f1a102f45dce49bfa1cd9f093d38f8156ceb98d4ffb026e8b7e17e4618826438

Sharing

Copy URL Twitter E-mail

General

Target
nixware loader.rar
Size 228KB
Sample260826-2raqxsvxbx
SHA256 f1a102f45dce49bfa1cd9f093d38f8156ceb98d4ffb026e8b7e17e4618826438
MD5 43d7189f3954070ce67b420ae2f19a46
SHA1 d8f66aa997e28b25256cd28cbdca668cbd813b3b
SHA512 827144295ead4bccb46a460f95bb48d02f32f998a3607bb65599fab4b93fd64220694225456714d655e7a22ed0e0274630169fec2b405e1792f7dce98c811bb5
SSDEEP 6144:UYODKBpqp2vsqkltxcl/kuRkOI9kESZxCcp85ruCZI:uKBpe2kqkGsSkOI4i44I
TLSH
T1CE3412AB33159BBAEB54CA1580921C69E9429FC7CD12E27751C2A48FC7DD3E0B1206BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  nixware loader/loader/Form1.cs
- Size 4KB
- SHA256 f9c464d32bcd3253c0f6df27a0aec3a198c69a0b52d8d8982dde353c5c6bbb41
- MD5 45daa43df22befa149fcc6ae18ba6e04
- SHA1 19baad4a672dca7a339fab12672b93c33da5c009
- SHA512 c2e0ad77d0cc43669e99391565a27a670aeb259463185159c46a89c732abb9ae0a5d8ca299f274a8e803d2af78675d397ac5c2d65788849f5737325159a8a41a
- SSDEEP 96:0LTo4h4Dcz02nXVgcFUlz0h5a41sNh6sMXosixBpFpr9OK:iXKGpF6IhQ4GQsMXopJp
- TLSH
  T134A1714E634AC73A85B39218EF128955DF72233B079AD5207EDF8080EF310559279FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  nixware loader/loader/Form1.resx
- Size 335KB
- SHA256 2878541f141c602cf9df6e494e178ccad894e6ac32b2f149072459293faf698c
- MD5 9a00f608b72b0ad0fbab33122480ca33
- SHA1 23c763296b63728e1becdc4779e068608a9a88b9
- SHA512 5510cee20b9272d67ab28440901686c167fb8cf605ca98866cd7a9461b4c2d705c0490c8346a1a0dafb93ea770c3441dc49fac6ef710e8a51d41530ae4a01107
- SSDEEP 1536:Kj2v6TfKHQuYH71mO52o1PjSabd2W7X/nP9kKJEnuYnVXJgV90xPOn4DYsMXraO:Kj2SyHWBTOaPb/P9VbyJEOWnZsSrj
- TLSH
  T1AC7401B129D54D9AE8308657EB77AE2DED80035701E957D1B22E3E26CFB98D9CC0C613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  nixware loader/loader/Injection/Helpers.cs
- Size 923B
- SHA256 eab1e5454c1364abec84548bf35f1535b83de35cc0b886a095f08a4c6b0e0ae6
- MD5 3602d932a1760e64d2e36a39f1b68e37
- SHA1 096f0a0acc41afe00bf8c0e1c720fee0e2de1bbf
- SHA512 eaea4f05b151ae16a2aab3af31dc57ab29d130f067aa53ea13bf7bf36aa4d5f056872d8705985c70cc02d9e0be761dbc163ab99baf284e3d8747f5a3084c2ba8
- TLSH
  T1FD11285BB9A3D1599257683D878F8024F730A01391AECC12FE9D82259F910256F7AF8E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  nixware loader/loader/Injection/ManualMapInjector.cs
- Size 38KB
- SHA256 768f987ee98b702e851d53573476cc556f0094fbeb3d726052208d752fbb4436
- MD5 a86f72baae904ca3ef3b792ddcaa7fb8
- SHA1 df6b8bfa490ef065656f45b32f0046afd9b041aa
- SHA512 cb78e5746844926cb188a13a92989b8c39303bc1d2e4b798707e7e8202aad151c5613d994c6bf6fd43f9f671afa73a959329bb01042f0a8e029b1951d95664cd
- SSDEEP 768:uU9i66NduvyT8gs3tnN/MF4TS+DC4UfSWrUT:uUuduvyTi9nNwrUT
- TLSH
