27fb279e61eef8a6edf791bed3129dfdff60c27501f9a9126d97c904841eba29

Sharing

Copy URL Twitter E-mail

General

Target
RTMediaFrame.zip
Size 72.0MB
Sample260812-gnc2nabk2w
SHA256 27fb279e61eef8a6edf791bed3129dfdff60c27501f9a9126d97c904841eba29
MD5 0e1a79f8bc2573e111a5fb7f52a94f45
SHA1 47fd90e4f551ab406eae5ecbbd0d4bd2d1034515
SHA512 7825ce48da9e511c94f883e07371c9d43061798f60cb80da649f091a7438e323d7ec00d9645d6d9b841c796d26c0c542305b3eacca0339bf215a38771d31059d
SSDEEP 1572864:6Go6MZ/ltJugcOqATBVWm02xDWIyPr4UpcmqRN9SvlGGS2M:BU/nJ7czATvx5yzppcyNS2M
TLSH
T125F733429C6E2705FD7213368165A67BE077A3036B26D484AB637F4D47FA803EF74A06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  RDSAppXHelper.dll
- Size 112KB
- SHA256 f7f2a844b3ae09b78145b3fd7113b37e01e5589fb38fba3a4cafd96642b843dc
- MD5 5c1a168097ea840b8b3e3ecdc56d394d
- SHA1 f364cf6013ed7465a8667501ebfa277e51d6bd37
- SHA512 66441255f8b06e9f5e29c034e5423728b08631d7748235074fde1e7df9ffab3a6cb84bc2d3cfe231a61b560c9f5b1f970cb346b1dbf710f2b72f20a2c7216cb4
- SSDEEP 3072:r2ZUrWE3cQGfgjQOvOV9bAMxKy+yDlUj1kOM/f:+KWacNoiTDlVOM/
- TLSH
  T188B3195E63F8109AE176913C857B0A14E772F461576243FF2384827E8E27BD46E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  RDXService.dll
- Size 908KB
- SHA256 047792061f23a80f0427d204e2b1d92b86a6aa6a28b875534a2f7d41be1f342a
- MD5 dd5ac4ff5f45d5b9a73f7b708b750b77
- SHA1 39d2ae22d38afc32e01560f315dbf5417ce97f76
- SHA512 a11f3bbcd22f7990b5da3116156d5cb8d817a27f0d0613fec2b637af65c90184b13df03577324d95b76c7dab92e98deaca499249d01be8ad4d69f6099c1c6145
- SSDEEP 12288:/ntWpDJHn1QLNR93yOwlKUXymsfASmD/woiyRj4sznaUkGSieTojI:1qJHnmB73dwQUDSmD4e4sbayveTM
- TLSH
  T1A3156D6E6AEC00D5E9BAC27CCAA3490BE5B27816473196CF0150426D7F37FF45A3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  RDXTaskFactory.dll
- Size 504KB
- SHA256 5abe48678ea0f4950ae48691af60a9325db998cbcd5cd85f9a8902b023aae029
- MD5 b9261e89b9927a79a3b52e8033889aa2
- SHA1 356216029345bdf00347f7ffcdbcd36074f6b989
- SHA512 947919b419da77ed3c429af1d7cd41bddbdaa892fd391462999721d6d096a1fb9b53e267976ad87fecee68162115ee0367d5808002499b03667132ea59a93674
- SSDEEP 6144:ty5JtHY/9wdYBNyr+5M1hRItw6k3RSUa8WXV6A6J6G686P6n686k6f6h6x6W6J6Y:g5JtHYFJN5MJV3RSUa8WB4
- TLSH
  T1A2B43B6E67E801E5E1B6D23CC5934A0AF1B2781547729BCF02A0817D5F27FE4A93B721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  RESAMPLEDMO.DLL
- Size 743KB
- SHA256 64a7fbb49d80c7efce5718f5f75a7bca54cadee6af275ae0aacc1d1f2308678a
- MD5 f65d57e75723cb6d1570e29008423e92
- SHA1 dfcfbe04fa43fc639d6cc10755650d75a50936db
