2223413340e0dd9b3600f75175c0bcfd11566ce56fcd6e3025c25072433537b2

Sharing

Copy URL Twitter E-mail

General

Target
0ver-L0rdBoot[p1].zip
Size 10.1MB
Sample260823-npf82aab24
SHA256 2223413340e0dd9b3600f75175c0bcfd11566ce56fcd6e3025c25072433537b2
MD5 07d7d22fbbfeca3f1632d807c5f56441
SHA1 ea144593e5cd230eb4ae7fc8a01969638de484e6
SHA512 076faaa222d8f08d6c9cbd4afe2554496b5fbddfae744819884e49391e744a8d077f6d769340d1d1f9c18cc6b086273c8d279165ff58e83a9dda9db757126842
SSDEEP 196608:vQu/taRBqr2Q5W1QvAXyfiu2o0rgsCO4PDC1H09dG0V1jELGfOFgTd1TQ5:Y4B75WmoCv2o0MfO4Pf9dG0LSGfOKTdq
TLSH
T138B6332E8105D6B07BF76493EAD385C54E1ACB087E7506BD678326CD7C72D3A32A8C49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  0ver-L0rdBoot[p1].zip
- Size 10.1MB
- SHA256 2223413340e0dd9b3600f75175c0bcfd11566ce56fcd6e3025c25072433537b2
- MD5 07d7d22fbbfeca3f1632d807c5f56441
- SHA1 ea144593e5cd230eb4ae7fc8a01969638de484e6
- SHA512 076faaa222d8f08d6c9cbd4afe2554496b5fbddfae744819884e49391e744a8d077f6d769340d1d1f9c18cc6b086273c8d279165ff58e83a9dda9db757126842
- SSDEEP 196608:vQu/taRBqr2Q5W1QvAXyfiu2o0rgsCO4PDC1H09dG0V1jELGfOFgTd1TQ5:Y4B75WmoCv2o0MfO4Pf9dG0LSGfOKTdq
- TLSH
  T138B6332E8105D6B07BF76493EAD385C54E1ACB087E7506BD678326CD7C72D3A32A8C49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  0ver-L0rdBoot[p2].zip
- Size 10.1MB
- SHA256 0767db2eac9e0ac233cc0d5510328ae07c211d097d8f3d7631366227b577f489
- MD5 dfb2529007eadfb7c23fd3e473fccc2e
- SHA1 4d4783ac5e10b065043153d277ecff7ee6a2461c
- SHA512 3752d1e61a49374440e20a5c7dd60c0df4bb81b15963a382c1b9f6e56107209cc45b87569891c6c9570d820916b5166a13c499aa61b2c05d105f6ef824b39edc
- SSDEEP 196608:yUPewJ4epHv966ncceXi9n7wjCdw9+bxtwDH0HFE0OXA/8EVf+SPYF9sKY1qp:5PLzpHv96fpi9IqD+UjCW8Ep+SgIYp
- TLSH
  T1CCB63322D801D3CFF5B513605D7A1FA6BFBDA5DD4AA0703DE9190B467890291F3B88B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Over-L0rd_V2.exe
- Size 3.3MB
- SHA256 e811fa7cc219028e8bb1552fd261a4e1fb55f710832f2ad0ec4ace027d2d6189
- MD5 498c4db5824a76bfefec84e24ca536ef
- SHA1 61faae5a981fc9de22e3f0debbdc3ad26c09bd19
- SHA512 05f7fc5f3ff942d6f3b8a3050564296204789b4e0bcf45883ade27b8d5a9e2dfff1ff33cd98846e4b6983dceffcc927bed4aceff13aae2befb586fbdb05c496c
- SSDEEP 49152:+C3zATs8fOXwqMd0++Ckx9lfLGokQQhLvns:v2hHv0+w9lTnkdQ
- TLSH
  T100F5AE4BACA141A5D497973686AB4163B771BC098B3133D73F90B6342F363D1AE7AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  local_bin/EqualizerAPO.dll
- Size 599KB
- SHA256 2cb094f9a14dad89d9acf29fae4b6e036d8896b7e8eac52d010248a31006fb1d
- MD5 3f96577baa37bf625bb350776a91296b
- SHA1 cb9150ed61774b428ee3c55b7ab61be62baa8e8a
- SHA512 62fe6ead155c9a176fe90bc2bbb848e9afa7d760add8b2d5e5ea1522997cc05c83d138ed1281d4c047599363f1658117070b85e425b4f3df3afee86bcd1a8e6d
- SSDEEP 12288:3ruD49udWGn9SNMbrS456F+upz31+s5TiaN0a:3ruD4sdzt3p3o71LTiaNR
