e11eb8331c93320cba39a2c2fae3f585c560355a89e37b9120328f9dd2c91304

Sharing

Copy URL Twitter E-mail

General

Target
AvrPascal_v3_Source.zip
Size 13.9MB
Sample260820-wyds9sfb86
SHA256 e11eb8331c93320cba39a2c2fae3f585c560355a89e37b9120328f9dd2c91304
MD5 15bed0db6b0cdf7dd7c3ea4f29b9e25d
SHA1 d26f91837d05bd59ba736af9cac8003364cd1e48
SHA512 7a7df75cd58fde8e22be0a114c3617a2fd0ca8e32506b835a9e5127395aff4e2f7769b0cbac872eda1c9bb60c5bf549153b4d604c7722af48aa8a0936886130f
SSDEEP 393216:T2RbEAiCa3wsPmWARD0Ia0mNHCcjsuip3DStX:eArH16Cb0mFCQqVmtX
TLSH
T114E633DDC8D95991DAF9073D5A30A2422FA9502AD1AB870F4CA5205ECED3F6773EE0C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  AsmPas.pas
- Size 185KB
- SHA256 a1e67d8342e4a7b921b956721df9d492ec3316005e90015d666cf3c1ce872904
- MD5 6d7ce00368d60e2ac0382d55db768a16
- SHA1 eaa58d4da2241b4e8911793efdb5daf864738758
- SHA512 4f0722886fbf9ad897ccdd678d50fe4b3811a6d071de1f0842a07c405946ed4214926e72c9117339ca1be1531c377a301d1c66be3cec55a253a30228d2c13ffb
- SSDEEP 3072:5VNJzFvFUF+F+FSFxFjFe1+cl3Yx+2rFaF0FAF4FAF2FWFY6PGC/N:5ql3Yo
- TLSH
  T10D040E22FDE65BF25171CB282FA14103D24C926352519B67798E44ED2FB278E61F03EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  AsmStatus.pas
- Size 107KB
- SHA256 1675b8eec28b93a212dd9dfb06eabf6702b9a9e6f0feb9ae3756e7df5d07aaeb
- MD5 aa3e00a221f9b78fde38a27439a8e916
- SHA1 8c09c3ed9838be641fd85ca7a24171775df08c3f
- SHA512 6a102da9cb7b9a8c707e92322eb2762357cb64dc7d1a23a620e24d18cbb35d9e9964ab6a572cb87734a61ef1f28d324a9c253fbb9b1b4b7dd7818e90d636ecbe
- SSDEEP 1536:7YbB0ww+EvcAtTcAtUc1SNGG6frDgqPiknIbB6Im3v3UlfAilwwSOuVtoKDltU7t:CB0wV6wSOu3U7xD
- TLSH
  T197B3511B9EA70BF755F0C0291F965807C700519386858622B8DE90E61FB6BDDB2F07FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  AvrPascal.exe
- Size 17.5MB
- SHA256 a0dd8323ff7f8c3c12a0ac9483192374d8d92cb51f6ffdc68ccc5c0b93b536ac
- MD5 be1e468824db0fb8f047c761992de8b5
- SHA1 7bc12744e4291fb63779df048a1685a364721ec1
- SHA512 c8865c20a6252c881064502921954897e71bdfb3a0051f574dc8714851f232e67256db1d3d7edf1871456c9781e4c3fe385b1cc2242d13913d788f2f88081175
- SSDEEP 98304:5GwfSsjempG6r8snA1zyrmMyucGD4QOgwGuuBl+gpDhsrl6PZZQalZLCwpokCFCa:5GsY6r8kTcBgxuKDyoPm
- TLSH
  T1A6072A22F2608E36C0DE573A449F47219331411A9B93A78706E89ABCFD8D3916F7674F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  BlockA.pas
- Size 162KB
- SHA256 db6c75c62eee6fb71cd3b137a3a2b213d4a45f567428083ec2548009d95201bc