  T1D00332084EAB34961693A47DABCF84069DE08153165CCD253D7CC1726FF01B8DEB7BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  nixware loader/loader/Injection/Types/ManagedPtr.cs
- Size 2KB
- SHA256 9d47dd05ddeb793b7af9d6f183d3d8bde55cdfe51d423bd1764d71606f43ca4f
- MD5 b3cb2c461aad5fd4c029d876d1f93b0d
- SHA1 5eb8919e107ac287dd6ceef4e0c042339817396a
- SHA512 37b5b804ebf376852e0c0e5ce626332924ee1f3881b5fda2fe2d4ca1fb5c8016cce0749bf606acd2204a9568e4471399441c2ece2e10502eb91ff771babacda6
- TLSH
  T1F651BC9437EE9424014B71BB67EA8052BA62425782CC5C007E1CD539EF92230FFB9B6E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  nixware loader/loader/Injection/Win32/Imports.cs
- Size 7KB
- SHA256 b890fb5ffe3c3ce6b362c56f0ac74cb846d9f0fc0f5a35ae44f7471af42f640c
- MD5 ff85f0e3de5f6d0a86bb1f581d9ba9dd
- SHA1 8ff240fbf60642a13ee532bb620d692287429961
- SHA512 717ad4cca14ccb9e4e46b18af54d683c311c1ecf848b50df540dcce81cd0267c18fd086ee91f73f8ecec8aa5d03b8ed94674ef7f040a4793e5cf03ea3edc995a
- SSDEEP 96:JjNrMopQyuf9Llc9CZn870R0ZlMuR5PpP2c54+80dKoBEL:t2jeCZ8IqZlMuRZ4+80dBEL
- TLSH
  T10BE1302863246714B4A35919BAC6A4DFF90320331AFF5C14B5FD8B219F8B19CD53639E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  nixware loader/loader/Properties/Resources.Designer.cs
- Size 2KB
- SHA256 b285151a163fcf3b814afc7000344711640a72b54556fa9e9cc75552890309d2
- MD5 e6e7a3794850588b1fe7d6b834bf9eab
- SHA1 2c4b4592e133c041538b0d2c3cda1ef8d2a840b8
- SHA512 e29ff7b5acb558c0ea07ccc1281aabd9278b5f7ca543a8787353caa2bcf1f529b2b069c9b104372d458b455b17fb0cb4454de1e6cca666fe7f392dddc26d9972
- TLSH
  T16351CCB71F94C1320C34D5AB8700F851CB662123C63DD874F8AE02655FB639043BEDAA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  nixware loader/loader/Properties/Resources.resx
- Size 5KB
- SHA256 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
- MD5 0cd8c971317d19bbed44757809bcb92b
- SHA1 47b15748ecc8e952c5935170090db7c269ce4b4f
- SHA512 883dba84bf7daae3ea49f9d54c13dda4f125da82ba63f90eeba0900602896ad9492a0adf7b69b67d838034090af20926af5c2934797afaadb38aa069786c1fc6
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT200qSdvabvDIwQBugqvA:KjrbLPD9sLvIzSvKgIqUEa2
- TLSH
  T17FC11245B1C09D220BF3482DE6527988F7A8923B0235AC54B4DCA61F5F73C85A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  nixware loader/loader/obj/Release/TempPE/Properties.Resources.Designer.cs.dll
- Size 3KB
- SHA256 1b32708b81bfa1535f21eabb839d0d71ee234208263bc899b6d7583e27318785
- MD5 a3375ddc69618b4a4a5af1eb47002d6f
- SHA1 960a4316624613a5c8c9dd14fd5db321b33867df
- SHA512 708debc3007244ba56c0b04e62abe142abf0929701a04dba6afe20d8a070e932bd0a60660bae6d64cc048968710cef0b12d843e39529baa4f492812a9b32f61c
- TLSH
  T147714333ABE8C7BAC96E0B3115A375600B70D1065A636B7B18C8201AEC573900FA6F69
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18