- TLSH
  T12BD41906A2A903A8D0BBD27C8AA79912F7B678050775D6CF1391426B1F23BD1DF3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral4
- Target
  local_bin/Qt5Core.dll
- Size 5.7MB
- SHA256 872a148e5fecf7df77231f68ad10d739cfc7c06cc2c04666b641529750dde991
- MD5 2f187bf96f7900698d8be13f55b295c9
- SHA1 8fda0e7b9e9d5eff146477f47c7e0fcc9c18d24e
- SHA512 f78d34aa2ee638025b7dd9fb14cb6f275bbeb9225915954b0c0d50dd7c59dd19841fffabd3de879c4b8e5b6ef4892a25a9558773e4b98b73d52af2d43ccfce38
- SSDEEP 98304:Fh2mYpTb+mDZZKQkJsv6tWKFdu9C2idxqf/gw:z2mYpTb+mDbhkJsv6tWKFdu9C2Mxqf/F
- TLSH
  T13F569D57B6A70150D0B6C23CC9A7821BE6B3B81287228ADF425CA70A5F777F1293F715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  local_bin/config/config.txt
- Size 201B
- SHA256 49319dcc9787bfbccc215c9fb461c42774dd6769e59fd3f5ebc84709940a9317
- MD5 2b7aa37c7e05329950a57a1b62f1689a
- SHA1 e69337e01f629fa882cf1b07dadc5799df58dae6
- SHA512 f9d049a592e85dc41e1ef3a818b634c17cc34b0215797a4a2931bac751ac41bdad9fa3fca8baf7c0b6324e8d67b54cf169ecd3760a2041c42b48628329e41a54
- TLSH
  T1F1D0C974976A2130F2F8C4411CA452404C1FA5E592021DD4224CF6F71A72C22E1C9B38
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral6
- Target
  local_bin/config/demo.txt
- Size 1KB
- SHA256 77eb35c3023b525024d5e3362cdfd8aaa132a5392d7ab1fca6e8c3da9478f15e
- MD5 3d9273d3e162ba953ed89e1c5a37aa41
- SHA1 4ae08056d90c3887148748bd3c11584eeaaa43e9
- SHA512 0b2c8b57de9b395692848475a219237f6bd09580627dd86b5c119be124b295879f8bad10d78cb3454d061a91e95a994d121e1508e5f887f17ff9edfc086e96a4
- TLSH
  T1F311813F398190F42681A6E9F12CC960606B98D5E63668F9751DE1DCB363A22CEF504B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral7
- Target
  local_bin/config/example.txt
- Size 692B
- SHA256 83f6d9063a14feb292632b7667c62b763baa52421345a4967f4078cf62385fd8
- MD5 d7facba3d4181d0289f46cebe05b73ff
- SHA1 43c119148a0a62ee24da0f7b34e7d46ed7e4b836
- SHA512 fe1c19a59c2922beb5bd26f911ce98418f81517c98985ca48e9f227dd8648b2222232352ae21b21ef309346cb222352351d21c6e18a5362c89b6fa719564a31d
- TLSH
  T15E0184366561C0F214884AE4B602E720B03F8D92FE6F64B13C0F608562F3638CB791EA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral8
- Target
  local_bin/config/iir_lowpass.txt
- Size 524B
- SHA256 7e17fc092784570d11c622084a9e797a435b50fa254fd2097729223ab07535ff
- MD5 f423067d009a7eec93f39f5bf79585e2
- SHA1 09f9a0830072ed08722d2888297d93503fdfb4ee
- SHA512 3ce702ea00dd8c795a1be29975c5372be9129d3422a86021fddf1c6b242774fd7762189ecba07ded82bbdc26d99d97a6e8d77ca1d2ca59776cbce5892d10b7b2
- TLSH
  T1B2F052085ECC8075EF5C9052BD0309738C4672AAA8381D5DAF9E83143509EA4F67FC18
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral9
- Target
  local_bin/config/multichannel.txt
- Size 231B
- SHA256 07b9a4de9ce6008a18e2c86ce22fe9f5ccbbfae02322203c69a099b6b4b23e80