- SHA512 5c6f87301b8fafe896f69d7e056e77af5236e2f04c88253aa2677dcde4bb1007f4c23b3ef919d4fdbefa3c9a21d242a8b5756522a5c1f086a4dcc9da003f528e
- SSDEEP 12288:Ve24WW30CyBqy13KqVq0/vFbaR15sW/azNQqfXv0SB:VeNZolaqNtO/2CsZ
- TLSH
  T10FF49E1AA65E04CBD127803C52EA741BF932781393404AD723E591AC6FBF7D05FBA726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral4
- Target
  RMSRoamingSecurity.dll
- Size 128KB
- SHA256 208ab1e81f08ebf910c4f986eb38688aa093a5507f553b35815dd1eaad63c2e7
- MD5 9bf521571c71612e9de5b06f213c1c01
- SHA1 01bfd72152c8ef86d221721c6bf2635a008d0d69
- SHA512 b534956f92151022d8ca388e13024349891dea9f8e55984076a6589d442485cc71009ae10f42d2a933e778d40d0abdfc859052c6ec13781a36c0f9240910de13
- SSDEEP 3072:9lvTVU2EfMbvX4v1x/wJmkJ5e+9T2wWimJfUOsG1c:nTVU2EfMbvX4v1x/wJ9aQbmtUI1
- TLSH
  T169D3F95FB2A410D6E361B13C88175D1CE771B0621712A3EF2781826F6F6BBD4AD3A760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  RMapi.dll
- Size 244KB
- SHA256 acb6147e50172e8fb520ee2cf3c34274f2c9e2e959a1a1c1e75e48ba0e1068cf
- MD5 c002a23790e1295b82de1e0729c114c8
- SHA1 b4b3d57538ec3a6e62720775410992ec778c7bef
- SHA512 144dc7eadae998d1b840e32e0a3dae819d6791a3e3847d80a616bc02545c1549aab776540a0716022dc58ed0af5d172c8cba8c0a5c1e8bdccbf1bb2ccad11ee4
- SSDEEP 6144:96w0026Btyh4R0E+8PBoO2bWxzhnao0CQo7:96w002J2R0j8Pe1azNJQ
- TLSH
  T1E7343B3E675D1CF5E97AD13EC9878A09E5B27421032296CF06A0417E1F2BFE8A93D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  RTHDASIO64.dll
- Size 270KB
- SHA256 030974cf41050d0766415a8b39f66fb809efd4413a6713905d9fb76a7a22d1e7
- MD5 04cb1e48d26f8b34d3074087e1727bbb
- SHA1 56f7b7e989a3791ed44078ef88557ccb084ebe79
- SHA512 1d59484e35d3a0c2aa832128514e41a5c4eb40d43c36c204748c4171b91f79a5af1933016ee4af3eac5a5729215d8eb61d86c764feacecf72f0a6839676563d6
- SSDEEP 6144:KDhchNhhRE8ONYXeHLSRx9G/Nv/k3Dt00mQkvEDIbUH:KDh0NhE6mCCiCdQaE/
- TLSH
  T129447C5977B40CB5E877C13DC943861AEBB278510731CADF0760826A5F23BE1A93EB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  RTMediaFrame.dll
- Size 508KB
- SHA256 1edcf1ced6a5c63dc61c9ef96df65d6b75888153cb4799eb32156668762b734b
- MD5 f4c7b75a22e12309879c7a45ee08ef9f
- SHA1 4779ae684287010b4aa346360d424cfe4db2939a
- SHA512 f4b9bb77483d0e613a0399591794e9816b24fdf6a0bea04e3301653862eaebe7929c3d2ad5a0a2d616e773e200c008b023c6d0dbe42f851d402c63b6cf55ddc7
- SSDEEP 6144:IwJX0XjVj0qfnxzaK/JBMGLNO+xEpG2iGY5M43FLLUOZ2KJ4jzwn:ID3nxzaW/NO+xEptZYlZCH
- TLSH
  T183B4296E26AC0996E27AD13CC557860DE3B138204762D7CB0250867DDF3FFE8593AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  RandomAccessStreamDataSource.dll
