7a88ff24cd830e992ba8f2d1c9f16a7c7003bc624266887d9c2722db239a2b2e

Sharing

Copy URL Twitter E-mail

General

Target
Katana_ZERO_files.zip_Archive_win_866755.zip
Size 801.0MB
Sample260828-btlyvsscrc
SHA256 7a88ff24cd830e992ba8f2d1c9f16a7c7003bc624266887d9c2722db239a2b2e
MD5 3d352abda903fcbabbe666ab32d133a6
SHA1 58669a423a9e3046993ccffbabc9fad517d8430f
SHA512 da4c1b801d4212be9b05a57de0cd6573e128fd14e99142c3fa40283c8bdbc7b1e3e8c9c53f0fd1d9a34b0da95a6b1aa0b785a9b8206ce793a4e093420b3c534c
SSDEEP 786432:hLmBBvdDunybvsJyuOrdX0vXihnPYz5SQH0TZZo5:hLm3vNKEvsJtOhkviVgND0Ti
TLSH
T1439933158A2DE4D7FB9772B474B0D097D52F90B131DF92A8F8AA31B09D8B9043F2D909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Katana_ZERO_files.zip_Archive_win_866755.zip
- Size 801.0MB
- SHA256 7a88ff24cd830e992ba8f2d1c9f16a7c7003bc624266887d9c2722db239a2b2e
- MD5 3d352abda903fcbabbe666ab32d133a6
- SHA1 58669a423a9e3046993ccffbabc9fad517d8430f
- SHA512 da4c1b801d4212be9b05a57de0cd6573e128fd14e99142c3fa40283c8bdbc7b1e3e8c9c53f0fd1d9a34b0da95a6b1aa0b785a9b8206ce793a4e093420b3c534c
- SSDEEP 786432:hLmBBvdDunybvsJyuOrdX0vXihnPYz5SQH0TZZo5:hLm3vNKEvsJtOhkviVgND0Ti
- TLSH
  T1439933158A2DE4D7FB9772B474B0D097D52F90B131DF92A8F8AA31B09D8B9043F2D909
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution ransomware
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  data/python-packages/sys_config/__init__.py
- Size 997B
- SHA256 17ef818c3d19684f5677d02f20c0f7ddcfbb5071217a464cb4a9a0b5abba6849
- MD5 5fec418248fdf26067a2299ab1155156
- SHA1 748fec5fecb7eda55fae6e3a6bc9f62455f06830
- SHA512 9dd65e01b9088584d186d73baf374fe78cca44a4e57b89ab45d174d2bf15cd2c16060d0719764d216b4c089d06fedd61378627a4928868c2cdd7e28b08c225df
- TLSH
  T17111DCD3835C04D4F3898E8201593B6AD1EABC2B75ECE9403EBDD2DA6711A7BD8534B4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  data/python-packages/sys_config/access_internet.py
- Size 1KB
- SHA256 8e9c8e275edc9b589814f897da13c4624946ad092e8cdbcf09f05844e824d3d3
- MD5 296b6e254cd0e03119f0d2c34ef8ef2e
- SHA1 4548be9f7c842e7bcb2f93fabb8ee24472e7abcc
- SHA512 1f79d57ddfa74a320a7df8500fe66d2b9bac2e8d318da2c749e22706ed46d1c8817223f549bf140d6f628adb5ad82bb5bb85d3dc35902b5d408756733b33c30e
- TLSH
  T13921D6D7974EE846F322834B0C8BB70690596CD2262CC91CB6FDC80D5751EF2A6D74B1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  data/python-packages/sys_config/sys_check.py
- Size 6KB
- SHA256 de114cf37a50f1e504288017b8645c615b221c676f67c137dc70507142fc30ee
- MD5 89f0082cfa57472f7a1a05ffd4894664
- SHA1 fcd903fc6ad723aa6974f26ddf17e61638eac53a
