a72d53b9f0802ceb6a8e938d5eb2a85df3f86872a0271066b25b9c6cc8d6d2b8

Sharing

Copy URL Twitter E-mail

General

Target
a72d53b9f0802ceb6a8e938d5eb2a85df3f86872a0271066b25b9c6cc8d6d2b8
Size 12.5MB
Sample260820-n2ekzada59
SHA256 a72d53b9f0802ceb6a8e938d5eb2a85df3f86872a0271066b25b9c6cc8d6d2b8
MD5 11e14a7688165552e6b8e26c87e64f8d
SHA1 9f4ecf2d8e57efdea21df1ddbb9ddcfa51bf693a
SHA512 c424cabf8d7623c43c2421deb56320105ab4f2331e0ee9898c71f9d66ea6974e96dcfb7b3137251495d108641af9e7f191b016b43686dc2da078c4073dea5b35
SSDEEP 196608:5YbFx8WvlOq17shLL+oYQzp26/p0EXbcLM9D94upFWdOKi5DfeMEX+:88WvjonaQd26qTKhW4fe9+
TLSH
T171D6334B5870900BBD5A5AF83CEB683048BD9EFC98793C3594D2ADD10AC75C876EAF05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CommunityToolkit.Mvvm.dll
- Size 179KB
- SHA256 000b7031687712c9738efbdb1cf6b852fea366282d32ea1ad4eef8ec8a2542f7
- MD5 d4a61328f8567e243ae0161a6898c077
- SHA1 43b11f92563da0a5de202ec70be72b2509a50f16
- SHA512 1f798434a3d49948379c25fc7b0ae96f72173ed640b77b30cc9a4b0b048761052d7127630eb2450cc373bd5dafee57c92223640307733b54d35fe876dc16688f
- SSDEEP 3072:eaw6XkY384nXSzSGICS+zQXy7GYEFl+wecF6ACrxLzL9y40J8Thyul3si2QGVTpQ:Dwym4XSfFnwyFL9yh2ThFlJ2QGpptG
- TLSH
  T141048D4263EC5715E5FF1B7AA47180099B73FA27FAA3D39D2389529601033C16990FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ContextMenuManagerPlus.Service.dll
- Size 814KB
- SHA256 49592e8473648dab3492f1d64bb633274dcbb4a17edc3c7cd90c0f101fa11187
- MD5 43e6f1dc45fddcdadd0a23de3c52dfbd
- SHA1 9bb0789874480a91e33264db5727b38963e0ebe9
- SHA512 76b0ef23ccafdfb52813e8ae38ebbf28301d369bf80edb881b39c910c21d69c934eabce9a07df01356ef71f786ba798692971771f382e3d09d10d95fb6e3dd63
- SSDEEP 12288:t1C6Rly3AjedgaIJWJlyzUeWHtNa5V5UXiI:DjlpegeyzeHS5Vb
- TLSH
  T13C051981A3F41E46E6FFABB9EA7045394B72F946DE66E34D110861DD0DB2B818C60373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ContextMenuManagerPlus.Service.exe
- Size 159KB
- SHA256 c48990152e28c18c0775e356f61837bab78efccf8420a0df1a9dd1380d349419
- MD5 3d0dc8d90212db57f3503dd17b5605c9
- SHA1 7f9b5daf6eba7bccb5244ede8df4ddea841493bb
- SHA512 a400bba2c0a5cd632a185f44f072494113686c68abc87bb782cfbb79b50a291de6a79f2d4e8a89c5837cd28343f656047aae86ac3a1074965a15aa1e1497746c
- SSDEEP 3072:EVDxk88wN1nLVu7dL1Z9QnlX9rE38wm1VzaAT5F9:gHRu7F1nQnZ88Ui
- TLSH
  T1FDF33C13A6A851BEE1B3D678C9924941FB7278594B71A7CF03504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ContextMenuManagerPlus.TrayHost.dll
- Size 286KB
