96606116ce12fa633fe4486e33c8960cb7e6a80a2b5684a3a36d8027757aa047

Sharing

Copy URL Twitter E-mail

General

Target
8xkvq9.zip
Size 2.8MB
Sample260804-xqdc7scm5w
SHA256 96606116ce12fa633fe4486e33c8960cb7e6a80a2b5684a3a36d8027757aa047
MD5 f0a93107f1939ef16c69348c033ac113
SHA1 f8d87a98d24415d0a2c22c33e952b67bad4a875a
SHA512 2260fc85d8aca75852e75428fe5c8512a689d4b4ff5828342dd31183b8c10b060eb855bbce4078a4b241c55d30a3a952954465a2748930fd19d8c63a99c8e165
SSDEEP 49152:WqCVsts85fG2LdeD+kkHNpHy4FEZmP0sfqtxub4Ay2/ACgQIPFmDt69IU57EOZXR:WqCVQH5fFeCkWPHy4FEZmP0aqDub4AyZ
TLSH
T1D6D5238958AA872E837CC53C544A05F9F41B1BAD722F2FC1D7182B96C9C8FDF64052B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Guna.UI2.dll
- Size 2.1MB
- SHA256 9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82
- MD5 c19e9e6a4bc1b668d19505a0437e7f7e
- SHA1 73be712aef4baa6e9dabfc237b5c039f62a847fa
- SHA512 b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de
- SSDEEP 49152:6QNztBO2+VN7N3HtnPhx70ZO4+CPXOn5PThDH2TBeHjvjiBckYf+Yh/FJ3:6Ahck2z
- TLSH
  T1B4A5F9153DD4EE27C16ACE3395E25021E2F1E4933AB1EB0E72D757681842749788B3BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Koola Ultimate Tweaking Utility V2.04.exe
- Size 1.5MB
- SHA256 be8c0aca59afb619cca092bf23635308dae81ce95768f0c1127a8b1e0d8b7cca
- MD5 e47b8700a2b726100b6a71bf0e7eac57
- SHA1 03d80b82b1ae030db2cb38fc859f93dac2a9b643
- SHA512 b6f623816bdc6f2423cefd00f8b577eb6a584b364eb75225295c3968619928ccf811c17cc16fbdb0372d9028edcd4a199777c6b7db1a94a2e323aa6a47d91b48
- SSDEEP 49152:/IqbOq6oqDqPBqnhqKq++q68qBhqt2qCbpm+H:wqbOq6oqDqPBqnhqKq++q68qBhqt2qCc
- TLSH
  T1E175BEBD346A4D07C67C0AF91005C08CB3FA950B2A9ED6CC9EC5B0EA5BF5FDA11116A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  System.Net.Http.dll
- Size 84KB
- SHA256 cb1b1ac1c1a435f7ea7ee75914aa7bb1324bfafb7910d8c814db62a77b09ffa0
- MD5 cfaedd3de549e3cb02f8bb77a28bc076
- SHA1 859c5f82a2fc22a6bcfbee92b841761a1b5b08b2
- SHA512 d0cb88b8a6e6b27c159d609069ac4c586e0236dd0721c8c51e7e64202a17fda3084d0c035da8009162f8a00d20ef70f3b296c00b3096e87ab1819fe0e276956d
- SSDEEP 1536:nC3UkaSGZKFcLZBPH5bdlY/zLcKAViCu8:nC3xaSGZKmBPJdlYrYK0u8
- TLSH
  T1A3833B0857E4832DE9B70BB0F8F5C5A7AA38F7823921C79D2485134D189274F97627EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  emu/KeyAuthEmu1.3.dll
- Size 27KB
- SHA256 5ef7b10d5f62832fdfc2a5d9608027ad3ae5ab3a48bfd84d38ce2aaf66b5a5ea
- MD5 574a26e2757a5ff8875cc532ef877541
- SHA1 066f16ce003c0376dbe2269552b943031317f0e2
- SHA512 a76a798d78b6cb46c747452704ed9ae47354c3a5c865b17d3880e1658c942eaf9fa6d4b235ed53ef864db5169dbdf8e85947317356eb78cc0d8037d0c186ffe6