- Size 108KB
- SHA256 3c2294ae38f00d4f0281144236a6323e0cab25c61072fa95350dec81f08d6ae3
- MD5 96175f0be27cc7b2cd1f1b4f63246e11
- SHA1 295147afa9828739c71f0008a75c909ada99a7f9
- SHA512 ca86a7a50d9694b38480bcf18abaf24e2884d8d438c1261ea4b57aa468e1a92bfb7bc6ed23ce982272dee3e478b0443cea21f37c4a7a76e1237dd2d5cfcbd827
- SSDEEP 1536:RVYlSh9IC39NC70TzxCzCpwLfSytde0zkLyWUXbyiFwdDzAOuxG:R1v39FTzXw/tde/Wv2dgHxG
- TLSH
  T135B3062E66A824A5E176C17C85974609E371B02663125BFF02E0C1BE5F17FE8AC3DF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  RasMediaManager.dll
- Size 412KB
- SHA256 88648bb3f14465fa4aba227702f601852a18dc18952fa2cf24823b4659931ea2
- MD5 ac8b1845dcf135b4db676ec6dd66bd90
- SHA1 b815a89c6c1146a93bd7e311598cdf5e48512ae0
- SHA512 092983857258f51c725950c41dbd204b7b9c980a70c9ad2a2338bddd68cfda0067ec7aed2f792fb623b7c61e2ae55244c7363aafa9dfb93ab9997fdc1e6de881
- SSDEEP 6144:ZpyyYI9r4sMDZ/blaUyXavRFIQ08aZO3F8sQlb3XQLqc77TrB9H:yynksMDVbIUycFC8aZO3sqjbH
- TLSH
  T1BF944A3EE7A800AAE0B6D23C80930B1ADA71741D4B629ACB1174857D9F17FF46E34F59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  RdpAvenc.dll
- Size 261KB
- SHA256 547b14e2df0e731402a4d02ffd108c04720435b8fe83a2d48e35c6c8d54ee765
- MD5 b67ed149dc126a18da659de8585899a6
- SHA1 465a143f7f6d9d859150652bbe81ecf14370c7a5
- SHA512 86a27d2dd11a55fc32f5bf3e7ac34184b03aff8f9df91efbbae2a8547e9c6bdd4acbb3e565042257a5552c57f282e049f876d04bdbbf7217f4888f9679c22e25
- SSDEEP 3072:mnJpxAzXjRAtMGaCf8obkGtxrWHirqK266MrfmqVo1aWYUV3vpmR4NZNUrbIPAck:pPRblOW6Ll6V1/3vpmRQArbIPAcbov
- TLSH
  T1FE446D3A71590CE5E9BED1B989678A06F97174100322D7DF46A081BA4F27FE8F93DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  RdpRelayTransport.dll
- Size 312KB
- SHA256 8a1f0af21a90d387c55ba667c65ea9858b6e41782db8aae9116e4af4aebe9e01
- MD5 af4df9aa1d1b2795b6197c0ccd4d50a9
- SHA1 c3eceee9fed11c0e70cb55de5db521768cac17e8
- SHA512 aa204f5c22d01bd89b0e907b3b09ef14ccb193ae8349ed9ea7e804e01965718ab6a0d8d5e017ea778648e9fd56f8a7f6bcf13649031854420e182bf70bb652f0
- SSDEEP 6144:Ja5W9swicLLAe1pBtwX3TCf+ChskPzjnO1hL6VwL:JSW9R7BtODWNQLqC
- TLSH
  T107643A3D22A510D9E67AA17C816B8E49FE717414171265EF1290817EAF3FBE0AE3DF04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  RdpSaPs.dll
- Size 40KB
- SHA256 9d19cfa5c31bdea9e341d0730b119f815cb4e94fb626f83293d3334d4151e1ce
- MD5 1f19ce394c228e57d3dd78f6687b6425
- SHA1 edadb568e32e6289ac75d462e442064b9a825ee9
- SHA512 3e91ddcef24cf1ad5922dd090a042a9b53740ccf294dec30f5407f54e3eae7389db24bc9050e187d649ee7a735c33dfcf3cb33d4fe7ccaf3ac42d10a8f158baa
