1ef0d443f06f9263f204dcafae1ab209fb766a1539c0d6354ecc6654394d4495

Sharing

Copy URL Twitter E-mail

General

Target
1ef0d443f06f9263f204dcafae1ab209fb766a1539c0d6354ecc6654394d4495
Size 14.3MB
Sample260803-ty96cstamf
SHA256 1ef0d443f06f9263f204dcafae1ab209fb766a1539c0d6354ecc6654394d4495
MD5 403bc195bac63435423461a8fcc3cb9e
SHA1 81662647626814e306d9d9071740799567f37a40
SHA512 6a761ac9ae8136e360f2dedafa889acfda31ab86ee4d8da98d89e3d3cb4bcdb917653bf591f88424b1f4d7360a06003725c5720837f7c6f578570d93e0b00b6c
SSDEEP 393216:OBqGaXCIMujAvc39GcWeySaMGvEDCWHCl:O3J5u3WwPU
TLSH
T1AEE633DC032E208F6CBAD8DD6E7283DD7EC2ABEDD7A05618C114DE055B7846166236CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AR Statement/AR Statement.js
- Size 6KB
- SHA256 990112dc9c2c6e10da4c546e46f8afcea844444dd31e5dfff8c8ae9b07575a5b
- MD5 729b7b79134094f33f6852460c3800e8
- SHA1 04d33031076c70715886525aeb5a9aeb73cf69b9
- SHA512 644a4daaff83dca55a1ad038cd31f2d1fefc8ff05a672b038ea2111cd8a29cd77b0b339e07df3d16f7c89dc8b63ae0df76abcb1bdb26c9c57a0824b02c68a66b
- SSDEEP 192:kl1Om1Ysn3FkrxR59RxL7NSfjpE4ODr4RXWE3ybcetvTUhmwVby:GFpnExRPBU1E4OO3JSUXy
- TLSH
  T169E122892FE06265162E1FBB7D7F92CCD16764DD688848AFF21069F05CD0232D9A1B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  AR Statement/File.ClientSetup.msi
- Size 12.8MB
- SHA256 f8d4db2294c4aa167f767de2e016b5498e7ccd1955002292769e50c9ca53c332
- MD5 996a4007aa678df3484d9a75b76516eb
- SHA1 215a8e5d66e86d399b15f623609f6c46ff9a7204
- SHA512 1e50031733b7ce6a3c3f6348b3f5bc25692aec709fd67fe46b0d375e24b84fe8cdad6568db7b296577240b1e338e2474b06be956c856f6f1fe21348be083cff2
- SSDEEP 196608:UWh0cGw4Wh0cGjWh0cGuWh0cGlWh0cGhWh0cG2Wh0cGI:UWacGWacmWaclWacSWac0Wac9WacZ
- TLSH
  T11FD6232523FD401AE8F74B79FE3682F46A72BE68DF21C11E5228790D1A74D4096727B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  AR Statement/File.ClientSetup/ScreenConnect.Client.dll
- Size 192KB
- SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
- MD5 3724f06f3422f4e42b41e23acb39b152
- SHA1 1220987627782d3c3397d4abf01ac3777999e01c
- SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
- SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
- TLSH
  T1DD144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  AR Statement/File.ClientSetup/ScreenConnect.ClientService.dll
- Size 66KB
- SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
- MD5 5db908c12d6e768081bced0e165e36f8
- SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
- SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
- SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
- TLSH
  T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  AR Statement/File.ClientSetup/ScreenConnect.Core.dll
- Size 536KB
- SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
- MD5 14e7489ffebbb5a2ea500f796d881ad9
- SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
- SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
- SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
- TLSH
  T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  AR Statement/File.ClientSetup/ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
- MD5 9ad3964ba3ad24c42c567e47f88c82b2
- SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
- SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
- SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
- TLSH
  T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  AR Statement/File.ClientSetup/ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH
  T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe
- Size 59KB
- SHA256 e25f32ba3fa32fd0ddd99eb65b26835e30829b5e4b58573690aa717e093a5d8f
- MD5 afa97caf20f3608799e670e9d6253247
- SHA1 7e410fde0ca1350aa68ef478e48274888688f8ee
- SHA512 fe0b378651783ef4add3851e12291c82edccde1dbd1fa0b76d7a2c2dcd181e013b9361bbdae4dae946c0d45fb4bf6f75dc027f217326893c906e47041e3039b0
- SSDEEP 1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
- TLSH
  T1DE537D4063F84A26C9FE5E3AB4F1D2250AF1AA426451E7AE0ECD51E94E137C16F603F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

defense_evasion
behavioral15 behavioral16
- Target
  AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe
- Size 588KB
- SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
- MD5 1778204a8c3bc2b8e5e4194edbaf7135
- SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
- SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
- SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
- TLSH
  T168D46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  AR Statement/File.ClientSetup/ScreenConnect.WindowsCredentialProvider.dll
- Size 822KB
- SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
- MD5 be74ab7a848a2450a06de33d3026f59e
- SHA1 21568dcb44df019f9faf049d6676a829323c601e
- SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
- SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
- TLSH
  T10C055C1BE79840B9D0ADC2B5D31B9636BBB6F4864514B68F07D40A227E2FF50AF1C394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe
- Size 79KB
- SHA256 ebd04a4540d6e76776bd58deea627345d0f8fba2c04cc65be5e979a8a67a62a1
- MD5 1aee526dc110e24d1399affccd452ab3
- SHA1 04db0e8772933bc57364615d0d104dc2550bd064
- SHA512 482a8ee35d53be907be39dbd6c46d1f45656046baca95630d1f07ac90a66f0e61d41f940fb166677ac4d5a48cf66c28e76d89912aed3d673a80737732e863851
- SSDEEP 1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
- TLSH
  T18883E68235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion
behavioral21 behavioral22
- Target
  AR Statement/File.ClientSetup/ServiceExeWithService
- Size 93KB
- SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
- MD5 75b21d04c69128a7230a0998086b61aa
- SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
- SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
- SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
- TLSH
  T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  AR Statement/File.ClientSetup/ServiceExeWithoutService
- Size 93KB
- SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
- MD5 75b21d04c69128a7230a0998086b61aa
- SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
- SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
- SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
- TLSH
  T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26