4ce2c6bf245f074b93f3b2d1a30ad89da434d6dbe7914b8c05612c9b2729d23d

Sharing

Copy URL Twitter E-mail

General

Target
CelWare V.1.1.0.zip
Size 29.9MB
Sample260810-hc2fjsshne
SHA256 4ce2c6bf245f074b93f3b2d1a30ad89da434d6dbe7914b8c05612c9b2729d23d
MD5 38a2d40b6e6784a1281d516279fa8d4a
SHA1 70aff8b73c187e8c98a3a6c10e4efab2b6f17ef6
SHA512 acffb9c3bcf456494ee756a9aa9919c728d68cd87862b11ff56a6e1f4483297f7e3d2eb243dfaac7bac4798e6b60a78a7a72b982c5d7757bd1d04c956e1be8e4
SSDEEP 786432:EXRBhtR/hhpfpHdEWM/xyKet32K5z7HP+Nr8iCFeVch9m0FP:+RJp5hGvxQwK5vHPYre9/h
TLSH
T1B767337A857D94FE48F006EBDD9DF3943871A8ACE32BFD5A1C32250BBC649821541E63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Targets

- Target
  CelWare V.1.1.0.zip
- Size 29.9MB
- SHA256 4ce2c6bf245f074b93f3b2d1a30ad89da434d6dbe7914b8c05612c9b2729d23d
- MD5 38a2d40b6e6784a1281d516279fa8d4a
- SHA1 70aff8b73c187e8c98a3a6c10e4efab2b6f17ef6
- SHA512 acffb9c3bcf456494ee756a9aa9919c728d68cd87862b11ff56a6e1f4483297f7e3d2eb243dfaac7bac4798e6b60a78a7a72b982c5d7757bd1d04c956e1be8e4
- SSDEEP 786432:EXRBhtR/hhpfpHdEWM/xyKet32K5z7HP+Nr8iCFeVch9m0FP:+RJp5hGvxQwK5vHPYre9/h
- TLSH
  T1B767337A857D94FE48F006EBDD9DF3943871A8ACE32BFD5A1C32250BBC649821541E63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CelWare V.1.1.0/Bin/Decompiler.exe
- Size 9.4MB
- SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
- MD5 a109790efbe0542dddf63ef0415dd508
- SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
- SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
- SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
- TLSH
  T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  CelWare V.1.1.0/Bin/current_version.txt
- Size 5B
- SHA256 dcd17f34d5ea3ab83d52607a49c50a505b7285dc2710f9bd891aae49436c16c3
- MD5 7461df82ce707677f20a34b947284d6c
- SHA1 4db1f31ac8b042e0ba76d72e1d1c675413946d85
- SHA512 d74d5bd3bd6b6b26156ad3a897438312d2d61d4a5bbb4d5eebd07af4e5f6712095a40fd537bcce3249049376bd02acfa1d389cc106814bd4eb0055b7d18327fb
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  CelWare V.1.1.0/Bin/erto3e4rortoergn.exe
- Size 30.1MB
- SHA256 c4a8e9064cf39e9b06a84c9cd8e4ab7a51347ef509807b52c6acc508b4271d0d
- MD5 9356728bccf5c0c207b6664a64a376c8
- SHA1 30e50fc753a05bde53a67fdaaa0872ed35e019ca
- SHA512 5ca5b30a9edc9e10913aeb58d16bc9d0c92e58374a4a60f67dc6e0a1389647152b6d938374024ae7f1fbba8033895adf26b55a2b9d951e0dcdc01d81221a305a
- SSDEEP 786432:QwOusLTll/KusdtUAMbhYSb3bDRFJ3bd:GLBoJtmOSbrDRR
- TLSH
  T1E86723C265D572D49BD30544638E12DE22C2A87985FD99297EC61C039F30EFF2998EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  CelWare V.1.1.0/CelWare.dll
- Size 549KB
- SHA256 a11686258460cbc2dad26eee82fab3058fe3d0a866817016d55153bd523a73d5
- MD5 b86c5a7d023a07d48d2f10be0306168f
- SHA1 f9ec9352be7fec2a14f15ca37980c5cd318e4a5c
- SHA512 eb55cc6adaa206078b3e4d4b14c9db06dce673892e1454bfdc9bb846ddd765eeb4aed2289e0259704f24170d8b04f6935ae99d11018cd5599200d22b90fd6289
