27648d8e4eb9b533f3bff6a00850084558588cfdce41ed8b5d9772bfb6e37b92

Sharing

Copy URL Twitter E-mail

General

Target
blender_source_tools_3.4.3.zip
Size 77KB
Sample260905-ae9wpssgpb
SHA256 27648d8e4eb9b533f3bff6a00850084558588cfdce41ed8b5d9772bfb6e37b92
MD5 a6184c51ab02a86971658c016900a265
SHA1 9debd2901adf7e5d3a6d0316a8d5c00b0e1ddabf
SHA512 f5d9d1e6284209d70c10e0dceafff193caeae02e65123c3ae4e4df5a1103bb4cf6e5546dd47f7ef40c546ba9d0b1e641fa332634931a38ada6177a940f2d2154
SSDEEP 1536:5o1/VD9wjgJXtw9fbCZWxcvvc+4oB6wR9Tz9UXfRu5AUrTajj3fWPHH1N/M0Mp8V:y/VDGgX8fbGQJaz9UpQHoP6HH1N/M0Mw
TLSH
T1C2730213F1132F31C77B117EF523C60291409A2636A076DC086E78DE9E7BE97CA859AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  blender_source_tools_3.4.3.zip
- Size 77KB
- SHA256 27648d8e4eb9b533f3bff6a00850084558588cfdce41ed8b5d9772bfb6e37b92
- MD5 a6184c51ab02a86971658c016900a265
- SHA1 9debd2901adf7e5d3a6d0316a8d5c00b0e1ddabf
- SHA512 f5d9d1e6284209d70c10e0dceafff193caeae02e65123c3ae4e4df5a1103bb4cf6e5546dd47f7ef40c546ba9d0b1e641fa332634931a38ada6177a940f2d2154
- SSDEEP 1536:5o1/VD9wjgJXtw9fbCZWxcvvc+4oB6wR9Tz9UXfRu5AUrTajj3fWPHH1N/M0Mp8V:y/VDGgX8fbGQJaz9UpQHoP6HH1N/M0Mw
- TLSH
  T1C2730213F1132F31C77B117EF523C60291409A2636A076DC086E78DE9E7BE97CA859AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  io_scene_valvesource/GUI.py
- Size 23KB
- SHA256 6a9cf32b6548e91277f52896c1eaedefdb4d3524e572709a2f56dc4726442abe
- MD5 f1ef6a6e2824013d9815f7aed87e3194
- SHA1 c5b43997047a83e643377b59d810ead7dda2b819
- SHA512 ca8f8d0780e90f650d76c7f9937f1914d56c29f75648088d7aaf2c73eb32f2c73774033baaf4f68fa34445139ffaca8ef48543f0507da6b85929f01318e4e6df
- SSDEEP 192:d0Lt4W3oNTGGhT+L4dhcpwOMCiHSH49MFUr0lhMfz979zjP+2yaM/fMnMLQkwPK1:2L53o84pplP+2ya2GlYdjQP1tQD
- TLSH
  T158B2D768B47E9CD1525332A891381002E9ADD7D1D53ECF12FEB5E294B0E0C47A2BB7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  io_scene_valvesource/__init__.py
- Size 12KB
- SHA256 669c6e1faf1a411138e994dd1c382edc466fb840a64842dc188ccdf5b13600cb
- MD5 048891ef29659151dabf6191725cfbde
- SHA1 accefc19a0faba3a0c5c70e86936d7dd787cbc16
- SHA512 6abcecdce75e8027ff1f1f4a462c7c24597ea4de13db374a959529e0a11ded8299374613e0ebe6e5983c321b80dc875444b5e4bc75560a6ae2df7911444fada9
- SSDEEP 192:d0Ltri10TIHc14ciLCmh7aa3Xqikf+Zc5m8+nuh5MJi2Gn4zuh6QJhN0h0gDh6vX:2L5i2TIHh7aa3XqiO+Zc5m8QrzQH
- TLSH
  T199528463DE3AED7141D72245AE74800074B4079D613D9A13BFF9F7B46096E68B0B33AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  io_scene_valvesource/datamodel.py
- Size 34KB
- SHA256 43c2b822d6fa895b832941b8df0e142ec77a919ad2138eae2fd2843bd3267112
- MD5 0f03ed2781cfb03562be43f1ac7209bd
- SHA1 32155cdfb3050b667f42f2192005077330fc9e29
- SHA512 376ccf9a86263364dacc1cbdefa3fb14597593dd36d9337fb7a008c61a7cd5df7c84ed1438a5166466df357ad13bd1997ffd30e135a8cd2d01f44f20bd3cde79
- SSDEEP 768:qudOgaQ5PEMX57P23LFpPMhBU+yIm+o/L/Cuw3yCiBwwzB3BNPP9RzsVNDPVOUII:qqaQ5PhX57P23LFEoImN/L/1wCCLoTNi
- TLSH
  T12DF284B0F25DD8931325223E523A980BB65EE073467F59C2BCF9D0347464C6690B9EEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  io_scene_valvesource/export_smd.py
- Size 78KB
- SHA256 9fad2bdf16ad5c8ce3f7bebc85a679521ff2cdc95aed49dd114545aec159e356
- MD5 85d059eab681ec2c36a3fc86ae76daeb
- SHA1 dfd31ca54d5e983e978cc812a5e559f4b096f125
- SHA512 9c173c725ee5666cd75a8f5e9cfd4bcfbe8964166e892ca311f4046930b469af22b4cd3f6416d2687cb72a7b4447a891595ae3ce6f46d4cf41039b2266027d15
- SSDEEP 1536:ATP4T1i4rBEymAwRBoSRuIQD9RFPoDzST7jyxmriRfUul0aG0Fkn5Qx8SBxfGiQe:ATwpiCEymAwRBoSRuIQZRFPoDzST7jy5
