4f6aca15e0d116425adeb305bd56008a0a838f211d84fc92f6c8133845118c593c1945c94807d1c44047cb152621
- SSDEEP 192:cwp5wHnzBNG7FKFZwhCSM231VH2I0bkNQFl4Un4ZBUmdyUkeB+swxEx:cwpmHnzPG7iZwUSdlVWI0ANs4Un4ZnoG
- TLSH
  T1D1124AF5FB443C30CD4662785B0CC12ED257A60A733828DA6DF61A583D5DE106B3BA55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  HYPESQUAD CHANGER/__pycache__/config.cpython-312.pyc
- Size 487B
- SHA256 fa2dc89a405385a7b00a707eaaaad056b022dfc0729ba40eb77f0d86ad3dfb4c
- MD5 55f272c47a8c6a727680a3f71fc536f4
- SHA1 1b5d4a3dfbd7d6fdcf39462f5302928a1a0da82d
- SHA512 b34a2d2525f536167264b52c3195fd7d497d6c6bc91ef9e7ccbbc1b177a18e3b8957e27505cd2d2311df71a69c10630e5251e881c1ddede6011b5bb0d730d657
- TLSH
  T12FF0DC4323D18C07C6321CF4D220214F61E779EAEEBEB2112A1035134D8CF05F9E2943
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  HYPESQUAD CHANGER/__pycache__/embed.cpython-312.pyc
- Size 3KB
- SHA256 5f266167665a7ead955df3cbbc8bb6f0692f50483e7eb7fdf481905b313a79fa
- MD5 a30725135465884032f35ff8f2f60889
- SHA1 d5f85347d58d1cc41203ea48c392718ab8c35109
- SHA512 5bdd882a587483bede5d2115214e5c8b8303bd8b933b21aebbf8284192bfe89ca4d05f1bd5212b74ad57b56127c610ce0b3c26e36101868e64412b8e872611e7
- TLSH
  T1A98163456B07C47BE6A48E7045722EABE3718DB2F851D307726F90C84E3A678ED510EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  HYPESQUAD CHANGER/__pycache__/hypesquad.cpython-312.pyc
- Size 1KB
- SHA256 6635f95e52ed3a2d81ebac8ce310b660718b9f1d78179dfebb6a138d53379892
- MD5 3cbbc4ede3f4327a2e752dcb0f7f89e9
- SHA1 4632436656b44b00e3d131f37a6f9a7423731c57
- SHA512 4285865f7b175f10611371eb4e479ce0c12fa27529bdd631e67f2fa78df15dacb490aa986252a5d669fed9806e1415f907b2e7b3f7c29f62f39aa73134687d32
- TLSH
  T1971123C17394CC2AFC68A1F441470B2D33B189F7F218B717267A17B66C5F8D449254AE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  HYPESQUAD CHANGER/__pycache__/utils.cpython-312.pyc
- Size 1KB
- SHA256 59ec03b925fdf438fbbd25bf9f44f7b2c24275e85e114537519c2b79b8b14971
- MD5 5adf133126b7547689c7a49d85f62a91
- SHA1 f39d466ff15468e4e0f16b83a5f4ce09fa24f447
- SHA512 3406dc3e94a7d45740a1fabf3f793fec8ce6a68685376efef88c8a58536042aaad80116218ba294c445f115fa2de135dc6660012ac9bf814fa1b74db6c7ab8a4
- TLSH
  T1FE31968AB642F431E84261B4A1271B5C73A382F8B119D71761EDC3F71C5F940A0724BE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  HYPESQUAD CHANGER/config.py
- Size 322B
- SHA256 f2a6bbb12dc3e1e6d1718fd6174bb45fc8efbba6ca622ab94f3f80dd491fdccc
- MD5 0f14e7869b3593742d0ffb5ae09c4d3c
- SHA1 9c530cbd2716977475262e3cb68ff2930a0727bf
