fe0fdf52e73d9b537a4464263eb7b7df4f5eaca0b0955456ac881904a2585bd5

Sharing

Copy URL Twitter E-mail

General

Target
candy.zip
Size 372.9MB
Sample260816-b7271ax1a1
SHA256 fe0fdf52e73d9b537a4464263eb7b7df4f5eaca0b0955456ac881904a2585bd5
MD5 13dc49f71b5a586948ef8628c02e62ef
SHA1 94cb1cd9c1ba95587f418f42284f244afc2ba5de
SHA512 bdd12169a15d34e0bab555b21feaf0662b618852f0f17f84ad0c84a0b0ab026dc0da48614c427cb9c7c5fe87b78b9ff5916f9cb34652005e7b9e883e1cd175d5
SSDEEP 6291456:OtzEYgW7Q/fLc4V/hMSbdklaFjljX6wNKKnY29l7XY650HEst2l7hbB7TKPWFAnH:Yz7gWs/DHcSbdwYl+wNKKnt9lLY650jH
TLSH
T1961933DDBAE77D04C353F27F61BA0049607666C3F60FA967E5A212210DA31469F3A21F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  candy.zip
- Size 372.9MB
- SHA256 fe0fdf52e73d9b537a4464263eb7b7df4f5eaca0b0955456ac881904a2585bd5
- MD5 13dc49f71b5a586948ef8628c02e62ef
- SHA1 94cb1cd9c1ba95587f418f42284f244afc2ba5de
- SHA512 bdd12169a15d34e0bab555b21feaf0662b618852f0f17f84ad0c84a0b0ab026dc0da48614c427cb9c7c5fe87b78b9ff5916f9cb34652005e7b9e883e1cd175d5
- SSDEEP 6291456:OtzEYgW7Q/fLc4V/hMSbdklaFjljX6wNKKnY29l7XY650HEst2l7hbB7TKPWFAnH:Yz7gWs/DHcSbdwYl+wNKKnt9lLY650jH
- TLSH
  T1961933DDBAE77D04C353F27F61BA0049607666C3F60FA967E5A212210DA31469F3A21F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  IDA Pro 7.7/plugins/samaout.dll
- Size 15KB
- SHA256 3f2135116d091bc0d24c021c124da88fd9a973eb1c0c4bbda75a6da433f1f516
- MD5 bc28877c8dcaefcfcd59d0e0ad4b0d51
- SHA1 e268f25b3be3a1dd7d3a8be399802b1236a1412b
- SHA512 09f3dcba62e15716133f8b1d79f99b9f4d0931944001da48d81858d28f0a7fda8b987661ef5ed519918147d3173802cad8efbba9883a33a766201e26388c436c
- SSDEEP 192:Im/OuNkh69m3GUbFmIwZnAFM9YjMa4XDfyw4MbM4r+AHu4E5b:Fjkam2UMVZASIMMv4xH3E5
- TLSH
  T112621A0AFA94DDD5E011D17E86A30616B4BCB71A036152DF0750B96D1EEB7C0363BBCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  IDA Pro 7.7/plugins/samaout64.dll
- Size 15KB
- SHA256 6dea8e11e6a52188dd92da8c304d69ad63593341c43a79abe1556738baa5e7fd
- MD5 1e8ab789de2d9a0cb59c78689f3a7a59
- SHA1 6e81ddfd4d9bc764c00b0f4d9093a0afaa3c0065
- SHA512 bee5c1edf34b378f47ae50b0f120ec2257d9c532297f40931078b2ca89d64d997a89324143ba320d395a4bcbd72f12439d442d968d29b18ad7f6314c63a49cc8
- SSDEEP 192:e2f+faY9mnv/kaU177XRQZpXIzxgMhXhyLRoG5I4J+AHu4T:7+S2mXkTXwyxgFq43H3
- TLSH
  T1D762FA06FB94EDD5E011D27D85A30716E4B8B35A036252EF4B50B93D0EEBBC1353AAC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  IDA Pro 7.7/plugins/sigmaker64.dll
