bc3d1d3dc1f90a592398e58c2fed8b754ab4021764ec33d721fd25f997e0c31d

Sharing

Copy URL Twitter E-mail

General

Target
Manuel spoof-20260821T231526Z-1-001.zip
Size 7.5MB
Sample260822-p7ch8sgr3z
SHA256 bc3d1d3dc1f90a592398e58c2fed8b754ab4021764ec33d721fd25f997e0c31d
MD5 86b594c320574652e3ee62a7b4b33197
SHA1 b2a0a62c137bbf35f5c1255ec581d980908c4671
SHA512 2fd920fe947912903d3ecd11ba183a58fed35b7b86a163a793999c1ea22f664302d4f11738f2f1dde027f44dc2e3413abd40c6ccc9927b873ba4a625416ab796
SSDEEP 196608:LPjyhr2bR6JbCeosZELME208SgqEJzrKGvHFyKqs7h2qvuIgfUk2qk:LGdu+bCeosZ6N20KvtFyKqs7h2qlujfk
TLSH
T1F78633AAD13F2AD76402177B1AA68827E6DF5633FDF2861F117C781A0780FC9D0A55C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Manuel spoof/HardDiskSerialNumberChanger.exe
- Size 636KB
- SHA256 2c141c06f7df57f11ef2c62f2a96093484a65df47065b1a475c53784af0e2664
- MD5 c20e96d4e616ce333c19a1c15a1cc137
- SHA1 f79645ec115130ee59958c55a556f564260b7a9e
- SHA512 519fec9955c4a18e45ec68d9e7dc2bcda74721a6ea088e59e634e26b136bfa15f5efedf8839c036a3cfdcdb9780a2121dc2d71f1fdbbfd3df02d9969e5db753b
- SSDEEP 12288:EN1TNRzUSWgDxPWnP0Lamg+hyMU1EUFT99qpDDcZDDR5Id1888888888888W888H:whNRASWgDxPWnP0LamWYC8EOd
- TLSH
  T188D47D12B3D14437D177563D9C7B92A8AC26BD212EE4984A2EF4FE4C1F787813939263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Manuel spoof/Manual-Spoofer-main/Manual-Spoofer-main/sefdebos64.sys
- Size 18KB
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH
  T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Manuel spoof/Manual-Spoofer-main/Manual-Spoofer-main/spoof.EXE
- Size 453KB
- SHA256 4d876771b67f7987bc5a91be1b2082af285f4b1ab76f6f9d6c4f19eb94cd7ce6
- MD5 901c83df6761665877301485c0a7e52c
- SHA1 b838134c8951da7be96eb5d7ddb80aec071f1ed0
- SHA512 5701791b71f318c32d88330009369a7db1917a5258124fa270c71ef13047130ec71ccff36dd18c068c30dd57f3d1e9dedede0058611eec791d259845f81f9184
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsCiZ
- TLSH
  T1F0A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Manuel spoof/Manual-Spoofer-main/Manual-Spoofer-main/spoof.bat.bat
- Size 969B
- SHA256 c518015bfb22067be444f9bf3bb1048715fb66925a00d6f34db5562eb22d7e6f
- MD5 4df6a92a224171929bd136a523e2a299
- SHA1 a51fa05232de6640377d5b2118a9d830baa54bcb
- SHA512 c54e22532462878f6b41d4d3e4615001a58090437198468fa9966e45a129f969d3b11036fdebb7a4e0d741a8df1f07c9b10b507360bb5e0d4ee9a01e4965f65a
- TLSH
  T12D1170E5BC4BF022EFC54A8381919C3299E365DFB168B36BDDC0551CD276018B1E4B2B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Manuel spoof/TMACv6.0.7_Setup.exe
- Size 5.1MB
- SHA256 a453b3ea8d8133531fad26b18701c694c324cc201e3069d07e99f0e100908c1a
- MD5 a7c8cf1d50ebe630a7d0c47686a0abbf
- SHA1 3229e8080975f4f5512d2382552f68c0389acff5
- SHA512 42340b7435605049e3f817feac1ac238177772b2b1ebf05eb9311bb58ee3dd1cab39913240a4c39e3407374009310770d8221c31914549524ecd92beab93b787
- SSDEEP 98304:ARU3j4wtopcj2dqCYV1coZ4hv3tmF1b6CrjfW/sfH6s7zQcKDsVv/JLSF66b/:ARqt/CdqRc64hv3tmF1b6CffW/sfH6sm
- TLSH
  T14C369E2777EF9035D6D7827036B66FA26E387C452A3C8D0B3234B54C17729A19AB431B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  Manuel spoof/dmiedit-main/AMI_AptioV_DMIEDIT_GUI_User_Guide_NDA.pdf