- SHA512 51b968abc58fd68f1ef7d474f80970e079fe63008555d17873520bb2769cfed60136336afbb9d54e32b5dbee46712373416c084cb6934f5dbfb6fa73610347ac
- SSDEEP 192:hasnR2RKLzQReNC/xFuXR9MB7UyU5viGGOFDj8:hqReYFkReB7UyU5vZ5Q
- TLSH
  T144C12EA20C0BA821E35B98194CC7E75A63292F47134CE92C7EECD8186F515B297E3CB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  data/python-packages/sys_config/sys_file.py
- Size 16KB
- SHA256 2d4d01b5a889cd42e05058d08876e92724662b10e073a840ec4e0ce13cf9cccc
- MD5 2a4bec3261f0a959a1649767ae71199d
- SHA1 512637d581479ce22f5c5587e3aaeaa0bc4fa6c6
- SHA512 8bf6d52afcdc49199ceb9da98ea10efc11a439d1cd27f3cd91c52ea9b8e73a5d61e7e322f06a3e52fcecdf54b38f0f47a74dcbf7028e22507e7948be99cd0220
- SSDEEP 192:MV5EBKE1xnCHrsuWM9xViCi+TzD5YpjpjY6umQc9ONgWsHWHtT7dSR:uXKRY6umQhwWNu
- TLSH
  T1AB72CCC3C75C5AA5F312431A188BB78140A57C97172CD86C7AFCC94EAB81EFB62E6474
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  data/python-packages/sys_config/sys_spec.py
- Size 22KB
- SHA256 030e5b3b070193cd1843ebba9b653477aac468b0ac117a43f26cc8a6bac7417d
- MD5 e830d56dcf2d138f394080610bc3ffa1
- SHA1 3baaffd5618c4daf2044abe74e943289a9f231c3
- SHA512 58e95436bd939fb334b176282e1644012238ec598b4417978a5634e106e536ba7e6b0f3414ef72f7738eedd1e55640f8b40fef86d7e124d2e3815e7d895aedc2
- SSDEEP 192:4kwIdzvjz8Tztu/wWpiEAC9lv4hacwg9D4fH+2UQqQS:XR4uIWpPdlvofwgRI+2bqL
- TLSH
  T10DA2BCC7C34C9AA4F326431B089B734A90956CD7121CD89CBAFDC85E6B92DBB65D30B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  lib/py3-windows-x86_64/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  lib/py3-windows-x86_64/libEGL.dll
- Size 436KB
- SHA256 b20c1e14e42da55c13dad3c23a5060ca086eaf5b18b12ef5c60cd7e80276a9f2
- MD5 1090bf4c5495697a1416cd77481cf7d0
- SHA1 94452eed4fa88dcb0a5b3c503a12f3a3b5f23ee8
- SHA512 d205dd98260d033300afe3f2a1c0c06f3bfbf158067fc3290e10ddf6f51eb80b57af56fb0e75a56b82dc3ec49190c5d2c296aa548b64e39b4b004f60a7da89a6
- SSDEEP 6144:CrHQz/GL44uCWgSqTpyGRxyB5EdpmMB6cm+p4HRw0FlA1Qu4P:uudhGDyB5Xa4HRw0FlCQ
- TLSH
  T182947C29B2A448A9D036C038CA174A72DB31B89A0F75F7DF12E5D2692F773D45B39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  lib/py3-windows-x86_64/libGLESv2.dll
- Size 6.3MB
- SHA256 2d171e91e1fe7205b76dd69ba9f7ddce7910283a5a5111c09c84f5db8c795a74
- MD5 7dde909bd5c7538ac46064741a8da6c0
- SHA1 46b50003be83eab7e0c48ebbd9260b5b021e70eb
- SHA512 a057586a0b566c5470a6508e27764f9662ceaf3b08244c3db3d1e07789e87a30a43f1daad0274a4e3d00b641d3f9f90e9c073a5f7db3fa6d1de7f45c33adc092
- SSDEEP 98304:1DACC5v8sHfvlfkvghk3xlkihzsfFUQOJt6c:CvxkvgfyoiQOR
