3ccedeebeb6b9858b26254256061e60471778257dc394debc4ca4adca2490850

Sharing

Copy URL Twitter E-mail

General

Target
Potassium.rar
Size 34.7MB
Sample260825-tp4bfswakd
SHA256 3ccedeebeb6b9858b26254256061e60471778257dc394debc4ca4adca2490850
MD5 9c6dbae5966f2b17cafe81c481779894
SHA1 fd0d8c3c2c99a64884382de909ff245898e53269
SHA512 29b418c96c08e0e68911bf3f02f1583044d5d154c1b7249881fa26048c36d24d96da4bfb05416a205613ca42159171c6aa1960ca7125f7a8f14fc0cf36d01da8
SSDEEP 786432:CcJKKLDo/sQd1dvSg75gydyVSkjjmM7k6D3+pLn:CcNLMz75ldyRjmB6Un
TLSH
T17B87335327AE9865EC17111AF3EDB43F42280457EF63201E9C853CE9AEDD528E5EAD30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Potassium/Potassium.exe
- Size 74.9MB
- SHA256 32c23117961e1c5e56d108f087314151f1c714be5015b5622871a2cb346fb0f7
- MD5 eeb010dec5e5c64d818ab2a9eda690e8
- SHA1 fa4e3666ed480fa2308b320d563c6b813c1cedc9
- SHA512 31022291d211e966136617ca868e75819c2094c3f611377a7c0617c1caadf4b28d54a6fe01772aae64136cfbd4ad1204cef648297446e5b2615aaad2511a8e5b
- SSDEEP 196608:c9dnSC56xrIHs2XTWMrd0mzO9dnSC5ZudFcc+/m4hvmS:c9dnSC56xcHs2aMZK9dnSC5Zg+/TRd
- TLSH
  T1FC0808F9936023BCDC4957BFB96138B4B60F747A37E5CD94C22E4E92581789ECA09843
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Potassium/WebView2Loader.dll
- Size 156KB
- SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
- MD5 daf9a81004a961e39650a0e2bafe233e
- SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
- SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
- SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
- TLSH
  T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Potassium/bin/Decompiler.exe
- Size 2.5MB
- SHA256 0ae066344b869c2e443aea77cf52063e02ed060f1867e54279b9616420a8fc3a
- MD5 3c4625d27f37d8be6d4ba6d4e4e1bdcd
- SHA1 d433c03990c3e5bbb1ee2373c561b16a277cea15
- SHA512 0952011178c417a2c184ca08fd7cd48d6c3735d0dd2416d7aba3153164fe97b5176e6eb2c3120cc39fa13444511212b787ce6fcdc51450702142270f51fc7664
- SSDEEP 49152:EPBu56RV7JJ08KoQyijE1qKJR/nO6ocT:dwy
- TLSH
  T1ECC518757B5A98BCD59AC43083068A775A3534DB0B35B8FF04C992792FA9EF45F38208
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Potassium/bin/Potassium.dll
- Size 9.9MB
- SHA256 f3eb9b13c4c44139e98f85eacabc567816a64cee5fca66f24d14ea311f326d93
- MD5 f56d2ae22bc4bb894b14db8afd98e6ea
- SHA1 2a2f5855f4319c603ad6098f1874755e27519fd8
- SHA512 d36ab3384b2b8b0e10a2bba576a2f1d9a638e9553a4bd05f6e171e3ca31beabdf6e726cef767ed5c7803bfbfdcffb922ac1d7596835213e8b86157900b69f052
- SSDEEP 49152:HbHWRthvXqWoP8EWpR4Z3Oo/CdJNrN0TEqRxgUgUZZs2S7XhCxbOItS8tiDxKJMr:3WoP1ozgGFctqDxKJMLBotxB+1J
- TLSH
  T186A67D6551F409E8C3BBC079EA4A9E13F6717C4D8320B6EB8EA14B511BA37E0677E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Potassium/bin/Potassium.exe
- Size 14.1MB
- SHA256 eba4c721e04562a9411d1d115514796c055f67c0ea3d91994bdaadb7e31a568e
- MD5 6d1e4aa7ed1304e60d9219f6151a7eac
- SHA1 ef35919519c757a1946f46a3bd68be1b337071c1
- SHA512 aae198e8e82b3ea7ba3b65fd386ffc6b0dde565aca4a6820217fdc1391434f131d755ade75b8a904e27e0bd17ff8bce4659f12b9c3fc58ef39eb077c9cf979d9
- SSDEEP 393216:fkLeqUDt+SkHwv3aidtCZo8zTk51SWhQHvb1V3o:fkLeqmsShSidEk/SWhWxFo
- TLSH
  T148E612E658C562F4C8D74B64A24A1BCE65F0E4AA5AB8BC1C3BC11C434F31FEB4649D27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10