25502dc9711a9ca48d5f8124f5dd450df1c33cc9a1674804d3c7e96bea213e45

Sharing

Copy URL Twitter E-mail

General

Target
MrAhmedSamir_V1.0.3.zip
Size 2.6MB
Sample260828-1qpm1stemh
SHA256 25502dc9711a9ca48d5f8124f5dd450df1c33cc9a1674804d3c7e96bea213e45
MD5 8295c4790512e1e8757ff75ae101979c
SHA1 9c2c94e8b7ab856d8990c77d8ebc3d85d491c3e2
SHA512 b3cecbb7051bd8084ce8d31733e9c089f067968dd3200c20094f0aab32b6aefba20a00147dded3b4772f65e4b473e6d3ea02a996784f44b12456905250668369
SSDEEP 49152:CwFUhNUjKRxl23XytpP4G/7xhxAPl+WqBh/9iQi21S4dJx7J/XtRRRRRRRRRRRRZ:J0MapQGDDxEUBVR1S4XJPtRRRRRRRRRn
TLSH
T1E3D53321730AF837ED03197769E79EC5B1B72280D27B221A900B76F26F5E604719ED87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MrAhmedSamir_V1.0.3/MrAhmedSamir.exe
- Size 1.1MB
- SHA256 c0fdba1d1a5ad092df8e04b24dfcbae68015d992f047a68955b4f927c7dc5ddc
- MD5 2acff37d94c2ad6c7a6c4e18e25cdb10
- SHA1 03aa71538b403a2d9c46ac23743c0c1dbf941787
- SHA512 66d2f596639f9bdaee2b5d5fe81f4cdfeb5a3d093250a42951f67aef568f094ed28828417268e4a16791853289a1ae7c6b4a0921e23e5f41b490bdad0b85d391
- SSDEEP 12288:MYXjNdssYAZzx8VURmaXZycrpZRakBq+NC9uDAZJKJ9XXp7uTYv+3bcxbZr/kBC9:MmNdsPRazCiqGC9hUvwg
- TLSH
  T197356D5D6A0241B2E1BD35B041A66B7505FE5D396B20B9C3AACF3E2B473F1E02D3522D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery trojan
- Looks for VMWare Tools registry key
  defense_evasion
- Checks whether UAC is enabled
  defense_evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  MrAhmedSamir_V1.0.3/WebView2Loader.dll
- Size 113KB
- SHA256 7207eedc90f99b1ac9631b221cd8c443309d724d6815d9a3067ec05de7d493a5
- MD5 47223d1936f9798d807ad6cb3165f767
- SHA1 2455d8663ae0e746ce7689b312e42181970bec7a
- SHA512 7ae84c3bb3f5520499194520946825d4f0c1a0f325c390aa5a916ad2e7d1cc44d90de5189ec36e870fd6128ea8cc520c8754471e86dda939f575397d9a91cffc
- SSDEEP 3072:6lh/J1Qh5NZN2fi1LDUFWExc6GCH3QKHy7TgkEtoAl5Ut1hQ:ghvm5LN2fg83c6yEtlTk1u
- TLSH
  T1A8B35B51B6D08471E5BE1A3808B4EB655B3F7D20DF609DAB37581AB94E313C08F35A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  MrAhmedSamir_V1.0.3/capi.dll
- Size 50KB
- SHA256 f9a58669e0bbb861839cd95bdeb7cb83d62bf6052ffd2030e4f8d4492e0fd667
- MD5 45717ce907b1ec4f858354e7793eff64
- SHA1 ba4277b1c10dba6fce335479ae15ba96b7a60a10
- SHA512 4956b13a43ea37eb5eb56959d550e271eca3ff98954fb3eb5ded75ab93d3b2c1a06e245b6529babc1b98c9524472550ec16dd56c68997495e7ba67150cb03dec
- SSDEEP 384:aknykQ3/V2olDwfxHQqG/4AigTqXPqNPJj/nEk9JOqlmmCMa406aVycdpoGcdX8q:abkQ3dxlUOQ2qXyN2k9QZMa4w9poF6U
- TLSH
  T111331992AA4190B3D3DD587870F69BBB193AD1B1D79889D30BB32D958CD16E7703A30C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  MrAhmedSamir_V1.0.3/cpprest141_2_10.dll
- Size 2.5MB
- SHA256 c99c14a353592762ee25f8bc28cb4bc02785dd330a454c85717bdc9525a7b5b7
- MD5 ee334c55149295399adbc7dcdc263d04
- SHA1 e83c162b3a3e739dc902de1d6ad869297988a471
- SHA512 9363d8eb7bd9f2eb606c9c7bc2d5fae47b7566679e9d76d75503f69bf341aacd2d0d6d6dbdba75663bb55d48694f299ecdc0fe0f1c4e0aec86ae60325973d400
- SSDEEP 49152:hyIxLjeqehkpz7MAypje7MOMGtE2b/YPkTXp0I2uE+X+:hyIx2q06nMAypjbOMGtb/
- TLSH
  T180C5AE22BA41C136F69E02B1547ADBBF84399E640B3442C3D3D5AF2C4D615D31F3AA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  MrAhmedSamir_V1.0.3/dasync.dll
- Size 31KB
