431b9a901e1ea5ec609a3a5d47ead5503d077d0e78c4f95f00f3aad7558f9713

General

Target
tigue (3).zip
Size 5.7MB
Sample260820-w57pxstbra
SHA256 431b9a901e1ea5ec609a3a5d47ead5503d077d0e78c4f95f00f3aad7558f9713
MD5 aaaaaa9ce915ef230da3eb181c004263
SHA1 323f2e4be26b11568c75ac9ef2788ed06858754e
SHA512 facdf1e704d558b33efab3e01abb3acd2d9912b841ad18ee6257cffea72b6c332e53d4c530878eabc14203936a1cfacc28592dc698be36ecd196994bbdd75e33
SSDEEP 98304:ucOqHATcf/9CYFvb+k9x95H93ColbWe+WRS9cdWeIWhIiRjxoyB7QmSiD7v/q20u:ucsTcf/9vFbh5H93LwfWRS9oIWhpB7D7
TLSH
T1C3563331624F58DCF345E9F8C8619DD2D7FAF84B47F0C2DB3641A81B25966C4AAB4C21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Loader.exe
- Size 153KB
- SHA256 62ba9d5570cab6174c2193651713a2115ae0e3421a519f0ac0f060a8317608e7
- MD5 b3b2fd1e5d447ed909c98c3d941c574c
- SHA1 dcfa9206ec8f25b207fe365bff9f94c7b6b2985a
- SHA512 dbfc199837917e7aa138cb12406595dfc50d18086f3ea0657c3bc0400c3ba217f4e22f4554fa82d7598bee623d0b40e1228d65c686bc285287df40f8a412d402
- SSDEEP 1536:X6qbopMrUI6w6SEen6ibnHt2dArkPPULnjyGzZq4ObnKYfrnonsEOrSSdIHj4Tjy:vMpGUO6Sbbnjftq7mwos2g
- TLSH
  T149E3F672560B44ACE312A9FC8C594C42F7F6B84783A0D7EF1790A46B39A56C0EBB6D11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  RobloxPlayerInstaller (3).exe
- Size 12.9MB
- SHA256 d156faf0c712d4ce26d95a596ad9b1dfc813021b5c422c93887b2522d8b01a59
- MD5 01efe1df5326f000751be197341731a0
- SHA1 dc5f851e56567a8b378c72b6f6e6ecb90592c788
- SHA512 24fd10d28ab92bb12efecdda5d32d08982f531a9309e1db609d2c4e90735c07adf7033afecc1d9c76ad38efb284cabd399c89787f434c05e0f9df0ce1312842b
- SSDEEP 196608:dAX6ERRxgExTkVEn7tnD1+tr7E7FnXdGoq5/FFgdLbM:dAtDgEMEn7tD1+trInXQFS5bM
- TLSH
  T1F0D69D6AB2B800E8D4BBD178C6565617EB71741603709BDF1AA046FA1F63BE02F7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery spyware trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4