9c63e99d6635aa68138644a8f178b0557f89d91b487445de2a5c2b5022a72ca0

Sharing

Copy URL Twitter E-mail

General

Target
UABEANext Modified By Rayvo Cracked by Rix.rar
Size 56.0MB
Sample260823-xl333aba65
SHA256 9c63e99d6635aa68138644a8f178b0557f89d91b487445de2a5c2b5022a72ca0
MD5 587da3b679d4508bab221a4ee09fbbbb
SHA1 6240a3635e6c2c2b9c17016e6a889b06bf82c6d4
SHA512 cdcb621e858ee87e1009992203ea444e56eb18bf366c0a046aa1af8442176295f6f6bccdf7c12b526a1c4bac2c0127a0fbd1fb063aa17f6d0cf0652a79810250
SSDEEP 1572864:katTuTC8/Ep3MKEbBhimoRsab84NhPQACkphIHXDVJHJdCB:kaITCDcKcyzRsab8iPjYHzDHJQ
TLSH
T182D73336E9873B66C772FE215882C874834CA0F3F722CA4A7F7915B24A4CCB4D69E515
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Avalonia.Win32.Automation.dll
- Size 111KB
- SHA256 050417f248e6f60b3ddf16e7e20bc4a940affd601846b0ff0f522fc931ad127f
- MD5 0b92a01332649a05396f46c84762cf9e
- SHA1 b106b2748d90838229cd66e15b539cbf56d4351c
- SHA512 19c233a3715ba2c6071a4ebb5af578fc5fa5c3cb2754b5e95d13c7cd250a38ef8ee975aed1f84ade0bc062880fc696eb1f4fd34a62166cd9d8a44e40378bb1d3
- SSDEEP 1536:Zol0NSAEk6eG6yO7b6YUlvR67LMucyUcLtvL/GMUY+R:Zol0NFWIbUAR1GMUY4
- TLSH
  T1A3B32C91632D1B19CEAECF377CE1A5048BB1F5D6A4D3D7061D90EAF18CABA100B427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Avalonia.Win32.dll
- Size 890KB
- SHA256 fa18c3e2e7390c65773511c02a1462828454bbcaaf4fbe09cd7dba078ee2e345
- MD5 53effb6d4d4bad6966c47dba8e46d677
- SHA1 5c5180c83484ff926bb5bc3a517c5bd370d6397c
- SHA512 58bacdc33da0470376199772f7d8e467614bb25468d2b77ca400363a7a161b6399757e0e7cbfdc9c69ff3a4d926580d5a59b6e27a8ed157315ec89001d71110e
- SSDEEP 12288:QPvCQQT7lJzYBjETcO/KTAZZXtqcXe2aqytmJhK:0GT7lJzYjETNuAZZXtqqjytmJ
- TLSH
  T1B415190293E40F63D51F467A74351A4BF2B0B786D39BB75F5C0C427E1AA2F502E89AD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Avalonia.X11.dll
- Size 348KB
- SHA256 f98bc7229da34daa34f3d169dc07866838287a672f1c82a4b393d7899281f68a
- MD5 cdaa323df09698fb35867a1953fc7061
- SHA1 980cb5198993ba93f9225984339f9975f74c6235
- SHA512 4988f44b9039a46b8ad9aac9fd3cae9e761be34160b3e4bf8a8d5281a2ba1c9bd1e25ac66abc7fc8e95a45ce63c6b9e8d675a72ec04c0e102fdcd34ec10fab44
- SSDEEP 6144:s+7u8nmtXauDK9FdXeFCOgKGwGDbZl5Z2psECuDzuFKZkCg3V8:sdtafdXZwGXZl58p3leKZsV
- TLSH
  T1EE747B2173A8DE23D55F6A37D493582543B1E84E9232FB4A6F78A4661DD376C2E003E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Avalonia.dll
- Size 4KB
