3f1a3e0d76df422f8ada4fdea65e0dd6b766299841420acb09ea5bcfe520e9b5

Sharing

Copy URL Twitter E-mail

General

Target
CH341A USB Programmer, Drivers & User Manual.zip
Size 11.0MB
Sample260806-ff18vaysbv
SHA256 3f1a3e0d76df422f8ada4fdea65e0dd6b766299841420acb09ea5bcfe520e9b5
MD5 6d48d010647d2a3c063961e17f74807c
SHA1 aa2a68c00e127e86d131697f7ef702721cc15640
SHA512 412fb3bc71e7164e21fafaf7a810ab4a8528cf53a95698a74dda35500f819ff028217a113c64cb4b046c641fb7958a914add0dc3d0371111c21c49300286db75
SSDEEP 196608:xQ6ZDtEtHKYOWcn2Z0WPSD1W4yKFy3/RVKzsYDwjJtFyuDywb+u+u0Exy4OeGS/m:xQ6Z5GKYS2Z0MSBW47gvrKIYkVtgsWui
TLSH
T1CDC63317CAF5C12AB75A6D128257CBD120D79A42817033BD7B1C9427B9FDBA72C4A0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CH341A USB Programmer, Drivers & User Manual/24 25 Series BIOS Chip Support List.pdf
- Size 498KB
- SHA256 43dd526505371186ff6c4824d77ef278fede36e85870e50d5b071d77621f448b
- MD5 c66d86487376e2095a6783afcc3e90a6
- SHA1 cecd2a5d49bac6c7ffb55301d4bcad2c2190e7d6
- SHA512 61c586805c9cccdb4cba8996acb894db11b17aa6fef625e0eaff88c7cad46c6a2d461dc781c1fcf461b254a622e4466fc38ba5bbad7fb408a055d40399d3933d
- SSDEEP 12288:HuNDrVBH8R9cJikOM5QpWcD7089hTwCy4775XZbsaNBRD7:H+hB+9cJx5tcV9hT6IZbDBRf
- TLSH
  T1C6B4237CB3D2D81D97B50C53A8171425B4E1AEE1072784EE68235CA708EBB6958B39FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A 24CXX25XX 2009 INF.EXE
- Size 185KB
- SHA256 68a7fcfcdc69c5c4206452773ce0b413b3251bd1db316efd52b517ef7e46f091
- MD5 7069baef6a62fe763b410dd6a1ebfcfc
- SHA1 904c5e2da2f762eba37fdb4900cce9b5106b6e65
- SHA512 af0f1d90b3f0694f83b905f1a20cf47060c1b96cecae6849fa1aa27b7e820c97b3c889f5a2513e10ccc42138d7577ca8f81babadf8e3dc99e7f6e344678634b7
- SSDEEP 3072:Z8U2yJN5f661xRZbALxB1Ojdgx8GY4VJkjP3FMCUl7kkzWg1cB1G1yXii24X0cH:Z8U2qy6rRZb7jxGY4VJsVG1cYqii9l
- TLSH
  T15E04D004BBC680F3C4000730489D67B7E63DFF256F61A29ED7AA5D597C38642B41EEA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A Programmer v1.18/CH341A.DLL
- Size 2KB
- SHA256 ce195269447fa92eb380d0a0767f84b484e8263fba61cb52284dfe0997ba84a8
- MD5 8fd8fad92995fb8f42114320a6c1b4fe
- SHA1 7e04b24cd93d83eda96df9d455670a015297e66e
- SHA512 f66167280bdb7a3ead29dcbb9337b5693efa740a80be19061ed9bce9bc11ad79308e473a710236cf71a81a9caa538db490c2c2ee0a4a9891c5463c4f76f82ae4
- TLSH
  T175515715A84F4705BE67B97DA3A7DF60280B09B3CB0CB1A8C85D1F2A953496809FC0E3
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A Programmer v1.18/CH341A.exe
- Size 656KB