- SHA256 f45451ffcd484148595734c0ef4573c88b592baa4f59f1fafe34b0704e8fd06c
- MD5 c77b35e54a133d63a68691c1318552d2
- SHA1 13bf229c033d3cb2f28393a8654b8dc17305f118
- SHA512 21a0e45d2708c32338d3a4d9cca5fda04d3e6f0c5eff38fa93a4655190e7c13c8781400f7f139e2429b7141514b33045a71ba9e0bb3a8b8ecb748d0d66fc68b3
- SSDEEP 6144:rM287kLKo/AK6kWG/R4yH2KBPTt01aXtznoIyN+9GvEpc32uB+:OcKoGDGDWKDlxojll
- TLSH
  T1DA546BC2F54062AAECAF40B9B43B05DB4BA7997EC6D175D322C8F52B05D50778236A33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ContextMenuManagerPlus.TrayHost.exe
- Size 403KB
- SHA256 5ac9e8078f7f3ee632d8f940a3f312bcfc5256e36afa0136232e14480e8cf7f3
- MD5 59b1636463b5291b78766e4ebe727399
- SHA1 641880523b75bb0590b7513eaaec7014b0fef8d2
- SHA512 14b58319a44be1109427c3f110780684f670d259e9ba3d889df2746182977344ae2351a11fb0370d3d6d3ba71da9d61fc344bd1fe27ad0461d21bada1c9efc4a
- SSDEEP 6144:nHRu7F1nQnZ88UR8o/HKVkWG/R4yHwKBPTt/1aXtznoIyNB9GvEpc32uB+:nxOF1Z8XoGDGDQKDCxoj0l
- TLSH
  T198945D83F54421BAE8BF8078D4674986DB73787AC7E135C713C4B9370EA65A18A39B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral10 behavioral9
- Target
  ContextMenuManagerPlus.dll
- Size 1.4MB
- SHA256 b7632ed75e3a2dab839953f370f07fc928fb14ab6943aecaf4950ad0efed3a98
- MD5 10cf0a161597dad1150cdb02dc8a9548
- SHA1 a5e8857b25e5e69007fba55eb4029f607621e535
- SHA512 c8b2ea6edde715a07310e78451a39a8cd50ec807336977d39568bd19ad5c9244f27dadd659841b379f82269b6917962059d21dc6e4289c6376dd470f2a3e0a0a
- SSDEEP 12288:wckylYnmqsBqPd5UvIWTicpeaanUKT0ALhWM1bffQlLr97IITbeu/RwIt/dx6tod:5ick/QwhMlH9riIJdaoCwhKTxonl
- TLSH
  T1E5659EA033F41626EAFF5B75F87A42488B72F91A4946F39E02C8B44D1DE37528E11763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ContextMenuManagerPlus.exe
- Size 403KB
- SHA256 66d2fbaedb624270efe9b7bb04ae6d6d221b098e574905a53ee1049c1eaee01d
- MD5 2db2b16411c8e425f740a1c589490bd9
- SHA1 5f7d88fd5b2b1951b67401342477582c6c9e6303
- SHA512 6d6195b570b7ea946fa627f9266d94cac35c1e08ff6a1e4a7d439977185f2d0e2153ee2458268ad884884113967245843d362bf3e05f6157a1fe8c64d08cbd6f
- SSDEEP 6144:3HRu7F1nQnZ88U1Mo/HKVkWG/R4yHwKBPTt/1aXtznoIyNB9GvEpc32uB+:3xOF1Z87oGDGDQKDCxoj0l
- TLSH
  T107945D83F54421BAE8BF8078D4674986DB73787AC7E135C713C4B9370EA65A18A39B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral13 behavioral14
- Target
  ContextMenuMgr.Contracts.dll
- Size 123KB
- SHA256 fd6dc30cec032e52ca258d74880c02a9e1ac970daf78fbe7af206a1567ed5970
- MD5 7913726d315f98c960a04365bdbd9d00