- MD5 5f0248dcd14ff2775c1a80dcec5e1e2a
- SHA1 a085454486342d5445ef2a533bcfad10398679ad
- SHA512 5f3868229e9b2083e25eee3884991f2ab02c3ffd1358e55a48261e04be56e2ae00b61e1b2418a943a3833d4800db9d227ae275aec8c2da1284b26d855ed1fc94
- SSDEEP 3072:VCcWcIfIR+SR+5xARHlZAJfIRBZslgP35s/itFCp5lE95q+90yNqgTPGMaM7WnAb:VCTvyaxCp
- TLSH
  T1F8F3DE17AEE627F252B9C22D9B8A4006D308407782917B25788D64E71FF179DEBF47E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Compiler.pas
- Size 23KB
- SHA256 b018d15c906cfc1de9f90688c54d6c70ec69ef8c76dbefc3c1e40b0f968b67ef
- MD5 53ce20e7ff9851fb23bba102e4272ac7
- SHA1 07288afaebc649de17670a4f4d58ccf3f4f12bc6
- SHA512 9457ca44460b5336d286aad721a7ebd5f112e312b17583ae225b90860b9d9b2b7bbd46430337aa764cd35499a33c34fc91b11278947767ac3eee937ce1419d6e
- SSDEEP 384:PfX8OVFoJsxxfVcLphiVc1tV2VVVovDLKLwo8VsbV+VpK6Vc9P9ZPvVsOVlPMVsg:P87LKLw/BCj8F4ZyfwXXm
- TLSH
  T174B22D6BDEDF06B785B0C0692F8A9407C31461274A85662078CC50E26FF5BCDA1FE7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  EditorFrame.pas
- Size 7KB
- SHA256 f4a9e90417670193e2ec2a95d8bc96195528d71f167d969177fe12ac740002b1
- MD5 e47fa64abcfad9fb27b866e44cc98c70
- SHA1 242e4fde3819f20179c2b52a246455ae9979d9fe
- SHA512 17b72317207a91e4d7c716ddc1cebab2ac0a4cbc371e9a179f4a2782c81596cb7e47aea84c7463f95c1c1a60ebad9ad29a1e531c698ec6820d8715cca26f2458
- SSDEEP 96:7ghQBnW1NF0KbdV/4/JM/EP/7Rcsk8+B/hbF3P3jmPBLRIRv0Rcy4325Jhont33m:vdW1NiotUsmPBLuWh5MWn8WE5m
- TLSH
  T17AF1CDD7C987A2B26F32905C3A4194C9CA10C0035E95EAA1B4CD90EC5F73B9872D57FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Lib/Intlib.asm
- Size 55KB
- SHA256 ce197f3378bbdad25f29f1b2fdc8969b8e0975102954ae62d60915eea6668ba4
- MD5 eaac049fa5bd163ac25794818818dbfc
- SHA1 ebd0a365050d13d39eed3dec2fd11fb76c1aaa44
- SHA512 6a191b497a251c01067d38efb1df76d2d2965626c974415aeaff5bc3ed57e451a6d64cb4ba5319f7096d27c58015a29c343e0c5621c8b5eec7af2cd918c00f7f
- SSDEEP 1536:y14rFds50ZEjRSN2HumFumHumwieiie2umqW/smvNpiLAPdZyEZwOyjKEfUkUViF:yarm0ZUW/smvNpiLAPdZyEZwOyWE9UVq
- TLSH
  T1E9439625180351E79A9032B6CCF54262D1B968E207F27275F84CD87D3F21DA78DFA6AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  MainForm.pas
- Size 51KB
- SHA256 d2f500ce07862a696478cf61f56fcb582189faef48caf037893ed168d715707d
- MD5 0dee08f6b75e76cb6d80627d497cc22a
- SHA1 871e70a813256618df682828b55037199a8afc14
- SHA512 be551f37d2a63d41db51412a5343b62bfdea5ea49c833931e8731623a426d1c1d493b4b19a3180c69273a54d9b75775f115063ea0892045806509aeafdfacf50
