64430de7911a93cfdd89bc538e24f9fa1ff57d6faf95d11e6c860c62209cc489

Sharing

Copy URL Twitter E-mail

General

Target
enable-unsigned-firefox-addons.zip
Size 39KB
Sample260818-twt2csxsfx
SHA256 64430de7911a93cfdd89bc538e24f9fa1ff57d6faf95d11e6c860c62209cc489
MD5 e8e60c95c5e22489a6df58a4683f2248
SHA1 17e85e46b2be1db30420e36558fd3f78bde150c3
SHA512 d79859b3e3721bcfef776a5bfab3272f60678e4a707263a3dcbd1889e77b41d5bffdb019f760f949f7168e3b7da2d2cedc0492766d7aca1ac2b08e608c4e42e9
SSDEEP 768:RWbT1BBfrenJlMKmKOJCgqCuHUiNXpR3Xua/Y1nFxQiiACL4PmQ6p3bW:sT5renNmKCTqx7R3+awZvQXJMPmFNS
TLSH
T1270302B1E7806564F0A2F4B640BDCC37D8AE1AA044A05BF2745939F91B6F3944BCB94F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Targets

- Target
  START-WINDOWS.cmd
- Size 9KB
- SHA256 0951aa0c4fdf7361a3eec2d7a06bf7e3fc044ce7be09cd0e6a7dd85eb179eff0
- MD5 a973c52fa679047733bb459dead8491a
- SHA1 0f912055d6fe5864d62504135cae83e29e16e901
- SHA512 1462fc1225fafe9ebc0b44d58892eed8766acc29fed2c5366e9ef49a6d11ef6a7de2a8338727d0427dc0d93e433f2ece031069d11f06492c94d964727bb3b03d
- SSDEEP 192:4z06PKa2A5O9FHWM2OeikogcfCXTmidSaSLXBXPdld3dDd98d7faCVScYc2YFzjl:4o6PHtpw79hNxm7yY/s3F+7
- TLSH
  T1062220B3349916A334B6B925A6BE0182F78CC29713351CC4B062A17D721EB846FFC2D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  clear-startup-cache.cmd
- Size 5KB
- SHA256 17b4107ab27806a98bd812db1f460654e886f11ac5fd09815af1ac4b93b80029
- MD5 589aa3ede7042039ab1236199d18b159
- SHA1 26b2c38c6306fbe41447e5a9aa9053a20b925c27
- SHA512 f5e4816aaa79e46755347e5b4fb4cffc0218a741233722e19d7136e800551a74ed2eb5b916bfbd8593f31ddc412d01c7ac63ee2c642e2d3a3e8f51a6856080bd
- SSDEEP 96:Cb4HWjXUB9UDuwHw98WT3+xYySK2YK2p30uyYsoMrz1D4oYS7y1yExx:CPrUrnkMjESK2YK2p30ksoMrz1EoY4Qh
- TLSH
  T13CB1E85B294907AF157D4A6035FC46E6F28E80B72212D1E6703AD02EB79E7432DF97C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  clear-startup-cache.sh
- Size 9KB
- SHA256 e0ea304ea637f7bbee2a9cd6467afc178b7e8eabfe1199c62f0d158f861958f4
- MD5 b44b7f95671223dd5c6829e479dc5000
- SHA1 42125b4f87f91394155594b0a02e09ae6461325a
- SHA512 9efeb9d79170b02a6a82b54ced628003dacdfad24b3505be485126f0b11a806d70422d785def3ef39169760eef107c05b29e8bf118453d179d603483605ef493
- SSDEEP 192:qneKpK3p23w9lGqGPPJPfHK1X8C5WtdU0Y8BgGYnFOOO4lJjgkE:qneOgpMwvGqGPPJPfq1MC52U0Y8BnYFo
- TLSH
  T18E220103B9CE09F11A49FEA5BDC551422184402B595C3C15FAACA7183F2579CA3FABFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  patch-firefox.cmd
- Size 5KB
- SHA256 db39f3b733347c322fa9c7d98e39fcd80e958cc3df4d207b447397ae62e10145
- MD5 ced48e5b65af8029a1e790d70c205eb7
- SHA1 36bc8a7d44fadb89f4916e8e233d706ecc274885
- SHA512 0821b77b39a836f522d8a2a380b25aceac86b83ad1414449f7412cc56d7f1ab4a279fa15be9f766fc109f8260b5083e246f36553f26db0000f4043cf63243dad
- SSDEEP 96:Cb4HWjXUB9UDuwHw98gT5rNSK2YK2p30uyYsoMrz1D4oYS7y1yExx:CPrUrnkMpSK2YK2p30ksoMrz1EoY4Qh
- TLSH
  T112B1F95A294907AF257D465036BC06E6F28E80A72203D1D6303AC02EB79E7433DFD7D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  patch-firefox.sh
- Size 25KB
- SHA256 5e1304dd9cf6c53bdaa0b03155883cc0bd9908c5abfb7f6d56ad1e1d7ea1a56a
- MD5 2b70f723087633459a8f8af74cff6b5d
- SHA1 f329c700aac09a46d20b1c9df9cbfe3132a2d3ac
- SHA512 4a826de07fbd5096d69620f5de880b5f943f4bcf5b474cccf73288919b681a4d3ef29e26de1e5f1d4558ca2b711f6f915506340ca3a759bb24159da525092618
- SSDEEP 384:USly9AKPyOeV2CxI1t4fftSXa+cgHaUz+qciMRHA+BxpI+yIhdAL:USlyCz21t4fft+cLU68OJE
