ba9c53c6c8bd5d5dfb6971d3288dd45fb633b86070d2335b753254c2b945c5c0

Sharing

Copy URL Twitter E-mail

General

Target
FL24.1.2.4394_CRACK.zip
Size 377.8MB
Sample260810-xjazhaaa74
SHA256 ba9c53c6c8bd5d5dfb6971d3288dd45fb633b86070d2335b753254c2b945c5c0
MD5 ce4f0ea86bca2280cb017672d13637e2
SHA1 9e1a6253b4ef16fd951457a13444b0255060614a
SHA512 1946e3eaaf5e61fcb8a1eef8e2d3b627c0776cb8726dca40f7c5c915267952ab0e9af051a45778cabd8283089f73cacd5294952d652ac44000d2babb7732e0ff
SSDEEP 6291456:3kj+dxHkj+dxSkj+dxZkj+dxEkj+dxzkj+dxa:3HHHSHZHEHzHa
TLSH
T1E019F16B36E4821DC0EBC239C5535B96F63372B55B31C6FB029012591F62A889EBF371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution persistence

Malware Config

Targets

- Target
  FL64 (scaled).exe
- Size 3.2MB
- SHA256 f12290c79a9ce16f6f61633628e1d22200187910c520be77139ede388f657aa0
- MD5 60f7eadbba42d5845dc64bb45b87c14a
- SHA1 882fe7d41cb97e3925c515a9c5da68cbd6f3badf
- SHA512 27ccc5784ac403e3aa159324ed0e6b6873ed27e372a6da0023118466d858d399f0d78eac29621158b493faa22e253d661ebae3b360746334baceb509e574e2e4
- SSDEEP 49152:bbbBlmv7dNTZlDZ00x2/g+J2macMK7Zs2LPzRh5Jm7F8xuzvh4r4lX1O5:bByxNTh0hgI2Nc3LRh5JmaC+41O5
- TLSH
  T1D8F5012B19C442B4E2575234C4CB074BF3F2344987969B0F26E298522F93EA7994F76F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  FL64.exe
- Size 3.2MB
- SHA256 9eeb6c08d235d41f18a2d37a305cbb3513e6974765a84669f093b8b45cee6b71
- MD5 e1aac20518dbb1dedd71339640e6206c
- SHA1 90ee232a5999ba5dd3a5dcacbb149b149a045374
- SHA512 3d2660176a94ff72c914636649db5274f64e6fcce14ce034efd360dc77a96f768a4311bea1bba8a85ab62feb9d57338a4c3333156ae8e26ce9bb55844296ce78
- SSDEEP 49152:LbWBimayHzXF9tJcztfrrsliM2NtSUnyz8hD3xoAn0zUrr6ZnuCS8QtC8UY7NAD5:GBayzT6f8lGyAoWJWFJ4pO
- TLSH
  T128E5012B198442B8F1971274C0CA0B4FE3F1710596A61F1F2AE0A8522F93EA75D5F76F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution persistence
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  FLEngine_x64.dll
- Size 61.9MB
- SHA256 ae10f61083af5139f60bfc26068dc803175f5e0a7b5995d308f9b670c595aa43
- MD5 88fe3bf05f68697408532b3f6c3c3dff
- SHA1 96dce18cc9ce666f56011fd43969526d6535b5ef
- SHA512 4f52a6c65ad547c96247bcde5992cca8f9d7223ada7bcc80f09f02ccac3890337120096146b624bef20e1926d32514b9ad8019bbfa2dbfde9551c28b85c93ebb
- SSDEEP 786432:6tTgo/ikr5Q3JU+3Pz1Ixx0y8QlDtq0ThoxWhCunf63uQM5thSBzA3CWnPsdk6+K:6t0oKkVXakf8Wzho0Ui+dAy8Ak6l
- TLSH
  T171E7F16B36E4821DC0EBC23AC5535B96F63371B55B31C6FB029012591F62A889EBF371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6
- Target
  FLEngine_x64_Copy1.dll
- Size 61.9MB
- SHA256 ae10f61083af5139f60bfc26068dc803175f5e0a7b5995d308f9b670c595aa43
- MD5 88fe3bf05f68697408532b3f6c3c3dff
- SHA1 96dce18cc9ce666f56011fd43969526d6535b5ef
- SHA512 4f52a6c65ad547c96247bcde5992cca8f9d7223ada7bcc80f09f02ccac3890337120096146b624bef20e1926d32514b9ad8019bbfa2dbfde9551c28b85c93ebb