- SSDEEP 384:3+3scHkR+18KfwPojujuSdCLP4rxgrN2PXPifjw+/l5068ernw+zDb2fE5z4flff:6sqF1muLP6gGuBZBB5zmfJjl
- TLSH
  T12F33744BC8499E71E9B2815C2B45588AEE109027ED25ABF174CCD1E50F73B8DB2D83F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Mo1.pas
- Size 104KB
- SHA256 771ea861c6b6eee138b0c003a3c5a562488688710514eb9d0938851c2d1a01c2
- MD5 3819ee4c40a1bda6d2b573cf300b0459
- SHA1 80126feae8b742cbbce747568f6aad3b975863c3
- SHA512 3d8b20235c78957dd67a8bf74c6c7a4f11724e8020f1c8880a8f35c4666533dc4f62c12f29da8b82d270cb403c16b29e648880650021cb2fa2d6e4a7e4fa3c95
- SSDEEP 384:c8jcJRUC6nh/U6LlA8qcI0QchkBVwMowGwFkx/57hi:c8jc716nxJLK8qcIHchkiwGwFkx/57hi
- TLSH
  T18AA38D26FDEB5BF349F1D12D1A964002C314498396C582527A8E54F12FB6BCEEAF03E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  PasSym.pas
- Size 42KB
- SHA256 5410bbd62b628fcc354be9b5ab3b4634b8c098b92e557f03c5843e56c329062a
- MD5 0dcbb6b6db71bf919a9f77c2f3bd2065
- SHA1 5403efc36c6c6758c04a9a0a875fd1443b48aba1
- SHA512 9ecd94e871947b92ac7114faadf3efe70027a1e0da3fd1bc3cc6fb023d9c2c0d5dba9a2595285c5372fc9b4a1bc94b0540f221b9e142f72ed6c75608cec843e7
- SSDEEP 768:uC8RNUy15XozvYQIk72jmwnM+SB8Lh2xa0O5XJ2PQu:b8RNUy15XojYQIk72jmwnM+SB8Lh2xpj
- TLSH
  T1F813AD7BED9307F705B5C16E0B53A04BCB088097A5889166BC8DD0E62FB478D66F43E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  RPNUtils.pas
- Size 21KB
- SHA256 3caca3e38380f86ced6437f550a23be35eb92fde038613ee9ac65335b928f084
- MD5 7b027f986a7793ecf932bc14a1952de1
- SHA1 c26e5bcd2170c3a6c27151ee1ffb279167aa8b6b
- SHA512 288d8c8deb03c3b4196226c837e48cfc48cd9c6a1150a1bc59a9a4377266532b5a5c964bedc0e02b4310d9fee4b9c49e111b91c4042ff3002542e04888cdc0cd
- SSDEEP 192:q2ucjo8NpvpnbkgLhvueJo4h9DDJCI4CfKCXj8MaIvMECEAH0GzpNqgreCDDez:qqjowpvpb5J9D/COjQpHE
- TLSH
  T1C0A2C72A8D6216B5CAF5C53F3B812451C32D409312F0A16F755C42FE2FB268DEAAD3D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Win32/Debug/AvrPascal.exe
- Size 17.5MB
- SHA256 d9e07819f7673fb811a0e20a4878b9d9c3d1768e1d218b71bb4c6f631fb410a6
- MD5 98deb0bc8ab44199dfb79ca6639cfbc1
- SHA1 b95424b0499bb9cc2bd8545eb4ec55b6bd0088b9
- SHA512 ad6089762387bc4437054efc1ad29b0b648f982e50f48c37ccf4c2535c29b1ebcbbff438fce43f07f99ead256aa59d3c43bec3374364188c706e0bd847ecb30e
- SSDEEP 98304:a25rVJ0empmK7onatE1zy7yMyucGD4ohQv0WanRq1+gpDhsrl6PZZQalZLCwpokW:a2gYK7oilTc4QvsRODyoPE
- TLSH
