a1ca6fd2d508d9a063eae6eea7b953895d4e4568fd8753774f50b4326692d799

Sharing

Copy URL Twitter E-mail

General

Target
How_to_Fish.rar
Size 551.3MB
Sample260822-d2s39aea99
SHA256 a1ca6fd2d508d9a063eae6eea7b953895d4e4568fd8753774f50b4326692d799
MD5 5fec3b4e0aa14971416975692f814f0f
SHA1 c5156715b8b770cffa1ae21025ec7fc7158d0a2d
SHA512 d2dae008e1b3ab1c4170bf47930bc2f2ed8e3d1bbc47e0facb58d177423bfa7a0a1e00d7bcc8878a92f6eeaaf9f12b2872c2e8e3c2e9976cf2b1d26aaaf8ebab
SSDEEP 12582912:XnPqbceImBTl/CEyqr2ZYKMVBzTadCSVNiPtmonmfkziAtt6OWuDNxbk7h:3PqbhzyYKIPSVNil9n0kziAiKxbu
TLSH
T1385933973EB4800EEA1FC3356FEBDB308562BD21DBD9C9168781356135BE260B52B91C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  How to Fish/How to Fish_Data/Managed/Unity.Addressables.dll
- Size 114KB
- SHA256 339de44cbc20b4973ec6a49e3ace75cf926dd420139a8f9069efd5a717f36e85
- MD5 dc47a15a089648271ca5df43ead40f27
- SHA1 690f24870ea5b5caf32f171aa9a68e20eeb25ae9
- SHA512 9aaf2ce94da44356941959358b866006550483d66d467d9f9d57e23aff2cbfd4e2a837cde5f6ec8dd39ce8792860ad0ee621aaaaaa7badc486b24eef4a7f83b6
- SSDEEP 1536:ametBhrJHUCBkSv66775n5c5CAcCrBsco6njOlxeEQbHVSPnbF3eD1osEHE75rKc:ametBoyr66H5+5CslcJe6EdrKlzI+g
- TLSH
  T11DB329A613EC9623D3BF2F76B478125107B1F80BA936D35D5E88A0ED19B2B901D12773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  How to Fish/How to Fish_Data/Managed/Unity.Animation.Rigging.DocCodeExamples.dll
- Size 6KB
- SHA256 687e066bab068e7007d148e7136f61c9919bbff2a8fa9a9aacbe21d874854087
- MD5 e0df0a63258c111c90ec783f3e7ffb21
- SHA1 0f1bfcfb5bb755fab5a6f339cba6a127b44d9944
- SHA512 11be24b26747599bb99be2bee6a8b4887612e8eca1ff5ab8f2c4423b0607fedbf7e7dd2a1c76d0a32d2862d9a50a8be2f837d074842978e6432dfb19e2e541e9
- SSDEEP 96:revh7/0z6ALwSELPt23+zigaPZtkxk5k/XSniVG/R:654tLwZLPcuzzaPEusLs
- TLSH
  T190C1A66697F8062BFD9B4B771DBE471227B9CC008A97E77E2489500DAC662441E22FB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  How to Fish/How to Fish_Data/Managed/Unity.Animation.Rigging.dll
- Size 111KB
- SHA256 1f1764e77963602b8a47144e6e747d21a05420b2a4875b5ffe52db0f4f7bb1eb
- MD5 4dfc17dd976555da02669fa303e491d6
- SHA1 4a034cfda0bbcba679c23a3a79409907b5dce3ce
- SHA512 e627417c18564a6681916cd5bd99e37e539c363da09789406e925818bf3a3727c316476007254b0a2a303dbb93c2de617537e13de5ada1ca42d1895b481d9a0d
- SSDEEP 3072:0kmGrV2hbZI5W8pqs1M7VBjzjA3cjHXaCWutc:0PVBHjA8
- TLSH
  T1B6B30AA007444E36CB5F873FA0A846066B75C11315A7E2EE379EE15A54B73B22B437E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  How to Fish/How to Fish_Data/Plugins/x86_64/SOVEREIGN64.dll
- Size 1.2MB
- SHA256 95f1e83dc0a453663a728bcd302358ab42c17f930acba64bfb2ca83b6b749227
- MD5 f3aa29323fa18efab55a336402efbea8
- SHA1 eedd07473198e3117ac8bcedd7acdd5cc43e031a
- SHA512 65117a1989a07f9b824d391e35b8fe8f4945b67a59e243d58901d5bbdcebee57e272a33d234cc96a7ac67f42a9bc2d1776eadd21401508a24862e050d714aad1
