ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d

Sharing

Copy URL Twitter E-mail

General

Target
Oracle_VirtualBox_Extension_Pack-7.2.14.vbox-extpack
Size 19.1MB
Sample260818-prvpwasdnb
SHA256 ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d
MD5 28b8819ead3327b94733ec78063830e8
SHA1 4e552fd72fa6786a3d208a2c7695a5ede5f11486
SHA512 5f8aea7cda208681437ece898ec1784ab222895660e0366f9ec7fba39fbc2060350282a520302d89953f74bcf07600c1b80cc6633dcc7b5f85b72e9e050fe631
SSDEEP 393216:WSEo+vjoPBYoTenfL5cwijy6k3Vq8z20lcx9UiMhsRylarwDfE:dAjeYoTenTBijrk31z2ScARWYSaE
TLSH
T16217332C8EA832B19CB42BB5D68BFA51344FFCE7857445D12E01A8D4C248DDA745CEAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Targets

- Target
  Oracle_VirtualBox_Extension_Pack-7.2.14.vbox-extpack
- Size 19.1MB
- SHA256 ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d
- MD5 28b8819ead3327b94733ec78063830e8
- SHA1 4e552fd72fa6786a3d208a2c7695a5ede5f11486
- SHA512 5f8aea7cda208681437ece898ec1784ab222895660e0366f9ec7fba39fbc2060350282a520302d89953f74bcf07600c1b80cc6633dcc7b5f85b72e9e050fe631
- SSDEEP 393216:WSEo+vjoPBYoTenfL5cwijy6k3Vq8z20lcx9UiMhsRylarwDfE:dAjeYoTenTBijrk31z2ScARWYSaE
- TLSH
  T16217332C8EA832B19CB42BB5D68BFA51344FFCE7857445D12E01A8D4C248DDA745CEAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Oracle_VirtualBox_Extension_Pack-7.2.14.vbox-extpack
- Size 82.5MB
- SHA256 c7cf0a77f303eb725d6d8f8abce059f5cd6a33bf253513350e0ad7fb4a34d21d
- MD5 04286348bd32c733ddbca146ba22c353
- SHA1 3d7d182e7865665abf70b7c839f4124c919f15ef
- SHA512 2ef303a895ffba0f67476b397d2e489c94bb658cfd3354a312667d6ca87e8a0c1695c6b301081f67ff13d5e06360c4640386950228c5421483a0d5246210e83c
- SSDEEP 786432:+TMZjGAGG2ncnA0DymGYK/URNcic3cEahX/7r:6tD/UR3c3cEah
- TLSH
  T1AC188E3BEF2C8C1EC589867E77AB8B712B30F8510572573706D9E2359C962874F0DA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ExtPack-license.html
- Size 10KB
- SHA256 d323942ce5115ec94f0c400818935883865212a7885696d010d00ca51eca5d41
- MD5 e5c315881ceb72a6188cdbda4517ec1e
- SHA1 ff3a623e1dcfad6f03e4af51718a2af3e29aa4ad
- SHA512 6fc81ee5121db08d0ba4950009bab91a8426d022fdf2e390a13d9332f2d5781e3bc52ece47338e538a709cf8843fd1826f9b6540180bbfae3074fc1a3f6c3ace
- SSDEEP 192:qLayy8KgvxJI3XThbH+cDlprVjcgd3404ErXC6xoe0yDGpRpP7ixYU:Caz8KgMHTbprVj40rk0DGBGH
- TLSH
  T17D22D9E7B34827A11787037A36478FD5F369883D76BF451020A5C11A2762D7883BF6AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ExtPack-license.rtf
- Size 19KB
- SHA256 00e1e8ef63cdd94af6a8971961131a59287e1feddc9a9fb251ac1d06940a49cb
- MD5 307cd6f1206ca2a3ef0b053a67e460a9
- SHA1 d58658149451b56f0b79068d387b776b5405ae8d
- SHA512 0a6e1211ecf915c219a4efdc53558c812573d713c4fa1e81d917d3bdcf5278bd288c46b2ead30c1df115ff7bbbb6f16f15b333979487d35b21180c3566b2210c
- SSDEEP 192:wJrjv1M0L/yjpKWDJIT0TyPH7cDcpr5wcgd3+EoXG6xoB0yDGpRpP7irYV:whh/wpK3ITspr5qOoDDGBG4
- TLSH
  T1CA92E9B758434AE425C50BDA0E92CCC8AF7AC82C353ED1AE576580C8366FE7847366D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  win.amd64/VBoxExtPackPuel.inf
- Size 1KB
- SHA256 f4704086ce832400e5fd468a9645b07a116c5bc89de32dedbf359ca69db85144
- MD5 d43f2143cd4aee466bf8926cb07b7882
- SHA1 10819b682753dd157e45b744b7283ada92a2693d