- TLSH
  T1E083D87DF22FDC8950161199627D5982BF2EE0F3593B4263B9F4E2187080C21B5ADFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  io_scene_valvesource/flex.py
- Size 8KB
- SHA256 c11447aa85e4be635959d33a7dcf150f98939370819cdd14245d9d0c24c25fef
- MD5 294daf95cf6329215a04e30fdb9a50fc
- SHA1 6119e9db0a50f861bd72de08a9e8a1f1f98824a2
- SHA512 abc14ee65e95139be97b0f5cae06134ac14bd95e7d0e40e447e18a836b446c29a0f62f8afce21df972190de45a04792ad27802812d50d1db022abce78233e77e
- SSDEEP 192:d0Lt0TRFf+0ZW2zhLAHrhglnVqTSUG7n9J:2Lwp+CErRGj
- TLSH
  T16812B979757BD8F6012930A8163540C2F649E583AB2F4452FCB8E884F1E085EE7677EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  io_scene_valvesource/import_smd.py
- Size 60KB
- SHA256 3aa77d5ed5cd81e068e797f97e219dd790c1d6a0d4253732f1982c3adab52346
- MD5 8034eab3949265fb74005ea9dce2cfdf
- SHA1 bd1c8ea7f8371ca0245efb9b1bdcb59810bd47ce
- SHA512 fc2884560aed0f24ceb46870eb2d61b88df32e224eb3874701e9e3499f2e68dda547b57a4e2610cf99609032b84c60610bca2acb0f5ddebea3342c178f5deae7
- SSDEEP 1536:j3B/rpucS69jEhq//nbIjdNTVyLCsNoKzZQrcbWEL:j3BTpucS69jEhq/PsjYOmoKzZqAL
- TLSH
  T10553E769B61E888540152259527965C67F2ED4F3983782B2FDE4E268B084C7372FCFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  io_scene_valvesource/ordered_set.py
- Size 15KB
- SHA256 95d2e63f93e7cac700d984a579bcba6e2393a6e2ec6b641507b83d9cb61cd6d8
- MD5 6e031a6dd1da87be274fd0b1a92321d8
- SHA1 52a368fef1cfdbda037a1f51d199aeb258426233
- SHA512 e39e12f1e5bb8c7efdcc17f424566d8cfb5014ec7b72e0cbc3a2c8612a447a4e598c54d47f76f284f204b394d73ef86ff0600001437e69b56f80c6ef0b3823fe
- SSDEEP 384:IF64c8WfrlXi+voKhJxFg/B34dt1szjkj8U/6bkdy9:86Bfr9GKK2Lakj8U/6bkdy9
- TLSH
  T11962CE53EE8B2929A1B2D5BD4B1F9C06E31C401380ADD52A3C7E206E6F77417D1F99AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  io_scene_valvesource/translations.py
- Size 24KB
- SHA256 5eaf84412c2e76dff4abca7cbfa350cc52ebadb7c27df48a12ba8771507e79e2
- MD5 b9507ab0880adcc2934b9c94d71170a9
- SHA1 9e57a289ced0e470cacb3443f8ec9cbae026cd58
- SHA512 d26170e82125874064172d28f611dc15bc7184f7050819c8236b740fe731d5309f903c0bc303e38af22974b9659a8d61e98b6a314fbdf738e4ebf5fd2257b609
- SSDEEP 384:2XuVNDDz0vDxnDuNoB69vieTp+R8MZFFWRS0bljVY:2X8NDXIhDu+cZTIAju
- TLSH
  T133B21D2F93D0757EC1AB33DD32368F802717587FE62AA92D38B8FE1C2195C999156270
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  io_scene_valvesource/update.py
- Size 3KB
- SHA256 53d6b2dd7cff8815b740d1bdda6f7d7527a121a874a4879dbe24e0fd4cd564a0
- MD5 287bed0f890ea1d42bce830ee10fefcb
- SHA1 199c862dd1fb85a6a401404fc2dd101ebd481fdb
- SHA512 1c15abf2e969851edc3b6d05741a9b464befb380d5b9efc46f8b3153b76b5e6ced82035461303dfd4f21581cac98fd4ea8a3ccc2bd216c26a077e9dbcfc7ba23
- TLSH
  T1D871DAA9722ECDD70130269435F944C7726EE2F21E6F9203FDE5E34CD010666C6B86D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  io_scene_valvesource/utils.py
- Size 26KB
- SHA256 330a55fc72cf7bcb4ec9d4dd0f200dafaf7c358a3154a5d4ec7ba2f87d341d47
- MD5 7d1136ba829c3681028e7c002a4a704c
- SHA1 3ad23eb67aa01a3fb544857ffdd386a064ab1475
- SHA512 ee467499370d47b99ceb3b81387b38e04c1711f7d90c907d14ca5c481619765876045aa9a7c2f01b8857f14fff0d62d52f148c082865c7974f8002e63b930493
- SSDEEP 192:d0LtIuEXtOZGcje3uG/exs1IbQ+OiNIkiLi0hc0u7TpUmUDlaI4N7c151czpFS6Y:2L+tuLRQySk0JWnURlLKt3veMCW90b
- TLSH
  T100C2E9B6B10BEC570272729D62B45142F76DE0B2613B9412FEF8D1A87150C3BD07AE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22