- SSDEEP 786432:6tTgo/ikr5Q3JU+3Pz1Ixx0y8QlDtq0ThoxWhCunf63uQM5thSBzA3CWnPsdk6+K:6t0oKkVXakf8Wzho0Ui+dAy8Ak6l
- TLSH
  T171E7F16B36E4821DC0EBC23AC5535B96F63371B55B31C6FB029012591F62A889EBF371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  FLEngine_x64_Copy2.dll
- Size 61.9MB
- SHA256 ae10f61083af5139f60bfc26068dc803175f5e0a7b5995d308f9b670c595aa43
- MD5 88fe3bf05f68697408532b3f6c3c3dff
- SHA1 96dce18cc9ce666f56011fd43969526d6535b5ef
- SHA512 4f52a6c65ad547c96247bcde5992cca8f9d7223ada7bcc80f09f02ccac3890337120096146b624bef20e1926d32514b9ad8019bbfa2dbfde9551c28b85c93ebb
- SSDEEP 786432:6tTgo/ikr5Q3JU+3Pz1Ixx0y8QlDtq0ThoxWhCunf63uQM5thSBzA3CWnPsdk6+K:6t0oKkVXakf8Wzho0Ui+dAy8Ak6l
- TLSH
  T171E7F16B36E4821DC0EBC23AC5535B96F63371B55B31C6FB029012591F62A889EBF371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  FLEngine_x64_Copy3.dll
- Size 61.9MB
- SHA256 ae10f61083af5139f60bfc26068dc803175f5e0a7b5995d308f9b670c595aa43
- MD5 88fe3bf05f68697408532b3f6c3c3dff
- SHA1 96dce18cc9ce666f56011fd43969526d6535b5ef
- SHA512 4f52a6c65ad547c96247bcde5992cca8f9d7223ada7bcc80f09f02ccac3890337120096146b624bef20e1926d32514b9ad8019bbfa2dbfde9551c28b85c93ebb
- SSDEEP 786432:6tTgo/ikr5Q3JU+3Pz1Ixx0y8QlDtq0ThoxWhCunf63uQM5thSBzA3CWnPsdk6+K:6t0oKkVXakf8Wzho0Ui+dAy8Ak6l
- TLSH
  T171E7F16B36E4821DC0EBC23AC5535B96F63371B55B31C6FB029012591F62A889EBF371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12
- Target
  FLEngine_x64_Copy4.dll
- Size 61.9MB
- SHA256 ae10f61083af5139f60bfc26068dc803175f5e0a7b5995d308f9b670c595aa43
- MD5 88fe3bf05f68697408532b3f6c3c3dff
- SHA1 96dce18cc9ce666f56011fd43969526d6535b5ef
- SHA512 4f52a6c65ad547c96247bcde5992cca8f9d7223ada7bcc80f09f02ccac3890337120096146b624bef20e1926d32514b9ad8019bbfa2dbfde9551c28b85c93ebb
- SSDEEP 786432:6tTgo/ikr5Q3JU+3Pz1Ixx0y8QlDtq0ThoxWhCunf63uQM5thSBzA3CWnPsdk6+K:6t0oKkVXakf8Wzho0Ui+dAy8Ak6l
- TLSH
  T171E7F16B36E4821DC0EBC23AC5535B96F63371B55B31C6FB029012591F62A889EBF371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13 behavioral14
- Target
  FLEngine_x64_Copy5.dll
- Size 61.9MB
- SHA256 ae10f61083af5139f60bfc26068dc803175f5e0a7b5995d308f9b670c595aa43
- MD5 88fe3bf05f68697408532b3f6c3c3dff
- SHA1 96dce18cc9ce666f56011fd43969526d6535b5ef
- SHA512 4f52a6c65ad547c96247bcde5992cca8f9d7223ada7bcc80f09f02ccac3890337120096146b624bef20e1926d32514b9ad8019bbfa2dbfde9551c28b85c93ebb
- SSDEEP 786432:6tTgo/ikr5Q3JU+3Pz1Ixx0y8QlDtq0ThoxWhCunf63uQM5thSBzA3CWnPsdk6+K:6t0oKkVXakf8Wzho0Ui+dAy8Ak6l
- TLSH
  T171E7F16B36E4821DC0EBC23AC5535B96F63371B55B31C6FB029012591F62A889EBF371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Executes a VBScript file via the Windows Script Host.

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16