6ca47c3e4b2b2b1952bba1d201a6777deca4089d9b261c03447190ed5ecf3b7a

Sharing

Copy URL Twitter E-mail

General

Target
Lossless Scaling.V2.8.rar
Size 1.4MB
Sample260804-zzry3azgng
SHA256 6ca47c3e4b2b2b1952bba1d201a6777deca4089d9b261c03447190ed5ecf3b7a
MD5 e6d46da39f71c35e80dfda7da67fcc87
SHA1 cf5c3f631476662e28f7e8fd560523b76b1657a0
SHA512 7acd7aa4f3cab7e0fa3a8f5df20b164878f9123b812b7675452ffe2a9e22f2a335af7948d3af3cb251dc0acc8f36d91fe719414b4fec02b172f71dd9b5b0223b
SSDEEP 24576:s06ITNFnvwPtiaN5aiaoUWs1Yo0yE6lsh3mDSElk1f7LnZB72H6Nui5zri:h/noVPNzanWs1VfESZllMnb72H6Nui5K
TLSH
T1E865336F6D3C5472A947337A4DE209C27ACD8D3CD178F46E55A1883E06E498E04D8AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lossless Scaling/Lossless.dll
- Size 215KB
- SHA256 b8a25e608f8a97f2ec191c082238c378191f1a44daa6d870b957d17a7057f326
- MD5 2e512e4d72934ea8c461c3aa231be2d3
- SHA1 e7367f16b54c71be28e15e847e460aa928e012db
- SHA512 68b45b7c6e238b132d5e83529da6e5b6d953380610ccd951f412a6eb3f7489ab20bb5c439c83a416dec7aceedd4ef559ebe557dbf3e99aea490f5f395e1adbc7
- SSDEEP 6144:apyXV5O+votW9PGdxiE0lQ8VN46gvtLbFA7scuOolyrtc:ajhFA9bo
- TLSH
  T17124288666F91868E177527D9B32C102CBB279A54B61E7CF221042390FF3BE9ED34725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Lossless Scaling/LosslessScaling.exe
- Size 960KB
- SHA256 4974f4dc44d177e4cdbce794be53876b4b05f7ce9a1d8f08ba911e2ee6c5f631
- MD5 e27c616ad41a73f23170e264581bf1ea
- SHA1 175b43bf60a71fa0512283c3c4ad48821f658d04
- SHA512 dbe0fb2f9350659250153f66380ceb72c79d677cd9667728cec47a50509b57cefbcbf8f3d2aa61d6056fe30e1542b44b51bebfad6a3db8ef46fd748093d07d4e
- SSDEEP 12288:T0u/oEDS4MCLSyf6mOuGyW38yHJc+CKtOaO5Z7WhaGwnzE4ZbuRCwmhI2J+0sDKr:T1/xtMCLPf1Oi32OvzTo4ZiRlT/bM
- TLSH
  T13925E03013B80E64F1710FB72530A916597F3A5BCC26EB9DE501369D48EBBC98762E63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

defense_evasion
behavioral3 behavioral4
- Target
  Lossless Scaling/de/LosslessScaling.resources.dll
- Size 19KB
- SHA256 62565512010e111506a4ea9c4b2bf559b6d5105463b6135dbd3a6c19c60317e7
- MD5 52006c31caae13740e2c67e1c7cc9adb
- SHA1 446cb6c0f196851b57d1c4c7c754d97bc993b397
- SHA512 9562d0fa82ec43b3e8aa8d43032b5864687de4edc739fac0872904d53f05bab6dac72ee0c835c9bb3f5939a5f323045500c5206a3baeb432becbb9c7b708e6be
- SSDEEP 192:tXcbmf+pRpXYCyfv+3L+Xk7S1lVN0gGgPGqMyXsmFCOY/VRiiCEaLKWrYkQ8y1hE:lcnXYxWL+Xk7OiqhszOs7T6LQyxW
- TLSH
  T196926407A7F95629F5F32B737E305859693FFED60A02E00D1056708D953ABA18AAC733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Lossless Scaling/es/LosslessScaling.resources.dll