- MD5 61738e95f82d20ff31e1f44de85d9dd2
- SHA1 aa8fed0399c880b4a2ef168f7692bdcd257b3670
- SHA512 7e434c7055f671317171cee2c760c88a8c669967a6f023f0a182f9325adf297cdc7008dcfb94b7e48f611abc97a2a8405ec10c2e23e6d33df745bdce9dbe6b00
- TLSH
  T1EFD05EA6E52A25310100A202D5A08641102D77B2F0064C2138CCDBD6EB6200EA91AB43
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral10
- Target
  local_bin/config/selective_delay.txt
- Size 353B
- SHA256 2635c340e93d1b87815017c1a728ea3cd79f28b82178a891d05e7ddbc9ffc737
- MD5 9df2eabc36599c6ef6890178fd3727cc
- SHA1 5c0741d42d66b46dc40f8932bf912ea054baa089
- SHA512 838bfd3718626a611b0c9ddefdbefca038a99b1d032029a50a6938469cf66f747c1f545bf92c7d6399abac983f3b4541d65c100afae7dbffda7bc58f654dc7ea
- TLSH
  T1A3E0C0C3BD9E10E1E71031A093D44A33483D734BC5A1C590F2189080F028025C152F86
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral11
- Target
  local_bin/libfftw3f-3.dll
- Size 2.6MB
- SHA256 42ca18fff35dd12890e04478bc990005b3969cb744f6843976bd436ccd7f0a4c
- MD5 9bc1a19ef7fafb31b43a964895ed9dcb
- SHA1 4e9eccb805eb876177a6b3a42f912ac52e9f20d2
- SHA512 72c5bc879c8869f0d3c00dc32f9187b267969948e5b578ac1a86af8c83d7126297eb9a7958d6da156a5f348aaca60bee0822c5416c17240cc8850dc2cadc2d8e
- SSDEEP 49152:ZbVolI4xMje7CLVUnHQl1Wv+sKwh14RT9Z04TMzYr1ZBXwD2idL:3o+0ae7GQ+5XZidL
- TLSH
  T11AD54A41B6ECCCDAF43E683091FAFA2B77257941490A479753A095AC1F637C02FE5A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  local_bin/libsndfile-1.dll
- Size 1.7MB
- SHA256 740dc79589813c83f5a6b8ea214b5c1031041881b4dc96703e295a7c04d09f5b
- MD5 ab078f3f6241fddfd39637d7b9358834
- SHA1 c895b2555e99a34bed57ecaa328c56bda4481b3b
- SHA512 f5646ce0255ae551308c6861447c39deade07f775ff33526bdc58e22a90132cae86ac44767b2b83c07633f54f8b516e06e2efdce75de98d9a0fa530d6e581d78
- SSDEEP 49152:gmYf13JE1o6kK5eQnahfzNqTBboLTfKIK15sRcRcQQQkixzjYz:gNJELapfJq6b
- TLSH
  T185851827D653AC6FC3F681704642EA727830FC6DD3726ABB298066B13F529305F5AB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  local_bin/msvcp140.dll
- Size 552KB
- SHA256 256492fbbcf3dc63987318f83e5f49eaacdbb6a9a5be54e403f0ddb437582881
- MD5 111e00ce3412a863ddf3db65f237d62b
- SHA1 58503f051d650d0d95ea36515682afce18f504af
- SHA512 d586b8c2ee928aeed5e1e9f771dea24d209e09a47c8e84821ad0a5976e5fa16b77a04294100555f553aea85c5acdcfe49ad3aff6f645b5618fa8f482fcdb959b
- SSDEEP 12288:F/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6zNyVQEKZm+jWodm:ZN59IW6zN+QEKZm+jWodEEY
- TLSH
  T1A3C40923B75D05E0E195A3B8A1838305D7F17C4A8312A3C792FB96AD2F673D56B3B190
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  local_bin/msvcp140_1.dll
- Size 23KB
- SHA256 2c03cf78553689ca0523a3ef7c3161939b8f4a2fe246d9e90efa9cfef95c59a7
- MD5 6d0a35401a239a046dc2a43777b01a30
- SHA1 0d7070f9abaa911f636cad4f0d5bf8a3445a9e6e
