94e092b96e1673bb1efe3ec6bbfe810b02b7ca90ee3fa4df56dce4cc685874bb

Sharing

Copy URL Twitter E-mail

General

Target
new_Hellogpt_take119_Setup_win.exe
Size 141.8MB
Sample260816-tha2bsdr7v
SHA256 94e092b96e1673bb1efe3ec6bbfe810b02b7ca90ee3fa4df56dce4cc685874bb
MD5 256083ae516faed43bd09a17e78a314f
SHA1 ebbda5e131a651535ed97959c10dc51177df40b3
SHA512 a240e64184b15b9f6f21d52daf49fb64dab7df519ae1327d29b1b404df5c4acd1c246428e20c7097e207c6c38f555b05efbec0de2e86af2b85627f56297e2022
SSDEEP 3145728:LZthIyPhiAkvn6v3gk4qcHp5TC0nKtxSDWJU3EDfHhvR9Xrg6W:1I1FvqCqcHx3Cq4fHh7XM1
TLSH
T14D6833A284A18D4ACDEA793195A6F9B991937D2BC7C7CB03FDE57D8B373B9401E04102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  new_Hellogpt_take119_Setup_win.exe
- Size 141.8MB
- SHA256 94e092b96e1673bb1efe3ec6bbfe810b02b7ca90ee3fa4df56dce4cc685874bb
- MD5 256083ae516faed43bd09a17e78a314f
- SHA1 ebbda5e131a651535ed97959c10dc51177df40b3
- SHA512 a240e64184b15b9f6f21d52daf49fb64dab7df519ae1327d29b1b404df5c4acd1c246428e20c7097e207c6c38f555b05efbec0de2e86af2b85627f56297e2022
- SSDEEP 3145728:LZthIyPhiAkvn6v3gk4qcHp5TC0nKtxSDWJU3EDfHhvR9Xrg6W:1I1FvqCqcHx3Cq4fHh7XM1
- TLSH
  T14D6833A284A18D4ACDEA793195A6F9B991937D2BC7C7CB03FDE57D8B373B9401E04102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 31944b93e44301974d9c6f810d2da792e34a53dcacd619a08cb0385ac59e513d
- MD5 5f35212d7e90ee622b10be39b09bd270
- SHA1 c4bc9593902adf6daaef37e456dc6100d50d0925
- SHA512 7514810367f56d994c6d5703b56ac16124fab5dfdcfbe337d4413274c1ff9037a2ee623e49ab2fb6227412ab29fcc49a3ada1391910d44c2b5de0adeb3e7c2f0
- SSDEEP 192:E4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjaK72dwF7dBOne:tn3T5KdHCMRD/R1cOnrja+BO
- TLSH
  T187622B55738488F3DBE2003E785237079B995565B4929ED2CA275FC6687B08D7EB2303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- TLSH
  T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
- MD5 09c2e27c626d6f33018b8a34d3d98cb6
- SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
- SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
- SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
- TLSH
  T136D1D63B6AD029F3D0498930286779368BF988360F614210EFAB19E535E5DEBDA20647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8