- TLSH
  T1BD665917F2A281E9C009C135574B9632EB31BC851734BADF2294F6692FB27E06B3E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  lib/py3-windows-x86_64/libpython3.9.dll
- Size 8.3MB
- SHA256 ff051213109bca8ae55d458c3eb8c9c0aae12a765ecbb45e6b4b20d4b97b8da7
- MD5 32d079f77a2383e262b4a512931fb120
- SHA1 19902535da3cb79c093f59fd597444a96f143761
- SHA512 b1bca949aa2f7b735a9e8e5d4fed3e698f3ce77edb804ec56d0f66d3faffb9d1f82a55bfdfa5393ea5d64cd8379ce9a59a298fa486d21e4ea5f29340d4cde65b
- SSDEEP 98304:Dt85Qi40yDueXVj4ka+Pjd2wSY6XO7dPlMBLa2THxM/UZpMBAOd3+opm9g0vHF6:B8r4pr4OjZR/XBA63+opm9g0vHF
- TLSH
  T160967C23B19150EDD93AC13192975233BBB5BC501B21BBDB2154B7702F72B911FAEB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  lib/py3-windows-x86_64/librenpython.dll
- Size 18.2MB
- SHA256 29d7304930809804502f331e47d06b72f07b3a1569eb29e0a12dbc71932915d6
- MD5 773d30682db91d99eed3b6f6a3591fe6
- SHA1 1be09711350cc40dc258d893ca3c0500c71f92cf
- SHA512 b0893ee4d82b5efe59d8a8ff9690579b106da608d04d161093ce4757e0eea62b5e16d84bbf3a422012801cec3c45a570907bab6d33ae5516facb9e57e3940322
- SSDEEP 196608:Vg6lprLkZark54oIFe/IFtRRcYoB/xEOAoP3i:W6lprLkZarkCoaeQzcYoBxEki
- TLSH
  T146176C4BF05268A8C586D174CE2BEB22BB65784C457279DF329457B03F71BC0AB29F48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  lib/py3-windows-x86_64/libwinpthread-1.dll
- Size 344KB
- SHA256 00d784e7e002c1b01f3146c87f30030f169843988f87c9631cb2df211979286b
- MD5 da67da022bbc1bb9409e3328c1cb64e1
- SHA1 e1fd29f4256d7066f05d113cb8e96e1aebaa38e7
- SHA512 24ba4936ff149f0875b3e4c7e36e80f941130faccd4d6296d68c8af8b0e647c37d0822d477218ab0b3d4b51f24cd1dfa1ace54adfbd175d122036c3a7e787ebf
- SSDEEP 6144:Wo14rtZLc1fPm3YjZxgMOKSjkPDNjYBlplydMofn6cHqq85l:Wo14r/cBPm3Yg8SjoYvplydMofRHqq85
- TLSH
  T1E4744B8BE754DA7ACA1146318CBB0B097337D04067979F5BAB2CD2783D8BBC4DD99608
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  lib/py3-windows-x86_64/nvdrs.dll
- Size 14KB
- SHA256 068b0c02c881a5d8587a24929e30d8c596305543ae6da5f264f8230a2e45d300
- MD5 c48d5218e5f97b2064c4002d4b30c435
- SHA1 4ac56e31bfb9c5036d60afd6de46a3f1e41f2ec8
- SHA512 3e54fe5174f121528d175ac691c5d36cee63031823c9e09d603d8955312046f57f452e33ffa4863698597849102f52711c3d8738933c07cba12d1f49e611c44c
- SSDEEP 192:rKFj3Az2SjQ0bnUdPIPKPpCxeELcNiTw/dUfYa2GzEfw9vmQ:rKejQ07KPUKueELcNiM/dyDzCw9vF
- TLSH
  T1D762E7069B5524BEDE4AC17FC2771762FAA0B960076219C70371F2650E71FD42B3D8AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  lib/py3-windows-x86_64/python.exe
- Size 101KB
