39e78a6608aa874c9c1d0b5710dc168a8ecf3c4e514a207b466613d6bf7e6681

Sharing

Copy URL Twitter E-mail

General

Target
New folder.zip
Size 160KB
Sample260803-c72rxabb74
SHA256 39e78a6608aa874c9c1d0b5710dc168a8ecf3c4e514a207b466613d6bf7e6681
MD5 b236872182633a13ba60f8c62cb476d5
SHA1 1924ec85a59d8085c9b24fa75600cf844a9848ed
SHA512 1e8310d9167b4e246a757b14c398526815eef7142adaff2a1b0ed03ddf42a5519e02acc66aacb60ef0803d8c58b2d725e63b1cdd25a5bb3a83cfd21074b95557
SSDEEP 3072:BhehkLcsvJwKh8MZciZEQfqCEjjC+LcsvJwKh8MZciZEQfqCEjjCL:B0KcsvJwKvxbdEHdcsvJwKvxbdEHc
TLSH
T1BBF31221B8F9DE68FDA959B26983DC0D3E0608931C9ADCCDA1E58B93351CB8D87D5310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  New folder.zip
- Size 160KB
- SHA256 39e78a6608aa874c9c1d0b5710dc168a8ecf3c4e514a207b466613d6bf7e6681
- MD5 b236872182633a13ba60f8c62cb476d5
- SHA1 1924ec85a59d8085c9b24fa75600cf844a9848ed
- SHA512 1e8310d9167b4e246a757b14c398526815eef7142adaff2a1b0ed03ddf42a5519e02acc66aacb60ef0803d8c58b2d725e63b1cdd25a5bb3a83cfd21074b95557
- SSDEEP 3072:BhehkLcsvJwKh8MZciZEQfqCEjjC+LcsvJwKh8MZciZEQfqCEjjCL:B0KcsvJwKvxbdEHdcsvJwKvxbdEHc
- TLSH
  T1BBF31221B8F9DE68FDA959B26983DC0D3E0608931C9ADCCDA1E58B93351CB8D87D5310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  New folder/img-29b545c4-6b21-4abb-87e0-55b5d5d55391
- Size 2KB
- SHA256 b6a4da72eb8e1633d1314911da93b482e6153950e9b66ac44c411f7871148506
- MD5 c08d367fcfc6928dc3d599bb1617559a
- SHA1 9763f7eb4d64638aec736561bb7ab51098a15ab4
- SHA512 a7119eb33eac9fe5b594646420dd484e6a298f697eb654ca27de58cd6a88508e50cdea83d3514f7645a1cfc601ade71148d2f519dc680e374848a69ef2b09878
- TLSH
  T112412BA21B031C9CC5FC1372A6275A49F821F0D6157AC4DFBE03F87A24515E45D2615D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  New folder/img-29b545c4-6b21-4abb-87e0-55b5d5d55391 1
- Size 2KB
- SHA256 b6a4da72eb8e1633d1314911da93b482e6153950e9b66ac44c411f7871148506
- MD5 c08d367fcfc6928dc3d599bb1617559a
- SHA1 9763f7eb4d64638aec736561bb7ab51098a15ab4
- SHA512 a7119eb33eac9fe5b594646420dd484e6a298f697eb654ca27de58cd6a88508e50cdea83d3514f7645a1cfc601ade71148d2f519dc680e374848a69ef2b09878
- TLSH
  T112412BA21B031C9CC5FC1372A6275A49F821F0D6157AC4DFBE03F87A24515E45D2615D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  New folder/img-4fe2b7aa-7024-4275-851c-f59118530632
- Size 901B
- SHA256 14618caf573900e24e05a2b53d11b8204a024019f91d08c7547d6ce429c9eebd
- MD5 c79809f9452285a7de5703accb1df5c6
- SHA1 2f5c3cbb45051cf1af61a838e1bfcebf0922c187
- SHA512 04bb37b9a5a6a17ca92b84e376b2047cfb5def6a3e9ae820d7d28ce80d5745b9f7e7270948503551252f0b73498f28a7e80a3581c492b10754f9ab3cec013d4f
- TLSH
  T1B01163D15E206CB9C7E2553EAD83A3CC8863E4A25562B21A5758A3668E860C31D80994
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  New folder/img-4fe2b7aa-7024-4275-851c-f59118530632 1
- Size 901B
- SHA256 14618caf573900e24e05a2b53d11b8204a024019f91d08c7547d6ce429c9eebd
- MD5 c79809f9452285a7de5703accb1df5c6
- SHA1 2f5c3cbb45051cf1af61a838e1bfcebf0922c187
- SHA512 04bb37b9a5a6a17ca92b84e376b2047cfb5def6a3e9ae820d7d28ce80d5745b9f7e7270948503551252f0b73498f28a7e80a3581c492b10754f9ab3cec013d4f
- TLSH
  T1B01163D15E206CB9C7E2553EAD83A3CC8863E4A25562B21A5758A3668E860C31D80994