- SSDEEP 192:erzop+fDUPlFowrk1ttSwlQZMLHcPA+4jIIgg7pNOgaW7WW9:erQ7dFow4ztJcML04jINbW7WW
- TLSH
  T12E03F865FF5A0CA6F47A823A84935F9B91B5FA05072293CF03600A6E1C36BC65E74FD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral14
- Target
  ReAgent.dll
- Size 769KB
- SHA256 28a8da9033b08a25ae0b16cc1f540511b2d49c26f6a0996724f6ff5ae786e4a3
- MD5 6d9e33f24b4e85bfbf434c7944bfeb5f
- SHA1 65c4085fdf1952b0ec7ece2359618f10c66b285e
- SHA512 14f6667885984b0581e2633ea7ab5d1be60a594d23f6581c929eedda36f1426e362ae2836467d4df1a1dbe4cad536ad41ef69097ea09ddc1dee02508a5ebf7f7
- SSDEEP 6144:OQiui5XhjYt4fUIOocGA05rLppRuZtz1OnyVA+CHbWznvwhWZeJ3k4OeA:OQiu6Xhrgo3Ra0XHbWznIhgZzX
- TLSH
  T129F480256BFA0158F1F3AB789EB64615A972BC656B71C6DF1150C06D1E32BE08838F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  ReAgentTask.dll
- Size 40KB
- SHA256 5d35f02dda38c82722bfd19cfc7f08c394180f99917382150136348f4839feab
- MD5 c945a4789e5ae9f080f475cdea8f49ab
- SHA1 7c033e2532e6f2e9bfde66fb330454f19ddd020c
- SHA512 2997774bc5e42135b7e67c650c9d2bdd765d458b8217b44d9b99f1f7f31b364a6f965fcd15de911b5de2b311e6514ef9d51b5e2fd9dea60d3b25c0ce80d9e363
- SSDEEP 384:0IvNTAzGG0NIbepLBDBPJ0hwGCoWOGCW:yA3Ew1
- TLSH
  T1A903E78AB77519F8F575863D8857894E9132B51107224AEF073143DE1D3BBC29E38BE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ReInfo.dll
- Size 216KB
- SHA256 283b3e841555e2a080644ebcd28e5121f1b084c1df3b3728befe3f5b3fdcaeb1
- MD5 f878983ae058527f2019df9da8689691
- SHA1 2bc041be7333bb22c90d40bcff4eee7635fd2e4c
- SHA512 cd8d2046294e16b38594eb47c1a48801775bf8fee671014f4cb6faea12126884b08d737b47d23c7047ee43387972a262f3e9f7c73d5d0ec8a84ac61ff6f72c8e
- SSDEEP 3072:9KCOgHLNsaPgdIR/8PueAL5DEk+EjyR+U88gjiGecqof4rUbLwH:9KCbHLmaPv35QnEjyRyIofiUbLw
- TLSH
  T1BD24D60927FA1058F1F7AB789E760505AA72B8652771D2DF02D0C17D5E27BE4B838F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  RefsDedupSvc.Proxy.dll
- Size 52KB
- SHA256 42de317ad6155f6554f8aa823b396890137d20f98f07e689413887e6666087a0
- MD5 38379dd0c2094626bd9777559f9f6236
- SHA1 88cd0abdb2cdc1c2179f9527208347c8192abfbb
- SHA512 040d0b66f6e40a6115183386c64e057b247623c5629a7a9ae5fbc7639aa5295e40ffc6998dbd5f9c1e747616c1fea1cb041a4f9911e1018cfeae3ccb29ae208e
- SSDEEP 384:JJn5n6PUDg/ddYaPGyfsYYM2lE60oBQhVqICkWTPWfEE:TAPXd3Pw6toBSVqIChE/
- TLSH
  T17E33C948BA6818AAE8399235445B0F29A375FF049BA347CB1651321D0D77BE2EF31FC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  RegCtrl.dll
- Size 76KB
- SHA256 537a409cb951d0ff8b17cae23187e635ba5fac093b5f5f0769f0e97ccbd2bc2a
- MD5 35f354fedbfc6115f43c6730643af2e5