- Size 18KB
- SHA256 bbb84bb4c40fa465bc7015e9a0fce1a26acccf38a9da6f98349f4c9e085b49c1
- MD5 73801d460abac6e14a150641c2f390e9
- SHA1 dc33852218d2b955776535d38235c0625e6eb21f
- SHA512 ca732b7cae92e1df1303767f7aa993a924ee28420476fdd0a5ed85579f4c834ec9d098444a27d337485647fe8f1dc0e77a6fc50f046b4e6fa48f0f621156e7ff
- SSDEEP 192:0l/lXAPIPTvOwN0y3+2wlZkUBRvpIABX93Mi7UB+gtcj4UBd1oE/6Q:OWdwe2Alvvjj8i7olcjFRvS
- TLSH
  T1F0828125A7F81A76F5F30B7BBA21C967A07EBDD12800C10E5067709D903CF549AA1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Lossless Scaling/fr/LosslessScaling.resources.dll
- Size 17KB
- SHA256 8d05dc8e653f710e14ff67c16a7a7a38d10e10d71c67894248a38ab3cc8acd0d
- MD5 82c6598d32bd761c77bb0f3d7d938aa3
- SHA1 be5a89ae92f81d2c5110e65be9499e0f974f5a94
- SHA512 3e4a307e061fe3f576f0360cdddeca3299ac5b6e6b2f5043a90e4c3548959c59110d6746861937612b9d17cc8b9ebbde386102ecd126c1e8ba2321e7e5384793
- SSDEEP 384:W65suPtDX0njV+erj/Uou3BcfnAU/Ox8fMiNaOEHG7T:LsuPC/mqnH/u8HN2AT
- TLSH
  T16872A407A7F82529F4F70F33BD3265B6E83AFED42920C25D0196308A9864F98D5A4737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Lossless Scaling/hr/LosslessScaling.resources.dll
- Size 18KB
- SHA256 a115beb6f1ec3160f6cfeb4042d99ead18897c7bbd8a17a2f8b83c0316ed19a5
- MD5 8bafcb4072fd0ecf1a8e34938351b3c1
- SHA1 3509cd4ee289b7c21f527498f444784b6eb8534a
- SHA512 ce6e639b3b51ea7f0209509097894a9f75656c7128e8663687bd950b3210f11a577e830af1a9d89ac252149a62496ba4d5b9edb720287312d98bc6cd90c3aacd
- SSDEEP 192:e/cbmWM/VN5iYIq9U38tOIli0v8xdLMaoGlQVHWbTEir/lDkH6mJtPrVsObN0GiZ:AcnuEYIWOIlFkdLs2fr/lDktlVLB0t4
- TLSH
  T18E827156A7F89A28F9F34F77BEB58A05257FBDD98C01C96E104A304CC825F4586A4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Lossless Scaling/it/LosslessScaling.resources.dll
- Size 18KB
- SHA256 1c0067ad4f1885e29cfcde1c603744f6c29bfe04de923df3f03dc61627781445
- MD5 ddf6e8cd31125f4407552f92ff1c6326
- SHA1 9d7a8c2ec208a7952accc31d0139fdb4f6c7b117
- SHA512 01239dbbd668e04d5c1d001055f31b4ab3ffea22420b813155188ca0c49adced1cf7a0173527f5850ec54859ef2329588111d105bc0ad6c035435680eb25913e
- SSDEEP 192:p3lXRALmv12VBLSHn7b8PWnZpSNjs3SRka4xOGWuHXj9FAEHctRyy+v5kOYo6Q:BzAbebWWI2Et3vk6cMJZ
- TLSH
  T154826029E7E81638F5F30BB3A930954DE63FBCD96D01951D461B318D912DB009AB8B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Lossless Scaling/ja/LosslessScaling.resources.dll
- Size 20KB
- SHA256 8136769bb5589445ab5d4bbf3657822d7486fdf692c18b521e50a6a5f048f30e
- MD5 110df8785057f6ea6741a970c9a32f6c
- SHA1 93891085bf75eb4b927dd2f4c30c1f0d3a41b6b5
