7e26d35649333fe6cbe4683cd705a57b49e945984b10253be375a48a6611d84a

Sharing

Copy URL Twitter E-mail

General

Target
Download_Archive_full_871082.zip
Size 721.4MB
Sample260823-sqd8aaaf48
SHA256 7e26d35649333fe6cbe4683cd705a57b49e945984b10253be375a48a6611d84a
MD5 a0cff90a034d2579c2a658a97324e335
SHA1 6e35079f84cf86f105636ef4d4f02723be94dff4
SHA512 ec8e114c11ee7cb6f1a8d85bdd1be71d1bee009e1a82f8b0e8d392871d3c13a660d2b865717702cbbbe4af5d7a95106b0b7a67f44e366830401a4b46e7494824
SSDEEP 786432:WD5SK91rNQ5OWtX0vXihnPYz5SQH0TZZok:WD5SKLpOOEkviVgND0T/
TLSH
T1B5793305CD2CE4D7FB9736B9B8B0D1579A2F907232CF9195B99A31F4AD4AC006F2C909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Download_Archive_full_871082.zip
- Size 721.4MB
- SHA256 7e26d35649333fe6cbe4683cd705a57b49e945984b10253be375a48a6611d84a
- MD5 a0cff90a034d2579c2a658a97324e335
- SHA1 6e35079f84cf86f105636ef4d4f02723be94dff4
- SHA512 ec8e114c11ee7cb6f1a8d85bdd1be71d1bee009e1a82f8b0e8d392871d3c13a660d2b865717702cbbbe4af5d7a95106b0b7a67f44e366830401a4b46e7494824
- SSDEEP 786432:WD5SK91rNQ5OWtX0vXihnPYz5SQH0TZZok:WD5SKLpOOEkviVgND0T/
- TLSH
  T1B5793305CD2CE4D7FB9736B9B8B0D1579A2F907232CF9195B99A31F4AD4AC006F2C909
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  data/.cHA
- Size 328B
- SHA256 8a7e2c51bb0151bd222187121d1cf93e112aa9ab9438fff108191d775b92b4c1
- MD5 fd3b1b934e0fe594b714b407f037c0c2
- SHA1 6c8491c19eabd1c569f53c20c7a7ac258bbb15dc
- SHA512 0d5d650d7d16748789b02888144283d9f03ff290c0c6c93971b2b2e677917c7c3f879a0139c597e050f1ac5076a9e03fd4104e0ac013ffa9d45a2c26e013000b
- TLSH
  T13BE02D2A7C39D898C3C80E7ECC00A44080CC2B2D6D8E572A3EACA84D38FDC806C3E5C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/JAmiTwKlOTW0.Dp
- Size 10.9MB
- SHA256 c0fa528fdafb051c7a2259c529cf2117cc8e688393ba3a996bd6cdb553676524
- MD5 eb28ea2d2a78fd204681d48efcbed74c
- SHA1 6effa67d5c8ff9ad0447cd33dc623f91b0eee47d
- SHA512 a1dd2d239fb32a8fbde412c7ac670f629595cf357122306b590d47a563a928846af89f0b3909ec176882df18fefe867dc0ac8a5edb085c0cdf4699f7739c76fb
- SSDEEP 196608:Fl0w+Lt4cBvvt1DsPBAWszxHNF2S4JHGafOCkCTA/axBeUpKOYFY4Zq5IA/KNfaY:YP/rfv
- TLSH
  T1F0B6E7A64708BE47630B7F07D310E6D8A356652B29499B88F6E987FF7077FE9410070A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 ef417087c3d879eedfab3046e523786e9f69b3325ca293fd07adc742d7891c07
- MD5 48ed0de10f95e04797b201df5f549ecb
- SHA1 d8999df0c9b48973e6774f2d585ff219ac5c0d29
- SHA512 983633120fea618cd085d2ccb7d0786e59d37eb0dd1230c7997463a3c7a9ec805a14ced72aa3bc0e3cd1d9e2bce33c922c4c17ab5170e101333b7c2ac9339a7f
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/Fn:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYs
- TLSH