- SHA512 a4bdb41cff3577d2285050b744c0a2200b729e5f52b51bd1a3c2b75b1b1f3c6e6cdc8ad7e93ae3b41e3e9e5c4c42cc37a182b3b0ad5ddb1776daf07e46cd9754
- TLSH
  T131E0C2270274962347B20EAAC355740EB96972FFA97C1242752454010EC9CC5BFE28EB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  HYPESQUAD CHANGER/embed.py
- Size 2KB
- SHA256 dfd05da9eb0aa038083184fedaa990624b4cdc39ad8d2f708a620a304b88e874
- MD5 923e3fd899ee5dace145a9d0e951c863
- SHA1 9d04d7a6c7aa06bbd5a082c801977945f7b670b0
- SHA512 8ae3b9cffeacc8c6a5b07e78a05e6010c27c09dccf9b2137b84ca958ad541c8a4d2518f4508dfad5996aafb4621ccfee5ebb7578a496b23a0d2596b0249fd69a
- TLSH
  T1EB41DD358C62A08169B7004D6D90A019F320833757366317BDBDC76C3F3AF59E56696C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  HYPESQUAD CHANGER/hypesquad.py
- Size 540B
- SHA256 392a2893552c017970a1c33f429b98b57c25883561ca9c0ec3b2bd6e9fd5af25
- MD5 ecf7434daef34d391e03423528684c49
- SHA1 5c7fea55c92067f07171145b66105a85857bc60d
- SHA512 620f9207023fc82f351fd59d508990162e4f62590bdc7660952eadc02f2d4a80d4a7fbae76ae097d1be3d7fccf0ad7806cd5f0f512a2169c0515cd74b829600d
- TLSH
  T190F02B437D9A7C4952748484E404951AF519F253331D2552B0B002E93F3C924A8F2B8E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  HYPESQUAD CHANGER/main.py
- Size 4KB
- SHA256 0deb46100f881dcbd1af88ed6dffd2bea598b6ca0a7d3cd03d9b5cac7321d6b4
- MD5 12a2204be32cc9481bfd979c2d64e3c2
- SHA1 3dfccf28a98a45b70944071c85408bed9bb193b7
- SHA512 73566c73bd0b628eeda16e29db1d04ea27da86a9edf951a68f0b0ae08f07538e26496e12a52f24828ae45035d602539585f1f3d3ac30f6188e2688337d41e550
- SSDEEP 96:kF116RI4o7WV3EL8igVeIqEW8Ejkcb8E/PWsB4n:kXw4CSVI6jb8E/usB4n
- TLSH
  T177918C056D18E9554332011FBD32E0C0FA1E6177DA3E713275AE06434FBAE78BAC222D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  HYPESQUAD CHANGER/requirements.txt
- Size 33B
- SHA256 bcfc2d9cb3b23d109682992f464eb30935b71e054c6856439bb35da8d85803ac
- MD5 c5533f2faa095e85f012a02dab3ed9b4
- SHA1 2d034c19bd4a78bf4c81d710fb2ec2fefc13cfbf
- SHA512 8242a8fcf54c48bd924237ce73b8fe34bd44a9dae3ec0427d16ef453baf55a56d302f718dbc3dda1606ee8fd7b186539a8c647ec51aff43fbbb665514c3da954
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  HYPESQUAD CHANGER/utils.py
- Size 1KB
- SHA256 9e6a708889bc9b089f5c987188b9fe16d75cf598fccf09728a37ec89d56784cb
- MD5 96034c2f98e0cb126abb5f4650eb75e9
- SHA1 0fca5f9bb7b2436e67733e3438db42084913f402
- SHA512 de1c05899c098d65c3481c7c85209393d71bd758cf2a246d5d4cf4a2683a153aad918c86d8e3ec7997a8f835c39f5444b9a871b9f4074c833c39db1986c161c1
- TLSH
  T1D5117BC69C87B413813CD84CD852C51BF696971756CA6A22B8BC42AE3FB4469C1B50ED
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22