- SHA512 f4b26f3d97254877f108e1d5718c8d42b6d3b1644c92a862a50659391b14fd62efda36bc2b2c7722df97c406474b60289e90a5a0b3c7fa88d7ea40a8a52d2672
- SSDEEP 384:b65spW12i2aO5KtZISEojssRagahBBij:ospWpplegahaj
- TLSH
  T1A892422DA3E95835F8F247733C296554A43AFDD6EC52B52D002EF074A934B8DE9407B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Lossless Scaling/ko/LosslessScaling.resources.dll
- Size 16KB
- SHA256 6f90b504aa44e4b14009ba5a7d35bd46d6eb8b05d520d999feb1dc13f803565c
- MD5 595c2e3ab60231394e038b6233af6ef0
- SHA1 e94de228259eb441ac955abe240d46fc2aad0b4f
- SHA512 ec98abef265ccb0b8c4e7c6612a10c2c1386486635d53f33288e46c504593183986cede183cc593c3e138235a367d8ef92a388910a47017e04e808a24648cc6c
- SSDEEP 192:zL1Flim56i/WfPSsCmclHMFgUUR29wGc/pkEkqwj/TcQDE+6Q:fkCIqsWkgUUR29Y/pkRnbwQAT
- TLSH
  T15B72604662FA1768F4F38F73BDB1AA18516BFCE66F03854C840678C9D938B818951B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Lossless Scaling/pl/LosslessScaling.resources.dll
- Size 18KB
- SHA256 143878bcc0bb7730284db91fd0526f38b771188c987599acf8ab7dc011f3053a
- MD5 6acccdbcf4423ae7e0d2de8f222abe46
- SHA1 8e13aa48185f357b4e21b59d29f6ac7eb89b6a04
- SHA512 0375722e263f5a4ca8871cfcadfe7b95c8e118ed3af193e396a30e2a11eb432d98ef144e421f2db3a97d80da69eaa595224e514f10e5bb32561cd2c33fe9f723
- SSDEEP 192:wjDcbmYIEt34V+BWyZKkhAykB65K1LWwbMvfbZxqBwbRQ9RojvHRQ4RGql8v6Q:6cnqVDSAN/WwbM74Z9RozHRQJC
- TLSH
  T117828005E3F85A28F9F20F77F9B66A69157FBCE5A822C10D401B389CC439B408961B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Lossless Scaling/pt-BR/LosslessScaling.resources.dll
- Size 18KB
- SHA256 a341ddd6871180bdf50aa4d1e4cfe3a47adf72c8167f2107826e40645efbdca1
- MD5 adaa50cd0cb63a87fecc4642dab7a331
- SHA1 0e2cface90dceb4da1d76fac3ac0c0d3a2089bd9
- SHA512 87d80bc6d0d3a4fceffb739eae1ba8b01ba5d10009c97520125e1df13e9c0efcc50c8f28fc691543c23351d2cac2c11433b431c8875f9d8a6efe29b57941bc53
- SSDEEP 384:N4mFf60tBW9Xz6HJnfnxhI+/luZn2Qcd:emiEHJnfxhpluZnKd
- TLSH
  T1B482632967E80A38F5F30B73BE32D90E617EBDD56802C55E415A3189A4ADF408A62737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Lossless Scaling/ro/LosslessScaling.resources.dll
- Size 18KB
- SHA256 fc8ec8e815ac27cd7532671f41fac85fe0235ab4761335f3355639a3b06ff90c
- MD5 16ea2c2fe30f1e856d1b9e142bed6bf5
- SHA1 0ce0867a490ba8a805eeedd503bf7e867d337f26
- SHA512 313aa27723ed4c59ce7e90c75950e8fdec2d3f6150e93b264b65f2aabbc8368b4ca440c74e23c3465b0445db5b1546bacdc1ae5de1c936cb53a8c5e870d3d7a9
- SSDEEP 192:mfcbmQK6ImF0gW6tF4r4lkTyltAHUyd5BDycNnqw53wUXgNsbIYR2Yh6Q:4cBFLz4UOyltwT7JzNqwJFgNsMY54