- SHA1 23aa497778b62f617c5aba8db556cea3170fa763
- SHA512 dd971ff9e86d1fb646517a3c802313439a35ea43ad57a75f2ec5b1b2f7246601c24ad10180fc03b93f7f06aba7d69f5cc9d5ff79b3e4b65a90f5d22c003288e2
- SSDEEP 1536:35nwYyn93kSSe1Bn8CbNz8x2kiKCvkfB6U2PMx/zHAcoE5Gy7YkU+N4B:3mnlS0n8CJzmU8fiMJLAtE17Yl+N4B
- TLSH
  T159C3B52037B5C54AE7D9467DF0254D34936AB94A3812E7FD4F6078DE2AA3B8580087FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 64KB
- SHA256 ca708422782fb25819941a16a057ea96d6d18b037e7e5cbfdf340b7a04362b57
- MD5 ae5e45ed689ecd9ca584e517dec04437
- SHA1 a03538d460b2cd255477500b364d9e463afe05c2
- SHA512 0ec0ddb7f15cda3e02039de26d1730d6ac4383a384ad56fda8398ec6cf33d9489add536e78e76f6a6f33590895f9da60e2d6b98aa437607c6533e9b80d26152c
- SSDEEP 1536:PFuu+NbA5+iU5t53Ueb4I+MkT/sEyWzekwmgzT:Ph4ttkDsb6omg3
- TLSH
  T10C532B6837F9E613DBBE4A3137E642C1AB78AF036001F70F254A92F50597BC949909B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Microsoft.Extensions.DependencyInjection.dll
- Size 93KB
- SHA256 47f8175d34e9087d3858644803c558cb9cf52b29bffda796f65c1c527d1b6a22
- MD5 691d122172e70a956be0ed59b935a8a9
- SHA1 13db5e854cfe3805bb518b501c438ea394b5683b
- SHA512 995afb87da135e03386bd5d0072bc93a8c99372ec963a566d304161ba9521a4735d88e9048e5b9bd07a25da410c54a1165e0392aceb292410be6c8f5c48308f0
- SSDEEP 1536:txemzdEwSsliCvUFoN93dJrutpF5nRN46zIQ:txqsl2FoNBrutdj46/
- TLSH
  T1F2935C7513FC9B26E9DF0A74A87542404B79FA9A3402E35D0EC4E06D1EA3FC54B6226B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Microsoft.Win32.SystemEvents.dll
- Size 26KB
- SHA256 2781f7269d44cff362f5d6f956dc38a7222806cd7c44645b457e29180d510a26
- MD5 47c2a1b10ffaa604f9675a624c1572ba
- SHA1 3f35cc6786e31bd6820a5d0e3fc8b34674702e26
- SHA512 30e8627db634ba1389b435cf827b4b118e3868d44c5de4d69a39a82cdf1dbaa4899a082eb407b615823423f60e2799a5f6870c4cc5a317835ca7370d3377680d
- SSDEEP 384:QW0q2f2+uwwZmnxzYwLnEZWrvGJWDZlN0ER9zNHo0l:Qk2daZKzYwgbjo9zd
- TLSH
  T10FC24B22DB28C539CCEB0D721965C6562B38E2E3CC13EB4E654DF0084EA77C9E735668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Microsoft.Windows.SDK.NET.dll
- Size 22.5MB
- SHA256 43b12f190d22f258039df567ef407333dc41dc95ac7b232dbf94aab069c65bbb
- MD5 4d96303222f4ccc86a7d55b904b3ba7f
- SHA1 384419bea960a2d3a51ab145d452465109f1d53c
- SHA512 37600b1e4ffefc5482f3005522bde6799c8409be3ec5f4f1cf494d9df5e417ee35485a10ffd13f30fb23a115244be1831785670c702bdef93c49787dc7f975b9
- SSDEEP 196608:PQhPlaviiGD4FjXWPgXzDTjzND/GyCyLnSJ:wne7WqzDTjzND/GyaJ