- SHA512 9554ffb6d87aa25bc80bc56ddc46a5f310fe0cdbd4dd1ba412c58c4f103be55bd96dc76652c39865f662118df5853fc3d2886a7c02b4e156eb31d5abd7f1cc59
- SSDEEP 384:IXt9apR9zFzN2WWcZ5gWc/14gHRN7eDH24rlGs8:IXK79zFzEqQeT6
- TLSH
  T1F2B24B86FB284843F866543082A6DE07BA3DB3D59B2193DF1361E75D0DE37C1AA35A18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  local_bin/temp/d3dcompiler_47.dll
- Size 3.3MB
- SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
- MD5 c5b362bce86bb0ad3149c4540201331d
- SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
- SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
- SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
- TLSH
  T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  local_bin/temp/libGLESv2.dll
- Size 7.6MB
- SHA256 68d56f1681840e5f87e1b06c47a82887d9a147dcfc8de9c1f9a778f3370014de
- MD5 a536c452920e0d95c5cd8cd187ca3e65
- SHA1 c33974d8def318317615f9714ee175e0dbd80661
- SHA512 959c81d2ce72b498aecc96f07666461c6b59f4e0c6113b5118b5e1cd727e8e9370a29a07595516066b83b70c43e4d1ac62b87545ec708019aceee3b7e3657258
- SSDEEP 98304:5nlbXzhGP2sAjc8pjCT1VNpv0RCw+MGIuRStSVoYewueeNygIc73ECclRI:5nlLzhGP2sg75CpVNpv0RCAuRStSVEz
- TLSH
  T160860B46EE474CF2DCD33775B197B32E9A25AC30892BC6E7DE458224D9A31C12C26B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  presets/DDSPreview.py
- Size 17KB
- SHA256 a5fc7f2959b2ec55ded0ab8164c2fd16531dbdc394c33c0adb0a4b7de169e253
- MD5 7443cbda06135e84f3d6045c7333b8c7
- SHA1 f20e1c8fa3ddb7d34a199a6a079a7760f605ef6f
- SHA512 ad06d00f6574f5e6538aea0a7c295920f679ce3cf69241b6ce6266c6c6090eb70ccb0057fe934bec541bad1c6c7a0f7e7fcad3bafd67d73655e61f048528f588
- SSDEEP 192:306/66i86vi6Ph6k20f7CA0pQMSYautfwS7P7k8dK1mU3wvpmSxVAgL:30PDRgP7k4QwvpmCVp
- TLSH
  T10A7277D2DA4A8114A533E86F15812D03EB2E9397981DD59F387C6054DFB4480C2F9FEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  presets/FNISPatches.py
- Size 9KB
- SHA256 393feaa7b7927b66f3ede107a77d8b2e6dae9d4723cad9565651e64ec1a9a12b
- MD5 02aa10fba48dd5e388de1d182d82e2b6
- SHA1 e0053ba2cbb6e25806e4d13f62312eb20ce18140
- SHA512 0c2d491789878a0d559b0094b1938cf2376b04d81ad95f83fce0bc55ffc78c01c0644ac5c8fa66f6708eb46855f93a2259218fee73cc7c8ad5639babb903cc10
- SSDEEP 192:MBqMjctPihOPhX2yXyjU7d50QEOadkut/zkrJVKhpo//nsjgPRFuo:cqKUi8PhX2yXyjUgJdkukd08tB
- TLSH
  T1EC2275F12DCFAA11E2B3835D992EDCD3F31B816B11286512797C82543FB1494C2B6EE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  presets/FNISTool.py
- Size 19KB
- SHA256 9cdf21f7e797cc0312fecc385790ca3a67555d0af57406d696251e09fc37a042
- MD5 0b0f700ca8287585c28c61977b25053f
- SHA1 a1e6a94311f217d0376a8620837c75f0d5c209a1
- SHA512 3623307587c1c3b4a24cb564743fdd2eb363a921d6c82a9cadaf2647ec9b1d308463353a362fb99355b020ceb6ab02d03b0b9c6cf757c4df09c16a6e7d4b7125