- SHA256 8b3c13c1bb8d954028afdda8cae749808a64ec3d931063192ac0acd102ac1416
- MD5 3f217d4dbfeccab5f7bf158981f46ca9
- SHA1 a9d52d195becb4f793ba8cba668161a2e9622fe0
- SHA512 8d9b43cdc997475917a0b8d179da18845cea8371b504aec0d302edc47dde8dfb016c9c25b701f5add3533598a67ada21453022dd08ddf87fca0fb0b23170dd2c
- SSDEEP 12288:E1dqsh78vq+gV30hoy0d3mInj9GTnSUOQT3sE4EGnuvQsfQqFWnvipDVdkuw/vP:EXh7yq+gB0T0x5nxGTSUqELQsfVOyWue
- TLSH
  T1EDE42397BB2D4245D153953188C7D37B3F8B8241C2BB9B9A130913F9D4692B7BD0BA38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A Programmer v1.18/USBIOX.DLL
- Size 30KB
- SHA256 0650452fed018cf1f1b08f70c61eee2161abb8249df37f30706c2dfa30100b41
- MD5 dd5716ccfeb8e01d68cdc7ee55bd159a
- SHA1 6a85e33e51e20fd62a2b8e4a8b553001ce436220
- SHA512 4d39dc5dc268ab0687f1a1c91ddae95ca2c85c775af18f97fdbd490b14b71b74104a04406a55406c2416356e5f96504f8d4893c14edc2cf93f2dfac71cfcf33f
- SSDEEP 384:wX3mJPDhYdCNMZQHXg8XMpcuMt80acI0m+VkS2Enpex1XGzfBUNcAyvw6:s3qYdCN3Xg8c10actm+yS2UZAEw6
- TLSH
  T1D3D20A9867934DABC475173088D23BA3A87CEC619A778FB31C013DB51FB6A579272212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A Programmer v1.18/Zlib1.dll
- Size 88KB
- SHA256 ae79d55c29038ccfad270f627b120d539d433b385bf299ad8cd5d10743bbf795
- MD5 b99629d4dbeb3e7a080e9ac4ad1418c5
- SHA1 9d54b4bf2885c46d8d4055ff4c11c1d000ca35b1
- SHA512 dc80d03ea4eb6bca411ea5847137d96b1626ada70c687407aa233a3a015d7c4fe7f2ad1f58ca078b78ff7578c365a4537957fe7c99add2d5daf61f3cc5b25516
- SSDEEP 1536:cxp+EkOafsX2mS3oMJfwlJSsn9OtaKftXlo2wTxfnToIfdIOvIOTI+ii:cxQ1OafsXg3oMJfwlQsgMAw2wTxvTBfz
- TLSH
  T1AA936C81B7C343F6D4F6183590EBA66F9B3A711255E4EAD3CC9D76A0A813B505B023CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A Programmer v1.34/BoxedAppSDK.dll
- Size 1.5MB
- SHA256 e4811dbe3b8fb7940158e335437e75a5225e4de6edcee4abf4fae5ca0ea106e0
- MD5 7c6fefbdebcbbe2db932c0221614567f
- SHA1 1201458b36ea2bc2afb19185409e2373b2e6871a
- SHA512 ec26e5352ae165a6ac018f479838a9113ab665bcaa40ffa11a7e0d96349c2bd4da55ca6b5cd1ab2edb53100b8fdf59014fde3feaefbc3b51298b1564a516b36e
- SSDEEP 24576:DjFe/Rz8G2EE41fd8a6XnRw0aNUH2s7JPd2tOLSDTvmwzcDSqu9ggcwefgEWhqv+:3119aTMvq2wntQ6
- TLSH
  T1BF655B47BDC602F8C5C716B6A17F2B0BD7568D17933890CB63E4BA4259B13D1F2BA242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A Programmer v1.34/CH341A.DLL
- Size 34KB
- SHA256 04273d1af6705f1d960b47d2666fbfcb529dba04a0e9b9358324eb688118ac1c
- MD5 922c1cdf120f4aa0096c2b16b10a35bf
- SHA1 83b55d88316485a274b5df64be3035feb20a5b57
