33a98b92bebf8b97c4148422714bbf4f2a0a5f92dd2d703b3d029b63bbf6bc1c

Sharing

Copy URL Twitter E-mail

General

Target
DarthFN.zip
Size 12.2MB
Sample260802-ykff2s1cnc
SHA256 33a98b92bebf8b97c4148422714bbf4f2a0a5f92dd2d703b3d029b63bbf6bc1c
MD5 9a69d49a97e2ca1e07039846af4096af
SHA1 eb8170898d158a1c4585acf92276efd7620e5505
SHA512 b93809dcd695d12eb6432f8e5b75b2fdea2da0ffec92ca1f1ad494cf8d7a0b4a0cb223c7f6655cc83120a37cfa4a2ffbad9040f0477491e99847d4f2c378ce15
SSDEEP 196608:6FRMhE/ujdFyn14mYY6/jUtVvD53CcXoLKpgoxgDdYD/Bgx2joFINdVdBUc:MRMhEW/y+mu/g53CIgBYDJo2EyNdVIc
TLSH
T1C8D633D9E65A20B3D2F962B14532901AACCC446CEA90EFC7A2D10D57227FBDB5DD43C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  DarthFN/DarthFN.exe
- Size 146KB
- SHA256 dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee
- MD5 301a5357ec4151273a737a57a211c7a5
- SHA1 482fe3a0f2e701c69f40134e71faf5c134cd1fae
- SHA512 db8bef0960722e0372e1af2eb8057ba7640dc140d5710f301c2896d997fb1222c645e0b3b7a5a138b8a0fd4a1a316cc71f305b9a9170d728a4851f2abfd76d89
- SSDEEP 3072:QhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuGEL/:QhK4XycqgpfCup5sVxuZ04uhAD/
- TLSH
  T194E34A43B2AC00FDE1BBA3788AA21906F7767859477197CF0390C56A1F67BD09E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  DarthFN/Microsoft.Spark.Worker.dll
- Size 62KB
- SHA256 4674c82b4f6086d56e0a74aea72a268de453b94153adf591bb321a9faca5ff91
- MD5 fc5770e46d2ba46b53bfa6abef195876
- SHA1 da857c91ab8d7f839e94584ee14a5d98f6927886
- SHA512 5dace24959fae55c3126ade840a7a35e2508e165e8a2262b1f3efe9f9a917efa4b3e0a49fed39c687ab6f6b19cd95aa8662108569d73aa5dfcb4ea218401f8eb
- SSDEEP 1536:brLKvAu6oRsrqcQCnwwR1KQyT94xMQhmP8Hzs:vlu6oKGCn1R1KQyTUM7P2Y
- TLSH
  T16D537D0023DC8723D6EE2FBE54F120000B75A71B6962EB4E6D85B59E5877F858630BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  DarthFN/System.Collections.dll
- Size 254KB
- SHA256 5b20181ee4e188aa6b328c107fee9506e63efe3a4f9d2c3517ef2972b6aa1211
- MD5 f79c5255b5a8113246917ae7681e4a24
- SHA1 cc1b9bed6269bb109657a3bbec56f54c31444b0e
- SHA512 731ab48b1913fc9ba4f8d25eb497ef860796ffca7364ac91d18be2dcb243cda6bae0bd141cd6b8cb77c940253fe642bd44d85999003dd5701be9242a6bdab5bb
- SSDEEP 6144:unxoXLUDXDiKNYX8qTKfAyryS1rIgD3lgT:mxCUDXDiQ+jTURrhFLlY
- TLSH
  T14744492A77CC4E12E52F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6155
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  DarthFN/System.ComponentModel.Primitives.dll
- Size 78KB
- SHA256 304635dbc025b5c3bff78df48c19980e9b52c632a7d3c145b61288f546293bf7
- MD5 bc478fc2764a94c56e69e9e38a51452a
- SHA1 1c199bf6064992a5a81472b091a01f45b4442889
- SHA512 ae81a6ce5e66cdde1b074474459db6081c627b8b38e0f959ebcdee02ae935bb022e66f39a4451989aa59e3ebb15ce3052cc23ddee4c9db5e6649d33eaee484b6