- SHA1 c78df2f578ae7789b369668609909b03ba40ceda
- SHA512 ef3839c67cb41e2eee17ca3cfe619757c3257e536fdb14924c666f91e3d4360fc456e1109fe967cbc4e94a2c3e5ac39c575f56482305eeaec06c29a776f02147
- SSDEEP 1536:NlbhiPjH0ZhQ96VLKolUXMFcv+BwcK2Ozj:/IP70ZhVLKolYuwcK2ej
- TLSH
  T159733C4ABAE820E9E276917D85430A55E671FC22271106DF33ACB27E1F37BD0AD34B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  RemoteRemediationCSP.dll
- Size 196KB
- SHA256 97849f25ec326a5ff6ceacf9330b492882ff04faf7527960e4a557081d4777d7
- MD5 bda0c165f09a419b1f2eda7b370c17a0
- SHA1 1f7daf297862857497905bf14947ce87253b693b
- SHA512 0010cb14cb82b02240e6857c11211c2d4c167db58544841626db831e31a20cc6798e651954b8febe02897596728f349a5808a686c363ac3e1a08cf916cd666ff
- SSDEEP 3072:0K/RW9NfzUDhIkWp8/m5aB7tmM1509GHY+tQUiGv9Y8AM:fJW99zAhIZK/AU509iYcF28
- TLSH
  T10914E71A27FA105AF5F69278DEB24505DA72B8606731A2EF01D0C17E5E377D4B838F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  RemoteWipeCSP.dll
- Size 92KB
- SHA256 9963463c98eba11e4c94d67439a41ed43adfcfa1755b8d1922455dcd14d581a9
- MD5 d862c75abf82c0cbecc01f38c4fde8f2
- SHA1 1f3e19581c7d2e3d134bc50ef89a819e405b0505
- SHA512 47cb6b5e3abd155bbcf40e9cb07a9716634f31bbe2b15b4323218ad7eb96db1262477dec12bf2d52b4557bb6d91b840c381fa9e8e5640bbd067656068d4dc463
- SSDEEP 1536:XduYYTGiaoRwkhjk6PvsHyDTJ+w+nQXEvKZcCcaet:NuYYnXNk6PkHyDV+C0vKa3t
- TLSH
  T1CA93299E2674209AF47A813C86674E06DB71F060131267EF06E4C1BD6F93BE06D39BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  RemovableMediaProvisioningPlugin.dll
- Size 96KB
- SHA256 7a1646e6f363e2ed5a950ee17ae4a31528d854501ba534d43ada1fec6f98f6d5
- MD5 ae7ff80fea206c9702cdd95fb880c31f
- SHA1 4ca80304c33ae1b443b30246473bcb85f12ed770
- SHA512 417733de775b05f5eb8f41d10bc09739652bc24023d1da5e57b6582370a7d1f45fb5484f4c35d0c5c271d32d6f112176b61af62d16584c480361a5d1b235bb27
- SSDEEP 1536:j/YU3vZI+emUbYSWhX904Srx03ku/+wgXNOtVuYcCvP9k3mFHgsw+wK4YNYk74:j/JK+FjGS0uHgXNOSYFPesjwK4YNXM
- TLSH
  T1A4A34B2EB5BC11A9E5BAD17C94434909E7B0B021171217FF07A0817E1F67BE86D3AFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  RemoveDeviceContextHandler.dll
- Size 100KB
- SHA256 327745ed8f2a0a070dd929a9b1a31d5f59130f0aa95b8aca7e2cfc23e3dc6207
- MD5 cd5b6f9962bafab12aa09c11cbfe11fa
- SHA1 1570b8f1f3a047fde5366e061c3b302c79edd20b
- SHA512 75f32eac652cf8f3700e43cae332b85925cc35a20d38731ee0a1922b38dc006cd2c4d37e2b526f2711f7f13a4d1f80f003b9b75627899cd50aa08750751482a3
- SSDEEP 1536:AM/mhPr7LKhNQWrBn//E+0lN5u4+t1aeSiy59TagdQXtJ:J/UWdn0hlN5ux149Tagi3
- TLSH