- SHA512 37e741b6f16e4f105ea3e158f47be7698d72d2cf60ac0e60744f1cb1845febb41cecf867a296981c5b3da74dd905f422e090fcbdd31e9d28b4212d3267fac9e7
- TLSH
  T1D34133494683E723163146B97707CFCFE35D4202A9DA0402F66AC97BCD0DC1D1179CB4
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  win.amd64/VBoxPuelMain.dll
- Size 1.3MB
- SHA256 6aaf0960234bd3f9d4c8684f8aa67795b38ab4c71d1d3b2aa6956ea05350d0c4
- MD5 8e82884d5af94fe7750c766852b4322b
- SHA1 fc4d578d167d2856219b1867f4da10cd420367d5
- SHA512 91ae799da81553e56e2e1327041aefdd7af2135fa1ea8e8404b73bfbde824fb28c6f9d6244b5e69bd467c2b03e88a1c65a0e90c533943a42f56a3ee60cc26245
- SSDEEP 12288:7XAQTmEwFRZiLadFg6zqJKB2kopedVdtPn0Nc/XDKmC1X+Tpcp6jj1bAwDRvoTMm:bAK7n1JK5pv06/XDKmC1X+Ts695NYN6y
- TLSH
  T108554A4B23AC4065D47AE13DE2538B1BDBB3301147A2E3DF026587AE5F237D29A79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  win.amd64/VBoxPuelMainVM.dll
- Size 23KB
- SHA256 3a5db8aa2bc086abee32fb39d93647f2d2956005e42d54418f47751db1dd320b
- MD5 d9e89ca5a16f86a1f60a66968250d5c4
- SHA1 4968479dabf6b214f27c757e94c762d5ad6e7aee
- SHA512 1ff68589a111aa8be781e9b1a0a88bedcd741296c1cd3d3ce2813dea942f640def11f01568e6371c1822a2a2cdf9dccc685fde00806a53675ce5c13beca7087d
- SSDEEP 384:9XmPsg9EG0PyjAMwSg6GuIYiq1GVMc7SeMy8RbmL4nNyPYPl:BmyDyiSJGjYi1Vz5M5ALK9
- TLSH
  T1FFB27D57AA944C54DC674970E8A15B17E976BA101FA2D3CF2324C01D0FA13873BBE6EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  win.amd64/vboxextpackpuel.cat
- Size 11KB
- SHA256 5878e9a08b3a801518c54ae911966e4cfd6a9885518513e60ef7cc6219f4a78c
- MD5 2e91c37e1d5ea24ba89b7e070f2d1524
- SHA1 3374437ac254af1df73eddf5940078fd46d762b9
- SHA512 6bafbae4898df82730101dd5a653a8923dbe6169932ad296345f841330b44f00affc2045f13dafd88dc327eacef0ca756d9d62d35f0698df9f63abac16bc329f
- SSDEEP 192:6LVyT+/OXJEwlLdthYCV/v8aVueTXflYBQXBnX01k9z3A/JwFbsXevH:HT+/ORdth3V/v8acUthXBnR9zowFou/
- TLSH
  T12A322AE645684086FE9BAC6087ECF9977C3D37CB2D50486512EAE75A09933C8EB1413E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral15 behavioral16
- Target
  win.arm64/VBoxPuelMain.dll
- Size 1.6MB
- SHA256 a4ce9fdc94058e613f3150dafeefde24eca3860cc837682fba903475c8330599
- MD5 9d2f255668d024560212ee22138b4168
- SHA1 c02fcb737c2b0f5d440a75e2c89bfc3884f5866a
- SHA512 53735186d158d3f82812802f8b7eeeaa3b327af419c7ea32713097c1a1f63e6b72c4f8f33d284f63915610f1f8e5d379de499abccbad0d3c3d32a9004c93479a
- SSDEEP 12288:Nqhcqey/L5Oj03DbeKd4OSBa0ipQ5gISG05HIuUahQrD5N9PZMNL/u+0cFT:Aey/F4o3rSuFifCL5
- TLSH
  T1F3751C6B8B4D5436D1CAD2F8FF3F57683167A060A6378283B97E064DFCC7AC64586062
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  win.arm64/VBoxPuelMainVM.dll
- Size 22KB
- SHA256 ebc3d06e4fa10a67f705d9392d327c5dce12b5cab4126c9adb1056b796bc9ab0
- MD5 5a5e51604bc589665c813e8c9e2c6aad
- SHA1 f52cce8640055f300a03e13b72954637066a54ad
- SHA512 94a59b87bfb8fe5f08095ad104e95ffe6955cfaf524f47c8101d70995075e8dacef1a0d2fcd4c4ba140139e1ec147017812e859661736fb2ea7b0ee007f3fe85
- SSDEEP 384:VXfopQThHEt2B89D6GzIYiq1GVM6Yy8RbmL4nNy9Gs0y:5fOTwW4G8Yi1V9Y5ALoy
- TLSH
  T1CAA26CD24AE41C12D9D75F38E89599259937FBA44CA0C0C33316821BCF993C676BD1EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20