- SHA256 eb38b28cd7087fa081b0de5593a8530050915c254358c62dc6526e80d9b12836
- MD5 78ae8ef42fa0c97ca1615e88853e73e8
- SHA1 68d07058c00beb806858062a200882baa48d201b
- SHA512 d9537a664f54ad95d35506a3eb2885cecfaf737f05facdb2ea673f5b3c724930db60225e7bdbdeedcb630b63bfb171780c6de560ae6c3ca74b65ca07a1fce69b
- SSDEEP 384:VIqpRX4Kqclv41qkyzMJeBJ24iKHi7663Qi1N7:yy4Kr/zMIeKHMH5
- TLSH
  T17DE22954BA45C1F3DBDE153964FA2B3A0B266603636849D37B32917D0C644F7A2F838E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  MrAhmedSamir_V1.0.3/libcrypto-1_1.dll
- Size 2.4MB
- SHA256 b9319cfeba74ce498ffceca1c372521f755a8a467e1f9b73b05a6c0c6d7ab191
- MD5 26a9fea0632bdbea17b904ef5643843d
- SHA1 c909d6ac08f2ad8fe5db8d39bbb9c26333b47c0a
- SHA512 c99fff9258d36379371731a4d012c21709bcbf43aad6b814247de0ed60d11af469963bec682caf1039516bc3f72439b7b15660c316bbfbde490e5083ec877608
- SSDEEP 49152:2OP5ENi8AzyZtvgH98ei1CPwDv3uFfJqTyQ:2OPaZZ6H98Z1CPwDv3uFfJ
- TLSH
  T11CC5AF02FBA71691E9CF863D52EB573F4E366B14C328C9D3896168A1C8B16D1373E385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  MrAhmedSamir_V1.0.3/libssl-1_1.dll
- Size 522KB
- SHA256 de15ccdd6ea9e38f297bf0893acba478da2ca10ab7e681a9dd8ec9445de8f237
- MD5 75fa2d10e47049207886f2d41afec8c7
- SHA1 9bcbb2f548a5e03ed424909bf450c903ae6b8511
- SHA512 db96f7628980ebdabc616410b8822e6e3429ff0d0f708835ef51820c20ce32077661aaac3db1dc1b928908a3ddf1ed8453f2e2a38f447c419e55f8d40d49d41b
- SSDEEP 12288:SncmTon8ymkzeQqjkU9TqDwrHt2F4iU2lvzu:xmTjwm2eHsF9U2lvzu
- TLSH
  T11FB46D52FF825BA2E5CA817A25BB17BA0D3D67105724CCD38EA119B8CD716C1963E3CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  MrAhmedSamir_V1.0.3/ossltest.dll
- Size 30KB
- SHA256 d0a3f3cd45043eb5520676281d3c8a33bd08118684a52b176020fbd617599476
- MD5 c25412b3789529254f6804c763544bd3
- SHA1 8b51695e2b376a3e1dc17335a91ce2363aa14e7c
- SHA512 a442f9f7850b5b7479de45b5d24ab3058ec178c019536e6bd7a2e10f3b74d2b6c324a2e4414041fad5dde3ab7a3badd786c360256e3a6f4676aa9759a33db708
- SSDEEP 192:2fo7DBbNcAa1WhXnl7itbEzq8jIAYExCJdw3/pZGRzAyJyTfzaEMZVx5VZh:so7Nb+Y5EEzq/3EoJC3/EA7lMD
- TLSH
  T17FD2E6296A614173EBDC447D55E90F3706AD9203A374A8C36B3352AC1E2D6E3B1BD34D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  MrAhmedSamir_V1.0.3/ppadlock.dll
- Size 28KB
- SHA256 04305999c8893616b8d22f495499864a418d8b49eca63f4c3cacafa5e6e72667
- MD5 ddff5a7eda5884cf4ba7bde4554580a8
- SHA1 d017b71e9abd39830c1fdd54e0a03dca06ea3670
- SHA512 53737d9885228318f5b1ba47d8adf0c3eed9411f7090320bd278c50d7283e5fd7666439d3e2f7b41f1beb9971093946f8b5bbb0d12b13ff950939921b15b5bfc
- SSDEEP 192:0O2NnOIhpZxOAJ0kCdC0+6Ih3bUElFJvzABzNzDyJy+fzaAf:0O2NdO+060+6IpgE/JvUBBvW
- TLSH
  T17ED219A0BA4680B3DEE4027984FE59380A7D56124B19AED3A7E2C6DD0DE11D3E3B4B45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  MrAhmedSamir_V1.0.3/wvbrowser_ui/commands.js
- Size 680B
- SHA256 3708cb9814ba568e015ef3e695c394c30194c1a76e1e97abebdf80aa40c96dfc
- MD5 c2c1251f0235d6ed65ce3edfb773474a
- SHA1 d7496e2c5ae30ff00001a9e9ad7ef22558bf9dd0
- SHA512 fae7778f79adcbc7c36db4d0724121f7f1f4d587c42c31591dac407a8305ac98d9237ce7430822cbfa69ee71e1fce86a1a6daa3823b9b43d30284e45d7e4c00c
- TLSH
  T167014C84650130A1B05415B1656D1F02D60556B7EFB67BB9B5F29D040F1C70DD137E1A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  MrAhmedSamir_V1.0.3/wvbrowser_ui/content_ui/favorites.html