- Size 34KB
- SHA256 67722bd824337626547b2e66e4f12dd7782bf195ffb2afb34cb707034e124026
- MD5 c70ba6113f64851cd680cc118a4d2b1c
- SHA1 6d6f94bd74eac2fa440f1a470048197bf094d849
- SHA512 790bdbc5233f76edaee8a8c587cd97450304c02bb0c0435c9a0d5a216d7512d903ab99817715f1a3448318ff0f5c3ed616889bc21636ac08ed8af5532b92118c
- SSDEEP 768:xW0troIkl109WOtP1Z3vd8uRmg8lYy3IwVrV1dipE:x3roIkl10WOJ/d8QmgGZmC
- TLSH
  T1F1F24B96B10B00FDD97B817185BBA56BE6B5F4869314B6FF02D0853A1F32ED1223E342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  IDA Pro 7.7/plugins/sqldrivers/qsqlite.dll
- Size 1.3MB
- SHA256 16d856cac0fdc337112cd262098fb8b5e954f1467e2355813c42013175335569
- MD5 06d9e3eca2701e8457b6e240806c03ed
- SHA1 97488d60ee1a3d3712b4ffa39f50ae122dfadf9c
- SHA512 1bfc350a05609dbe3279d541e5572d7d7b0a04e3f371330f6547f858b4caec630579af247b089f60683940cdd7cc51f8ab320ca8d6b3d4ad7fbba4c99ba52120
- SSDEEP 24576:4NU6YaBSlOBLsSEIzLORFH5+c/rehxenf8WgcJXDIad5:36Ya2aLNEsORFHt/7YaXEad5
- TLSH
  T15E559D5BF3B8009DD157C2BACA0B5607E7B174052720ABDB5590CA692F53FE31ABE324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  IDA Pro 7.7/plugins/strings.dll
- Size 10KB
- SHA256 bcc438fde73082cc6709c54e72a5c6994870aca7f0ff1b78fef1c8fd8adbcf6d
- MD5 c77984d47b4d4a384b830fc39beb2ce2
- SHA1 5bc5cb2a2ff4a2538540fdf7ca564a46bc83f2aa
- SHA512 f90d7c7d941321846c324ca511b34b3a219b8043e5d7e0091e5c463258ede190e8b79665b211871490afd4f26db88b9f76145446e3b83589b47a6402a4f22384
- SSDEEP 192:6Vewflc58ErsrgjoPARVuXrDVrLNrEOX+/UD:odc58EweoYRgPlNDTD
- TLSH
  T183223A4DFE544EB6E56D82B8C4824B0DD27CF7A593A263CF132441441EE72C53A7ABCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  IDA Pro 7.7/plugins/strings64.dll
- Size 10KB
- SHA256 00ec6600c88113e438cfbccbeeb3900f27c6694d63ed112036a57f9a4702f63b
- MD5 89aec00505a448b5a24a6cfe485f10bf
- SHA1 b4579970a2fa3f6b22285e9e30a1709010e396fb
- SHA512 73f58097b69b7e756299b81ed519d08f9e9dba0ba67163ed9dfbc657fb2bac4e3f2e961053465b9cfad70ebdf7450cddf179fd4a3576df99286f8e7ba00fc97a
- SSDEEP 192:62f1cRsU+u8MM9wymoPiMRVy5D8X+/UC:HcRsU+3MMQoJRo5YTC
- TLSH
  T17522294DFA914BA6E96542B8C842074DD1BCFB56D3A123CF032442152AF62D53BBDBCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  IDA Pro 7.7/plugins/styles/qwindowsvistastyle.dll
- Size 136KB
- SHA256 8117351508ec6dea8326959ca820a72abcd6517f4449d77469596e7f09f7a887
- MD5 cf345ed9ada7f58f5fb7ecf32f0795c4
- SHA1 f82f0b7972cf5d0ed5a470a9ae7f096861383f81