- SHA256 652f72976536214578a6ef848d7359495e02db58846d15ea3a85e90ef1040dc9
- MD5 d11142598cad7ca67caf7606470bbd00
- SHA1 f6d35808803e2c7eaaa85d2f1f756b06495771aa
- SHA512 87b8533b53f87bd8ce0133cd949b0b5393dc3ce02235b374f73be41cea0fa0697da15bee65ec9cf0b8109b549b85659cee38ffb39df763898f584671ff9e2e1a
- SSDEEP 3072:jOC3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:qcQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T115A3F10AAF5616BED921403FEAA70562D7B0FB6223911CC71211A3311FB7BC1AD3747A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  lib/py3-windows-x86_64/pythonw.exe
- Size 101KB
- SHA256 092c282f21cdedf3d533dfbc3c77401856de863833904fc09a1d3668e8d50181
- MD5 8cd16e17df02782c111ef7475bece461
- SHA1 e368b52a96d656c6635df6717bdfad13572ee746
- SHA512 8029576e56a28b9f1975cb28b093c4896bdeee8b7ffe4596bdd9fa4ab7bc277906c7dd6aa7c33375a1fbbc5182ef009e70d7feee1689d4c7ed6510254cbda4f0
- SSDEEP 3072:yOc3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:TqQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T149A3F10AAF5615BED921403FEAA71562D7B0FB6223911CC71211A3311FB7BC1AD3747A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  lib/python3.9/__future__.pyc
- Size 4KB
- SHA256 791de268946ce6bca07aea7fb44c9ad0172b374bea4b290c38fa6e9c1efd5e44
- MD5 2d68b1f1a4da598a147bc9e375534570
- SHA1 fbf957813a63fd6d7bcc347eb5d4f221ae1e3d62
- SHA512 1c841e412d336bbb1d11d1ce903f1d076af1f9375e74733106ab69e081534948fd1d5ce30949ef139b5e95369fec6badfbfb9f8ca8ba3ef9b54f9a8a3b683709
- SSDEEP 96:Gg1NzUuGd+P2sKNwWwD2j82xnCg8Q/Ks/qN+Bj0ui:L4BRdwD1YCM/KsSN+Bj0ui
- TLSH
  T1BA81860A694549AFFE47F2F2A2C911C14F59C2BD2F94603A365C52443BC3892937B88B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  lib/python3.9/_bootlocale.pyc
- Size 1KB
- SHA256 9858005ffc5e24dbd8c8324aa7a1c677da5f4d256da7970053cf8320ddd295b9
- MD5 b310c1aa498564e607b7323a4c1e5675
- SHA1 9d52941323913140830ccdfdffbcf6916b18d193
- SHA512 1b75a52813a372e7d5fce372b9319c3c8e832754bd18ad6003a8a0f1f106668f01f69c82abd9c0f282439342d406e8a269793ee4139408c5cc9fede8b2486d50
- TLSH
  T12A21024A0B015E4BFD21FBF476C5822446B985790E1FB9591715C27A3D0E25C6E514CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  lib/python3.9/_bootsubprocess.pyc
- Size 2KB
- SHA256 f7070e19a60e1bf2aa5fb590af586328854777554de682ef47a2c2a8580f742c
- MD5 1e73b6724083ab5dd5c41de3fb2bd812
- SHA1 f41b1909e0bf7380553827acfcfa7e8988baf92b
- SHA512 d10667f08268fdd524340073b45bc3705e75b4f47f804dd8ad2fc6b4bb892a4f81e7f195fab08de75f4fbd06c0729afcbce777172858058d8a5675ea1340bcee
- TLSH