- SSDEEP 192:M7jbnrMCKJ0PoRnQ42k57jUg/y95pnbaV/g/FlpbNHy/8l8jHPzy/T8UfFcSt/DQ:W3MDJ0PoRnQ42k57jUD9znWy8ws
- TLSH
  T12C92869DAD9D6A21D233432A193975CBF72782CF001C0E2A743C4BA16F7845583DEEE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  presets/FNISToolReset.py
- Size 2KB
- SHA256 69c3eea951ae26dddad43c110a0814a427679822b5bbb0b7f9249c903422cf75
- MD5 929641a65d9317b0a21471ce02802bc9
- SHA1 2a5c81100a0bfc01a51760f170a88f450cc6ad37
- SHA512 4b4457ab5cf8b903a21c8764af41ad4d580a6bd815deddc90c99ff81912c3645e49e3ebac3e2fdf98ede96b52fd7a08d60dd405f8dbd94a03afa47df05cde9ed
- TLSH
  T15241FFD1AD4BDA54923BC26D2D51D983F33E52031D1DA217B8BC81B06F385A4C1F9ADC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21
- Target
  presets/Form43Checker.py
- Size 3KB
- SHA256 32688f5ca3bc6eba94163c0479dce9622b07907d5aa5b405e9f3b1968940dac8
- MD5 cad8a25b2c6169b6a0f407f55885ce79
- SHA1 cf16a384dc9bc8943045b8935bb6a13958b7c3b9
- SHA512 97fcf215c1b65bea29bf1e6cb52206c93b35dadc340434f62b295f786f7839e7503d422b94b3d34f9d8fca73d8f5da3325301e61d392359cd759019e4016b5fb
- TLSH
  T147810FE2EE4FE805A2B2835D8919D8D7E75DC79B051C9203B57C90A02F36866C1F6ACC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  presets/check_fnis.dll
- Size 50KB
- SHA256 4c20fd64783299a172a902d6ed363ef95eb8e81fa7e8c56f114e090e712d6de4
- MD5 6b1118334b92edb81c42680660e74bab
- SHA1 1e07b57e8f6ef2f276786795dc317b07957366f7
- SHA512 18cc6a6f0ff4b1d811c46df5652f2879ee1c95d00663673b5dd902c52a7c53d26ac0ffabca2a1bed2bf93d14b6c6f5538a172917138ddc538c21834d0be77bad
- SSDEEP 768:f1DbtJWRyg6pG/JJFpx60yWTbohR7Beu+/:pWAg6pG/9px60JbSR7Eu+/
- TLSH
  T1FD333A2E735801E5E178C2BDCB5B4A56E272F4204362CBFF4355472A2F277C6AA7E604
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  presets/diagnose_basic.dll
- Size 131KB
- SHA256 03b0f12b25450d4cf51fbecb2177ce67b16ba63a2d3e1221d5cbd770bd554178
- MD5 a2ebbf85b1043919bd9fa7e514b0c65f
- SHA1 c9e761e7e9525ef1a071a7cd3ecdbe8885d699e4
- SHA512 ab2f604915a16768bf6422e1a130b97a77da88a26a537afb9ebf76d6ddd887f44df9f577061485f54248a038f642575661c3cae5d4d846ce2936322717f49e91
- SSDEEP 3072:Q1KfXscoAf0TvKQ9qCKarMczQNLd9jKk/:Q1Kf8cBf0WWkhczQNLd9jKk/
- TLSH
  T137D35A2F366602F3E526D17DCB4B4946C3B2B01547129BEF036A072A2E377D06E7E690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  presets/game_enderal.dll
- Size 418KB
- SHA256 7b7cd413d7a98f42cf5ce812c081127311e85ccdc99a0ad7824a9ee205ef06b7
- MD5 8c6ef12862c8f719b433281d1e339c78
- SHA1 2767059548db81533ac1c39df266f93fb474dffd
- SHA512 5ad6faa7b32acb9cb312a0fabd0d4ffefd333501284224282486b0bb8442844f3cf386c42eb7751f8a5ea87c1b953f0632e23cfe5b76e38cfb9c496187a220e4
- SSDEEP 6144:0NODaK1JH2v0IYwCAFHnQ8F6sDCZph0lhSMXlBXBWfbyedQzIKNIk1/cXQSjkyl:0NiFatHpCZph0lhSMXl++Y
- TLSH
  T1AB949D1BFB9501E9F12AC17CCA9BC946E2737088434147DF2669E93A9F373D26E39604
