d19ba6934984f53fbeb7d9a076b3fbc89b84b313021e8d3550396b5e0c005d84

Sharing

Copy URL Twitter E-mail

General

Target
zeninfork.zip
Size 71.6MB
Sample260819-k9ghra1elf
SHA256 d19ba6934984f53fbeb7d9a076b3fbc89b84b313021e8d3550396b5e0c005d84
MD5 bb2d597a84b60359d707ccf110787ce8
SHA1 e02b4a9236dc28cf2e1641dfd37771ab4de95e22
SHA512 ff810faeba70876aa4c0f058a714aedf48cf92636f05e797eb71cb4cb9d4b8831b3f91064f14de79287527cebd374e2e9d231cd000c17ce054e686e877cb9a55
SSDEEP 1572864:qycPQkWrn1/Y67EDeJlQbfF9LT1Cvdr1187MJn1FmdXWfDomyh:qrQBpT7bJsWix
TLSH
T1AAF73335CC1987B6F83B70B5853E5310C7FA65A1CB9089B94958EBF078DBBCB1929384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  zeninfork/build/CMakeFiles/4.0.0/CMakeDetermineCompilerABI_CXX.bin
- Size 52KB
- SHA256 980e9b83f53a88e7d36e99801985cdf4f417206dc62f6b6a550d93c5dda1c2ea
- MD5 e39207f4870e9cf53e4c0cba5a476d30
- SHA1 e1d7dc6cc5d1de13b335295d609c72e4519e81e0
- SHA512 95f79968509ee9947afa14f6d65803aace01ce4c25e04fa247d9e9c8fbd41e3953c08799f26a2bb9af9496313fa39a52f5146075c30289baed7fdb80ab61df7c
- SSDEEP 384:ml+dmWqeTiyh63+GIvH4BCfcU3wNM7Nieyu7y/uIoXQfBX9/zZP89Z7L:9AyUMvYdeyyEomBZzZP89
- TLSH
  T18E33081FA79A20F7D577C13D9AE22329B5A1B17403321BCB861109192F71BEC783E789
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  zeninfork/build/CMakeFiles/4.0.0/CompilerIdCXX/CMakeCXXCompilerId.cpp
- Size 28KB
- SHA256 d244ecbd7c2d941e9b103fae669d3f79e117ae5c24852bbf435af9f0bdcaf5bb
- MD5 9052acf207c4aa9760e610d7ea2fdedb
- SHA1 14d63ffe3789016362c98a97d635f42d13bcd583
- SHA512 103c493e9afd6397b3f2540cc9b9594d35c7d2c140145c102a8770e19c82d02da1516598a7dfc1c5fe9c8331935f7866dbb021cb924b53c5d46869d85b482ff9
- SSDEEP 768:zTdzNkx/fkVD4Y2FqcEks3QuwWfBMKK/iL26CTxRc:zBNs/fkT2FqcEjQeBMKKayJRc
- TLSH
  T1A6D216131FE35094803B54A1111EA667B208D9BF236354E5F19DBE5C1F68E09A3FE6CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  zeninfork/build/CMakeFiles/4.0.0/CompilerIdCXX/CompilerIdCXX.exe
- Size 15KB
- SHA256 05216cd531efd7a47a9a5c80a899b1a277b32b43cd694ef5fad58f5d8b6f89c3
- MD5 3a5aaa4d461e7b6fadabf5b79e388773
- SHA1 6b248508a93741849fafa4411a9060ec419d0230
- SHA512 df16eacf577f4f50a89e41431db9b4300995c4cadfbb5090b0c3152861e5a61e6fa5eb453d22348ea3614711dc069dabc60655b5b7313cc21315da3abfef59ff
- SSDEEP 192:cML18lqeTqbyAY/Mwa8ETxmVswOb9ZEfd4pGb02rgtJe9l2vnc7l5:cMLCqeTq1Y3arNmVswWEfd4pGQJs9
- TLSH
  T1C162D64FA7CA54E6D839823984B37229B5F2B274033247CB5B6091160FA1BD8BC7E7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  zeninfork/build/Release/zenin_ui.exe
- Size 533KB
- SHA256 3ad0efe58def25978f1919ec94cefb58aa974ab9292be7695debf78e5fbeaffe