- SSDEEP 24576:nz2IidL1Ln5YP6dy8OOZFtvfI8SITe6sfrsv+4:nynl1TiPzKtvfJSIDsfrsd
- TLSH
  T14155CF17E7844078C0ADC0B48B5B9F27A672B486162276EF139E29387E76F83973D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  How to Fish/How to Fish_Data/Plugins/x86_64/lib_burst_generated.dll
- Size 1.2MB
- SHA256 f95223ca2a74b9f50904e41269d8536783c6b1caa0abcd48ba9d75555232960e
- MD5 d6228c038c32ed9857acf0b1402337bf
- SHA1 6045281e51f51e6e654685a995da06992233534e
- SHA512 afb3b11026b73a086c0b9da233cd9505aded7ce9fbcf552e8650287997108548cc6d34ab04d87698994fd6a6740dd94c00d2835c562e4ea7d6472c17370c8995
- SSDEEP 12288:w8TtFrHdU2bpEcrzg7/T9Sbtu0gzcDa/XowYzv8Gm1pV35LtxJxAtpK6u3IWUCp:DS2bpECg7JShyzOvi1bp7cK6Yp
- TLSH
  T12A457C2532A7A0ADC42AC470431F6763B722384917211DF791E489B23FE6ED22FBE715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  How to Fish/How to Fish_Data/Plugins/x86_64/libonigwrap.dll
- Size 538KB
- SHA256 6d539f2ad6e1b58d3c8836b9c3a1d50c97cbd7a6ca0c5de25d994a7c4b1ecf42
- MD5 ab2bd6d029d63fcf779f2032af98a5f8
- SHA1 28b1fd59b714d81bcfb353d1f2ae5cd4a9190656
- SHA512 7ca95bf475dd49069c0accfee0f41783824bc2e521ac7238f7a20aa1c04896b629c82d9518715e9193597f7efeab46f27cf3b2cdb382817ea58752abf07ccc05
- SSDEEP 12288:cGDjNa62yL+/RrsXdgcTE33T8Hhvrol87WruRGS2:cGDj9ZeYdDEIrolQx2
- TLSH
  T1D7C4C503FEC3DBA9C1AE4970C896D3F52136EC605A108E572358BE37BD626205FD962D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  How to Fish/How to Fish_Data/Plugins/x86_64/rnnoise.dll
- Size 137KB
- SHA256 d9d45f82de54aa10cd3499db8cae636a96015e185824dbbf6021d2044360f466
- MD5 2ee44c6231eb3b12c2cfcef4244b2daa
- SHA1 ff6507fed41fb8fd9baeddda2d676806d4bffc3f
- SHA512 a55ee3ee5af582a7046ed835eed3d0c739748ddfedb6b82919832aa072840dc91fa28cc5ef444e8f6675cf2ef78f06dd5ef8cc7c2fb5b3928ec1bc9efc8a7900
- SSDEEP 3072:WKaiQnW/uG6UO1XDiTBNHibhX4m9VGKQjstGsQfw2pKsV/uC:WS/tMX6EX4m9V5CTRpKsV/uC
- TLSH
  T110D3E005B1F996E9E132507AE1AAF14FF1313411072185E743A988BC7FA2BC55FEFA02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  How to Fish/How to Fish_Data/Plugins/x86_64/steam_api64.dll
- Size 475KB
- SHA256 b7499a5dfc40d565d8206827f4f89b32dcf753fa90a59902acc9e6d6f84669e4
- MD5 31e5bfad6b7474bc477282c7c1caf9ea
- SHA1 31d4a4c5ed346e81189eae62d22222aa9501484d
- SHA512 dab3aca9cad34fa866f8c8aa8a9b015789d5eb44efbc4e481f7818b6bd6058743c77371765cd23334d84f11e0ee0a7251146534f4d495faaa37d41c37ef52093
- SSDEEP 6144:AgI3bCfJ6CYztsCjdGUqtFjrz4srgkBAUJyCLfC2hc25KzZG7:AH3bC2FjAPcsrgkryMfCC5KzZG
- TLSH
  T119A4B63E82C581FCED3DC03889570867B565B1AF22182DDE76155A309FFA65A2F3E4C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  How to Fish/How to Fish_Data/Plugins/x86_64/steam_api64.svrn
- Size 312KB
- SHA256 670d654aa3255c5061cf0236a1cdbb2f5076cbd5ae44f613b6f4921558e83e2d
- MD5 b3caec4d455160acf21a318073c40dc7
- SHA1 fcb09f9da2172d58fbf4aa57bdd30d607ccbf237