  T1C84176DA52B954B3FC61E27F601A12724FB2C539530A5A20251EF9260C4E9D4EC937CE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  lib/python3.9/_collections_abc.pyc
- Size 31KB
- SHA256 2cbbd85b65288eafacdd1078886412b4db7028b2426e9e78fc0966ac9c72dca7
- MD5 f1d26a6e70afcc9b37d04638669eca5e
- SHA1 3434a10216fe9effbb8f0fa4c7b38bbd151eb552
- SHA512 9533623e12c78c417b9633e6f63f458178a84bc90a2bdf35cdc55646a79b5b258e353e51faa16673b711acae495e9fe14f114e7d2496bb4fdd4988b7de9a114d
- SSDEEP 768:/GJgavbRORmFHGyiajSVnsximHAC6t2TqBuuUBlMKzR:QbvbMRByiRsximHAC6tNuuUBlMwR
- TLSH
  T157E262C1DEC2EE67F855F2B940760128BB24D2E3B23C8297350DA57E2E07E8499F5D94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  lib/python3.9/_compat_pickle.pyc
- Size 5KB
- SHA256 2fd768fcb64fccdffe4706c751481fd12032c49c766d1821d35adf40cab80869
- MD5 911d807e5eeb4e53dcbdc9e23b200288
- SHA1 a5397052715a5ad80ebc50c01b83772e58434624
- SHA512 e41b28e73697423515b9a62f8159f1e523065453cd0bbfa6ef99d91ff34b5acccc08fa127bc771b9bc6b5c19a0f9a699a57995958ef9f28cd3dab1a39b4a4e96
- SSDEEP 96:Mgt2e8lJHvjrCWv4unx3TTdqBjR7ve6n/vNnrO+VCCkf+0QEWuO:12e8lJnCTA3TyG+9rSskO
- TLSH
  T109B1E605730DA6D3FEC6BBF3A7316316E57D008533A1C2958628DA5B0DA8B42DE2537B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  lib/python3.9/_compression.pyc
- Size 4KB
- SHA256 128a541d5bf44dce7df8c2b492a09db68d30895b89261f1822704dc990e16615
- MD5 2925bd5d0f6fd7943ec018515cee6c56
- SHA1 63e3d883f08d1e3bd344866ac22d407276186899
- SHA512 8d0121889c36da90d503fc6b02d531ae1b3c087487a48c83572576ce98012a03dfae31a5e4578ae2b0f55fd2d4821705ca41d76b6441013f47ac20b6647ae2e7
- SSDEEP 96:/GAZIrERfwbPtC0iEKj0KLs3IPrPZNd2ELjNqEcvqiuyng1aN:xk1IjEWCqiu31aN
- TLSH
  T1889172D98705FA9FFD66F3BE8A09777422E0427332886302A509804F7D4D6C59EB79D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  lib/python3.9/_markupbase.pyc
- Size 7KB
- SHA256 bb141259dfbceb260211410bfccd64c523aece349c77133d8c9e2cafb71b2081
- MD5 ba50e7dc5890d22c6a403d27d39c0155
- SHA1 d03b5bdea1deffd34828ec210bdd8f7461ae114b
- SHA512 a345c554ba4dc161be10e6f3f6d7873201d8544ada32fe813e48256958f6e8063a3a07f3d9873d12cc414307d260d4adee342185521eaee58a9e1500b5c00c75
- SSDEEP 192:evE293F7TF+f2cgj9L0+3aYfTdW31NTfDWE06hDorUcP6uitqgT2nV:iE2NF7TF02ci0kaYfTdqjSP6hSUcnlaW
- TLSH
  T130F1B6D959492F8BFC99F3BE940E0A21A436A33D6644C086A514C277BFDC1C19E1F29E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  lib/python3.9/_osx_support.pyc
- Size 11KB
- SHA256 a64365618a50cadd559c66ef966b976692a5a38b83d2767a1921ca401947559e
- MD5 ee5215d6e2a883f118cbe60a1079dc4e
