d0ff95aeb0881dce831e31bce4be527f1489764a1c9913b3590686df8ec469c0

Sharing

Copy URL Twitter E-mail

General

Target
SK-Builder-main.zip
Size 2.4MB
Sample260824-c8ct6ssdnh
SHA256 d0ff95aeb0881dce831e31bce4be527f1489764a1c9913b3590686df8ec469c0
MD5 cf74dc2652c5fdf94c4f82c191d2c14d
SHA1 51b7741aa8a19a0ecdd6749f7d46bbd42455501b
SHA512 7cc089018117f3ac67379d05ca93ecc143a5cfb0afb06115f891d7d734a6729d5de87fb4b4d5f6b279a99055ba5ba1a272f404391ad3d82634bf4bb0dea59d1b
SSDEEP 49152:vxy73nWvsAJwu8HxyJEjn3HeKo5ApekzJ+FK7Pqkz:vxyTf9HxyJo3HCkzAFg9z
TLSH
T12EB533BA93AE1905D227EA7F39901DCFB5D4AD259FB48F02D677A71C4C163012A1C3B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SK-Builder-main/main.py
- Size 356B
- SHA256 43743a1d1c0ed9a82f5f2d5e1a582527bc99cb8406b1f67fbcb9986423881a43
- MD5 585caa0269e387689ea61dbf7f968512
- SHA1 effda92522a22285cfde114c9b6a902160cbdbd4
- SHA512 cdefb8a1900ddfc04d61ca619623d327363a109fe517b60feaee25dd1663f0cf85dbfba178478d69d62d921323d583176d9508b30842ba4bf3c4f65002e56b2e
- TLSH
  T10AE0DFDB041EB0900FBB189EEA17A213D2B34537EFB0620139508A2A7EB014B8D05E5D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery execution spyware
behavioral1 behavioral2
- Target
  SK-Builder-main/src/functions/build_manager.py
- Size 11KB
- SHA256 ce79fb0b47c64c44622d9a2501f6dd56a1b7c3119dc37ee3f42416378e86266b
- MD5 e345374f15221132fdfb527c8709a0e9
- SHA1 3390c4b56d2dcdb99173aea385cf2d461496b0de
- SHA512 da01386e9ff80b74854c37a329f584b909390538d274f90f543e7222ab0244767add29b995ebda3cec2996d8b9e4066fc3cd34143ce6eb29624c934f3620a48c
- SSDEEP 192:KrPdMx9Ec+r/TK/2/gS/kS/fK/Nn/sC/v/ZuoPoHKUtRxWCHlFhY/TAU:KrPZc+doPoBDBnU
- TLSH
  T16F329764CD479C6212B2D39E8CA2C85EF32557674B251852F9BC816C2F31928E2F47FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  SK-Builder-main/src/functions/payload_manager.py
- Size 88KB
- SHA256 96e9c483f71175cbb3327dee2302e984ee35c8fd37bbd2c4d0ac515bb0e1a683
- MD5 2d4c567e31585d4e43d4d78dc238c27f
- SHA1 8dface0fa888a75dc4e16a6d8de0f6cde65033cf
- SHA512 9a37dd64ed9c143ea1a7a4d3f6dac3d32443d0c39d3d3cf82293a8c4c48e96fb71a5566839d5d354fa845195507d557ba7056ab3f2b3e470c1a260ea7c232359
- SSDEEP 1536:6Wa8Jsuh75VT4ccYY7RfkMqsTKSyti/y0mj8k6g1R7mzaKYVBb:6WtTrFZEKS5/yEkDyza/Vh
- TLSH
  T16393C026A6E6A8430B7D671D724AC036FFB443AB86828C0775FD12D8DFF8D3159CA914
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  SK-Builder-main/src/functions/tools.py
- Size 2KB
- SHA256 8660f24304c9654e11b9f5b355625d2f4fd0f72c9d2abce599770f588c75c051
- MD5 a2a178a43b3966aa56d5c90b1f1068fa
- SHA1 cc2363fc039d0fbb38040dc7ec0ca11ee788d7f9
- SHA512 588d686158ea89736fffa18d81d44cdc09cc78bd46358173c0a9f7806a5e8669fd0b547957db174579a43d5faa92daf4d165728a7ff7429619f49260ee48e8fa