- SSDEEP 1536:MI5/UZMu4Thd+Cv8A/oqevD2olsmIbktDinxze:Mr4X+S85qKD2ommIiOK
- TLSH
  T1DE734B1823EC0216FBBD46BC9573A821D575F6821713D9CF4AA0D90E1F9BBC2E27152E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  DarthFN/System.Console.dll
- Size 170KB
- SHA256 8469deb8c7d532e8857f5c68deb291035103dee3698bf5005f4e08c5bd05775a
- MD5 e58a5726978b1dfd94b6b4cb38102340
- SHA1 d1a561662830fd01351341ca862bb93191095338
- SHA512 2d7b698720d7ab2e8535a68afa3aba41d39a888d05e59454cb7e35ee04e9e3caef52ea9be46bcd8e28c7ef4e4098f168d7d0580347a9f980893198995301a388
- SSDEEP 3072:zqPlmXCzdfd6+Vfz5mDVV9evshARZvgL4OUgZjZXR1BB1GlKi7:uPoXifd6qwV9eEh2ZvgmQ9bB2KG
- TLSH
  T1EF047D2AAFE8252BE77F857444930301D637A9C70302D6EB61C585892F43BC6FB726E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  DarthFN/System.Diagnostics.Process.dll
- Size 330KB
- SHA256 7bbca593ed7f5b8f8650ecd5e597190d7d55bc4b1b9d8a992c7a1f887e65dcc2
- MD5 634fef75870c6c036fb4132a4e4d5b63
- SHA1 9020e99507a27d3009b5914f0e73c91f39c1aa1e
- SHA512 03b92b87e25344f425ab05475845b14bd8b320e8c09e5b55d94f8fd284097f5226a99720988ddcae025b92c60847f04ad60d74c0e4e90bad380eb0a5390251dc
- SSDEEP 6144:PZkDfqaP75HL9eEIdanhOe9jb3b41PlmFFVZTdiX2JD:P2DfqweDdSo8D
- TLSH
  T1E3747D247B980506FE6E96388C63D502EB78A49707D1EBD743A4D7DA3F4B7C2E632112
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  DarthFN/System.Private.CoreLib.dll
- Size 12.6MB
- SHA256 4cd6810b4ebe8d6e1f5928f2026d257c112380d33b557a60bcfa9c7f2bb012e8
- MD5 8b5ee62abdb7b72f418d797fe73f2521
- SHA1 77582007964cbb215278267691a255b63abe5ffd
- SHA512 870ef275e1e8d1607e2b22eb25f1f05f99346b54651bc119d809bf21f1a6f041eff801b3b5e1ffbb1897975feb2c3aa47b3699cc4c63eca8e3e6a60387ab4bd9
- SSDEEP 98304:FdVXzmQ6u2Pf1F1HpwajX4p92QKxV36FChEqiPVGK5+k+uiCi:9WuuT1HSajXgJgV36FDqM5+tuxi
- TLSH
  T15BD6AE21A3C45F16E56EC739C6638292E2B0F492535295CBC05DEFDA3F13BC15A3B262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  DarthFN/System.Runtime.InteropServices.dll
- Size 94KB
- SHA256 127ea3f2ff47cea14c082b2ed22066554d22c9d8f97dc0d403b17042fac62a5b
- MD5 1df866f691def4290407f5cf01b996ad
- SHA1 b2ba5af3f80aab63ef2fecf6341b44deae201ac1
- SHA512 6f96aec2abf7f6e96b7699f67cc8547334277c8e502e6ed357713c54b68faf264b1843ea42e6ab0f7c6ad7dcc1098b9042e1d5f15e93db6f8d346f613d1f6a1d
- SSDEEP 1536:4o6MupEelCtJfKS6+67NspnSPM+l5+CkmVhKWHOiOyzUizB:4o6R3lCto+dSPM+rJkm7NOxMUil
- TLSH
  T1D2935A2037C84666CA2A473C9C775D50C9B2F6C613A2E6DF5781895E1D9B7C0C3B23E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  DarthFN/System.Runtime.dll
- Size 42KB
- SHA256 9c506c9347f872c3375255f744dcf83b71a96ff71cbf4a19b39873fa22f73c22
- MD5 dac7d72763e59a64c0d706325b747d92
- SHA1 5890f0ee30b86e01ab55d6017261554d16f6c916
- SHA512 4218ca96d6d2d4e24e3b6a70a87890a9035156d522d217f48999870f644548a7bc5c09b78b23de41c5974c375f9d03ed49054a173b4230ae835ff808469ce50a