- SHA512 bd3417c5c5c022f2b3f729283d77a335200fab8a7c439eee00f9d298608f804a3f6698049d30351d8a5dbfa3e728518691472fc78b91b8785ca5d1a5c52c6142
- SSDEEP 6144:JfgdBtTW65Q6tW31ghwXRTRylO2CXuPu+SQ:JodBtW6pte1gsbys2Cza
- TLSH
  T199645B3962750CF4E077C13A88565E0BFA79344B23219EEF236062769E537C21EBB791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  How to Fish/How to Fish_Data/sharedassets1.assets
- Size 334KB
- SHA256 f9c3840803a2569c49bdf2dd16bcc5d49fe35c44a650593cb0a577b40b3ab62c
- MD5 862d5bf0644ff000a30d3cafb679ed30
- SHA1 59c6ef0fe6f3a70378e9744b5f5cde6583bad66d
- SHA512 40446498dd37c6af6f93ce08fb247411301d92e116932def7868c44bedf3d2db1baaaafc3a0a378606a06752ba07618a906004bd8be1eb2d85eaf255fdfe9b6d
- SSDEEP 6144:26aosol2leopbqtkhbd6zEjS2/mMQu5CW01GTt:26pHo7d6zE+Sm
- TLSH
  T1C3747B02BE23DA21F7FFC03EE93B3F6AD51BA006F31651669ADDC2C5948DA6518C1613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral10
- Target
  How to Fish/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
- Size 596KB
- SHA256 a08c0e9b6f0220e2e842fe2eea4efcebbc6fd0ea0dd7d8087abbc6e5c78c05a2
- MD5 45f56aa2127ecf52cdb07f4b8c5100ea
- SHA1 fc6a8c307e9d838e3a4c890776e68c802735acf3
- SHA512 aa80051f1381bda2a87b99d3431edc9d385a3cff59ab94543b8e3db0b43c950b5476ff329b54376c7e1ba5f40bc62036006a0bf2e131976448508195baa2fb32
- SSDEEP 12288:9OmNAmdeVH9Mwe9Ek/7jY4hOTBPyi9GaA:9nAmdcMj9Ek/7jYSOT8gA
- TLSH
  T15AD47C56B7A402B9E577D138C6834B5AEAB27811572093CF03A897AB1F137E11B7F360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  How to Fish/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
- Size 7.5MB
- SHA256 165472e153edbf04ab93c81988c4d0a6a47794e8ab43ca4f4c0e18e053bb0ee2
- MD5 d15c502c7bf706037ad34b8a9f66cde4
- SHA1 e6c0df1e64937d9d2c123b1f29bd7662b59b9aa3
- SHA512 d30f94c868e4c1001b61896fa61c12665ab848ff3b4ec8fa52be96d2ab66f77e54c4eb72c45d5d8548a94d875ec12110f7d453059d28842acec5dddb12576ac6
- SSDEEP 98304:J1JKQuu+DfvOtBQkSMDu0moP74cJGOlwoA:J1JKQurDnOtykNBP7vJGOlwT
- TLSH
  T10B767C5E92660068C8ABC23DCB676B73D375700443306EDB46905F6AAF23AE5537E7C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  How to Fish/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  How to Fish/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  How to Fish/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  How to Fish/UnityCrashHandler64.exe
- Size 1.5MB
- SHA256 1c7886ca06806b6849b37b1d90c34c6e3db036b8203fb8c8afd6b177bc614807
- MD5 049af484389636e0ea1fb957d37d10a7
- SHA1 d1e69fa371a38322cd7ef04c87282c06f3f1d1fb
- SHA512 cd99e9e46b3efc546ae664fb9b55eb28ef5d1feb8a42bdb01f21b9324366ae03e33b57696978e4107c47efa3006d178097c4688d1451ea791fdb7506ac20a890
- SSDEEP 12288:j4jwJ3wq31h+Rq+Hos3o5m+GDpijZjtY0aXFmp90udtqxz/yasN9tC/XEKU:0K31CqioQijZy0pxoxz/y/N9w/X/U
- TLSH
  T18275392A2E641DDCC426843DCB838A9FE2B1BD5A1F7147D717A17BA72E320D01A7B351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  How to Fish/UnityPlayer.dll