- TLSH
  T1185183754DD274A16ABAD19D4C4AC13DF7ADA75774100413FCEC01F84FB1824E1B27A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  SK-Builder-main/src/main_window.py
- Size 5KB
- SHA256 02c8bccee5d7d9712d77f1b22b4d95a3c52dc9807a0a6f08ec7518077977f17f
- MD5 143a0b28074b3bf979b1e626ad6be6e6
- SHA1 e29ed88db3a58b6e28f4ef0f9b18f41663105149
- SHA512 e2c3ae45f50904342f14f6ba470078b7d80ddeef026642e8b2bfe3a6952758594a184f9a0771d609b64b861518464a6c277f2208f811a88aa63c138703fe5ab8
- SSDEEP 96:114vkeZHScl3bYoVKa19nA95VscV4yoLv8q/a71V7b7NfXMoUp+bd:DerbhoC/aLDNvWE5
- TLSH
  T17BC124281005E45295BBDA5BAEB73513FF2B42439A3DAA253A3EC3914F750118CE1FED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  SK-Builder-main/src/pages/build_box.py
- Size 2KB
- SHA256 97dcad945da33971a6185c3b9da557ec00d55a0ca56c49c3ba03d96a3795c09a
- MD5 8cb551a5d0d0e40ceec32471f4526863
- SHA1 612e2e137daaa2ab32b8585d8ca4a604fe9f5c59
- SHA512 52c40c1170e32b4d9883b37041df19c6fe103decf921f490d34030f2386f92dca0251ed0bea9595f6a72b3f3a9fc1b81c1a07097515e9c99a4655f3ed1c85e07
- TLSH
  T16041E235C24E48012077DE26BA736203DF5B1597D96CAA2A7EBF92055FB002474E4EEE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  SK-Builder-main/src/pages/builder_page.py
- Size 8KB
- SHA256 23ab4ebedd666700b8f387e0e8e5512e38dd613a4dd69222f16cda06e8a9d381
- MD5 2a1fe690584db7f0919e53b9c27be740
- SHA1 8058ac4d915c92d7bf42a294959cee5e50173024
- SHA512 8ed6628cab4e90c1775786efc303fbb925d7f84789e858d2dabf9ffe533e30fa14a2a428a88696385dba84507893a665dea76eff66aa320019ef22cd3d0deb7a
- SSDEEP 96:RGF4RAJpYN58zu/C6RY8+rN0BJ9YxuY7l2dLkzY4YHIsTvvYY7/f9Dsxbbx:AQ58z76S8+a5YjY4YpTvvFz96t
- TLSH
  T1030244380A09B101E777DC039E633B47F51E031718691D11793E9A956FB9052A7E8FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  SK-Builder-main/src/pages/message_box.py
- Size 3KB
- SHA256 90df55b4a4bccc03d99a286d60b556f07d81edab78924846f7859e4a2b2e6b45
- MD5 0aa147ef78593402854c2b5de97d09c3
- SHA1 f7be26eedb3c388c28319835dd2b0e221658c98f
- SHA512 371dc5b7a89a55ace939eeb839367651c5f4e8007fdc7553016813adbe3924d9d86aacbe470966c98369921c24aa434075021f9ab4d1ef3b1d365ffd9e38be86
- TLSH
  T19771113C400A9087C2B7DA1BAEF73113FB155183D938A9253B3E82665FB501148A5FED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  SK-Builder-main/src/pages/options_page.py
- Size 4KB
- SHA256 11693fb7f67261d501fdd47b363eb26cc6b78737ad76663814114a31f142b3d4
- MD5 4a1a6c411005fc885eb48ee174ab7996
- SHA1 7cff06f24840b59e27885f7df4402ab699692af7
- SHA512 d805921d4928807f770c1320958b0741ebaaf017361f09d4bbebf21c68bfd75b3fb9aa31c57350a222b6ecd038150ba2f3d2b4cdacf2b25cdd8d2be8e9c07db4