- SHA512 848309a447feb636cda455cceaa3b4d5f45953c1be17b33995cc02409fe51690e80df138a87a9df4b0f79fbf52bde64d0b5ad8cae793a8dc524e71a90d768c95
- SSDEEP 3072:iyeS0Jf3JL6Y8sT8PzswOKXR4VCGA/xyZ8tc/:idd8ZoT7A/xyutc
- TLSH
  T1CDD31913325212D6C567D2B8C55F1912F3B3B05C1323579F0AA6CEB91F532A2BD3AAD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  IDA Pro 7.7/plugins/svdimport.dll
- Size 62KB
- SHA256 2f4bf9c7bbfac5b79c96289bc55af5de9fe722f01ec5808cf5d920c4ce2b6842
- MD5 dab02e52a610c4d4ab4d768a073cf004
- SHA1 72b736e34dcc4da1bd958bea55688d47bbfadc1e
- SHA512 e33c8d6014971baed8095f1695545ec042451cfb8b8a6da93491eea66c4663e25c4bbed01291d66b4e50d03f107db5ca3d405c6eef443fb9431f6e27e86f6aad
- SSDEEP 1536:ARoQoOlQTP/cn3/jrFebJlJe/XW//H5/xeJCah+:AOXT/cnFaIXIv5Je8ah+
- TLSH
  T152535C6F66A800A4D5BBC0BCC65E6607E3B63156032197EF03E149661F639F41EBEF50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  IDA Pro 7.7/plugins/svdimport64.dll
- Size 62KB
- SHA256 4847eb6ddf6b74107502a5889c33d6566793631be3377e793761a82db941f8f3
- MD5 fd0d30a2dcfb63a5f1bbd664aac656c8
- SHA1 280e7c0df3bc9d7d7a8e4308af987f25e7debaac
- SHA512 329c9c14902635d1b5e8611f0b786a8ca6f446c5b839dd9a5d3896b6d4920cbe90666c37524083d93c2056b011deaa25787c5efdef0fb37cabbb80e4b0f0df8e
- SSDEEP 1536:+5zEC/wzk6H87J+GnRantjmFebJl5+N+Pv7AC4Dc9fWQ:+CcF+Gnnaj+YPvsC4c9fW
- TLSH
  T1A3535C6E67A800E8C5BBC07CC65A6A07E3B671165321A7EF03E149661F139F42E7EF50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  IDA Pro 7.7/plugins/swift.dll
- Size 24KB
- SHA256 319233e3edf8e75411fd52dbdcb5b1436a9d0420a11d049e466a206ac189b2aa
- MD5 8956f27a54f3c3fc897e6f30c950296f
- SHA1 980e2e404cb165d8ce6301f4751026473cc6ca44
- SHA512 78a048c9eac7977918cc25bedec7ed4aa8d55830d1808147de6661db799e3842147e872aa8d6778c03eee1d23dba91b1aa690af2e38ac3728c0f38e4d150dd43
- SSDEEP 384:o/uA/3ed3P1WgxEzZiP4MHQRyjJyX7HNFEXTGVtPRVKpHBucT1uG:Y/43P1d4MHQoqFEXQNc
- TLSH
  T122B23A9F63AE40D1F1AAC0B9C6471619E5BE79609372D7EF076005570EA3BC8323AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  IDA Pro 7.7/plugins/swift64.dll
- Size 24KB
- SHA256 e26f9a43cbf0f4680ad2d026c9543ae9987b25c22c9e58858944913a9241379d
- MD5 613f2b408cf067485126be6c665a1877
- SHA1 eda2c3dfcb73d1756dd2907e621af2f54cdf0001
- SHA512 4c0f1ed09cb0b9e5116884259fdfac38b3a4336af68367835d0d426a820f0c2573c04e983fd96622571907337869255f18c33223d38911f436792a7a8895176d
- SSDEEP 384:vuK/6hbthyFBC8eZSn8nSLxESv0Wtyn3DBNFcVUaztPRV0pHBucLp/://6/gFL8nQaSMeeFcVUYXcR