- SHA256 47b3bb6aa5d818ecb793f208dc6c5cd9ce058f6b8a22cebf1df68ed7c4577d3e
- MD5 4a76ca6d1618b0e42f847d5f46d5e5ac
- SHA1 81ab4b3d4013a80866d17af895520db3aae23e8d
- SHA512 e8e49231b54527ff8291fd0adeed4a3bafd68c82040e0b1914ecffbd153b08f6b2bd2169f5f4a0c2402db1841c1406c20c755f5a0c15b0aa9bcc0441fbae963c
- TLSH
  T11F816256DBB04722FCBB4BB3DE735A424170BD61AD738F2F0CA222565C17A244E71B26
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/AvaloniaEdit.TextMate.dll
- Size 22KB
- SHA256 3f396c42af93e40af5c58d5e65e16a11683420e5b27c1920ecb4af0040ee16c9
- MD5 4766d8797f37170cec1ad74ebc79eec7
- SHA1 02aed9a161da54a77f3baf10ded28852451a2d31
- SHA512 12bcc1398fcd5c1dbb4dd7d71542c689f6cae57dfcd9a8deeddf66b61100c251fa57ce6995b822ad4f89a263f6ee990178de665e554659e6e2ad8976b1d43347
- SSDEEP 384:dQrioWCGya4hkDNbpmsKvP21ipBoWGBqgza07B:dQmoZGyzh0NbpbD1ipICKB
- TLSH
  T135A21C075A9CCA37E5EE42FDB4A1414603B1D797A903EBCA6D9C30D60C83785162A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/AvaloniaEdit.dll
- Size 659KB
- SHA256 48e7e01d3fcafd6e89d3b03b2a4bbcd889e6bb4bc0970bc4a5a28951a3654550
- MD5 a50b4a11da3eab7206625bb9cfd54dd5
- SHA1 cc1d7d2fdfa7dc23e9ba5065725dc45d12202764
- SHA512 6018902aad2e42788711554e3c816b312a64218fde7f71bb83f80c17d5ac4752e2edd792e0da8c463c14d6b793e7a7407f932ff4c165f8ee7bcf450786e23295
- SSDEEP 12288:sideP0JjfDWQCnOG2pG/6iEndueV8Xn4jKPpZn:side8JjfvCnOrG//EhmhZn
- TLSH
  T180E43B3C36985616D2BE4B37F23002049AFBE846B635DB4BA45576FA3E523931C40AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/CommunityToolkit.Mvvm.dll
- Size 117KB
- SHA256 7d7eb5c066cfe883b439b1200bf5dcb387b1e5319dd2edbdaa9e23adfe416452
- MD5 fd670f412739cb8b5c027fd9a1932758
- SHA1 577c458d5362b2e2b21e58c989adc028cc9656ff
- SHA512 95ef8fe3485b18d25c462741d84771b8f8290a84c882fe1fe0571e3983f47a521f13ca4a5e0fb7f052fb92466bd208e747ef72947108e54d1f072056e9330864
- SSDEEP 1536:miJTvUc85uIU56Z9qlKdsrbOvEnYQCGYhglgEwXrZ8zOUlLcPVVl:pjUcanqlKMYQFYhglgBKzj9cPP
- TLSH
  T19BC37D1233DC4A37EAFF1A36B4B080158F76E607E926E78E46CC96D505537C05E60BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Dock.Avalonia.Themes.Simple.dll
- Size 241KB
- SHA256 37b5e8104b14c533926392dc13f2f7e0cd310004750d9374d28a79bc3a0c290d
- MD5 73b41bbc1ddecffd821ccb78c2d4ded3
- SHA1 f2be1fddea05f487783cb2202668bcc895cfe6e2
- SHA512 cf2e4f6772cf05961671d6c3e52763153e5992f4c94b2022aebe69a0820e6e140ba9e4919c903a04ffbc2c1cf9adb3793733c1e44ff4e3c41706ca9f301bcaeb