- MD5 b7f7f192f84ba1fc2afb7f2be4a4d8bf
- SHA1 9e4456db6bd7c313eaa7508f43cda48b8ed4f251
- SHA512 81250f685a1497b7a281e579e6e59af0f4374deb7709f4926cc7654a63f54ea19bb6a323a7a2bcfcfd40d4bf081dc84d0fc0352b8d0b276012239a905aa64fc3
- SSDEEP 12288:tt4UogZ36w/KgOfbruQqTv0k7RHDA5iCwnXuT:v4U536w/MSRj4iPnXuT
- TLSH
  T172C49E91F1B957F8D07F9134A58AA61FF9353488072499CB63E409982BF37E466FB302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  zeninfork/build/ZERO_CHECK.vcxproj
- Size 38KB
- SHA256 e75cf7193b9bf5e0c7418120cdd46ae95820c66f6f18a46e73e2c0d08b32ed5f
- MD5 1df2b1344cdc50809bff65a3475d0d36
- SHA1 751dff08d8cb86bcf35ed832b10b95c788db062a
- SHA512 117d31a5a761ce78c87edee823553fee47d77e859caa039cc16c1d929a8f4166fc7e2e69aa7b0d947635dfe48a03c2612573e88a175e6e6a177c594aaf399038
- SSDEEP 384:VkNlbbwywFw3w66xv4CSvtF126xv4CSvtF186xv4CSvtF1K6xv4CSvtF1r:VkNlbbwywFw3wotFWtFYtF6tFV
- TLSH
  T11A03DC54BB5BCFEB31B12A45B3D27E7557A1CA063D1850DA2B8C724BA38B970442F7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  zeninfork/build/x64/Release/ALL_BUILD/ALL_BUILD.tlog/CustomBuild.command.1.tlog
- Size 353B
- SHA256 819a69717e246d7707748adb26a642ef2d81d37e07fc8f4085d962ef68718897
- MD5 7cc2101e01d15913ea1c4a2f868581bd
- SHA1 48d1f6c5d3118114fa4740fca6cd9f2f6d2bb97b
- SHA512 5e65e930d79bc1fc0ef7715039f5a8a04d527d117a0790454eea3790913a06c8d84fb01d5fad61af7c108bbc06b6d289de8634b0216d218abeb50881943b1321
- TLSH
  T1A0E06872494797CF2402B808822E0103F5B4A6C20E1E92DC3360C289E408908ADA7CD3
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  zeninfork/build/x64/Release/ZERO_CHECK/ZERO_CHECK.tlog/CustomBuild.command.1.tlog
- Size 445B
- SHA256 6f0e10b695577057a8a4d7e3577de4b20cfacf09d640136927099d1ca52b6359
- MD5 78ef6cac65bd410fafa61cea1b6f1e7a
- SHA1 df9de41f9291db7ec35da388fa161e565345cbe5
- SHA512 b44d005f6cefa827302e0868cb0c96fb6c26d3d78ac3a2eebc55889959b22e071f8856f90c01da8cb1343ecda67cd5183b83bcb62b81ccd5be36d98807905672
- TLSH
  T16AF05C714D4287DFA403F448D22E1113F6F5D5C30A1D92EC67A04386A485508BCA7CC3
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  zeninfork/build/zenin_ui.dir/Release/zenin_ui.tlog/CustomBuild.command.1.tlog
- Size 353B
- SHA256 819a69717e246d7707748adb26a642ef2d81d37e07fc8f4085d962ef68718897
- MD5 7cc2101e01d15913ea1c4a2f868581bd
- SHA1 48d1f6c5d3118114fa4740fca6cd9f2f6d2bb97b
- SHA512 5e65e930d79bc1fc0ef7715039f5a8a04d527d117a0790454eea3790913a06c8d84fb01d5fad61af7c108bbc06b6d289de8634b0216d218abeb50881943b1321
- TLSH
  T1A0E06872494797CF2402B808822E0103F5B4A6C20E1E92DC3360C289E408908ADA7CD3
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  zeninfork/build/zenin_ui.vcxproj
- Size 51KB