- Size 1.3MB
- SHA256 020fdee2068ff290edc66a12f095c59c7f310cd5a70878e96a9b7271b7c829ee
- MD5 5d77f7b365101d1aa897e64c9cb7dd66
- SHA1 7343d679d3b4a5d335a48236747d3773e9458443
- SHA512 649ce3d2adf429caf96027889d137b21e7a5233e120857a4786d8eb50fd867fc7f6fb8b1d4712ddb8899d8a89eec5a52047b303de0d76c3eaf0e4d70e9c65fd8
- SSDEEP 24576:MqF3GPB7o4BkzY7hAi1mzE3xrZcxud1Ql4cO89pJrCdkPcfZKJOYNrk8Z7Igg:2B7o4UYlAmXcI1Ql4IJ2SEfZKJOYNrkb
- TLSH
  T18E551220986D28EED6A14BF26B6F7C29765EB131E2C287551A6CC34301A1F7FD113A4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  Manuel spoof/dmiedit-main/DMIEDIT.EXE
- Size 874KB
- SHA256 9ccaa2db160696fb80254c618e5b9209721cc7e346e232975f89779153f4b110
- MD5 4117a0dffac69925a633663152b4f6c6
- SHA1 0b551b82844f33aa614e73225146be8ed0841934
- SHA512 4c3d2109b26d44e4cf87c43dfc16f59fe8cfbca6037aa99a438356e918de3127f80d7e316e32a8eb21a2d7929f5cf2c893247de7d7c29bb67554c310bffded2d
- SSDEEP 12288:cMsfL7gwKG2BuXYy1XqFYf6g8sKqNij8PGFo0rmMkwNq1C:cMsjEwKXs5qOSoNiQPGFlrZkw
- TLSH
  T10A15AE103650C072D52175764D6AE73ABA74A9311F342BCBBAD85E3DAF742C06E3A31E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Manuel spoof/dmiedit-main/DMIEDITx64.EXE
- Size 1.2MB
- SHA256 6dad893927f13d100e6d1ce85f243c3c3ba56696763e7a542bee986a368d613e
- MD5 1d8a4e6dc57fe8d8646fdf3c8aa76b64
- SHA1 727463b0185a600bf1e7972f6b554e612992f8be
- SHA512 d95bbf6810d14ac5da2fefce3ad9b68c2de10601eae5cd016815f3a403245701d77ab1faeac34241c866443c7315214c09aa94b7888aba98b8f519c7b67d6010
- SSDEEP 24576:WAWhlqoVygLhxVs2gl8wXS5PxSGpeN+Y7d+uocwXwhI:WAEygJaOeMtKh
- TLSH
  T158455946FAA841EDC467D179C931425AF7F078524B3087CBA1989B1B2F376E29E3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  procexp.chm
- Size 70KB
- SHA256 36daeb8eb206d1ca5a0933fffcb07645c9aa68a037d64839d3dbc692c403e76f
- MD5 475ae5061422ff073557d61fcea2b713
- SHA1 df3f4994759d21059c9f835f621740e3e2fa429b
- SHA512 22e9987f04fecad7aaedf7c415a7731871a004b4b516e4a3693b37789eb58b9b006356ca81f2cddb9a9d7c0156fa8fa125bef48791aec00f9b278b91f1eea308
- SSDEEP 768:SH5mRRhQe/XDDOsj7rIVlFt1jrxcff5vrq0evTXfpoMQ/e+JBPQJVM7fvMB:SH4R0I3BrIn1+ff40eTJQxJBYJVM73MB
- TLSH
  T19E63F1D6BC8B118DC44D30317E4FEE4979246CB9BA91A5FCE60E791F060520C5B749A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  procexp.exe
- Size 2.7MB
- SHA256 0f2081ebd2ef0baafdd699dbd1b77853a35b50943418ed6207f896599f41084c
- MD5 b5e7689f66866281c26503b58733d834
- SHA1 efeee983af571f5e3e519935ec385225274d05e2
- SHA512 a327d38c63049e7973df5668af07dded5dbe386e094c1e27af97059be3056bcf512293197837c514964a3d4009d6ea80d2a859de054b8be401f8d101dcc60e14
- SSDEEP 49152:xygKkss5FYpJ1vU5LdVa2d0JbASq6lFPYhVBHxuzIS:YgKYYz185LdY4UUxuv
- TLSH
  T1D4D58E1073F59165F0B6963059BA8762DA367C322B36C5CF5290A51E2F73AC1DB38B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence spyware trojan
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  procexp64.exe
- Size 1.4MB
- SHA256 77358157efbf4572c2d7f17a1a264990843307f802d20bad4fb2442245d65f0b
- MD5 29da4e6b4b4325651fd4e1a87d333b22
- SHA1 d3dc46078a137f17c50887ff6f17be40dab20626