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  presets/game_ttw.dll
- Size 418KB
- SHA256 c2fc20df111c2b798e023fcbbabc2238170e573e0d76ed9e8a9cb01febb94389
- MD5 210e11c7180f7f4730ac76f60769761b
- SHA1 5ebd6ef6206893516961948eca66c1c235246cc1
- SHA512 0505fe1e1007ad0b1f2aa660370c12e7d0f6c547a51f0b6074b60e736e38ca5dbab722b0ee0cf43e1c4071687368671383645b1b67358087b54e9f086660a295
- SSDEEP 12288:NMhIBVNesSSECEBlkph0lhSMXl+qin9yBZ:NlvXE1Bkh0lhSMXlXYyB
- TLSH
  T19F94AE1BF79901E9F05AC2BCCA9B8946E2737088430147DF2269E9799E373D2BD3D641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  presets/inibakery.dll
- Size 26KB
- SHA256 41627799e639e5a19312a90cce5f75991be4d000cb41bea3aacb94854b5d3cc8
- MD5 c2ae7e8c119b687fdec385a0ebbfa9be
- SHA1 4c6d5c90d38e9ccc227a1580878e4e1b236b720f
- SHA512 a57f9e99edb8a042e25822e74e81df4b2477c9ac18e98c763a75eab00ea862b8faca886ea8a32abfe78c425a17801ab80df917300805c447eec656cff203da14
- SSDEEP 384:TN5xCk4LlzB6QMpd+meZN+CBNDBqdlA0vC4QMu/F:1opB6QgcmhanQbQ1
- TLSH
  T1FAC23A5A771804D2C03AD0BD8A675E16C273F26057629BDF13A2029E2F377D4BE3E616
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  presets/inieditor.dll
- Size 38KB
- SHA256 84367a459f3a23903d25def69bf19b23d03d795b01d43632f1cf164525efb535
- MD5 03934df6787296e957fb7f4d7f5be9ef
- SHA1 9c9520310961489fad13b2dddd98cf0be8b707d9
- SHA512 140b0bafeda509eb1dd2f67d55e5e6b621caca9f0211b50d300716af56111ebbdd0f7b241c10894a4fd6e2faa8f7cdce8e98199601b00c2d85cffd8184e5818c
- SSDEEP 768:3zMzS6GeUFUuF+Z8QyQAQqm5zN9cn45A3WZwyayO2TJ:3zMzS6IUQ+BtvLZB5A3WZwyayO2TJ
- TLSH
  T13C035B0ABA1A00F2D165C27DCB175EA2D2B2F020972397EF8266051D2F337C16E7EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  presets/installer_bain.dll
- Size 75KB
- SHA256 a798807c3bec073d4874e9e0b4e18868b1f1cf19b8dc44f2fad1790517472ab0
- MD5 8bd7397f640b6ee8fc3a93d99f7ae20e
- SHA1 b7b34cc72c5a595e5eb40486f7b5ace48235f5be
- SHA512 1ce8ca05d3c01a3346a585fd6f724d1bb70c7f9a83619a6ae423a3237f06e306bbdd9ec81c33cb86362928f90cc6e91fe5885380b34068ccdafb449a57acbeab
- SSDEEP 1536:Kh259lggZoCsyHkWfYpISTAdb75A3swSuzFwbQOk8WbbIpNcpRcX++lQ63:KnQfscz8j8wSuzFwsOk8WnIpNcpRcXo6
- TLSH
  T13C73F867A76A0292C29AC33AC2874EA2D772F052471387DF551B670E2E273D13CFD949
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  presets/installer_bundle.dll
- Size 50KB
- SHA256 c2c1a7f2139c1c588beebc412f89a36ad948b84182c0272afa92a59ebd2ade06
- MD5 d3b9f6779996418e067a2239f5a2ec44
- SHA1 b371d33ca901301747bedbe6e1bf3bd806d5e5de
- SHA512 3b7272cadbab1aab626ac6b0b104b4efcbd5a483d36b4b762c6e7363a0e2f24475c27ed2876ac9271c8e6cef6b9273e40c452ce990ac7180cfad328106c9147b
- SSDEEP 1536:J9+umH9IZZsaL9c0VMMzUOQ8W0pNQcX++lx9:JO2N2AMMzUOQ8W0pNQcXJ9
- TLSH
  T1DF3317527B1A01AAE155C379CA434F50D072F0614B1297EF8267A9AF3D733D03DBDA8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30