  T1FD071A22F2608E36C0DE573A449F47619331411A8B93A78706E89ABCFD8D3916F7674F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Win32/Debug/SynEdit.dcu
- Size 387KB
- SHA256 a22a39127fc6a5245fe5221c939e396d702c4db83050bde42d093dff23468451
- MD5 13868a46aa0ba0cd4909da4e5f7d3f63
- SHA1 790e5794798b4c37e9cc363e7ab94c00cd109557
- SHA512 1e8220a84d18ffeb6cd391a35ba8f880424acbe892b9bb8be81843d563d69c031282d1db1634a3936d92f0a0778809082a75567bbc344af9aef9b5899a877f31
- SSDEEP 12288:WRc6sPfuIMS8Ayhca55wn03PPgCuZUzTKmqq6hf49O1xp+4ZcmuECM:WRc6sPfufSlyhca55wn03PPgCuZUzTKV
- TLSH
  T1EE8429617A5095AFCD9B6972A4571490EA33B3505B33CA4F8B282C4C7FB1E81ECB7247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Win32/Debug/SynEditCodeFolding.dcu
- Size 259KB
- SHA256 b8b274ac22f425c8b02b67427d7f1ff686cdf79267dbd44832314f9b030455d7
- MD5 29d673aa12bb05e62ca5de7526587e92
- SHA1 4f27919889cab62c1f3974e718920cc38f7c5694
- SHA512 8745df124fe0ada401aaf98972ce7adca1723e5d5a7b867aa02600ba666e122865976c2bb591ee7e695059586c7e52ceceb6cf0d603660e918f88f03ece4fe4f
- SSDEEP 6144:qQPuP5zKnHqAHZq/Ab0kDHpoK1SqoNSMW1xqOka5dBt9NEnZgoc/:LuP5zKnHqAHZq/Ab0kDJoK1SqoNSMW1D
- TLSH
  T1C444F723F6D07665D8EF0CB100175C207F7A6B81E7A0DB06DA94B968ECF5E04AEB7941
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Win32/Debug/SynEditKeyCmds.dcu
- Size 82KB
- SHA256 7e9315fe9c63bba688bf5676f0175e5b6b138ef6fd7709353a7225da7ecc2e6c
- MD5 e175529e9fd15bfd2225ace95f6c7dd8
- SHA1 7814f082ea5bc2d0f6880315fbd22da8f0fbdb89
- SHA512 1b3ddee51d776f023921404fd99c89837e9b0edfb8e99f04ea26e625ca7ad45e8cb9c8400fc68b79a1f0ff7d390fef1e308f9941a5145ad61c3cee954eec28d8
- SSDEEP 1536:q03dEQgQXO1aIPwgSy/Db3q09MUK1dlpKPP0ad3IveS1q1eB09hHhXfNZr:qxQlCaIPhMUol0PP0ad3IvD1q1eB09tV
- TLSH
  T18483E831B554D775CCDB1872B052C8A0AE3633625B71EA1FAAA80B0DDC72ED0DA77319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Win32/Debug/SynEditMiscProcs.dcu
- Size 63KB
- SHA256 d2320ce54331fd3db87c58719c17e1839cefa3b4233ead706c8ed91d007dec33
- MD5 30a3768295a68f2e9897ba9b37b4608d
- SHA1 a63c1834e48f3cb7799a41e78177544214c01ff5
- SHA512 656604a9fece834cd632f52992a536364d2c3337809395aac42ae7b7f1a792607ca9d05c6b69abb2a806e76297c721f5ee624c20c7aa26257fbb9c96fd2e8dbe
- SSDEEP 1536:VMdEQBlmlSFuipFx+O/ucgTLztYo/ijPSXBNdUuUgVCm:jQ7mlbTLztYo/ijPkBNdUu7VN
- TLSH
  T1C353F930B650A3F5CCDF2C72619254B05E7943A38BA6CB0F6EE4AA45DC71D84DAB3319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32