fc7585ba0e05869837dc14f5f25b7f61404c2c062fb0d09614320065d1e69055

Sharing

Copy URL Twitter E-mail

General

Target
Infected Company.zip
Size 692.9MB
Sample260819-sv7qdsdk9w
SHA256 fc7585ba0e05869837dc14f5f25b7f61404c2c062fb0d09614320065d1e69055
MD5 359c3e4f244037b64b55a0aea4ef001b
SHA1 93f93ac3f476be10396bc474637a66fcb58497f3
SHA512 60f07078c3fa0ed303942a71251fab92385c4065cdf6011d7dc8d1684aaf9041da110794abb14c7737e955f3c84bc47ca6a967717ee65cbb7faac17e21d2b800
SSDEEP 12582912:vfqAyADITTrkK0AL51vNotbhgWwlVlIzLPkih1mZ27pR42AiRFJLrdI9kvawhFMf:q+av0E1vNijG2j/RLXq90MkeX
TLSH
T1037933D8C0708D1EE93FB03555797906FAAD900852D64EF7B42A658B2D873F0A13CB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lethal Company/BepInEx/core/0Harmony.dll
- Size 200KB
- SHA256 1a21cc03424fc82c3dd1346905d16494536b9595ae4162228d99fb7c285c1031
- MD5 4705aa1c7a9795d2787722bc8c419ae8
- SHA1 aa1552cf0311f27ca02d34df0558a718d16fb660
- SHA512 2f2bb761d21d7288c2b373958a5eab228797d1a348147f8ff0ea603611c6d79e938a4ccf45f23ffc82500731a68bce8feafcd26a5264d79fd5d7435e6ba69b93
- SSDEEP 3072:VQsxAaNWfZKtIZWTr7MDiIVXQ9PsMIuvq14e3Lvvv9L2yZKDVkNCuwMTfyQV:GBa+UWi2XCH7s3RqyZ5NCuTeQ
- TLSH
  T124145B6267FD0616D7BF6BB4F47050040671FC17E9AAEB9D6C8464FA0C12780EA513BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Lethal Company/BepInEx/core/0Harmony20.dll
- Size 109KB
- SHA256 4b2fa06106044896e84d0a739a646333d98a34fa2c61c4d1eefc0bf96f964211
- MD5 b7116e8c024f51fe4bf5e425f0f495e3
- SHA1 f44249b08cb7825e170938a462d8d84128430365
- SHA512 ca702eb764aeacfa8891b9b8565332c11091430946e4ee3a0de92dc804a0b7faefc6164a415ab4fd65b763de702012d64203bc704b34bc9ef9a56114e6f16080
- SSDEEP 3072:Em7Ygs3s0FIIashShCJJwW1dEknAh1SvSE3zZ7:K5s0UsAQJzLEknAhE
- TLSH
  T1C7B33B6433BC4A63D6EE2B7CA87432505772F427E426FB4DDC48A6E91903BC116523BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Lethal Company/BepInEx/core/BepInEx.Harmony.dll
- Size 5KB
- SHA256 d0739c4a13f369094cb164c205ee4cca5392bdd7241b9f242ee13f0d4c0b1856
- MD5 dbda2a5dce19f10b1d28e4c9f6132f33
- SHA1 28cdb90e0ff909e125c97a1a16ab567387548395
- SHA512 515b30fa0479c8fdd9d5dfdbe7e4fd407ecf31d8885caf2a5d76ed02beafe2c4090aba94533cc844e7a04c552a642cd8e38623fdf91a8f7d3a0e06544ce10aa1
- SSDEEP 48:6Pw5Kgf/sY1jYyx1mG9dt7kjYgKYbLkark/G/wKCogkglufVkd6u9FFUpE6lPkgg:gQT1tx1mG9dt7kc/YbLkmA3okYKdWx
- TLSH
  T1F9C17422B3954337EE7B4731BCE7ABA00538B540596F7A6E2641F2056C666E40932B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Lethal Company/BepInEx/core/BepInEx.Preloader.dll
- Size 41KB
- SHA256 9678c74f47353a11afde4ab05887388bcbb69dffc4e28db93af1d1ce0b6ee635
