d0db85922ba0fb3e7a1a3380406ce20cde377c82119e6905b0468ddd0a30375c

Sharing

Copy URL Twitter E-mail

General

Target
d0db85922ba0fb3e7a1a3380406ce20cde377c82119e6905b0468ddd0a30375c
Size 6.7MB
Sample260805-d47dnach37
SHA256 d0db85922ba0fb3e7a1a3380406ce20cde377c82119e6905b0468ddd0a30375c
MD5 b437e34aa20e75a35b1492374e29157f
SHA1 b52b9e591d530f130abdca2e97b990001bf7fea2
SHA512 429cdf148c2fbee3f22e5e5911dc4c7055a2e22e62a3a166945308fd7f586dd70d9710930a774328ebd5ad7cfa6ef4d4a35c06f40b315d2e76b2427a3a1807f2
SSDEEP 196608:KydAoaJlwjo4EsD1H/jcsfD4/l6KyDp7yIfeUv73GT:KyrkKc4EsDJJ4xA75feUzW
TLSH
T1BC6633349959072B9BAB2B7CEE3731E8FD39F1FA264AEC0C7E45119613842EDC452358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/CmdColor.exe
- Size 96KB
- SHA256 e46befb51126a087f69603c92083d1f76dcbf97a598d604b9784dc3ac64ffaf1
- MD5 6e54e2184be6bd8f45635a527f7eecd3
- SHA1 e67328040eb9b6729017f2acb3203b2c42fcd156
- SHA512 7f750551dba011066eddc6a3d454531c7df08128086e1e68cc74e5a7c1ca0273d9c9a666d30eb3b433f3c113e40c45142a341888d61450cae3c311397553acc8
- SSDEEP 1536:JEFfH/RpufYadbDyWEJrCZT5aCt9W2CpN8h7Kk7ord:JqffkYcbD1E9CZTr9rsSKEoh
- TLSH
  T115A39D1274D2CCF3E81106300CE5AF7AEB7EE6680F116AC79358EA4D4E799D2CA37146
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv10/fancyrd.sys
- Size 200KB
- SHA256 93672c23a5bb6f67ee215e26b9d34f62129a39a4e17c1408498745c318acecdf
- MD5 9dc34e5a3512e120cdf5593533e98ba9
- SHA1 6ed1388184d9b68fe0e9b34b328a1bc36c7045b6
- SHA512 de91c794676c6afc053c2921775e93359a7e8cfcb78e607e2b75edc76b182f5f1f536ff1d0bae4f76371be76bcc54e26549acf9b1776da3fb886c8d68c85ddf8
- SSDEEP 3072:0W4sgcIgJl+ENc/FIHi2fTDMaJ7NCIiiRv2F/GuoW9Bu8I1cSno:0wgVocIHNTYw7sIuFvun1c
- TLSH
  T106149D41A2E519E4D9BFC175C6F5443AE7F3B4061762CBCF0268C6651B23BE0BA393A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv7/fancyrd.sys
- Size 214KB
- SHA256 117b378b14b10959b7a556f6f57c94f52ca1cd4bf640a9109d3734d690deaafd
- MD5 351e28df5e39fffa2853cbde182ac3d9
- SHA1 ee9ce60ff708d32791688cdb9aaf100c331f1796
- SHA512 536f5b59d214238c66a9b9763d505fd3a0fade92e15d74ca8642af1da2a8ed7d88537b230774c8f834a1f7bb8c0e41e8eed210e243477de021b0b718b5f7c0f7
- SSDEEP 3072:gSt8wNsgxarSONbYWN0H0TnZBmMallbqRKfpl0A0A4RrrW9UuIKVO2LC67cxV:gSVenVlqH8YlbbP0V7RuIKsuCf
- TLSH
  T1CF24AF42A2A519D5E9BF8135C6F6443BE7B3B4061761C7CF02A8C7A51B13BE07A393E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/install.bat
- Size 3KB
- SHA256 2b6f5f6737b1eddf6ea7eac1b19d5fa69e40605d9e2cff11a2a1b9648d544f2f
- MD5 3933b86b62a093fbef6d7c9c750ec53d
- SHA1 517148b96beb6bd63f3f40b295b5a4ed0f9fdbe6
- SHA512 9e41e6a0e3a11319a5c3d4d54c7849726fd7b1a80bf5b4e2250825e4ce0db86646ba321e265946bf935beb8f7f93a99ee0a220744bcffdb806fc8e209e545168
- TLSH
  T105514140B008043702B567FF84BAE1EBBADD118F8B742BF0B1E311B5571B39875AE196
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral5 behavioral6
- Target
  Primo-Ramdisk-Server-Edition-6.6.0/Primo.Ramdisk.Srv.Mui.Setup.6.6.0.exe
- Size 6.7MB
- SHA256 dffb6ffec6dcf7d7be5f9aaa92b5a78a11f5dc1ff706cf84cd0579ab3251b725
- MD5 31093d2fbb45902799b0fc74832d714e
- SHA1 1e2aacbb73029d7ce3975cf4fd9cbfb1e9b4c8e6
- SHA512 5aac80540df8984acb4f95558f13167a2e4c7c118f470f0a8939e2017f7fb14cbe41d6a6fa0df97f736b9df823b6d2ca0a8b7396a6b99ad22bf99b74b3897738
- SSDEEP 196608:DbRgoOj7wbuQqq1tl5NwsBzY9B48t76q7wcBDX:3F2saQqq11nYTt7F7wcp
- TLSH
  T1ED6633218B468036E66519BCC032F5705D7AAFF069F4544AACF4FC1F32B56B6A4362EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery installer
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8