  T11C84230988C710040DBC87A97105FA7CF16C6629A3EB637969E7C6F5FD1E8662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/cache/py3analysis.rpyb
- Size 69KB
- SHA256 189379f519ed97601893120e105a48827d387eea96daada17369c8f61658702c
- MD5 875d4fda753d3514a04c708ebfea12ef
- SHA1 5762b10aedd7bc1ca0ec40c7761e0cf24a12ad72
- SHA512 2607799b7fb1574ff510b760fbb4c1725baecea987ec1a2abcca3e48ee8904a7300150961a53247840505e767f65fde825a2cba93bb4c87314bad7ebb9782b52
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NR8:fK4FJumM68gsjFliwugQikL3NR8
- TLSH
  T1D463025A85497B3BB410EEBDBAD6DC44C124F7C03EC603A39F59B98853E4DA03652BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 d2e19463eaf427c81526f1054fbecc8d2688aa22699d88ccd032be6a0fd606a5
- MD5 a548e09b66e3aa3e873633b384c6427a
- SHA1 514e195fe30ca9d389a59998fb8b230d65479bf8
- SHA512 c5a8b05914768323fff8f7b3aa736be93ee7a9c3dcc520734cf5dc52606945db727630895dd4fe2af9f2bce6ac9c0456a433281a2634362c55349ba938de141f
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaKxM:Z77jHIL0vBzbiE54gbyDdkqL///qHaEM
- TLSH
  T149C31323BA3D584858A47C56CE81AFDA06E04C0EE68FBB4B41967C9C9C1F142FF51DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  data/cache/shaders.txt
- Size 659B
- SHA256 08ce1e0c036685e788b616ac5e1e3dfe1d5a9792e5c5544ae073efbd4e5288c0
- MD5 1efd5d32de89219b4a263f98d9725f8f
- SHA1 c9fa663c46785ffeb1852d53a28a7165c8e7c4d1
- SHA512 ea6ed9b5ec7a6f86271bac5bbaab1be2bcab14b62ab18e6279fe515d6a24d6e24f5a8782e699d6afc59ab71c74e99df128f3b9d2d5b3d7800f9e6555d7b6da02
- TLSH
  T14E0123D229664DA5C58260342D6024CCF38AB5014FE9CEF91267A3DB470130A27D0936
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  data/gui/bar/bottom.png
- Size 1KB
- SHA256 e0e00789ced8bdb46b92ce1c634e02303bfeb24c16c0042c816da6b4e1f4cea7
- MD5 db229c31afcdd9aade3480ed6886c18c
- SHA1 01eebc42cc55300f23ed96905142cdfcab0a7b79
- SHA512 b29169ec1a42f44525962aba0053089ed4b200d9fac6d26ee855e0936e85c6028143fc75702d2ee4b97cf4599fd51f8cdd2b8722ec0077567a25a297e2217d6b
- TLSH
  T13C2165EED3392F64A740E8A560317AF3CF1A1300FAFDA46C548B5B70054B633904A7B0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/left.png
- Size 1KB
- SHA256 edbb77e75f0469df2a08f4d959c2b189c5c470da8aa335e99f411e544ba42055
- MD5 9ca951fa2f4a7585ca51eca45413c2ea
- SHA1 ef03d8d25936600265db6708252ead9c03187fc1
- SHA512 93483031db7f007d7ab28ca062a24aa662eae1cd2169e10cd4ff72fbd13c7e0b3970f24fa14ab906484994e28b70766afba7a04c8682ab03ef4c22fde100a611
- TLSH
  T15E218754C345E537B36D25E3704857598C305D39B812DE6C25C2392F09DBF7A1C39C92
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/right.png
- Size 1KB
- SHA256 2b773acd38058d4f28b244cdaa6e19d03ba534b59e050f64ce372f1dc119b9f4
- MD5 6b3f37226cae4f85f4f55a7dea3a0e09