- MD5 80bb4e3e3b0ab831bc70be1f77644c2b
- SHA1 b0050dc0d9ade04c090ba85c3d07e4202ad0f75a
- SHA512 82abebc21148c080458e023add328a7f967f69326fcf7938f2064aabca5532ef23c0d0ca5e4da99d8af6bded7d61a09035680c4da554d12f49b871c0c1a5a429
- SSDEEP 768:M7p/5FwgFSj36au2hvZvbh58LC6MMGjobOogub86ciQG0Ev:I/5FvFjau2hxTt6MoSTkQG0y
- TLSH
  T18213284137E98709E6FE6F357D7161500AB2BE47AE32E38E0D8564AF0D26B814D21B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Lethal Company/BepInEx/core/BepInEx.dll
- Size 122KB
- SHA256 475f794330ff7da4e70f892694498cf516d41eb9b064faa5797e09a1dd546b33
- MD5 2572c62735efb9061a097c371c926921
- SHA1 576426e0477f156712348bf66db1b540d7640f98
- SHA512 52017d3591e70bf913a2366bffe12a458deb213e24b3b2ad791cda1aff5e363f46a9dc39c983c6fffa3cfc567872fe98adc3a997a43e601566e2fb521834fefa
- SSDEEP 3072:Jn2byYskqTNZtvs2cvv54+DRwBQS/9VR1cmbXz:Jnpxlxov54+DRrvmbX
- TLSH
  T172C33B1673FC8A16D6FF1F79B8B040554B71FE07A822FBED0A4928ED0572741A921772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Lethal Company/BepInEx/core/HarmonyXInterop.dll
- Size 23KB
- SHA256 21222a7c25a2ddea5e53e9390a693c9b9858fc824b38f9cfe4a5049648c50b6d
- MD5 c969b761bc13e019523c01be8a04eed1
- SHA1 b986e0add3fdbc92ef9edb9b019d69043bd92cd1
- SHA512 343ae988a183cee5dbd5ae1d89d5b86f9e01433aa134fd567557fe132c1515860c9024ef33704bd8c56e79a2f2f2c3865ac5f1f9ea9418277157ac964e394124
- SSDEEP 384:znZ+u8rdpVwx6ycbCvVOnjhTyO5P2F2KqY3DB/ZU2CamZM2/DVejhUFffC/bUAGp:znfqVBlC8VyePqrU2nSHC/oAG2xj6
- TLSH
  T183B24B49B3FC8BA2C6BF5A7979E1321907B8D65BA442EF490CCD21DA4C43768172136B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Lethal Company/BepInEx/core/Mono.Cecil.Mdb.dll
- Size 42KB
- SHA256 5896d1898f616701fff18f3b2c71e6b844d2390ef9f41e1c5fccce8cb27c698e
- MD5 5a8b48fcf5e445095799e2c9149ff932
- SHA1 d4c514fbac7a30ddee7d0f597c3eae23a32ccedc
- SHA512 b99b02f296e5c817b8f984317e67c885099a3cc1198ee1808a0033b48ef60d27866719f0986d7f9a1ad547939bf6dc1886e858b9db7ba4375013b96db31957b6
- SSDEEP 768:XgjgMVEdS09ayuzjF/RwmanXdIiO1nqP+7y4CRIJZTMRTIzcRuYhpzt:XgUMn09ay6jF/WmcITIlITMRTtuYnt
- TLSH
  T12213F7112BFD8B1BC29D82FDA4E625061BB1912DA653E7878FC4F1E7BC13B8515021B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Lethal Company/BepInEx/core/Mono.Cecil.Pdb.dll
- Size 84KB
- SHA256 174db44a067f58561510af746f3caeb032037762c57a31c8d9ee32db25174984
- MD5 427e0464246b1e364c5a1a898db2ecf4
- SHA1 dc968ab6e3f9202b5550efb04c0e17c1df04d7d7
- SHA512 02ef1f9246e6117e6e958f019333720f07ff13feb5778b343e69d6e27e74e8ef1e6f122b486ce12b1e1eed546b17499ce906e8660babf281676bd8c6405f0dd6