- SSDEEP 12288:MXioxVtQVyJCTLnjCAxKFvKcqT0vv5549y8rW48N5v5KhNy4Yd9zhug:hoxVtdJCTLn/K0cqT0X5y9hW48Tzw
- TLSH
  T1DEC41225B7BC445BD2FB057A4C7623488373770656A2EA4C2CFC18CE8EE6B12AD15367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  CelWare V.1.1.0/CelWare.exe
- Size 182KB
- SHA256 11d57b690d915fcc219916a5d790780732eccfbcf1ed63064762231ecedb9f6c
- MD5 b70593a8746712a5dda2b74a8034a00a
- SHA1 c1796f6c29bf9ebde305f6480514acf1b5ef75f2
- SHA512 5541ed7fafb1a45d2ef522c105370cff5f64985bf6b3d52c7fbdd36c99d340b60c5f1a61cfff3cca93550fb1d0bff92f77b1525eff84a0a3dbf2ae43197e0a2a
- SSDEEP 3072:gqvmgiYSoIk8uIHzlqRwa/YB26mkIgrFk2cRjx9Dtular:g64k83TlEvGTIgY9zDtug
- TLSH
  T181046C07E6A850BEE1B6D679CD924C41FB7278558B71A7CF07504EB60E77AD0AE38302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Downloads MZ/PE file
- Executes dropped EXE
behavioral11 behavioral12
- Target
  CelWare V.1.1.0/CelWare.pdb
- Size 23KB
- SHA256 7126f9fc4622f5ec67e49350a7dce33f05eab670432eeac3e31c6df91f85a2a9
- MD5 e0eead206b2a2952c6c05fac3e3a53cf
- SHA1 99ab114af491ab7c245a97e10f56fdb906afa2b5
- SHA512 2baa6948923d6b884564598b526bb418e10de71dae6da08661241e5094039adc0a5e1fe1c42870014592bd040ce3c8fc45f972806d3dbf7ed0386c0c00d5823d
- SSDEEP 384:aSyCPZtyOS1LMeJxjvnrq5aw34PFwCOGyfNe2h8G7AKxXsibz1bD9l0U9HEfA9Qv:JyC3S1L3JxPsI2hlhB6fJEyirgkuFUza
- TLSH
  T1B3B2C573935CC965C20269779562C38C7B30D3202742EF76F1D86969DEAF7980BB3261
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  CelWare V.1.1.0/CelWare.runtimeconfig.json
- Size 429B
- SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
- MD5 1043e1e5e960609d014e56f638202c24
- SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
- SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
- TLSH
  T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  CelWare V.1.1.0/ICSharpCode.AvalonEdit.dll
- Size 607KB
- SHA256 abf7dd1243fde8eb04016fd50bccc5da48cd2ed8b390c8dcf6c26984e1939293
- MD5 9c4bbb4c0e915e95d9e8ef8cb3b63928
- SHA1 869d2e4c5267641f043edd1d4598e831dad3970f
- SHA512 4c768d32ada10a38057081d331caacdf083b6b47c2a9daf97198872e3b9712a5feeb26305808f6aed6740ffa5ed4af3212d497318a956c2f81f0e27991b12c80
- SSDEEP 6144:1+Sq/OsB39SCIjrFerolw6StkXm9/acTH8Yb7hWU+wPXjJHUzXHP3b7DZjoY:QSqRUCFMlAky/dTcYjuH/R
- TLSH
  T1E9D43A2C379C161AD2BF1B77E5314204E3BFFC46B269DB4F388465BA2D527629C016A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  CelWare V.1.1.0/QuorumAPI.dll
- Size 369KB
- SHA256 3398ac3251b38a4a0376d1310e73ac89fa0aed631999514f4de31691d3e0a824
- MD5 233f688c757358ed5f97c76b8be88391
- SHA1 3dfc2f7d8aeb041b2016eb090688c1ba6308b865
- SHA512 e697a91e0fb4a4a541b94a7448688243aef0071e46158f8a956d8f7d94b072939b4e5c2d52e6eba292d0d87d5cc44afba880cc4f3959f3b2975427c7be9db63b
- SSDEEP 6144:0VwvTjHVVV9Qv0vspvhICzZxkNJsnlz5:0VwvHHVVV9Qv0vspOCzZxo
- TLSH
  T10184DE03AF449B11CA6C343A82FB2D2C63A1F5CB1771891FDF057AA71CD62A69DCD246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20