- SSDEEP 768:2+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLu:KB/LuYdy50b4b7RSHTSkingzIh
- TLSH
  T16D13D5A0AE485333CD8B6B72DC73AC810DF233C4047A597ED88EE51A13867748236B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  DarthFN/System.Security.Claims.dll
- Size 98KB
- SHA256 9aedeb23632f45084722906ced314074fb14e08478545a221ab6476febbaff0b
- MD5 31e935263d51f39c224e403bd5d7cc00
- SHA1 8af5efbc150d8f944adf84f89bfd9c11d00183e1
- SHA512 6b95226c760de73c85a4a9ed972c1f51f14b50087bccac290a31813ff3f6f882f7b5c7ee21352f504adcb7324214827d32bf9fe1dc34447520d97a7c12758d1a
- SSDEEP 1536:mt2q/as3w2pm4X+bX5SdluDQu6O/UZxOQwQ7rzUU3q2bP64LrSjYFFQWEzwC:mMU3LpmG+bJS7uP+pXSsFKvT
- TLSH
  T138A33B6437EC4222D2BA0F3C55E19909E9B4F9825772C7EF0A39CA4D1E97BC1D930A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  DarthFN/System.Security.Principal.Windows.dll
- Size 182KB
- SHA256 59815feab7b47abf6e7d4231a7081452b256704a3834c6a927a9e74c03897b9f
- MD5 7c560e02f8dfd723471f71cb71c0ccaa
- SHA1 c1ea98009aea6c3b12e078965ca3472e44eda305
- SHA512 32120bcf4d3e5c7a5ae676688fa8f0102c752e059c5eaf8987b37eaf3436c6892f9d1e7b3c531db808e1e554316e24abb0e3848705517833309954ebd537b037
- SSDEEP 3072:72kZDNC/sCTyRdtl63xJYrwkpDCRi1CSB2TOK1BguZbKXm:7U/sC6Ll67YrLpDCR4B2rPjxK2
- TLSH
  T11D045C16A3C8090BE6AF967D81639201D6B3A4570706DACB5591C9DA1FB7FC2FF32213
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  DarthFN/System.Security.Principal.dll
- Size 15KB
- SHA256 902d836b8cb066dc2279e4de0979b5a380bdccccfa69634ba51111cac2be2f44
- MD5 c9285d5497f2850234f48a0cf5619c0f
- SHA1 1b3aeaf0c40e401c1a2b4c19ead12314b5782ddf
- SHA512 5ee72864a21c23b1af540dad95d67348837467a3ce19478b02223ee220441e40388b97c8e1110452f32ec2fb04bb63b649e49860153b5b1df3f4d37d1c37866b
- SSDEEP 192:CB0LZxAyk4jWVUmfW2fpWjA6Kr4PFHnhWgN7aIW5agiZTOebR5X01k9z3AZZNFrg:zLD+uWimfWcYA6VFHRN7b9bt5R9zExr
- TLSH
  T103625B96C7A88203EEBB6E70A2B5D5173D3C63C69D51966616C5F2082C533C9DF3076C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  DarthFN/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 a875d0785cae18ee30db531303c166ba1a1d30c0ca4ab8edd38fe04056f91eaa
- MD5 7b3bded48604bacf38173a19cb38f269
- SHA1 9d15d2ad99f7437c9ae1775898c739712f8e5f93
- SHA512 a34cad7dc195b6c5b8a5c89e3a93083b1d401b5f772807524cede69210b04bf8fe746d9925c2fdb18b8d0f7636cfdfe48cf26fb0095500739cdc48e141bf344a
- SSDEEP 192:h7mXhp/SxgZW6sJWDWWxNzx95jmHnhWgN7agWP3zzccADB6ZX01k9z3AqRrimR:h6xiUW6sJWDdX6HRN7azzccTR9zlRrT
- TLSH
  T160724A918BA84207EDB75EB0A6FDEA823C3C67C25C11A66B16C9F6541C633C1DB3063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  DarthFN/System.Threading.Thread.dll
- Size 15KB
- SHA256 ecbe1cde0de93b08489005de9b2ba627725dc55646735dcf0f027e0e1fce6f6c