- SHA512 d3202ca31b95d768292b673c3472012e15e00b915be0bff315b5c6389825dd41e60ec684befc61552d6f7a18962c92fbb201329f27b55dce0565216b92633aad
- SSDEEP 768:s3qYdCN3Xg8c10actm+yS25mPnY/u0Aww:s3qkCN3XXc1/mPnY/u0Aww
- TLSH
  T1AFF2D888334B0F6BD9263A38C6D3AF537C2A9C72CF2A9E525C0D3E621E3654351B5163
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A Programmer v1.34/CH341A.EXE
- Size 5.2MB
- SHA256 2e470af5606097dbcda8b32cbbf5f4f32426f6d0db4c474834404013936f64ce
- MD5 d7f6285b820c28ec61ec424e41870916
- SHA1 6b9cb125bbd016c3ebd5df68a75ce9dcb0178686
- SHA512 b8edd6a19ee2b992618ad1af77872d2b059a619cefdd648ff51e9c61972fb47133e16a7da87e5029a176a17ecc229dba3a2f4f523fec0228aca2d7d56611cbea
- SSDEEP 49152:RtMM58nfMkWb9IPZPqaq119aTMvq2wntQ6lCQD4Ba+OKhQ7suTAzq4KSiviv4K:R58nPPZNq1vkf2NQD+mizi
- TLSH
  T1DD46BF13B6C2517AC5B31A79882F5B0AAE26BD12673894CB3BF47D0D1E757C1B538283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A Programmer v1.34/SPI.dll
- Size 1.3MB
- SHA256 c0866e0ed968be1c6e354af564e4f7220cc42cf236cc379880204a7f0997cb2f
- MD5 fb91412b1e660bbdeef933c2266e42d8
- SHA1 ec6f0cfa7a536d6329dddfb919273a0b9f312231
- SHA512 b9f19881ece69123cbe372e649b3d7d4db0f926ed190c82ffb780ec56e4247a16e4d656aae3529994780bf5fa5f4bb4aa0ea17cf6d374712b78cb302551246f4
- SSDEEP 24576:JG6Rz3yt23GEjfIbhevT/tNraVkO74KSiAq/iv4KqOo9:JhR7fIVVf4KSiviv4K
- TLSH
  T190558E22B684B53BD1621E789C2F9359DCBDBE012A38A4493BE53F4D2F36AC1B5151C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341A Programmer v1.34/Zlib1.dll
- Size 88KB
- SHA256 ae79d55c29038ccfad270f627b120d539d433b385bf299ad8cd5d10743bbf795
- MD5 b99629d4dbeb3e7a080e9ac4ad1418c5
- SHA1 9d54b4bf2885c46d8d4055ff4c11c1d000ca35b1
- SHA512 dc80d03ea4eb6bca411ea5847137d96b1626ada70c687407aa233a3a015d7c4fe7f2ad1f58ca078b78ff7578c365a4537957fe7c99add2d5daf61f3cc5b25516
- SSDEEP 1536:cxp+EkOafsX2mS3oMJfwlJSsn9OtaKftXlo2wTxfnToIfdIOvIOTI+ii:cxQ1OafsXg3oMJfwlQsgMAw2wTxvTBfz
- TLSH
  T1AA936C81B7C343F6D4F6183590EBA66F9B3A711255E4EAD3CC9D76A0A813B505B023CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  CH341A USB Programmer, Drivers & User Manual/CH341SER 2014 INF.EXE
- Size 237KB
- SHA256 625841a5f3d2eceba4b0193124f31514ff706cd7b9919239b86161e6a298a945
- MD5 eaf51c4de2c5392803505c8791458913
- SHA1 4132e788f01ca0ff9eb928bd75cdeab05c8cc919
- SHA512 86c87ae7dd9105d6a5ef7476eb6fc88e712c646e1f0e3c3c2bd1a300d11edee51a334397294933a28a6f85bb22f6cff64ed0c8578ea73473dcc1dc01e01f5a71