- TLSH
  T182373B4293A74F3DDA9F1B79E0C412260739C00A9F866337193CDAA93DD3396065A7F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  ProbeHost/arm64/ContextMenuMgr.ProbeHost.exe
- Size 553KB
- SHA256 f1c9d221ac0b7473e29acc52d5ca4c9354f5b0701416317402c8a8c693f30a8b
- MD5 d7744304a04f1b771554e2c54a1d886c
- SHA1 36e1d92e47159ec28eb24e838cd41ab6a4fd1e1b
- SHA512 044d2208dc34e49cf2a748236f8b4add98060cf027e27878bf35fb16e5b7d689f9c9e30e9af316d01d5e735a7a41cb9840c5cbb4f7ef8eb550710af2a051b3aa
- SSDEEP 6144:bglIfi4TF+cU7GNI7CmNpGvFi/UiVlbW1b08wrQrfjQv7pHMPEb/o08l9wQ2+dlQ:bRFK7Ga7Cm3wUxW1b08wrqgQjIn3
- TLSH
  T117C45C906E8DA986E3C7D33CDD628E60303FB8688574C64B7642131EDD9D9D0DBB2672
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  ProbeHost/x64/ContextMenuMgr.ProbeHost.exe
- Size 536KB
- SHA256 497d38da7a3bf375f5d0887e8f7ce40c71d4c21d9f10afd0ca5b8b78d2d9815d
- MD5 3c5d0ccafde310703df3e398462c2af8
- SHA1 5cb0d545894cb0b8cf74220ee290764748acb9a9
- SHA512 5f9601fa8750432dd6b165fe4aa778c608894f5ecb7854bbc72e023967d6e933cbb947ae678bfb26c17a0dec41c2c54dc0d50a7847ad031722d90ca79740aed8
- SSDEEP 12288:36SLq/LegeJcKOUGKLHx4fHkFwcJTWlRpg:RJcWGKLR4fH+HUlRpg
- TLSH
  T115C48E69E6A807F9D0B7C178C9538512FBB278990731AACF039185A75F276D04E3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  ProbeHost/x86/ContextMenuMgr.ProbeHost.exe
- Size 454KB
- SHA256 aff44564ef8000ebc93e7277c370922cb6f7e04cf7c88ed4f975684a20814fbd
- MD5 97a2ff9877882fa81717579e5e369b9a
- SHA1 cb49a07cebcab38afa0b6c5e4d46c88176cbc58d
- SHA512 ff8ada708cdcabd75e28d651c84f679cd3939a4669ee65f64ad895dcbd46d6c5968922a487ac95f694f77838d9492d9345d1dc80fef759a4ee5989551bf2fd72
- SSDEEP 6144:pfdpuJa3oBVgPu/qsZWd5q2Vq2EvbKHlzCGY3N/AjmsPrE4BbYajivZG/IAMPENs:pFnoBMXdMH2Ev6lYN/UpP2ciahRBuUQ
- TLSH
  T148A49D207922C032D55141F18C79EFAA596DACB00F6554CBB7C45DBAEE382C26B38F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  System.Diagnostics.EventLog.dll
- Size 52KB
- SHA256 5c3682155bcd075f5fb286f75b58839b7927f0b7d01a853a4806c63080555c9f
- MD5 4c836175452ad1c5a77cfd8fd360d410
- SHA1 12e22565130644e72d279211fea9b165a36d247b
- SHA512 32fd27c760b8dac38fa973af9c760a1f426ba271587f23af6d5a5177306ef13bc5eedd529d9f50a8f88c74535838f41d8f485c9164c66fc76dff42198b1b415e
- SSDEEP 768:VrAYIL3ol5Q75mL+e2/iMYeqgsGTmAXOaYH0ls9z/Vy:VrArLK5cQsilgsnH0+zty
- TLSH
  T175332BCD9F94472CD9D54A33B663822D063196E62F02CE0A2E0F75493B5FFC8E722559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32