- TLSH
  T18EB2399E63AE4091F1AE8079C612221AD5BD79659372D7DF07B0014B0F73BCC763AB86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  IDA Pro 7.7/plugins/tds.dll
- Size 26KB
- SHA256 1c5acefbf35ab031864fa1bd333dd2b922f44cdd572c2779170e13da1c665ac0
- MD5 b8166c061eb9672908154c37ae4729d8
- SHA1 d41dde27b76023d400af0960bd32879aff127112
- SHA512 652d0fed9fd0f24b22a08a34896919f6abb1eacf2eea5b52b3e365de1568d9dc6d7ab4cadc18bc3eed6d0a6b706d10a22e6c43f7b455c7b1cd484b7e344184a8
- SSDEEP 384:KcfGhJn7gnvumIzM9D5Lfr3ny0c5XQ3c0x59T41eDeyZc2jL4m3FvH/j:FG5gyM55T20c5yc0l41eDeM8I
- TLSH
  T125C26D46EED800DAE566C138C5131B1BE2F97021B33157CF0BA516A8DE76AD3B736782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  IDA Pro 7.7/plugins/tds64.dll
- Size 26KB
- SHA256 106761fde43c21566a17dd65be74db7b3ef224638ea6d6bf89dcf36c87861c5a
- MD5 4a39f7594f540373fe53c1205ca3b56b
- SHA1 dd806c62b7c5f56dd68f40882baabee446cbec49
- SHA512 1aa6cda0d79d6a7157c9167651c504c58cd7e571b2bfcd8b272f83807b07b8b7a0d7df9baba2e12dad924b5cd315dcf32e166b035c1b7b2abdbad83c1d4eceb9
- SSDEEP 384:eLcUpiL4ga8gpJ9nswbunbl8//DePDfpUG+LqvKLNQccEOleDesJCUOP/3m3FRHR:9oiL4g0V2eGDyG+Lbm7E8eDes5OPP1a
- TLSH
  T13AC26C46EED404AAD577C138CA025B16E2F67030B33483DF476115A5DEB7AD3B63AB82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  IDA Pro 7.7/plugins/uiswitch.dll
- Size 17KB
- SHA256 cf55cc4168297001ce095ab40b661f67044543e458cc579b40a74084f83ef8ba
- MD5 7516f04fe63cce986d5e43b52a385ecb
- SHA1 4c18dedfef93ffaea1388ef679f01eb616a921c8
- SHA512 458e068ef05fd107b96fec6a9bca116ea48360e67d45414f400dc6f709e6fd4c91efc82f9006b4fbf03fc0b990627ce96c0de3710551354da3e403cedd588548
- SSDEEP 384:9zzYIcV962qCzmfT/91miV2tV/tigwBeOsQwb6ckDVDkt:9aq21zIbmO2r8dBeOslGDGt
- TLSH
  T10882392EBD5674A2E428C03D80424526D97A74E9032A53EF335D466C0B3AED47B7EFD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  IDA Pro 7.7/plugins/uiswitch64.dll
- Size 17KB
- SHA256 24121eb50e5d1dae708d40d5aa2299d239273953ca887de0d89e11d400a59e1c
- MD5 d181205324e8ab7cb9cc2ee3d3d39b6d
- SHA1 b4bfc4fb723a6fee86fbe0e64b8383767fb6b6d5
- SHA512 2fe27f2f2307268bc5efd4c335fa5365180ba3973cadb4f855e67844d8defc33801118d39922d6f5c0e28a22577a3f90a04c33f90b096acf7673559c16740a67
- SSDEEP 384:9amteAyILu5MxrNuP7W2tV/tigwBeOsRAbsby9kDVlk:9sAruq2r8dBeOsOXODM
- TLSH
  T18C825A27BDA634B6E424C07885834916E47675E9072A13FF334D06580B7AED07BBEF92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32