- MD5 00fe534a33b1f18dd900df89e17f73de
- SHA1 0792678a143e8abdd57837d4b67d187b74570835
- SHA512 5ad071c4574453fe242344696db8d132386cb05398c241f003c5643cc843c354288bb2c9a91bb6e0b8db3e126b747c34bfbd01b51255c82dc6c237b86686e73a
- SSDEEP 384:u4z2EI0W8tWcC7WGkX6HRN7cN8KER9zlZ:uOQvEWcN8R9zf
- TLSH
  T12A724A958BA84243DCA72DB052B9EA833C3EB7D39861D96B12D5F5841C633C9DB3062D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  DarthFN/System.Threading.dll
- Size 82KB
- SHA256 15cc9db291b87042f1ab4319f8d04f4cd226f15bf88bf0810b31dcd50fb0bb7e
- MD5 932a0c2978b649703c40b260b1955d26
- SHA1 e9a4c055bc14b3a2db5bc5d0cf838e79838ce8e0
- SHA512 51d6d767425fa1afa0acd5a149b99d4c62bab174ecd7485211e9b9635eb876319e8ad2a96d9a7cef26beb855da3661b26912f05014f6dc22cffe33306d9988e4
- SSDEEP 1536:AWgoICPLdImrmODZcUBeZ8j0GEH9wd633GRm3LGgLWz9zu:AWgo9PL6FtZ8j0GEH9wd6GR4GgLaS
- TLSH
  T1FB836B197BE80416FA3B47F9EAB69906C472FCD20710C6DF5049910C2E67BC1DAB227B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  DarthFN/clrjit.dll
- Size 1.7MB
- SHA256 0dfe34be78144cad7db5b66a7fca3d86178ec0f353aafba6c81eb72e797e383b
- MD5 cafab1ff05ff429bd46cb78b2ff8e9e8
- SHA1 e02b3b243b6993c0add46cab15bbb6549c602700
- SHA512 f19b60d26d784b2000e67a8698f8915ef623eee074dab9b853ba927a20ff11ab267c4ba385971620470987240263f917199e1424f3d23d263382163d66435639
- SSDEEP 49152:OkM51Lv2FQJioLYRa19wEvKugOQY5iW4WGGzgdZO3Ebz8d:OBioLQi9w/5ONiVGzgdZO3P
- TLSH
  T1AB85AE46A6F805FCD0AF9534C6574A1FEBB2B81A13209BCF43F409A56F237E2261E355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  DarthFN/coreclr.dll
- Size 4.8MB
- SHA256 b4375494bb10be11db6134d361df2f39a7a2c7f6696ca8d239a3ed424ce66de7
- MD5 389f964635cb95c6696744f56cbc092d
- SHA1 f133da56b7ad65d162656e052c358328877db1b1
- SHA512 49dbab9c3d1e9fe506ea7e0942d431559dcaf406c8e8233afdd234bd8337f735e1d9510861c1de00b7295d5956ee166d0ad55afce2142fd75a876f506f4dc661
- SSDEEP 49152:jh3nYAkdW1bIowGlFCJvETHWzaK6YL/XPSpRdUWPfeSk5GjyuQS7bPdB15i9FqeV:jkdW1bIowcrW6p0qnWHn+2OSn
- TLSH
  T14C368D56B2BD01E8D4BAC078C9D70A17FBB1B8590738DBEF02654A651F23BE16A3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  DarthFN/hostfxr.dll
- Size 342KB
- SHA256 130a3656b07a317f859d542c0f11339f3d0ba4198169853781a3fc04ed64c907
- MD5 00f6fc45937b885439cc6c1a34dc96c1
- SHA1 5df3efd8a49b91e5af676d35c02e75a640f4755f
- SHA512 75f088c244271142c58a7ca8f42ee68b910332ac2a23c44f7e6f6c38ff2334f96b8f28ef312a79461f5c631b07110403523b67245be8d3c7b6d0368913438085
- SSDEEP 3072:zoo0qOJezezqrPeYvCuV10J3keQRJysmFTHABK/o3BCLNzWNxEvf5NCnFeotrcRw:0o0qOqqYvCuV1jyFTuKA2zGxuIeotdt
- TLSH
  T1E3741906A2F801BCF1F7A7789AA64901E77B78454B70D6CF0390846A2F67BD0DE79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  DarthFN/hostpolicy.dll
- Size 384KB