- Size 35.0MB
- SHA256 c85753eb31138449090594157977bb5d8003099fa18671cc3399da4df6df49cf
- MD5 7b63fa5c08b1e34324d93dca424132e1
- SHA1 95b55317089ea73a0c3443432d5e82e9e11f490f
- SHA512 e97005d8074a56063eabd42f0a1e1689edbc30cd7f76f2f5c6dfc53006f29e4d913b9fa314f0632ce37bf2e038c8e7c7de86b3e8e8939491fa5ba30961f54f49
- SSDEEP 393216:www5p/PywiICOSYoSL21fXgP/JFIYgKvqfcBrWxkRVErTIG3oZIClhH6A:wh5VPy/IixuqToBx
- TLSH
  T13B87AE9662B851D8D47BC078975FA91BF7B1344903309AEB52E04AA46F33FE12A7F350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  How to Fish/dstorage.dll
- Size 202KB
- SHA256 cae65787f61514bec6f012f44546e68b19e39d8854a9ab52af813370d44b272a
- MD5 08c190f8d8a2c4e20024b987c979de9d
- SHA1 a882f13df94f7e2dc3c0f2c4fbaa11bd988e1937
- SHA512 99002ae98cbd9cc9f377dd7b94c8d7883a0ff9ab02432585ffe2cf79600883d4d743790836fac425cb7f98126c255ac315130b861c464983c46be7a6f3064601
- SSDEEP 3072:Tzp2M7bV6ITJngWPqo5KVK8xHdoSe1OvnC/8FSz1RO2bR5cuL3TBJHi+eA+:TzsM7bLJn7PqouhHd9rVSZrtLTBJHiP
- TLSH
  T1B8148E55B6E400BAEDB7817CC9934606E6B2781107609BDF03A0837DAF2FBE8953D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  How to Fish/dstoragecore.dll
- Size 1.4MB
- SHA256 cf85b19a92a8276f8baca0db9bbcd60735bad50768deb303d310e84d5f4fdd11
- MD5 0b4f419dce596a34a7f8bdeaa06287fe
- SHA1 544ae4e733fe1f26d234b4921424e8564ca488ac
- SHA512 dd7dc0b08e4b7772fb41915e449dc2967e3ca046bce218d215f157a1201f2003fde8f469e74aed45a0d296c09b31593e4d0e415f576fc5b71916b083392d524a
- SSDEEP 24576:d4wQzMbV43xPciwvObM3vn0+poj5Z2ah:dZQ6+PcFYUa
- TLSH
  T1FD65AD83912194E1F1AAF23FD999D081EAFB7C210712CEDF95E1523A5B337D468392E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  How to Fish/~Common Redist/NDP48-x86-x64-AllOS-ENU.exe
- Size 115.7MB
- SHA256 0a3a390c47e639d0f7fc65b21195fee6b7f65b066f80f70c60fab191d14b7e40
- MD5 74d56b9081a42f6315cea96c895cbbcc
- SHA1 ca87b70910f131b625d140ffbfd1c232ea27ab71
- SHA512 a1d1976c85381f3d17ecb4f10cd4d46283ebee5fd4dcfb962a7d617e1db3a83b0709d41243bfe6036788193f64e41040d3c28d55b2dc39e766a933ceccd28d34
- SSDEEP 1572864:jnNsueXwCRTIZPwqGS91CVM6oqgZIzhsinDFrgY/AUkAYrhXbYcFyDr9WWdX5bUV:jqt02qR89gZClDCY/lYlbvFy3b7Nxo
- TLSH
  T10748336F2B7C4520ED0BC73B24D5996144A9C8335B3DCEA6BB185B0A35F8864F4AF835
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral20
- Target
  How to Fish/~Common Redist/VisualCppRedist_AIO_x86_x64.exe
- Size 27.7MB
- SHA256 de0f71175828f9214494a6f6612bb653d0c023875b8b544556bff84ee4953d96
- MD5 91e79e0543a28b0003ba1801a5132830
- SHA1 00caec42c200e33c87a15b9ae105a977b3a1edde
- SHA512 786775f33a1b2efc06604248261503012ae457a8805f2c1d6fdfc3f189257db116acf13b2420963c68951718af1b957cd8a1a612ba5fc7ac9bb6ddafb1831c4f
- SSDEEP 393216:rV8PuFzZgmwO6R2AIEd3A3Pr9J6SrAYVLMnbu7vB5uBlwBR3i4VZssb3piHVm7/N:x6u6IA/dwjqYVLvuBmBRS7e3MgTN
- TLSH