- SSDEEP 3072:h8U2yJN5f661xRZbALxB1Ojdgx8GYXCcUCrd3pPsZ2VWT5Qd4l896kjIPGJ6I7og:h8U2qy6rRZb7jxGYXcCr7PsZ2TlqFJG
- TLSH
  T19C34F114BBC281B6D4412B7058BE2777D534FF216B70F29ECB9A5D1A2C34612B40EBB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral23 behavioral24
- Target
  CH341A USB Programmer, Drivers & User Manual/Manual for 24 Series-EN.pdf
- Size 2.3MB
- SHA256 87e0f581ea120f3e97b00499c6e9df3110090486222999575a61b0ebc067c78e
- MD5 4bedc8acc59965e3b08c1d5ea695947e
- SHA1 ace955720a75eba2839ee55ea79f6e3d106b19dd
- SHA512 624f713c7c65cfc0eb1f4b9accba17f030d0d62f9e80198255d054bd41495ba163d7fdd0909746b079355af771378ae9b25aaf333378925ce8cba02192e05b12
- SSDEEP 49152:cufoBrlveTCQWiM5whd7V7smuZt8mUAkgashsGmCquw33ELgHjgBnm:BfonGvd7h/hxUBm
- TLSH
  T1C7B5E003CC588B96D12D82F9BE174E6D2B4A3B6C98C229FF15220EDF3D646611D8F15E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  CH341A USB Programmer, Drivers & User Manual/Manual for 25 Series-EN.pdf
- Size 3.5MB
- SHA256 e137b5d5a94fd7d652c0c727819970e0553f9bb556f403927162a91ec94f976b
- MD5 9e4897e80ede9ba8773baaf2fd02ef45
- SHA1 4ff91b5f09fda4b6608dc1693d72d2c626877187
- SHA512 5d2e4a67afbe3eb2b658ed9993b776cb5c8689d6f56cbf0eae9f6255a3d974564f0d85afca223468b663012d434a3f319eef22f1a99b85826c78d98cd575eb5f
- SSDEEP 49152:auf8GABJrHtrTy3HKmHppWg6EsnKIpwdsA/QQ1JwJzIzM/e21kp2uqvAbfkMvHYG:PfS3jFqx0mzM/LW2u71U2X
- TLSH
  T1F606F1178D44CB93922C47F47E575EAD2F563B0CD9867AFB15220EDB3E60A224D8E01E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  CH341A USB Programmer, Drivers & User Manual/Manual for USB TTL Serial Adapter.pdf
- Size 571KB
- SHA256 e032c796bef8aeb717f9c9cf7ec1b209e99feb4017d4886fa59f56b6517e7a67
- MD5 d0396dcb4a621cde656fefc846ee361c
- SHA1 f0de7c04201614a8f6aa48bbfe5dfa51f3ae3b79
- SHA512 8d3d96e0000ff552cfcd70d1a599aadc099f6f30ec8509c1157c9a4a161bee483e22d53e2da6347f2307502fd4d99c95b822d6eb190dc1db9782763eec5ad97e
- SSDEEP 12288:baTH8kIp/wUGvYOaTdvswScvrf8o1gb+/5v:bufUGABdScoo1ast
- TLSH
  T1F9C44C078C488B87956493F87E071EAD2F5A6B5D98D13AFF00220E8F7E607765D9E01E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Drops file in Drivers directory

Checks computer location settings

Executes dropped EXE

Enumerates connected drives

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops file in Drivers directory

Checks computer location settings

Executes dropped EXE

Enumerates connected drives

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30