- SHA256 65d61078b6b97884ad09aa12da97d96f50f7d98e6d163c926ae199f9bb58a3ce
- MD5 25fd4181ab8b572a1bbfba2f4a9ec239
- SHA1 b834dfc4c908b3cb8d3fc40771e6d0e900c7de64
- SHA512 38b708595e5a91194fdb089ae56e4051841c27406f8e770bb720ee9a5d66e6fb1ce8599f224071c2c23d30d832315c2a51a532677f121b383547f149385d1246
- SSDEEP 6144:Ux0Ke3VmzsnHpYHkGWqTRDERqBwT5eQC0+1Bs2u7FksfEXk0Pzfw:k0KWVmzsnKHkgTWkBDQq1K2vk+4
- TLSH
  T19D843956E2EC01ACE1BBB2785AB34901E7777C49077196CF13A0946A1F77BD09E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  DarthFN/win-64/Resources/System.Numerics.Vectors.dll
- Size 15KB
- SHA256 6fc60adc117431c23aeb22e7655256b4af6e0d11d6e93d39c30c67177cc31d45
- MD5 baea593f140ef4772af4a23baec65e57
- SHA1 7338629e6a810c8d8569237cb30cd4e0dc1fd87a
- SHA512 5d501eb9841b30327de248a28e460f7834a06cf9cbe83ce24900a0095cd737fe0642fbbecc3c8db469a0ff1c37f22f4d761454e3ba08a70cf1bcc8c77e0fb346
- SSDEEP 192:CgHhZikx+2W+BWgeZWQhFJtvUmmnoHnhWgN7agWhUBAdxP3NGmVX01k9z3ATQO9:hHhTfW+BWge/hljHRN74NP3U0R9zcQg
- TLSH
  T124724DA68BAC8247EDA71E7096B9D9833C7C77C71940A92D0995FA451C63385EF3063C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  DarthFN/win-64/Resources/System.ObjectModel.dll
- Size 78KB
- SHA256 3ee02fd08508eb34c84ded4a89f42e4b74a6fefa4e2c1122fa6abbe22fe532ce
- MD5 9629bed3e313ca1664aac39dfde59eeb
- SHA1 56c4eb26932276485cf31a53c505aa390a8031e5
- SHA512 0e4476aae8c61a5cd21e2e933ad4691f8ff955daa80d05560ac1b2cc910954185c7e84c08ab94366f941f84009f05db9e633bb2b6013955bbbe144bfcf0f8305
- SSDEEP 1536:P9r4De09KXrgcCGfNiQSscWrHGz3Yx4zEp:PX0wrqQN46HGzoGe
- TLSH
  T1BD739E2867C80327EABA063DD1F39862E135F6E31322C6CF45E1D54E0F937D2663656A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  DarthFN/win-64/Resources/System.Printing.dll
- Size 954KB
- SHA256 a056d90284f6d2448f2ee8d1d80c515a04a9d76fe9fb45a504f83fe056ec6709
- MD5 7f7180254264ae7d23178f474f3a164a
- SHA1 413860fdda727f83adc8f435bf137272e4bf3d8a
- SHA512 b5dc16d89ab05698bcb43b77586b6ab96fcc316bccfd8cd509f74533215a94bacf7358bf84229efa3a509e351214409e3be6feda08e7ca90970f41de8677ca6e
- SSDEEP 12288:CbwWR/X6XTuJmB8cjB6fqM77lwebn9F1jKW7sp0TYb7J1nf18G1ehJ:CAGfqMnlLIMG1eD
- TLSH
  T13B255B45A3C04D16D61EA37DC113C213EAB2A49253BAE3CB0581DA652FC77C3EA771A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  DarthFN/win-64/Resources/System.Private.DataContractSerialization.dll
- Size 2.0MB
- SHA256 7117e8f1dfa25f8431b5995e76bb053b4444e80ac5f42c1dde932dfc2272f075
- MD5 f0b0d897f3050b3356caa4f7b4ebfcf3
- SHA1 a179eeaed24b509af59cd43c40e1806b1e963356
- SHA512 1844657c6f9f50bfcb647ac409690dd766bb5917629a541dffb50050357306dff497e12ac8c5fe5b6701aaddf00a4acdec4617188dcb1504471771ab39916909
- SSDEEP 49152:aEOFavlNvjaq8s+3kOCP8tOEoxOouLso2DLgv6EI6Pa:aE8aCkday6Pa
- TLSH