- SSDEEP 1536:qguHKU52yKfwZyrw03xFjeylsP+ndKFi94lNSex6SU:qguHKU52rwZyrw03uZ+Um4lZ0SU
- TLSH
  T1FF836C39B7FC8972C1AD67B728AB4D0507F2D32ED243A75D49896EF8091776608322D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Lethal Company/BepInEx/core/Mono.Cecil.Rocks.dll
- Size 27KB
- SHA256 54ac539fb5ddc8b44c0e9acd0fcb7324f89d1a072edf8ebc1b06dd691e3d3927
- MD5 36a8284f264bdb2cb3420f5d2b8b10e0
- SHA1 b842aa70ac6ff9cc3922189e971a62659299ef64
- SHA512 3979601ce74b72e1519d020832e57e21b5269bda955878ad52e2d162d6de47fde4793fee9a163551f52081bc2dff90e197f030f8cb83128d07b8571073451e0d
- SSDEEP 384:ZNXMT7GsmR2jm13u4NcU11qvJCyIXcMeDz8PmR1uhLoXeuLMBG9UphJAprjE+J1H:v0I2jo3uobeCyV8uRsdeeum1pg1w7H
- TLSH
  T1D2C2291527598F37C9EF85BE78E1720807F1CA561213CB066CCCA4E9E9877D01B12BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Lethal Company/BepInEx/core/Mono.Cecil.dll
- Size 331KB
- SHA256 7ae470288fff4a402899c254d0a76cefef55877f5c54f96e83c797cc5bb6e2f6
- MD5 50ae8a86b701c83fce3a814ae8d79321
- SHA1 7c8b821367897baa1b78157d5cea0767f424bc40
- SHA512 04b57207d4fd9fa9f1a71323ea803f023b4b0f2f7a7070bf431806c7a7f41277969c0f5979ecf134812001b47f5d36ec8e8541982473287323e783b3ffe93121
- SSDEEP 6144:BTU5Xn0f1oUh8dK9S5K0UEece8plCTNgoF:9pJS5KEpWgo
- TLSH
  T128746B3537FC5A3BD68F83B6E066142A86F5D419628BEF4D5888F2FA4C437529D02273
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Lethal Company/BepInEx/core/MonoMod.RuntimeDetour.dll
- Size 103KB
- SHA256 40e49bb314391cd7bddc2644f8553eeba92c194b940836b103df16955c464e0c
- MD5 04e1988b3ea65408d4c4c29e34bcdeb1
- SHA1 9c599b3c60f92bd3663042dc0781be78e2ff0882
- SHA512 93fd6df274132691a47e00c84e69c84620de7967434c2164deeb7b605038233be7d29d0acb2dc6dce5bbb4b13225094a61f12458be094ac9b2ec27edc6a524a0
- SSDEEP 1536:IFSuZYhhgotA6e4GDSGVjkodWWD7Fjsgql8R6AvdbiwbeMvdo:IUuOhhgsAPDlV5agql8cAvd5do
- TLSH
  T132A36C2AA7EE4E15D6AD9778B477178043B4F8064897E3AA5CCC65FE0817BC11A203F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Lethal Company/BepInEx/core/MonoMod.Utils.dll
- Size 183KB
- SHA256 9d1495f147ac93c4f81f84538c1a326e8f8a6aefc78d6289d798f3ce1162c5e9
- MD5 96c7b1340105a3b86f3e8d19a844903a
- SHA1 bc258633aab1a2a1839dcc44eed944d865fd6038
- SHA512 36706eb655c995d81aa731c067912452a566ef5b752effdf212603aa0099e28de56588191acced82fb97aeae33df06f229d8cbed969c92cf9b8d439d04c223de
- SSDEEP 3072:ojh9XBmF8HjDrQlDSKNcTD3dAC49Uock8dey4DAYxRDA8:oXUF8HjDrohO3KCllAAYD
- TLSH