- SSDEEP 3072:vvhoBYeZ8sQFm6jH0dvo+kuwMCEA9QP0Qfk4HF08:hxeZ8U6jHSoLuFWQZf/l0
- TLSH
  T103346674A1A64E00C1B57B3E11E42411BAF4A4A27B13DAD4ADF2ACD515DEFCA1F832C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Dock.Avalonia.dll
- Size 137KB
- SHA256 b8c9ab88d3c707921c0f00d6ad5850aef41efd4813dca8bf8e5326dd98a2e638
- MD5 0c60d153b87184659b27c369a2cb4558
- SHA1 c930935245d8084f3ddf1dc763c83e40e4ee1f1b
- SHA512 336a31428fa9d31c402f2cb2b2e20df48eaa53af74c1b1d5a1a24be3d165296d647fa6eaf2bbe6e84ce0f020379bbcf8be09e02f98599d91c52672cc0ed3eb7d
- SSDEEP 1536:po0SmXNv5VsDw43FBRx6Y9O3oShc3AZfEPpoDgKgEQ6XWGcHuHDtpYDhwpwAEcNm:vsD0DgKXILTS3VxJmRbVsqmR5s6o7
- TLSH
  T135D39D5423B88B37D7EF9B38F1A56600C772AA869F11F7957D8472ED58D338246002BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Dock.Controls.ProportionalStackPanel.dll
- Size 44KB
- SHA256 14a8ae9c1bd31917ee98dec76bf98750d5915544fbfb38fa37c0a8eac3030bb0
- MD5 2b660ef496e8cc01d5d4cc0754a90545
- SHA1 7498985a3d310bcbbcceef7ef89b92e1b4b0498b
- SHA512 1f6392b92d20693e773cbb00c82b7cb3a1430a8fd5cdb0b996d750ca4ae0056093f11c96ba5da7f0804c5231d57c04732975313f41461d8d6fa64f9104e829a7
- SSDEEP 768:s/EriDUntvYLhl0uQPa/KpSWBs/xmUhVUf/NBN5l8xRzl9Jk:YE+DUtwLhl0uQSipBB0xHUf/NB0X+
- TLSH
  T1DF137D9673A58323EEFF0BB5BCB50C6543319757A422EB5A0D4122ED4ED37900882B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Dock.Controls.Recycling.Model.dll
- Size 12KB
- SHA256 64b2452f307a1668ce0a877e3a027cf97621e280b383b25a667acd36ab62a07e
- MD5 37afda08852af93d0fec1eec6205efa9
- SHA1 a902681f26ca1fe54012d9d85086cb2f07a93b11
- SHA512 1f0069babaddb53aec506640adfc20eb5b2f7ec3eccd901ebf81a19615a6f132699e88f7680571467f1a6f0987695b3bffe8895874ee9a70ac7705d9db0884a9
- SSDEEP 192:I6zsNNWs697jGaazH6PygXHZG4evCf90YLVZAvcQWwSvmWlFJJkLoHRz6D8Rwe:IGIH6PyOHgxCSYT2cBJlOozRwe
- TLSH
  T1CA427D212BA25331F17627B9B8FB5341EEB1F22099638F4F5A0A28456C60B484F6172B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Dock.Controls.Recycling.dll
- Size 17KB
- SHA256 408904a92b15178aadaf008f06d44866ec3d539767f6bcf51250fa848d82513a
- MD5 e367cca9a9d2842c2a18cf1b3c680c46
- SHA1 0095e8cba856e2ec5b3b6e01e20878ccd88b85f8
- SHA512 c4577f7abc2da2067fb0ef76de0636d771fe94a09aa79bb5bdde8a0108842fa5a89c6b23fd3ce587eabd3dcb46cf623f04074ddedc5cbce26def4bbd9132e456
- SSDEEP 384:G3hnKhg4DnRg9tYA2TjXzpNhkFcnLEJGktsKGgrAt:w1KjDgqHDlRLSsb
- TLSH