  T17FA32A6D66A820EAE275917D82534A15E771B061130227FF02F0C1BD1FA7BE4AD3DFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  RemoveDeviceElevated.dll
- Size 36KB
- SHA256 80c2095f819bbe7ab05a28cd798652052c3bf3e114d466bfb14fb23053d43f91
- MD5 68e93710282d93afde59f4a686c10f2c
- SHA1 e3ce9f03aef4325a1f5251827d58d65bdc37f377
- SHA512 fc7a6a3b9dcaac759d451975f7fc1d067b0648b58f56ddb253453bd08df06b34e03f3e3a39a1d11790ec035c421fbd9d5ab35668e25bf06f1336e793ee7dbb14
- SSDEEP 192:NZKRQD0Tz/lx4DfoPLt3UiFE4snsAE2L+7p+POBVN5KcRWeJWT:NZh0Tz/lx4Df8t3DFS+gYRWeJWT
- TLSH
  T15EF2E582FBB24E9CFD25067848EB1E066639F60493529BDB1230168D1C7BBC19E38FD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral24
- Target
  ReportingCSP.dll
- Size 164KB
- SHA256 aa53de9924f2fdbf1aae085a41d3c2fb39a8d42de9255b7f20f20042be8a9131
- MD5 ced900cdb680f4c7d25b61c4684a6bec
- SHA1 490a3d379a83966bfccadbdad0aca66d95b75d9c
- SHA512 9a08c5eb6225c38e2f384d245671d5a614aa34dc5e40780dabd4dc2708f7b2c4deb3a857f3cc4306b543debba5a954efcbcee5470bcdadf9b55a74906e6ccb9e
- SSDEEP 3072:QS2vEikbUdujLjTNzBsflxA+Tqg8kYFRGrAh4M1K2Pp9Z:28i+fFzC9xA+Tqg8kUYM1K2P
- TLSH
  T187F31A2E72A910B9E176E178CAC74A06F2B27465132257EF01E182BF1F17BD86D39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  ResBParser.dll
- Size 144KB
- SHA256 21603b4dd666a0aaec2dd7d09e18091040cc31b2c1b254bc89792717f051edc9
- MD5 44ecad534ef2dfae9b4f8f53d5202a09
- SHA1 a8543e792ac10603d48af1bb6db6f9691eebaf8b
- SHA512 2b5e05f372a2cf269b1497a02cb58f056c8ea6d7e6855fa0d87a55830e8034df1f26edf51dc633fbb253389d08002cd0e3d0af84f22e1ff569ef49d9ceeb9ba8
- SSDEEP 3072:WhSrsTBTMHHcHVPJ1sxunn828lp3L4XiyikYHK/O4enGM:lYBTwHc12wn820pb46HK/9
- TLSH
  T1CFE34A5777A840BBE2B7827EC4D30606D376B81517619FEF03A0425A1E23BE89D3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  ResetEngOnline.dll
- Size 228KB
- SHA256 2189cbadbe521b1afbd04c39423dfef1aec0a90392596b89d1b403887b4c4656
- MD5 6cf4ae631e19fd4957f9cff4727575cd
- SHA1 c07ce21f94cc79104ae94047135b18ad0c1d8d64
- SHA512 5bd5d132738fe3e0ae8af31ba5b3ebdb7cf78380e3c1bbc8fbb7582df5331e932d21903ab9e93686b5fc144e10007dd0b67fe567fc35fb513664ef4133f92167
- SSDEEP 6144:vicIKQJl+50G8opFWXAV8TGIrG0eTZZRgKeK3C:NIvv+50G8opFWwiTGIrG0eTZZfD
- TLSH
  T18B34275E23E918A4EDF3923C8D724605E67378609772D6DF0190817E5E27BE8E439F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  ResetEngine.dll
- Size 2.8MB
- SHA256 b6ecb1e91c27a39c5f3b6b205ad62d117e023a00b1941699c06bf082912488f2
- MD5 9a9145e02973f85de9a935fe9e1adbf8
- SHA1 06cfab1b4c50b3d156b4d96e12955dc7a2130494