  T1F9043C2D5799CE19C5AED6B1F46822604333DC03D2EBD70F7CB8A1F8499A388D6056E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Lethal Company/BepInEx/patchers/Evaisa-HookGenPatcher/BepInEx.MonoMod.HookGenPatcher/BepInEx.MonoMod.HookGenPatcher.dll
- Size 9KB
- SHA256 95fe40f8b8c49a991b9e69a1a1898575735c478ea6715a8f71f70bfc214d0b2b
- MD5 1764f642995e906313eba9a0065d0686
- SHA1 470aecd6d09acc1cc68e7b28ae3443adc207b717
- SHA512 1fb3a28f9c8b6d17907ea648537f1366e11aa6aff5ecdcfaefd816f722f0e98dbf22a187aa88b5918d730a5d487cece56a51f6fab3d1b54363a7d6031776fd9b
- SSDEEP 192:PtgRr2PAD+o7PfD7h8FuiXM+fVPuxgLQofcwZw:VsEAD+ob79uVeCESw
- TLSH
  T15512A315A7F8C3AAF4BF1F31A8F312584631FA568A23C61E189D548B5C26F554AB0F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Lethal Company/BepInEx/patchers/Evaisa-HookGenPatcher/BepInEx.MonoMod.HookGenPatcher/MonoMod.RuntimeDetour.HookGen.dll
- Size 23KB
- SHA256 79b2c4cef86328a482f4edc9a5973895f19d3f59566d4b57b0080bdf1872e802
- MD5 cedeb2d79ce46b05ef9cda878c61c447
- SHA1 294eb246e76fe87d3a4fb87fd86a343605067d25
- SHA512 9abae10a828e6348cdd04029264df82fb07262318a79b0dc19822651afaf17a506a09158c706773feaf28b5b300b3b9f673164b8e018b4b565566bc3f5ddcb11
- SSDEEP 384:aDqsgskJ/x0q6IJB0R3cCVIp/66pcThCsgAOeTs1Hblknp7A9tnncnOMuKriLq1j:aDqsgxJZzJyRcbp//pcmcs5bFtnFMuKB
- TLSH
  T11EB2D600B7F9CB6AD67E4B7869B5520A03F276479912DB5C0DCA70CF086AF859910BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Lethal Company/BepInEx/patchers/Evaisa-HookGenPatcher/BepInEx.MonoMod.HookGenPatcher/MonoMod.dll
- Size 64KB
- SHA256 cc7a1093d6ead17f75545c8d8cc455fdafcb1aca48d9b887735cc21095833bb8
- MD5 450b7f42a16bd0953e06de6d70b7d6ba
- SHA1 9a29c15f15bc4a026f61cacb2eb422703a66d69e
- SHA512 05d132afd79909c37f7e0e4316959cd46c432e5e34fbaf3c5e0ebfd45558e516c06ac97c60856221b4e7450185d56dd764495588c652703af2940aef4dd24baa
- SSDEEP 768:b15JKY7+9EBB5zpXY5Mdb0ElFxcf02Jq2c6BGUO/8WmcvPns7:ZjW0B5zpXY5Mdb0kxY0KzlBGV8IvU7
- TLSH
  T1D153170032F8CB96E77E56B5B878015C47B2AA468A6BD70D1CC5B0EB1D5738B4B427B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Lethal Company/BepInEx/plugins/Evaisa-LethalLib/LethalLib/LethalLib.dll
- Size 77KB
- SHA256 1d20076e81f4c607a71f874d9a2815b377d4198388c926cad8e7e093f1949577
- MD5 dfa76aa708aa5cd190eb87ac4745d6c7
- SHA1 1c5f04a75360cd8870f25c257ffdb4307866ea96
- SHA512 b626e2b8d2d7d85c5df6aedabc40f5d4aae1a2d44186c79436ebb0646fbd7e37fdaed86f9c04bb958733564572223496d0b283ac719f2a72048be583b7caf52b
- SSDEEP 1536:iKYxAfPcfWlRwPxB4HTjm7XBTjQDV+1Q0qHK9Z4oxEBjSgAH:iNAfQWlRwa21koOoSBE
- TLSH
  T12073394523A49B36CBED5BBF307022494B31F527D866F39D1CC898F909273846A257BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32