- SHA1 cd59c1ececc4aaaeec0a153dd9f26d5660b29c8f
- SHA512 af240db53e24734beb30a8c5bca4ab8c2fb402f96bcf433790a6b472b5b03734a284689e2ca06cbc615e299aa8a3e4e208120627784e7b82416092b3d55a6040
- SSDEEP 192:4yT4OYZGvl/YkB53qIPK4k2QAb/bCVNnXP/D2ojgMPOQ:VG8tAkvqIy4XQAb/bCbXPqog2b
- TLSH
  T1B9323DE659847C77F8E4F6F841090361DB20E7774B08B1CAB045B1590D8ADCA5ABF2EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  lib/python3.9/_py_abc.pyc
- Size 4KB
- SHA256 d9d4da55f6ee070b5bc8910cf3a2e5f2d3f05577e01e9d8f5a838f2b9bad9cee
- MD5 7f24ccb51b87d1e4e4f88246c138c2f4
- SHA1 bf3dce133b4eaaa6265d92a4f710d7535329c14c
- SHA512 c83ecf6f91f0c0b0c4bb5fb93c97d36e31e651e03e946d6757bf73e0d88e0ec7a4f1bdb4a5ad5d44d7cc26b614d487004321b88af2dcda356d76830baa3aeff2
- SSDEEP 96:gu+v2XIUHa25JJD/kj152HWmcYSBmhG3tsXoq8S9Q+7lSW9+DbLqfEO:u24Oz/Jb81522mQBZ3tsXL8S9Q+AWE/o
- TLSH
  T1F9A1F988DFC2B467FDCBF1BE5518424CB652D337932480826ABD919D2E066DA81F3768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  lib/python3.9/_pydecimal.pyc
- Size 156KB
- SHA256 102920c89e20da7f9dbeccc8711de1ca4a56e322c5d56b3b9c314cf1d3b1a763
- MD5 39580d19925b7b2cd3287d6940d5d809
- SHA1 5ebd89b347d74ecd591e4cfbb7a7e50f20ee675e
- SHA512 8486e4c6089a7003c568cd5b964a7291d6a71f30e65c9fcb4dbad946c6f3ed78e5e48780410799dee6adca8a0230b340e5195553ffeb99eea3de6bfca1c1966a
- SSDEEP 1536:gQM8XGTcllhiOu7dmImmdWQkAUmDZT7oe3mj5ygbF/O13J1+RoZv9NiX29Y8BaJ9:gQrlIR3dEAUOdpmjCQR0ATJP6kNd
- TLSH
  T18DF3C77527C3A552FA3FF9F4429E11816B14623B42C8415AB40DEE387FC1EAA29758FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  lib/python3.9/_pyio.pyc
- Size 72KB
- SHA256 2fa4145576bf7480eee5e71ef30f926bd270cc32e0c437b36140e639564e35c4
- MD5 a2876e244f100e59f5d2b0e5fcb6b748
- SHA1 c45961b1fab604424eb0842fd0aaadc249051db1
- SHA512 b417fd63ba9b77ac6093d049e81e1835530edde11895fcfe450162e725ed4781db7982988379a596b41e987362cc350ae0aa129b26cff0ec399ef220db3279a2
- SSDEEP 1536:XIJLtxzKWlapQyvW0yVbwWziA5Y0gpT8ZjILotgo:YJLbNyvv+bwWP5Y0gJcFr
- TLSH
  T10473C581AB65ED9BFE51F2F50985C7E0FA64923B13299241709CC46E3F0D2EAAC7D4C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  lib/python3.9/_sitebuiltins.pyc
- Size 3KB
- SHA256 5c6211bf1ea5ab94ddbdb19020f32f7b5cb9d9873f1f451417893013cecc3eec
- MD5 e56797d44177752bf47c23aac09e80a5
- SHA1 7d6515bfa38e34c1a981f26d88f8c3aa1c0a1d54
- SHA512 6606f544c0e296da9df58e76105712b15c5d65409ff31f3dfa1b5db4d376c977012ecad35e1dfb9b99eca7ea21d05647d9b59f0d6ce7bc03ccde205363724c9d
- TLSH