- SHA512 12f3d75d8b0f2d32a06d8e52eef1364dd219ada8fcaeda997d68a792413744cb5d66b2cf7aabe6bf9e56f54f348680b8101ec04353842ef0b08887f6eb6b4b66
- SSDEEP 24576:8Wd/PTCb6xqDtw5lx/HvYhNj0mHxURctb/r3G:ZJbASq6lFPYhVBHxuz
- TLSH
  T165657B1163F842A8E0BBE674897A4617E7717C561731DADF0250EA5E1F33AD0DA3CB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion persistence spyware trojan
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  procexp64a.exe
- Size 1.4MB
- SHA256 17312afa9f04eb4015442f209285e8adff7a179ed2a1e4536db5a2ae7108d032
- MD5 e09abe8955a7107260b1cb679590ec03
- SHA1 d7dfdc03fd00b1f57edda0d15e918fccaecc58b1
- SHA512 db3773e6ae75fd1a3a514ad8e6145d5e876b395919cb3e0b83fdaea68038088bfbbba47e35a0d2dcf9ba031fe35dad5559a02e3bd34aa022bb652bd1b38c5454
- SSDEEP 12288:CikV8YaU2BKCVhYVkjyTVxE7r68BEGpZ9KE4bpmB0EgtlMHusrcofWGVH9sGoBA0:Dk2YyVhYVkjyTIKEConVHiG9/Y
- TLSH
  T1D0655B405B9C9886F2E697BCBD714F51B13B7C208931C24B7A79218CDDB3ED0C9A57A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Manuel spoof/dmiedit-main/amifldrv32.sys
- Size 14KB
- SHA256 af9ecfefe947b93769364de7a0fdec145bb198e926164ed3e0617b0beadf969d
- MD5 8d3e1fb3111388c775c5e0b3f3dac9eb
- SHA1 3216a83ec00e805ac30c359ad07706f9ac65cebf
- SHA512 d987df8389d69f9035340d8cec56d7464ef267cf5201ac3c70e29b4f994b73b069c5a50d7ff2f4510bd7305f2c620cfd812e79b0559d371f703e5fba00d8c637
- SSDEEP 384:ICqzF3oQJdiUeTiI063mirILpiV8UHeMFB7OS:I/p3D9IILpAF
- TLSH
  T1C362E7A216242872ECC51EB082CAE6366F7AF3D51F9465D3507047C9BE8A7E53F2414F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Manuel spoof/dmiedit-main/amifldrv64.sys
- Size 15KB
- SHA256 26ba58c9af9c8a7aebf222f491f786daa0626be44d34f170fea3623d92828e63
- MD5 73fc2954829a49fc8eb178b000d10120
- SHA1 4040f6974119ff2486f9a0cbd749ce240cbee2aa
- SHA512 d4d6529633ffef9c6ce381db44dd4a568514e5d4f5118de1bea76e74c56fd1f4758a3fd3cabe215cbd651296fb818e88529c95270db00452c4dc07b372953137
- SSDEEP 384:OfkmSN6aOu0HMt8RMy+Ld3mirILpiV8UHeMjnBjm:Of3S8yCMtuMtLcIILpkY
- TLSH
  T192622A9746246457DD878E34D396DB37AE70B3A62FC452DB4070C1866E87BF02B3930A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Manuel spoof/dmiedit-main/bit.exe
- Size 472KB
- SHA256 1b4ec7c2e7809039c02d65f956e8aaed8520494b1474f0325d35e789df17955a
- MD5 2aaec74858669b34edf5bdbbe67a341b
- SHA1 0d488365065d1929b6892728425d8768f4d9ff43
- SHA512 795f1e70fff2f5d555b4fe0ff37ee2606eef077ccff10099d7d2b5815eca7a824441b21091bc0feb582d9071b64e7b0d3b73821013bd2c16c7c132f54961bc53
- SSDEEP 6144:GlWGftTYYSNjALESHNec7VWvdsPVwuZdhenbSVxMEgfqt1aR2Y8HrEWfqaq/PN4l:GlW5AZH9yUK7Y6/pQYeCinB7
- TLSH
  T1E8A4C026F7814437E2331ABCCD06A6A593397F703E28544BB6E80F0D9A793D67528397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Manuel spoof/quick_hwid (1).bat
- Size 480B
- SHA256 7545bef8cb8dfc56e4f18d75bbd16573c156491495f4d65b899d3d9ab2822ae1
- MD5 43e8d6c0136780fc73476f10ec177dfc
- SHA1 a55bf64d26ec4fd38bfd9b9e80e053df1e67f27f
- SHA512 d8a6650fb0cd991d90ab49c9789e447b7f77e4bdce4789797172d0c778f5619f1b4dc3bea3ba2b718c963318ce7fd260b19255f6976957bcf2cffaad36d9d534
- TLSH
  T150F02729C9948E965A3647391F6198427A2404139C57418D3C7CCA124F6A9ECA7F316D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32