  T142A56C1AB3D84716C66EC6BD86328013EAB1A41303A2D5CF1425EE592F977C19F727B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  DarthFN/win-64/Resources/System.Private.Uri.dll
- Size 254KB
- SHA256 635137a1d8426f7c7d9f08c09acb22bdaab8906fb73563d95b02ad10e0b51695
- MD5 d38fb29dc344db4b8fedd715038e96a8
- SHA1 d640ce393339c91d6624cc840a967b3daf171de6
- SHA512 9ea7d613de11bb543036f9521b9679fc68788541fb58cd994a4e2308326e7c3d890e1b67d6a703f2c99841dd8bf1f43ee1dbb1efbd0434931c9419946b385b17
- SSDEEP 6144:0fAevHZ+InBPKCeDc6CK9MG3CMeVmtGmFsGu6My8:7ygDc6MG3HamtGmfuVX
- TLSH
  T187448D29E3840E67F73DC2B981D3D112EAB270665315F7CB0AB5E1821F177C2AA36563
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  DarthFN/win-64/Resources/System.Private.Xml.Linq.dll
- Size 394KB
- SHA256 0eb1e793d58c6c81be11386bf81092ea0cf207336571d4d3e2986242dfd35754
- MD5 d342f376aa3fede8c7adaf030cc3103c
- SHA1 02068d32a4473aaf088d0c8ad47ce236c84d109f
- SHA512 8638530bc7ffde2d2aa6e1eb039fee3ca18bcf06beffa7b94f3f478f0709703153f3805b37d773ba0cf41cb2ac945e64929417d574859789b25e984a30bdd934
- SSDEEP 6144:CxVBCAdWedahF5g7yB4cPIm1OwpXQgQbACNYwzrZjzEOdlIZs:C3BZHUhF5Rv7/QcCywz1fQZs
- TLSH
  T13E846B24E3C80B12DB6F92BCC1939651E1B1918243D5DACFC418DDE5BE8B7C1BA3616B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  DarthFN/win-64/Resources/System.Reflection.DispatchProxy.dll
- Size 74KB
- SHA256 27e3386604333a7deedb5e7538839942f5720b1aa873c6345408664542a294f8
- MD5 7da9b40dfd29e56d9f05e44775db971b
- SHA1 46394c4d73b0ef6b6fb50497aaf7155613497bb7
- SHA512 eb745b20efbddcd9807513f2c0155933be23b45cec9057ce27ba948b45b5f0195e63c95e5995973cfddc4a9b3db96e1a39837b779fea68345bfb488fecbe12f4
- SSDEEP 1536:jvYuVA8CWZpWNv6zxMuSxRGHJSZYoqtTJoD+ezsrdP:jA/8CWZpWNv6qxRGZNtuAF
- TLSH
  T1B5734A26276C4705CBBB86389223AE85EAB1F6821210D9CF0CDAAC0F1EDF7D49735565
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  DarthFN/win-64/Resources/System.Reflection.Emit.ILGeneration.dll
- Size 15KB
- SHA256 ae47751a2d032d7269759daa1ee97a6ffb0a0e63a6aead090b009592a469eb1c
- MD5 f54481c0edc286a11b63fb95f83f35f0
- SHA1 270a9ff07e5fb7c50d047d243d81689615dd8b84
- SHA512 b4fdaa291994599d5d9017fe34c335ac9d45b50854ef3f2b0d0ef3822d3206a59b0564a1f0331ad0caf4fb19ad1fcb89f4554b3ac4ce6997d1c2644d7a855cc8
- SSDEEP 192:1KWKxvXW6UWIZWQhFJtvUmmnoHnhWgN7acWGOlo+DF9X01k9z3AHg:/QPW6UWI/hljHRN78Bp9R9zug
- TLSH
  T1927249E287B84243ECA75EB082F5DA933C7D77C78900A62E1695F6882C537849F3163D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  DarthFN/win-64/Resources/System.Reflection.Emit.Lightweight.dll
- Size 15KB
- SHA256 fa08d58251367b33b95d75252cb835cb710adf9a220099eb30c96264a3b73a71
- MD5 e484270ccb881e590a2c0bff3ec15c25
- SHA1 ee8f2075f2e9c25a60fd6ab167b0df733d309dca
- SHA512 00e218890f037ea15222565d2ba314a83183003d21b4a43f80b422f611215e6165aeb2bc34c84998edf1f32d8bafa647727c47615ac28362cda71ac9e4a0d768