- SHA1 3f95c46ac45e926c64d12d8beb73e14b00348e94
- SHA512 640b0da8d5ee95ea87646b312fadf93722f1f48a60672b6a6c155d15cabf8f291d2a524346423c69b0b40b67cee5a1e3f3ffbddbbb32c01f24ca77ac41ccb16f
- TLSH
  T1763162C8E2AD9536632802A0B2C64BE1442429BE7E50ED5841CB391F01E9F722D79E16
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 2bf63841e655bd93d2a4d9c4f27975105e809e012a8c201231cbc8450cfc1afd
- MD5 cd52c3dea88cdfa61910033343d97c83
- SHA1 89ccd5cbc63729e4048f8d42af5967f5f84e2e8a
- SHA512 1c55b56fe41f2183714401890535ec919c4f44d2ac32e23bf8a0e215f6f4c5183135287a75a456332090fc24219656b96757f7469a9e892cfa86a9d10bc2b1ae
- TLSH
  T14331379DE32D1B609381D8E69030B5F3DF1A1300B6ECB868A847A7700A8B9276585771
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/bubble.png
- Size 7KB
- SHA256 d4d841b5b0ce5727544b5e4a5efd502b04d8efb650cdb6420217c9b795e3355d
- MD5 b5273815487671b46d6556f3ff461c1a
- SHA1 fc1f5d0793d8c9e20fd4c194555240ef37a064c4
- SHA512 56a2a927fbde744d313fb6d3e43306e95ada180d58bd4c12b1e61d89bcc72eb63c6ffea409561dba7d92ac910e9e3644bba207bec508f7cac6e443e2ffacdd47
- SSDEEP 192:vzR3KblGhHiG+WsElhnJ3mD3SNnt5uxBuE:7R68hCedDtOSJuxBZ
- TLSH
  T1C1E19E12899CD226DBF940E159955763EEB10A3C06FE8FE2DCCC0E42CAB4D0B5B598F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_foreground.png
- Size 316B
- SHA256 0326417aff2c97af0602d923bede53de6a8e5cf467671e83ca6462e2f7dfde16
- MD5 ff57b7805ed38c41e43708d56512be99
- SHA1 2d43ebc94712004dad80c1baf1cf1b29f26747e8
- SHA512 3275c7d0b6a84b0b602f7dc300d30fc392dddc982315ba82a7cd7af5a9d1c8393f4a7b95c529ff55f105b31a8c2ad469aef3aec6f86cbeeea1766c9ff8ed514e
- TLSH
  T1D9E02DE74BB008348E0D3027233B082887B2863550A4281CA42EC8F06A41AB3700D2CF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/check_selected_foreground.png
- Size 884B
- SHA256 8d6e411d5c2d14a2e9f4506486bb89edf81cf168f749445faba1d38bbbaf911c
- MD5 40c084f37d440faeda6ddd5b98034bab
- SHA1 8d41decbd64070f7daf1808f49634ba1228c9956
- SHA512 e5f28ba7421a04109004e7ed2a746629ebc62c4afd8b4d29e6a0f5bab8a66d31b8b41b0a5d0b3ca245881b1ad0f69cd55f67002ea3136026960ff01b010f43c7
- TLSH
  T15D1163B56C636D15B04E31FFCF1A2A24EC01C45159E192FB0059E0B96A2EE9206D8B9E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_hover_background.png
- Size 2KB
- SHA256 11eb3bc6e85ffe882c44c132f24a8cbdaa8ecf8301535aeee20c136e5f637c17
- MD5 8acf40749bbbfd1d91a2c354f5bb18ce
- SHA1 ecd81dc2384aac21d46bf759cbcda2f098fdd5e2
- SHA512 baa9e80c62e27b37e471dc29a38be7c2e6cdfdb123dc6a79f2395cea9ad5f65ae183de79f755c12845b1848174a8613428935d18a70ed691d75ae62eb38acc01
- TLSH
  T1F641EBC2E3600133364601407129895341891CBB75B8FC558ACB793F87ABF3AAEB0F03
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32