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  New folder/img-854692b8-f7fb-4cc4-b925-119d1f0a4561
- Size 76KB
- SHA256 e0efd8c93510c46c444f9bd903886a32c388ab58ed71d29f108bf01402a63f3b
- MD5 a3392d8f43388342555857c9f2a8ad8a
- SHA1 e7c5f8b7a8a572db4ba559396e924659f919a832
- SHA512 78f65a5660a58fb9bb23d5cae648263487305c9c3a630520d2201b15fcf5c0f8ab1108744542bfb4e088d8285401db40e3d0aedd878ad9724f14e42140492e66
- SSDEEP 1536:A2SSB/G9MkU48A7LNeejEMhScaM5Owac46k4Ppo3renXVQkRl85Sg7A7H7B:tL/rRn7MhScSre9RWA7bB
- TLSH
  T12A73023CF15ACB52332B521C2AB85DB34BA45C10EAA5DE98B609FF41434346BAAE425D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  New folder/img-854692b8-f7fb-4cc4-b925-119d1f0a4561 1
- Size 76KB
- SHA256 e0efd8c93510c46c444f9bd903886a32c388ab58ed71d29f108bf01402a63f3b
- MD5 a3392d8f43388342555857c9f2a8ad8a
- SHA1 e7c5f8b7a8a572db4ba559396e924659f919a832
- SHA512 78f65a5660a58fb9bb23d5cae648263487305c9c3a630520d2201b15fcf5c0f8ab1108744542bfb4e088d8285401db40e3d0aedd878ad9724f14e42140492e66
- SSDEEP 1536:A2SSB/G9MkU48A7LNeejEMhScaM5Owac46k4Ppo3renXVQkRl85Sg7A7H7B:tL/rRn7MhScSre9RWA7bB
- TLSH
  T12A73023CF15ACB52332B521C2AB85DB34BA45C10EAA5DE98B609FF41434346BAAE425D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  New folder/img-9dff32dd-4e4d-4caa-953d-6b340d6ee556
- Size 1KB
- SHA256 e13156f560529b850f01d121c471ce898a439620600e6c7bd62fa0f454a20beb
- MD5 76a3861efd1e77fb21328ef7bf01130c
- SHA1 8be0428c2bed141a31a1e448874010857a6e4cfd
- SHA512 0d4d17793b3991b53ea4afe23e165b6f90c182ec59b80cc31fda735c9fbebe40d23366ef0290041c86d8774daa43a30d2ec23a2d99027e9cd6ca3cf47f60f695
- TLSH
  T11F31A7A3CAE41C48C2E4DE7DA64B2369F5298554E5463C8F742C3354ACE2B85CE4A4A4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  New folder/img-9dff32dd-4e4d-4caa-953d-6b340d6ee556 1
- Size 1KB
- SHA256 e13156f560529b850f01d121c471ce898a439620600e6c7bd62fa0f454a20beb
- MD5 76a3861efd1e77fb21328ef7bf01130c
- SHA1 8be0428c2bed141a31a1e448874010857a6e4cfd
- SHA512 0d4d17793b3991b53ea4afe23e165b6f90c182ec59b80cc31fda735c9fbebe40d23366ef0290041c86d8774daa43a30d2ec23a2d99027e9cd6ca3cf47f60f695
- TLSH
  T11F31A7A3CAE41C48C2E4DE7DA64B2369F5298554E5463C8F742C3354ACE2B85CE4A4A4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  New folder/img-b8fdb546-c801-4edf-9360-228c118a64d5
- Size 1KB
- SHA256 08582e3e642f8aad390733113200087df39d06de51fc49aec152c4e69d59cb51
- MD5 c8375072cab4777fed06225cf284a5ef
- SHA1 c1abfad2999acf5442acd2b82de44fc14f81a937
- SHA512 6c2be100835b70e43f3d4f04d8212a14315eba5a9c17988eb9b3313295786344b32c7ac2c5c3c62f018ce9255d48883ff9ae7da987a0c50d70e6149299ed76a4
- TLSH
  T11A31EA879F5ABE7DC39A177F5D22932381E281A10094936D2F1C83504DFFB149DAE158
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  New folder/img-b8fdb546-c801-4edf-9360-228c118a64d5 1
- Size 1KB
- SHA256 08582e3e642f8aad390733113200087df39d06de51fc49aec152c4e69d59cb51
- MD5 c8375072cab4777fed06225cf284a5ef
- SHA1 c1abfad2999acf5442acd2b82de44fc14f81a937
- SHA512 6c2be100835b70e43f3d4f04d8212a14315eba5a9c17988eb9b3313295786344b32c7ac2c5c3c62f018ce9255d48883ff9ae7da987a0c50d70e6149299ed76a4
- TLSH
  T11A31EA879F5ABE7DC39A177F5D22932381E281A10094936D2F1C83504DFFB149DAE158
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22