- SHA256 988c26e83640cc2e80f3c3f5fb7d8543cfc41cba886d4b2f9f84a00d8f21c1a8
- MD5 f5d3565e3afae8b624b7b553e43c2b12
- SHA1 e008d3956fe01077914959b097e27b7a51f8c2dd
- SHA512 49f9f4ecffa573fa2d032afe8294b99241ab8c3e1bb165ed6f1cfb3fe90fc2f9542e1f5bb3e21e086dca162504b5f9ee28c98fc2e45d3c276ecff0b3a8561f49
- SSDEEP 1536:bqbha4ata7wbabata7wnauata7wUaNata7wsONwoko:2bDwywrwLw9
- TLSH
  T1C5336115BA5ACEEB30B22A41B3D27E759761CA063D0950D93B8C734BA79B930543B7F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  zeninfork/third_party/imgui/.git/hooks/applypatch-msg.sample
- Size 478B
- SHA256 0223497a0b8b033aa58a3a521b8629869386cf7ab0e2f101963d328aa62193f7
- MD5 ce562e08d8098926a3862fc6e7905199
- SHA1 4de88eb95a5e93fd27e78b5fb3b5231a8d8917dd
- SHA512 536cce804d84e25813993efdd240537b52d00ce9cdcecf1982f85096d56a521290104c825c00b370b2752201952a9616a3f4e28c5d27a5b4e4842101a2ff9bee
- TLSH
  T125F02781599AB7374046051BEB2CF6AD9880D8D893926F10A0EC4938B67F5E862FAF51
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  zeninfork/third_party/imgui/.git/hooks/commit-msg.sample
- Size 896B
- SHA256 1f74d5e9292979b573ebd59741d46cb93ff391acdd083d340b94370753d92437
- MD5 579a3c1e12a1e74a98169175fb913012
- SHA1 ee1ed5aad98a435f2020b6de35c173b75d9affac
- SHA512 d6bb7fa747f4625adf1877f546565cbe812ca7dd4168f7e9068e6732555d8737eba549546cf5946649e3f38de82d173aaf9c160a4c9f9445655258b4c5f955eb
- TLSH
  T1C81127DE95656BB6480701011E1CB3F96D40D63C42C5EE10E0CE983EFB1D85602B9FDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  zeninfork/third_party/imgui/.git/hooks/fsmonitor-watchman.sample
- Size 4KB
- SHA256 e0549964e93897b519bd8e333c037e51fff0f88ba13e086a331592bf801fa1d0
- MD5 a0b2633a2c8e97501610bd3f73da66fc
- SHA1 0ec0ec9ac11111433d17ea79e0ae8cec650dcfa4
- SHA512 5168643c1768ec83554a9066754507a781b6d14251a46a469222d462efc6ca87a72c90679154e8a723349c91e7772b32ac9b08dfe313cded0ee0a6f17885079e
- SSDEEP 96:GFCscBOvOFXDgRvi/3UCwN4ZlkRo/j5SpoNOBoi+geBIzCa:GFCsEOmWRa8CwN4ZqRo7geEk3IzCa
- TLSH
  T122A1A6B0D38AD363927A74C9EE4845B43AFF40B023705C68693C463167A8536D3B9CF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  zeninfork/third_party/imgui/.git/hooks/post-update.sample
- Size 189B
- SHA256 81765af2daef323061dcbc5e61fc16481cb74b3bac9ad8a174b186523586f6c5
- MD5 2b7ea5cee3c49ff53d41e00785eb974c
- SHA1 b614c2f63da7dca9f1db2e7ade61ef30448fc96c
- SHA512 473ad124642571656276bf83b9ff63ab1804d3c23a5bdae52391c6f70a894849ac60c10c9d31deff3938922ce83b68b1e60c11592bbf7ea503f4acd39968cefa
- TLSH
  T119C0C0C89D41F4105091114A003D44BC4E0B80416106083070744B1FE28C45F3F4FDB8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32