- SSDEEP 384:a8JawDaZLaXuqnw2ohqSttQDjWJ0VOqBz/maaIrMHT2iEqfxGKyky5baII1yfmax:a8M5LZtrJm6HT2iEgBbf1ShFKG
- TLSH
  T14FC2080C73CC4516C3FE43B7EC77444987B5B2132C21DABE8BC585652CE2B9A8562BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  emu/KeyAuthEmu1.3.exe
- Size 135KB
- SHA256 93482943e4b184bf53b7b19c460fd273d24c5faf0ec98b7c2e2e1e7eee9282ac
- MD5 6a1e370f2ea783fe05fc4e7e8f2bb0fe
- SHA1 1b974c9ed7ce6442ba1947c64d6f1ddaff75c775
- SHA512 ec6f585f81622bb6dacedbeda7ce37b4f4969c576a2b32402aa5228b8087e94a7dba570870698dadf40dab1db9b87c1a502fbc5a035edb4b037662903b929714
- SSDEEP 3072:zhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfx9RhBur:zhK4XycqgpfCup5sVxuZ041RhA
- TLSH
  T153D32903B2AC11FDE1BBA37C89A21A05F3767819477297CF0390856A1F67BD09E7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  emu/Sodium.Core.dll
- Size 48KB
- SHA256 2148beb7a50d1e3be306ae4d3abc2276696744e8c926e39be7834e1e6b714084
- MD5 b749cd8d4a51e0e16a8e135db8163890
- SHA1 dd509b9f26849a6c7152d779438e0c56eb693cd7
- SHA512 a3006246db11b291381a3ab46a874b724bee54b1a146aa5e4787077a9f273e82a7d6dc90dddd083dc1f252dfdcf57921bcff2385730e69e7c76edef54530612e
- SSDEEP 768:ulLHjiNU09oOk+5RXqvS0hw9bfWS0mIK++ggwjkDENhEg4EgRe5S+U4opU4zU44z:ulLHjiNU09oOk+5RXqvZhw9bfWZmIjDQ
- TLSH
  T1DA23F994E7E29B11D7FD4338B8BA53319F31F88E6432C78F538500E994527A98168FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  emu/runtimes/win-x64/native/libsodium.dll
- Size 337KB
- SHA256 597e80901f20bd742bb9102e17572278341cc77acd283dc47f172b9ca8fbda4f
- MD5 7462950478708e413d32c5421280c056
- SHA1 68a5fa3cf4be0ad8417a89b1efade07c4ca18757
- SHA512 2d422baab92d65e58a71c1bae5de4ce9e3738ab3b840e1e7f91e7fa39ab72d13865014e5c7b83f18f3c5b311d683159d0ede389fcc2a4e16767a61da1badbbca
- SSDEEP 6144:nqvR7IKDFtdOd3eoqe8FvexQcYz6WTCOMCBJluJuWV50DEr41DEl1wRAyO:nqOz0PcYz6WT7MOJluJSDREMAy
- TLSH
  T1B7746D5EF9EAA5E9CDB3E078C2BEC6A6FA55380C43E057F313C2495429537E14638B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  emu/runtimes/win-x86/native/libsodium.dll
- Size 325KB
- SHA256 37dac83fc735dca24ddaf9e5f454808d029a335c1055bf6a8d03cab7d0a245b0
- MD5 0ba2909787356c6172bfcc1fe75417db
- SHA1 9f99646fec3f8029891b906a93288a1f3205616e
- SHA512 1e7111f73de23f526d480daa779e6607bb3469d8e185208918cb19bcf3912fae6c814b5a51915c5f658a06dbd43db28cd6a79af2fd3bcd02355d8d00da725442
- SSDEEP 6144:8ltkw95OlpOAzqqrb40Wzs3WsX8PPDrAA5h1hRqc/SgUyJztOWDxV50DErGuN:8b95OlpOAzqqrb40WhsqMcxweJ9YWqD
- TLSH
  T18F644A21F960B157F5D21479D2AF86F769781A3063FC15F3EB92285920734E3A230B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18