  T12E729E509174D230E5F7CEBDA6938A100BB1E2B99E61CF1F4E0F368254C074A89E7763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Dock.MarkupExtension.dll
- Size 14KB
- SHA256 413aae46835c3f7aa9ed39bc90218833c44ecd95c0a6d8533cca0d8887806918
- MD5 a9e3e76a7ebe99d259db6e686df7cc67
- SHA1 015ae733a190823946abddc7864da3db6af1a13e
- SHA512 9b7032635d9e3777017c87c7e8f45c0d0281fc681319daeb06d614da1eaa74d794138d71f7fe5e5fdeab2cb5f07c86b4c79d356cbd0df800d26e1f921b59f65e
- SSDEEP 192:04kNmgJm4w94S165JeLnhDTf3A32F6xWBDlBX3NMoaXd42GdMArlCD8sAr:wRz3eL1fQm3XdMo72yhrlpsAr
- TLSH
  T1FE52BF71D794823ADC6A87B0B9F2834597B1A523CC23DF8E0DCB45060C72B0849A3F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Dock.Model.Mvvm.dll
- Size 37KB
- SHA256 a5c39d241fa323156c48676a7dc9a51b079ab6d40eef84ed72442bfc6c664856
- MD5 37e05c4ee3f829ec73a32c0d6a447fae
- SHA1 44c74de3e54640bfca05db0b4e1a855215b2cb68
- SHA512 086ae2577b15fcb7388c1b12a0bf2a678cf5418008437df72f6fe20494d7d57f16f98727122579a246cb05a20f74effc48e62f923f67887170c62472f6cdba4a
- SSDEEP 768:sO3OXe6r/u+5Gv+yHDbOMwDt1LAZI5GiEm6INuiuRtYldf0NB:sO7wu+5TyHDbji9Gfm6INuiwwdcB
- TLSH
  T1BE033844B5F8637AC3E78E37245546420F35D79B2852E61E791EB08E6C2A36B0912FF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Dock.Model.dll
- Size 116KB
- SHA256 a0c3e37d73b949a1866517ea2218f5baf58c290c7c39a3224773c428a8efa414
- MD5 f3f39fa6a161e9c7a2e24c57ad51bac3
- SHA1 89ec18de41d488d658e5999300db44d80802872b
- SHA512 f744991c49e469756ff3b69da9966a02a1a59a58595421fa6b405207a4f76d94aaa718ffb5cfbd8caf2d9c6702150cfc36a69682e5c71cd7585e21a993b59307
- SSDEEP 1536:tOQO8NLABGkF+eZNSQSM6acUfl4l210CA28r3d5ESFvKfo:tfOOLRneiQShdUfl4QmxZjCfo
- TLSH
  T17CC34B38037482B2DD95973CB06D8248DBFED589F143E7533C2899FA6C1B3C6DA21696
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  UABEANext Modified By Rayvo Cracked by Rix/net8.0/Dock.Settings.dll
- Size 19KB
- SHA256 6408a835d99994bc862b52099ac3e7424c2fcf536044a6718e92d1a1cf5a0814
- MD5 ce62dd98284f2be254e82a8df19db35e
- SHA1 813cf77c37d74a786e332a9a0c6752bc329bd7b4
- SHA512 ff355ace663a0e724d83e9fda2a3c8abb1c73e92c12170bd39a6d031ed117b987a6de56487e16fd0eae7d4c8b1d126a4c22f01cb445af1bb711a2bec2b1103c4
- SSDEEP 384:9Zusa9BaKra/9AdABORvu+yb/vr8p4JqpglNShwi:9Zu3K8+AAONu+K/vrS4VN/
- TLSH
  T13F926E64D7F85539E9F803B464A7231242B1D9B45523ED6E2704F1DEBC03F1A0A92B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32