- SHA512 6a210eb44ed1736b0475050f9f367eedde15065b946873475102cbb96cef3d4f4316e9ae65566314f489970030621a7a20abde3d2416dd7dc8e24de706643676
- SSDEEP 49152:Yf0L6XmC5A50sroACNZ+6fBudktCPFAn1/+Zx0ZpBZ3+uyGkf+dWvo8JwIpbWxJ:WdF7L3J
- TLSH
  T1FBD5B55923F805D4F6FBA634897A4A0AFD72BC115732E6DF1600416E4F37BE18839B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  ResourceMapper.dll
- Size 524KB
- SHA256 5da8ff0973077112afd71b1d3ded7b06240b5ab616b063811dc10817c4ba230d
- MD5 d48cd8544be594bbe5727e6ed9dd2260
- SHA1 cd51a94bf1951148fba831f2cb782a5ecb119621
- SHA512 5a1a35c6d1dbd7bdc71079e96f5ec28260f43674d7bf01bca22dab0b46b97a6eaaefea8cf942b9966c15eb8ea7cfe643d9141350790735f1d1185c79e6e064ee
- SSDEEP 12288:1+Iz902t5DhEGW4ELhze8lKWYjKNdhu9qdE:1+KDhEGW4EteK7YB9q
- TLSH
  T10CB45C29A29803F5E1B7D17DC9874506E7B2785603619BDF03E042BA2F27FE8993E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  ResourcePolicyClient.dll
- Size 90KB
- SHA256 443a802b2287d316661794f69c690651f46d28fe905e93871cd8cbc99528e79c
- MD5 fd11607f2babb0e10927b748a69df9d5
- SHA1 e3a88a03b0c45f13aeacc510b508cb0f81fbecfa
- SHA512 81af1e0f8439502ebe7a8242796702bf9bd15cf2f3db2341a4651d632e470692560f74fe94f099ca0d2450d6dfebc59ac3720e07f6e8f15cb7771f3eb32e6d0a
- SSDEEP 1536:YhVxhnvNaFwBgnhFo8tnBy5uzWuWWKS6LhVLaY+jVO1nPCvrzl:YNB8zjc5gWWb6lVLado1naDh
- TLSH
  T1AF935C4A639820A9D07A957CC1D34B1DEA76F560576207EF02A182BC1F677CC6F3CB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  ResourcePolicyServer.dll
- Size 177KB
- SHA256 65dceca610a9e4336f9e0397e0b30fff14b80bab879374568dc2ae8e64d2a1af
- MD5 e3482c9ecf4680237105d699c3cadeca
- SHA1 8dd7443602360d02b9291d2ce3a0d4c675f5b5fb
- SHA512 8f29e2a71a45e97fee97612fd27c186e585108549594d0f5c9fb825f6444a7b9dfdd42f94ed05fecc9ef585e1d18d383961461944f26a8019e9d5e6de38caaf4
- SSDEEP 3072:ejHnr1tM3d5A6huKVPGO8w+qW9q8hn5ubm+Jh5gJr:+Hncb3+B3ubmH
- TLSH
  T1F2045B6B33E511BBE17A913C89E34656F7B27462232153DF02A0427D1F13BD8AE39792
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  RjvMDMConfig.dll
- Size 184KB
- SHA256 ac95d46fe77484e80bc33aeda6765ae64ecdabfc70ee2adea0a27ff8c741e3c4
- MD5 507fb215b9b7c42c19855a8dc8ebd78e
- SHA1 79ec2cc8174d5cc761da5f1a5e15150533910d00
- SHA512 b2e387193038e2e4a4dbb37fb2a092c40cf220b7ab251e375688b549d7778f9b802517660cedb261d7bcda7b62b1de7b7f7bee7a7ca009243b3f456d46aeebe1
- SSDEEP 3072:wnezXMg7lEmUmCjNQj3N7dj061x1fKHpI+o/nEULonVvqfjyL:hXMge+eQj3N7dj061FDonVvqLy
- TLSH
  T166042A5D22E910B9E57AD23CC9964506F6727871532257DF02E082BD1F33BE8BA39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32