- Size 516B
- SHA256 0f7dfb5114866b74b244c3bcccaa510f734339649ac99dc8ab6c8c6a4a6b667c
- MD5 f83a4a278599398ea2913f7cf8648ef5
- SHA1 db74a7053df7c04ded8ab14f1e73a57fa22ceee3
- SHA512 ee0886fdb7db23046a705978c729696394fa35aba9e250dd58e49731b64e4caf9da6c825faeaa3028e6e11352ebf0e52fce66ab1752b8471818f242a52956109
- TLSH
  T16CF0230A4CFEDD0915003585ED51F41D8D85C60FC3E5AC5570BE81A5AF55EEEC84B87D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  MrAhmedSamir_V1.0.3/wvbrowser_ui/content_ui/favorites.js
- Size 2KB
- SHA256 73d824684ab54563605bd211f7f456f92feec69939f22ba13350989c8ab42b73
- MD5 0c61815d2f84d8a3b1cf2af640a7bfbd
- SHA1 66a033d9d726f5318b24e7b7a6b59036b014a118
- SHA512 678c445ed6c7eaec9446e6c5042d15c1a2a376a378a7325b2eede64b25c37703c6d4052dbe008f6d2b4173bc5d6a327ba032e792acc4e17d6edc4455f578a9ec
- TLSH
  T197515C1A3D73193896DF704F3B3BE688B970501B9949A901B4CCD9886FB5FADC4C1B64
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  MrAhmedSamir_V1.0.3/wvbrowser_ui/content_ui/history.html
- Size 1KB
- SHA256 ccbdafeb3d9041d3b2348995ae4591fb3b76dca9a3157830bd785d23e66a1fa2
- MD5 2b5c3b6992a1022745cc39b0ee2510f8
- SHA1 06235e52f50f79c40e0ffa87d9c1e1e87fe070ae
- SHA512 7d8ef1e8119d0013bca35adc021d823814ea4e9feea3eda356620ad9bebc179f792caa150ec8aecae3d6bcdfae42a478239216f492a35f00bab12b663f43f759
- TLSH
  T1B3116B1688F8C53A215295C5BDF16B0B2FC1EA0B832EA50033EC07998FD6DC9CD4B468
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  MrAhmedSamir_V1.0.3/wvbrowser_ui/content_ui/history.js
- Size 7KB
- SHA256 4481c569c9b98d0d174a94ceb35261c45555b1e5f07d1d06c2018fd21a3ec151
- MD5 9e684cde839da33dbd2cf5e9de8bd421
- SHA1 a81785b7fcaf92c3d7850621d5f85c1752915ff6
- SHA512 b22a698e9fadb77c2f69a5118dd2b2088fe2e120b9aad291cc20eab1c8639ced5a0313a2643901718c5631086701d8b164016fb9a71b0839697ce9c0a26da8cf
- SSDEEP 192:M2icsGkqkfayTrB4GIK/MhLXYZZvs8vdPEM:M2x+P3TKM
- TLSH
  T1EBF1CE1B7BB20534D5AFB11E6BAFE6843E24511B7401EE157C8CCA89AFE0E6940F5BD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  MrAhmedSamir_V1.0.3/wvbrowser_ui/content_ui/settings.html
- Size 1KB
- SHA256 3616b632f19ba2c64e552e4f5b956c5e64f4e605da30816cbcbb76fadb40474f
- MD5 448a9ef8a62d7fdc7ea12b086255a708
- SHA1 ad0bbe3a8f35b4a5b55753c07ded00cc4e626dff
- SHA512 84f1f2b1b08b5f41288370837914de8f537be6d566b1720f4aebfaf7f5604df27bf60e74a4bc04b9025afadca21afb88b6f93ed95acbdb8f5ea5ab460492d5a5
- TLSH
  T1C04162B154F98F7611525281A9526F1B7EC3960BC9EB611072BD2BE40FDBCC2DC0745E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  MrAhmedSamir_V1.0.3/wvbrowser_ui/content_ui/settings.js
- Size 2KB
- SHA256 3f3418fb6b56612c606f517d076975dfdd01aafcdab7ee51b863c77561ec17dc
- MD5 3030965b548b23c9332aa929279b0d7b
- SHA1 99e316f4b6ddae612884526f771e12f5dcb0f2f6
- SHA512 ab376fe5a6fd5f8fbb95a1f6641bffa0f7cb884eca59927d616b813a5e4cc89d7a651c74efdee2313f061581442c24f5ec078df9d9dcce80a252113bfaf4317e
- TLSH
  T12451332D2AF65A38407FB63AF71BF546792A10272804E529BD8C8F500F24DC65DE57F8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks for VMWare Tools registry key

Checks whether UAC is enabled

Maps connected drives based on registry

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32