- TLSH
  T14AC292327AE609F02459C1AD5ACAC0422A56961B495D7DA4FA3CAF043F7039DF2F93DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  scripts\append-log.ps1
- Size 1KB
- SHA256 fe875397b91aaf18873eb7085c68e8e36849d0ccfcd983e935b0489ee7b36f6a
- MD5 e302a7101c923291f823d1570ffda1cd
- SHA1 e675f53b724408117c3b163f1cca556d40394e94
- SHA512 56426ca69af110d88efd5375e663d0c3d22dafc1467d403d1fa46a16d91a79c647e604bb4bf4bc27005f85f1d32ad55fcc815c60f4843ae5797552a8cae8c77c
- TLSH
  T10D21AF7831C5A088C1B3E2A168C1A59DE736807B160C646478DCC3885FF970083ECF8E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  scripts\read-choice.ps1
- Size 864B
- SHA256 54a2e8fffe51b870231794661f0acd07d7584e3c0efe517adc3f2b2e1e168f09
- MD5 0961f70763edc9ae07858626f1708754
- SHA1 cc55dfae7b371030625d58f9f08e5c24b507a9f8
- SHA512 220485bd5c10e5852fd0794eb5c2135037bf777dec517877e47a632c1442c31b864c5bfed87996b361eb5ad19e6518c8c78ff0e6b054ee4cc34584cd1a918faf
- TLSH
  T1AF118E132CC389B8843363A15D8304EAE60855271C2A2C787ADEC2585F7CD206590BDD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  set-unsigned-addon-pref.cmd
- Size 5KB
- SHA256 71511429382e49b4c08389d4161df3deb6e697679b31cb47cb87acdf9a5cf539
- MD5 0f089c8a9990aa6e550562d7f3243f76
- SHA1 4a7488d045421a0938e411db5ccbfb07bc63bef5
- SHA512 5a05b0b6694b1e9b5190fbc19fb56990381e786a4518317eda246f25243cc10a8883d052b1a2b387c95fe05aff306352094db82042490c1501dd1d2f9719dc43
- SSDEEP 96:Cb4HWjXUB9UDuwHw91DPQYSK2YK2p30uyYsoMrz1D4oYS7y1yExx:CPrUrnkMlSK2YK2p30ksoMrz1EoY4Qh
- TLSH
  T154B1D75B294907AF107E4A6035B806E6F64E90A73212D1E6303AD02E779F7422DF97D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral8
- Target
  set-unsigned-addon-pref.sh
- Size 15KB
- SHA256 1a61bada6c5bcc60f3cd2e8b9edccb84b2cf8463c34124d5c8ecc403271120d2
- MD5 59cdb35b241816e1929f292c1f324e4a
- SHA1 305ab9b28d6f096b5671e0fdc0db2c6cd002dec4
- SHA512 7750e708bacb73a4a08808b3c25b8075ac61b0950babc5019c0869d385a21bb9ac09b487d6fa5bbde7c3bd75cabe0806a8cd4cc7d62e91447142abf7bfb39ac3
- SSDEEP 384:kiRgNpMwvmqyPPJ6b8WmKsjQF5NFbDcixOe73lXhmUuc+vq1:kzNpMqmqynJ6b8WmKsj+DFbDciUeLlXH
- TLSH
  T15862FF13B8CD0AF61509FEA97DC254823148502B2C692C15B5ACAA1C3F3679C67F5BEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  unpatch-firefox.cmd
- Size 5KB
- SHA256 720a08a0fc97bd03663be95dbb598fe052d35c7e6b76210e59b97c8e27c8b9af
- MD5 57854310fe0798f2e4c93cf9aa7d5716
- SHA1 095bf7823a5616df5252070b1f864d3393f843ff
- SHA512 626713694facef7bdf13780ac83cf840e53a0b43ccdbdc79b4a8e3ce2a92aabc5ee46a548a42b1f0395822c169244ed3ace75f91595809cdf3d7444b3ee339b6
- SSDEEP 96:Cb4HWjXUB9UDuwHw98wrkT5rNSK2YK2p30uyYsoMrz1D4oYS7y1yExx:CPrUrnkMvWSK2YK2p30ksoMrz1EoY4Qh
- TLSH
  T177B1D75A294907AF157E465036BC06E6F28E80F72206D5D6703AC02EB79EB433DF97D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  unpatch-firefox.sh
- Size 19KB
- SHA256 a82f990f7896e01506e74cb20f2d9e178eda6065dbae196942b8735ae7eecd0b
- MD5 fd3b2d82e3ebfea298382ab298f82451
- SHA1 d378c5951e58a2283d05a4ffb597f641a69d5a71
- SHA512 d8f783d5f3ecb678bf00cd781c279aec40bea1a1d8cd864921cb76a4b54434c9d4d5e0b5cfea8c6a23f1983538adb641fc3e987961ffd74e4702f2eae873c1b8
- SSDEEP 384:Uxly9AKPyOeV2CxIJ/EtSD+cgHaUJ+BxtIYyRLPdB6aJ:UxlyCz2J/EM+cLU3LnDJ
- TLSH
  T1F09293227AE609F0245DD1AE69C6C0826A45D61B099C3D60FA3CAE147F7439CF2F93DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11