6667753f085386535e4fc746f7cd89a9c45a3babca7bf5a5544691763be70989

Sharing

Copy URL Twitter E-mail

General

Target
DDLCAoHILtSWaLtM-1.ohrightlikethismeritsversioncontrol.0-pc.zip
Size 110.3MB
Sample260808-x7wacacp5w
SHA256 6667753f085386535e4fc746f7cd89a9c45a3babca7bf5a5544691763be70989
MD5 ab3699a66433b06f73dbc0b8970e8a5f
SHA1 81e58bcdd956da8033e8277da8e4bfb5c25d80c7
SHA512 fa8598ff9dee5462dc7a3612711289487bef75dd151040a63c3a28e4798c62877aac28353781d8d9a303f522fb12c44386d8301b157eb36bb935cc8279ba8ac1
SSDEEP 3145728:MUIGIQ/l9kMcu0wnS/YR7y9TQQTz9JEeSdZbo:3ImbXqwS/pTB/9hSd9o
TLSH
T1FE4833D1909DF639FB7EB13AD2AAE05943333DA170464397FD067AC48AD1BE11612A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DDLCAoHILtSWaLtM-1.ohrightlikethismeritsversioncontrol.0-pc/game/python-packages/singleton.py
- Size 3KB
- SHA256 0390f38e7a83598d03ed641954caf36f90263114eb80c2c736179bc2361eeb80
- MD5 8885f8c835cfc3d49bfeeb33405e332a
- SHA1 b059f459fc81d7d5ad50eb2570548de414e20008
- SHA512 edcb612811d72c47092507f03cd1a935e79c759faa6b379be089c2813246f27f4b3e20d124d1c457e78ef87c211258053a41345e6cf864a200ea7410ce071cd0
- TLSH
  T11B717624EF6E94234C7663694DA556E2E31342B7E96851117CFCC2082F74C2012EAE6E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  DDLCAoHILtSWaLtM-1.ohrightlikethismeritsversioncontrol.0-pc/lib/linux-x86_64/lib/python2.7/UserDict.pyo
- Size 9KB
- SHA256 22e984682abf27c5c94c5762cb161c73eb9f0fc9dd2ecd2bfe29398216dd994a
- MD5 c003ec7444d814e1dbb1874d4e3f0a66
- SHA1 18771fb3e997b91dfae32f16c7cbf033ed0dc33a
- SHA512 715c1df89ec73e9cfffb1de446698484ef38592c3e368405f276386313c0de92f1a90b9ce66e40102929a3e4032545a8705bd42ecb2bbdea39367de74c2f2004
- SSDEEP 192:UJkM4+TBRTzY0lUHejZRTcYWk3lphoKkOs0Vxk7s+wrJ3T0vZUo1TvyR+SHCXLV4:8TPTzdiHejZRTcYbVvWOs0Vxk7s+wlTV
- TLSH
  T199225780F7A5C956E5A781F0A0B0111AEAF6F4A315092F4600FCFE7A5C5DA98CB6D3C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  DDLCAoHILtSWaLtM-1.ohrightlikethismeritsversioncontrol.0-pc/lib/linux-x86_64/lib/python2.7/_abcoll.pyo
- Size 27KB
- SHA256 9eb9bdece670abac6f349808909e0dd41fb3fa22e3647fde25c3ebdc6f88ce99
- MD5 48f1bbfe69d5488eb8eb8312654e6aae
- SHA1 6b6a7ff336e407f98a8c737722c910435257fb55
- SHA512 db29d94fa2604c093659b3202703b1e6b3ca5e60e09a555208efabad21839933562f20ceda383f9deed1aac770f98e8c3885dcf9421cba1477c96dced49b7225
- SSDEEP 768:Rw8B8mMYveTeWogNZrnXeUoTA6tvRcSuEZne53ybCIl4ocZimE0Kq1NHq8Ra+mnY:Rw+8mMYveeWogNZrnXeUoTA6tvRcSuEm
- TLSH
  T17CD2E54073618B5AE9E752B460E1012ABA79F47321053F59247CB77A4E9DADCCB3E3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  DDLCAoHILtSWaLtM-1.ohrightlikethismeritsversioncontrol.0-pc/lib/linux-x86_64/lib/python2.7/_weakrefset.pyo
- Size 10KB
- SHA256 5fd6efdf17da18b007463b57deecb9f0121d42cbba1950b9d52206daa36808dc
- MD5 852123ea115131088d0d98924b539e2d
- SHA1 21e65665e14595f57321c81562b155f944d1a759
- SHA512 f136d60363a7c44d3839efe793adee19e62d71bf25486b02626328e9b2ac72ee6c81f01317063e099170dc49eeeaf9a2492e65c33a9c47bc6068e0431b0bacf0
- SSDEEP 192:LP+2Ua0+jlMBSmGt/rcc+ob/QY9oOCU0sEqaE7F+RiqVDPG3Fuaa4vn471HX40WZ:b+Zf+jrmYrcc+oIY9oOCpsEqaeF+RiKW
- TLSH
  T148322B80B3558906E4AB45B0A0F12556FA75F4AB075A3F8740BCBB7A4C8D798CB2D3C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  DDLCAoHILtSWaLtM-1.ohrightlikethismeritsversioncontrol.0-pc/lib/linux-x86_64/lib/python2.7/abc.pyo
- Size 6KB
- SHA256 d7bc86aa66950e9dd6eb94614559ffb38a266a1ad02bb75fef002d0dec07b3c7
- MD5 89bdecd4c9a4d5ca02cb37b6a43c7422
- SHA1 57bbd1a164f9d81bf2d13fdb4254d7146b50423f
- SHA512 e5f5d40c0779652a146fa1522011be95272df01aa83fe043bb4ba8bb4d8cafc32d84b179e62058b168abe331f244003edd32149c0dcf913013f972e39e18893f
- SSDEEP 192:ae2+hvyo8152Pk2ainwe8fccn2xIDw1xvcUTm0E9:ae2+hvyNtinl8X2xIDw1xvcUTm0E9
- TLSH
  T1DDD18640A3E685A7D99B8178A0B41557FF62F07743143F0536FCD6782F8E2A8C27A396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  DDLCAoHILtSWaLtM-1.ohrightlikethismeritsversioncontrol.0-pc/lib/linux-x86_64/lib/python2.7/copy_reg.pyo
- Size 5KB
- SHA256 9d909a9f9bc6eeeddb2bdaa70c49f7416bab8d7eedab78b2a8f46753ba8ddb55
- MD5 0e828a4eb911d7884dbe87ed5fef4fda
- SHA1 47c08f8ac6450a7340aab214624eaf6609455dbc
- SHA512 40f047ac0b152a5842e6307a49a589606288da191f3620a4a0453b1dec031759b96de7bfd6702f045add543ce6791d14acc1e9ca3d78edadc6109875157dd656
- SSDEEP 96:3MLsP6Sy7+O99yCMmpm8b3Ik3VZDh1fq634/LHKnTjhwIT2zHCTsgLtbOH:3csCz1R9kylZDfoDHKnTjhwA2zHCTsQu
- TLSH
  T134B12380DBD8D867C9E780B4A0700113EB65F5B761002F4116FCE6BA59AD7A4C72E38B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12