  T1BE57331231ADFCD2E43521313B33E7D5FB7DED4AA1A4C98A29D01A05627E6273AE13D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence ransomware
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21
- Target
  How to Fish/~Common Redist/aio_installer.bat
- Size 3KB
- SHA256 f652b2eaef87fcad6ad38a1d41a337028a7353db2568f69a303a579e4d8eb3fc
- MD5 98c016af18a4f654fbb05fc168b9e495
- SHA1 7ae8cb6a197929713d5c635383706af81f31ff2d
- SHA512 252764cb8cb4a6ae34bb222d8995fa8d8701a29d7aa73d4df49a80a0b5d42d6744e76235a10cd2045c96c12afed0488418749862b29e42a1265b79a5ee110387
- TLSH
  T155611C3C340822FDB7719352C53E0682B658A18B4F22BC7470DB9578277AB8468FB4C7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  How to Fish/~Common Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral23
- Target
  How to Fish/~Common Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral24
- Target
  How to Fish/~Common Redist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25
- Target
  How to Fish/~Common Redist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral26
- Target
  How to Fish/~Common Redist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral27
- Target
  How to Fish/~Common Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral28
- Target
  How to Fish/~Common Redist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral29
- Target
  README.html
- Size 34KB
- SHA256 fe2a63bc761dbd9b4d4022960cc930b79e2ca42a46f490d01c1b8f8b0970ebc2
- MD5 271861d872564725a6939bd0a381a3e1
- SHA1 9b8e074a016c0c1ecc1ee092710e7dd37147cd8a
- SHA512 f4f31070d986a14484f27258425ac2c268dff9c40d1153710a58f462404c496bc73ed88209ea884b119c8f92513bfa175fa5117d055625a9e6b981a1ce8de787
- SSDEEP 384:LSn/iF+2qeobx1Gp6xjsibxMoKS/oFdWHEmA:LIiF+Ootu6xjzZKSQFdgEmA
- TLSH
  T1FAF2756592F301FB285795942BEB5B8B3F89A007D80AC9083FEC53988F87D94E95375C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  launch_proton.sh
- Size 2KB
- SHA256 44d98bc47bd42938549d4f52b8d619c92ed63b0f6abf6a04ffef397cab725703
- MD5 3d656ad33f8da78376c49f7846f23d29
- SHA1 6c3d3dcba1cd8fb4d09cceaed2c8e3a611472b94
- SHA512 8d3d2bb0835b753b554fb78960b773edd8ed68b09554ee0965bb4bf713a830e078df6f2a9a495a8914d9a7c81272d2b778e4f8f0f9c03ca38958f397f8fdc52d
- TLSH
  T10F514269B40473B9196901F43DC510667A9977FF88CC7CA134EEFA50AFA0B6C667830E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31
- Target
  launch_wine.sh
- Size 71B
- SHA256 4b489af16ebc912b40aa0195d0a01d2c801b9c40128bdb489f81eccbebaa7e6d
- MD5 5e721e08d1f745880fead8117199eb4a
- SHA1 23551774b64147314d19dc0bb3fc521deeab6b9a
- SHA512 3f485e4a0f6be0fecaa8cb2b057d2d2fae98beddf8f06e50b09f2fd409b333b2d9aa841b452c38fa3a5f5c9008b2db58e3d5600ffed17a93275992602036e02a
- TLSH
  T1F7A002628024CDAF055490902DDC08F16ACB59BF259614154483CD3FB17237BBDD67CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Checks installed software on the system

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32