- SSDEEP 192:+XwGcQxYbW3VJWNZWQhFJtvUmmnoHnhWgN7agWtWUTzlgnKug8X01k9z3AGqGUwy:+FrsW3VJWN/hljHRN76WIl8BR9zn6H
- TLSH
  T1F8725BA18BAC9343EDAB4D7086B9DA933C3DA7C64900D62A06D9F5491C17384DF3063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  DarthFN/win-64/Resources/System.Reflection.Emit.dll
- Size 126KB
- SHA256 8ed2694b576381e59866836b36fc0ef016140224e79d3e6a905324ea35b4978f
- MD5 a9db034fb016a6c4dd399d90044dd359
- SHA1 99f69df1e52edad4a7e0e552c7ec73077e8bc07c
- SHA512 ba01752fd47134bbe026a9070b61ff841d92b44daa73601f3885b15990402523a379e8382e5374b3dd9fc1ed9024f0f4ef94bc59d161d6cdc375aa9e656834fa
- SSDEEP 1536:aMKS54uaKi6blHXVZImoH4blYxM6pADtmXLJ1gEsVlcJrcBy0FugBR7y8szK:a254xKiEAYbKatyLJNsVkrcc0bBR7y9e
- TLSH
  T1B4C35A24B3E8462AD6AA82BD94B34952E373F5D31302D3DF08059A8D0E97FC1B572767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  DarthFN/win-64/Resources/System.Reflection.Extensions.dll
- Size 15KB
- SHA256 70235a191c9bc308a34c25f32232f0ac685da6c431e2d1ca0cc00d9c402e227a
- MD5 8bc2694609814b23f6f3322f34910979
- SHA1 184d3f6b5ff92203398e28ef108ceb897095b512
- SHA512 1d4943db79b871c9ba84d5d511c5dc0d8c2ee7272b2ddb843218b8d3f8d714cfa9375fe4698d6d5cfdccbeb0041806fa2584861d37bd1a839e3d450a4ce24c23
- SSDEEP 192:Iv8XzKxAGHGW/WW1fZWQhFJtvUmmnoHnhWgN7acWDj74zaSv6dlX01k9z3AnkuvB:IEDQvmW/WWN/hljHRN72jpS+R9zklpMY
- TLSH
  T1C66239929B6C4207EC675EB0C6E9DE833E38A7C69D10917B19C5F6491C673C4EB30639
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  DarthFN/win-64/Resources/System.Reflection.Metadata.dll
- Size 1.1MB
- SHA256 f3ab642fc2a102efd465cb49f4998524c7572228be4b0d2e70bcb1b8bba4933c
- MD5 f5f2e5bc330c80d7469daf08bc62217a
- SHA1 e337f060b545432220845d1444f4029381d3bf2c
- SHA512 bb74542be612f0eb0c0ddbf4567238d00845fa14c61bd0f58bc757d15ff221da0168627150d7a64de37cb5a2811940be692da86324ae90a3e996fbbcc9991e5e
- SSDEEP 12288:f3e0zGO6AJ8+utVRA8WDlLeO9om5EoU/mSdWTURfeGWhbrWAoDzgVdt:f3e0NlJ8TRocOWmc/CamGWhb/J
- TLSH
  T1E7358C21B3948B16C62F8679C0E34412D531B4A35BB6D3CF4A44FF1B2D53BD29A36A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  DarthFN/win-64/Resources/System.Reflection.Primitives.dll
- Size 15KB
- SHA256 657ed5f5cfb406b806f2cbc34d4dfbeb2e9c6b65f8d42c41dd5ff3ff46e4001e
- MD5 a2697f20a90f27d9a4828b0c531b77d1
- SHA1 c28cd15c3ec7c0ee646c8b4c17ce176c634aa550
- SHA512 e3055bce1c8067254145c95e02e2694a341fbaac41496aae7a3a03320016ec1e9a104522d8eef29b6297e1f3c8673998e1f46d6015cf9989f92c1d7faaa82e5f
- SSDEEP 192:ntCCMx1OW/+WTGeZWQhFJtvUmmnoHnhWgN7agWwItG7mCGZBX01k9z3A2fqDRgQ:8NMW/+WTGe/hljHRN7itoGR9zTyVgQ
- TLSH
  T10D725AA69BA84313DDA70DB096FADA833C7C73C61901E66E12C6EA491C53384DF31739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32