de352f497550ad7c1cd04e668ef22b40b9efa8160bb68c3e9f1c54ba959d8959

Sharing

Copy URL Twitter E-mail

General

Target
Maltascanner.exe
Size 1.2MB
Sample260811-slc5esvgqf
SHA256 de352f497550ad7c1cd04e668ef22b40b9efa8160bb68c3e9f1c54ba959d8959
MD5 c3bb4b07026445bf87e3fd6a4c855d71
SHA1 6ff6f85323cf1ab140dc00c10f61982717495ead
SHA512 4a0da882c414a2dfee9b5b581ac00eb520740daf332c5187b19e15d479c91e1c1eac246c159098f6330b4497491745bde23dcf7300ecf074bd8f800e19e0b785
SSDEEP 24576:8FgTQcPTAcySiDNpfVkqgfPyU8/oa8reuaDQkqjVnlqud+/2P+A:8270nS4pfVkqgy6r3askqXfd+/9A
TLSH
T144552201B2B6CA17F1A5A8B9C820D2F0152A7C6DD9D1D2DF3AC57F5EB070642C5D2F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Maltascanner.exe
- Size 1.2MB
- SHA256 de352f497550ad7c1cd04e668ef22b40b9efa8160bb68c3e9f1c54ba959d8959
- MD5 c3bb4b07026445bf87e3fd6a4c855d71
- SHA1 6ff6f85323cf1ab140dc00c10f61982717495ead
- SHA512 4a0da882c414a2dfee9b5b581ac00eb520740daf332c5187b19e15d479c91e1c1eac246c159098f6330b4497491745bde23dcf7300ecf074bd8f800e19e0b785
- SSDEEP 24576:8FgTQcPTAcySiDNpfVkqgfPyU8/oa8reuaDQkqjVnlqud+/2P+A:8270nS4pfVkqgy6r3askqXfd+/9A
- TLSH
  T144552201B2B6CA17F1A5A8B9C820D2F0152A7C6DD9D1D2DF3AC57F5EB070642C5D2F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  costura.pdb
- Size 2KB
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
- MD5 34b42a5776a3ad022b429124d55e576d
- SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
- SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
- TLSH
  T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  discordmessenger.dll
- Size 12KB
- SHA256 6f7e651c04c8880f5dc317acf6300c88774011c2580ede360dc409adc8fd6b84
- MD5 a21cadee2e82c04f4d7ba11c73e0b884
- SHA1 b17573b7166ab6bf9680f04fc897cabefcc1514d
- SHA512 53055f78b466c0edc1f660bef26fd428eb37d7256747bdcbf7e541e838a6307d11d2efd376b98a6c7e8d0a1ca885d088071a19ff9f7a687de47d43f84074da9d
- SSDEEP 192:UzrdFzRsz+1VB9kDVaipBeCG65jVIuv1puD0WbBKCrdyvCpSmV7rtir8DhF:gzRszGVPkDVaKG65SuNpuxBKCvrtLF
- TLSH
  T1B342A6320B6CC22DCA7F0734F87242A506B1D6497516D9BACB1CB00B3D57F4E98E59B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  guna.ui2.dll
- Size 2.1MB
- SHA256 e658e8a5616245dbe655e194b59f1bb704aaeafbd0925d6eebbe70555a638cdd
- MD5 c97f23b52087cfa97985f784ea83498f
- SHA1 d364618bec9cd6f8f5d4c24d3cc0f4c1a8e06b89
- SHA512 ecfa83596f99afde9758d1142ff8b510a090cba6f42ba6fda8ca5e0520b658943ad85829a07bf17411e26e58432b74f05356f7eaeb3949a8834faa5de1a4f512
- SSDEEP 49152:cvrqKk8q2gqi2OXCt6kuSw9g8PTNTN/23uxjPHEiCAjFcm:cvrqZr
- TLSH
  T16EA50A197DD4EE27D16ACE33D6D25021E3F1E4932AB2EB0E72D357681842349788637E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  newtonsoft.json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  system.diagnostics.diagnosticsource.dll
- Size 34KB
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- TLSH
  T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14