- TLSH
  T195829306B7F81934F9F30B73BD70589A287FBCD92D02C08D115A799C9428B854A65FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Lossless Scaling/tr/LosslessScaling.resources.dll
- Size 18KB
- SHA256 5644589e596c215b176e38db5b01c8b41e2741aebf9ae26a8fc48d367f41f0be
- MD5 d05d2d47d18f8689b48366d852fdfca8
- SHA1 e272dc25eb3783446211110ae32ac1cb60ed5b1e
- SHA512 0e25d6668cf6d958dbb8dd311b46c7e6f13ce0682682cc0615e2c7a6a7a4d5258995e617e9cb0f208d7c49aaa89bb2c3409b9be5d2ea41b4258c400b2edf0d6c
- SSDEEP 192:n/lX4j17rXx6ZmXoQxiljHCrC4Tc8LwQNRQc8cviy6U0l5cwWFTZq6oZL6Q:/+dxpodjHMC4B8hU0swWFQ+
- TLSH
  T14882A749BBFD182CF5F70FB3BAB5496AA47FBED22901D40E0107745A963D7104AA1336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Lossless Scaling/uk/LosslessScaling.resources.dll
- Size 24KB
- SHA256 a6d225a1d052a14928564a65460642477bf0bdbf264f160d87742a04f175af0d
- MD5 633c5ebfb6f48c6e2b179c37a8086420
- SHA1 9f40a1b35c812a16c88a404ab826a6db6d6be69a
- SHA512 0915e8bdb067697b5fae12eb6b5ed98a3e175f20bd265b2c7ced173842e869bc72142b42e071d01360db6064fbde18fbc179963ee674f8751cb333353bf713ea
- SSDEEP 192:HDlXpMzeJPEYXidRK3Zrd3F/7PRyHPjsKJY+M2tQFRBd4wYh0m4GFQEeoeXgGink:jNPofK3ZrRFgyFNEGspeo34Ev
- TLSH
  T1F0B2FE5597EC18EFF1A2EA77E954390938BB68FE3B52930E10513C6E58F1620C938736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Lossless Scaling/zh-CN/LosslessScaling.resources.dll
- Size 16KB
- SHA256 a6afd3a26e85f0be857b49d785debdcfbd32a54717e2f1cac0937111d283e21f
- MD5 202349586da823ab952c3063570eb658
- SHA1 5a9925069cc36450991b97f3c33f85e381694a4e
- SHA512 0d4b218c64805a13c99778a601e1063014c3e732c0d59e445b94a4a24794e93523907c820bea19caf06b77ff04359758edf87c2579a8632855e9d766dabd5424
- SSDEEP 192:HlXN7G0hcZ6JHKgk4MDLPmrqGVAasgdx9kxrXsbahV3fpTqI3GmFi66Q:H7cIqZQJAasgd/6rNhV3f87Pv
- TLSH
  T1B172611AA3F85E38F1F34BBB3A715528253FBDE56E21D50D006634998939F148E62B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Lossless Scaling/zh-TW/LosslessScaling.resources.dll
- Size 14KB
- SHA256 0545874848009b7bc475bcbdc551eabd844e4acd1d1dd057f7c618fdc1bdb29f
- MD5 0fc81f3398c2047b003cddd101235d3a
- SHA1 95eeb06d0bfbc90463a4fe26ea04817ea2acc63c
- SHA512 79c35a2dfd235b830be7659d6531d0a32d251ae8f8f70cdb62083f5b1a24b5142b297c20068187d5e562df9e2dc17162207bf1bdc6412e6d39cecea9acc5c7bd
- SSDEEP 192:GPaaehfBGWGNx9i6uP4I49L9mGtFiZ7Xdhtv9ntnqCoJF0WQ6Q:G65sCPuVnixl+rh
- TLSH
  T1E1623F5A67F85A38F4F34F733EB15A28253FBDE61D21A50E416730D99828F40A9A1733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32