General
- Target Syntex Hwid Spoofer(1).zip
- Size 9.3MB
- Sample260826-p16thazblb
- SHA256 6035f82a56b50567be6ce9a545a550180b41f76c992304f0d33ddc237b7d19ae
Malware Config
Targets
-
- Target Syntex Hwid Spoofer(1).zip
- Size 9.3MB
- SHA256 6035f82a56b50567be6ce9a545a550180b41f76c992304f0d33ddc237b7d19ae
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Syntex Hwid Spoofer/Microsoft.Spark.Worker.dll
- Size 16KB
- SHA256 a716e4fa4256a1a2a413b6b7644ae3d4cc4f5f25ca611c53e4e91692ef825691
Score1/10 -
- Target Syntex Hwid Spoofer/Serial Checker.bat
- Size 1KB
- SHA256 dbd50e99bd77c561fdcb70d0a685b0c177ae5dc6f62c195dd8a65be531a7bf2e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Syntex Hwid Spoofer/Syntex Spoofer.exe
- Size 146KB
- SHA256 03e515e9cdd1250bee3c25e23d5efe95c9efca6abac057ac3628132c15e98547
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
- Target Syntex Hwid Spoofer/System.Console.dll
- Size 170KB
- SHA256 8469deb8c7d532e8857f5c68deb291035103dee3698bf5005f4e08c5bd05775a
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Syntex Hwid Spoofer/System.Private.CoreLib.dll
- Size 12.6MB
- SHA256 4cd6810b4ebe8d6e1f5928f2026d257c112380d33b557a60bcfa9c7f2bb012e8
Score1/10 -
- Target Syntex Hwid Spoofer/System.Runtime.InteropServices.dll
- Size 94KB
- SHA256 127ea3f2ff47cea14c082b2ed22066554d22c9d8f97dc0d403b17042fac62a5b
Score1/10 -
- Target Syntex Hwid Spoofer/System.Runtime.dll
- Size 42KB
- SHA256 9c506c9347f872c3375255f744dcf83b71a96ff71cbf4a19b39873fa22f73c22
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Syntex Hwid Spoofer/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 a875d0785cae18ee30db531303c166ba1a1d30c0ca4ab8edd38fe04056f91eaa
Score1/10 -
- Target Syntex Hwid Spoofer/System.Threading.dll
- Size 82KB
- SHA256 15cc9db291b87042f1ab4319f8d04f4cd226f15bf88bf0810b31dcd50fb0bb7e
Score1/10 -
- Target Syntex Hwid Spoofer/clrjit.dll
- Size 1.7MB
- SHA256 0dfe34be78144cad7db5b66a7fca3d86178ec0f353aafba6c81eb72e797e383b
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Syntex Hwid Spoofer/coreclr.dll
- Size 4.8MB
- SHA256 b4375494bb10be11db6134d361df2f39a7a2c7f6696ca8d239a3ed424ce66de7
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Syntex Hwid Spoofer/hostfxr.dll
- Size 342KB
- SHA256 130a3656b07a317f859d542c0f11339f3d0ba4198169853781a3fc04ed64c907
Score1/10 -
- Target Syntex Hwid Spoofer/hostpolicy.dll
- Size 384KB
- SHA256 65d61078b6b97884ad09aa12da97d96f50f7d98e6d163c926ae199f9bb58a3ce
Score1/10