- SSDEEP 96:Bwr4mkEpx8SaLW385BzKFmeY5+9T9s5givWcrHWn:pzHSM3zPeY5+/2gi3rE
- TLSH
  T196A1323A191A980150FBE3FADE937906FA1102074A259C2B7EBEC2360FB805499D1F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  SK-Builder-main/src/pages/splash.py
- Size 1KB
- SHA256 996405a80588621331f3749bfd75ad3e1938b47eb1535c487e324d23ca52517e
- MD5 36670bbaac46eab66c923b5276fe0202
- SHA1 4f3bf4fa27b67c63cc962809a9585a731cb38199
- SHA512 8ac1a8d9e7bcdac6590669578e04e9a9cfba3145b495daf0b8fc1cefca71b9a7341c46727798c6a5666a8d9152f595c84c48916ec6bc313141753b4341ad87c6
- TLSH
  T18D31B6081A1ADC051277D803492A3D03EF5E0AA38D3DA14A39BEC11BBFB1000A6D5CFA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  SK-Builder-main/src/styles.py
- Size 5KB
- SHA256 8702e756a4b485d81038c43772ce8b2553d9bd95c1e4e3fb207037f41b4486a0
- MD5 6ee2f0521642f4b476b5f79816b448ce
- SHA1 1374090df61846db56ed76155c749f93601d87d7
- SHA512 d270c72675f43e655d1b4dd01fcdeb79a8f874b98ec43a17ad41cf6afb715704b9de4e45598fd11ce7c4d998c74c75c15d7c05f349a3cf2b3e23bd6c3a56663d
- SSDEEP 96:wsg51aL6sg51ay8dMUESLI+cukQsjIwcYhkdMOXsDD7Lo7/Q3kD7nPnCb:KTLo66HBSIDYhYH8DriHq
- TLSH
  T1FEB18E7AE6454C833036A775B3678980EB1B16A762010B3D7FEC72A11FB41692574F8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  SK-Builder-main/src/test/blob.py
- Size 1KB
- SHA256 94eb73ed36b9a7f44daed320cff54a2576fc2e9bd7594abc6c92b1e990926cef
- MD5 0ccd4a2790e7e893bc9cacb3e9ba6ffb
- SHA1 e856170b407fe2fd7fb97958731149708e96e2d0
- SHA512 92febe06272da27e4bb130235a46a54d6f2f34372a03fc7652b696ac7405a6881c882b4077d770b7a96f3192874e0cf82f27481a6be2348655a537667eaada56
- TLSH
  T14A21E9521A7060ACBDD4933E4EA34165CE3A296DD7B3C63757A00BA5F07C53E141E678
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  SK-Builder-main/src/test/obfuscation.py
- Size 1KB
- SHA256 6c56bb468cbc5ad93ba4740542662921fb1ec3c4e334703704c82a2ae6edb612
- MD5 6d699064947befb6954a64ee61b2fc1f
- SHA1 a9a120191b64159eb7e4abeb77054c67198bb743
- SHA512 a257dc3e71dad9fa005ebad2625184b54165889339a4bfbfe566fd2a54265851169f9931cfc4598a5fcf11dbff3c36768cf9a59280c813b9bae8aa0210c2920c
- TLSH
  T1DB31FE1A0C4A14C416F7569C7E42DDACD22AB5073FB10882F16E87F51FBC9299E628FC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  SK-Builder-main/src/test/raw_func.py
- Size 942B
- SHA256 658daf808cfa86d19e662db680fe52cc28321cecb6d404fededfc5cf34bf754b
- MD5 e4450a63100ad8d7f619e3007f610db0
- SHA1 5b156afd0a43a2ecca45fe6dbd4d814f553970a1
- SHA512 9c31a2d2e6b3614510b4defc42637c5a30b2167ec666ec17997298269b6b048a16f0326099e52433b26d345de9b844cd1275edb9efc232936e7f0b1717ca7a8f
- TLSH
  T17D112BC59CB65464DBB3EB4E4D53CAC9CB4945939417C94AFABC3804DF3548BC0982AD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28