  T16C7131C2CA82AF7EFE55F379852E8374926B513722D505076C0C905A4D9A091EE78F89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28
- Target
  lib/python3.9/_strptime.pyc
- Size 15KB
- SHA256 24deecf791358b1fcb3940200d0c74655e8a9c92d2b858acd32815392a2849e1
- MD5 804e2910cc870d8cb47ba8ac242b1bf5
- SHA1 f2c7ce5d4e85bd3c9c729f49887a6bd87f73d26a
- SHA512 593b0943035be455a629776806e7765d0c6e0538fce74aa5b20cc259819375e80c6dac18e36fedd9b9ff0d1fff843556a71dac73929bf48fa1e42e4085b8620a
- SSDEEP 384:4/CwAfsKSzQLjJM80oee9E05+u3PxxtTOU4OTFXJ:LJfR2QnJ50bE0OFKO55
- TLSH
  T12D724BE1514006BBFD68FBFCA08D0B882B15C2AF8B4AB655F90ED11D1F4AC2DA5391CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29
- Target
  lib/python3.9/_threading_local.pyc
- Size 6KB
- SHA256 6bdb8770268e79e975be567e95fe6b19fad01bb0201c4bccd38dd9e25ec29e0e
- MD5 237c825cc24840325c69a491039d503b
- SHA1 2af584a3b0ad7919cb166a06891a4be0478d2154
- SHA512 c886378e5127251d247d3562062d59f1a2adcff50f2e7a3c561a0b2bcd97fd9c48d1d12e7cbb84809637ed4ceedea4b71e1210b893f698ec65083fc7d0be9f7f
- SSDEEP 96:v5s4IChC4/ew4oV6TD/DhI24PlySp510uMeXM37AUKvYzyeef8Pk:Xi4mNoIG2clRjXsz+Nh
- TLSH
  T1B8D1945B654B65ABFE12F6F8862F13249213A239520F111EACA9E0361F4C7FC68B15CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30
- Target
  lib/python3.9/_weakrefset.pyc
- Size 7KB
- SHA256 f5a5dc1b0f6b04e1f4cfaac2de9a7d725cc36714cb3f6c6877ff1337744ff2e5
- MD5 8d0e4d6466571491118f7c429cb18e00
- SHA1 4fb4d21c428db4c364cdc5206ff260185a3ffe61
- SHA512 70186503b5f5ccea16823951d79608d404a15efdb125a3487ff7b26a631c0be5fc14846df90bd8005fc7a7c85f099a3042463f67f5af32b6b402f8b08c066788
- SSDEEP 192:iooi4O38vU5e6qTKNOHeJHz9s5k+f5hKil+xh+uRD9AuEqF+EJXoyOiOsuy8KQtk:/oil3MUYlTKI+JHzK5k+f5hJl+x0uRDJ
- TLSH
  T175F110C94E9ABC76FCBDF7B800970317F1355273465D82036029E4BA1E8F7C95A6689C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31
- Target
  lib/python3.9/abc.pyc
- Size 5KB
- SHA256 ff626b3784358e901e4471455590b498976ca5b8a00f03e4dfbddef18fccb713
- MD5 14174fd0fd4a70a224f12cef06f1f460
- SHA1 1898fc0100cfb62bee17f2cbf4fe809b3c71305f
- SHA512 0753460f7064411d773f291bd6047c81bd6473472e27fc17d8b16593f5961b794084227fd7ecddcefdc8bdb09b90e17c3468c55e31d59777207c6b47d15b2658
- SSDEEP 96:MCx06+Se5PA+Sr6F7xQIQpMYAULp0z1p23HXGgRERU8o7OGOU9o2UeWialn0prQm:M2+dPAh6JUds1p2mgRERU8cOGOU9o2U4
- TLSH
  T19BC1508EABE3ECA7FDCEF37A440D445DA5056223DB0AD917BE9D024A1F0A6D502F2460
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Suspicious use of NtSetInformationThreadHideFromDebugger

Indirect Command Execution

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32