d4a59654e603b9e3a711c5a85a1783d2db0856f920421082032b6a09474b2f9c

Sharing

Copy URL Twitter E-mail

General

Target
Go-Live-Setup-0.1.31.exe
Size 91.6MB
Sample260905-s8texsxfph
SHA256 d4a59654e603b9e3a711c5a85a1783d2db0856f920421082032b6a09474b2f9c
MD5 678f864f57dccc841b1913428da07d39
SHA1 53aef1f72054419f4d878822e58e1550001b0db8
SHA512 1e643fa4b4aec7c3b524dd627c3ae62f97c00325a45188390a56e55f85933283447f370ae64eef0d7c913085e7660391150ad6c51fa93d6ab8b623f23de2e511
SSDEEP 1572864:aZAKstwfGit65jHFqB0g3b1arQR+023wbwzCP01+c1VsldCcGkeqxixZPXd:aZAKsQGHjHub1arn02AbXP01+cUlEJkE
TLSH
T19428338F58213419C3C65EBB55FBA3B2284EE1E6465CB31FE1DDA4D130C58A57AFC282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Go-Live-Setup-0.1.31.exe
- Size 91.6MB
- SHA256 d4a59654e603b9e3a711c5a85a1783d2db0856f920421082032b6a09474b2f9c
- MD5 678f864f57dccc841b1913428da07d39
- SHA1 53aef1f72054419f4d878822e58e1550001b0db8
- SHA512 1e643fa4b4aec7c3b524dd627c3ae62f97c00325a45188390a56e55f85933283447f370ae64eef0d7c913085e7660391150ad6c51fa93d6ab8b623f23de2e511
- SSDEEP 1572864:aZAKstwfGit65jHFqB0g3b1arQR+023wbwzCP01+c1VsldCcGkeqxixZPXd:aZAKsQGHjHub1arn02AbXP01+cUlEJkE
- TLSH
  T19428338F58213419C3C65EBB55FBA3B2284EE1E6465CB31FE1DDA4D130C58A57AFC282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  Go Live.exe
- Size 200.4MB
- SHA256 d122eb07d3eb7ac926c7f381552b4289bff1764781b2a48fcaaf2b7e4d4e410e
- MD5 fe4adfe10be2fdf05c7fe010a224c18c
- SHA1 1f71664189d76c97852d2ee36bce7d50135c7091
- SHA512 0dcb7ca28f8d57055ebb7810a12ca9483485b28a8ab3dbf03db1d36e4b1ae9517ed75c9f5f37f02918b08d8ab8d1aabd0f82bf2f07f2e80779d5798c9e404dc7
- SSDEEP 1572864:kir3YkVksSEZWaMZDjL3r2sHCDTnq/jxOiuYSeh019IZQEKzVn7SfK4lJroH26Pq:FIAnVb+/jVSbxkg
- TLSH
  T1FEA88B13E29601D9E05DD1758B5A9633FEB2B80A4B24A3DF2B5407522F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral6
- Target
  LICENSES.chromium.html
- Size 14.5MB
- SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
- MD5 b5e57572cfb5efa08f55f46772a42ded
- SHA1 51db84dada057af72e2fb8acca3ee4436e4bd3ed
- SHA512 288bcbf48f928866a0d2910fe57cfbc040f23b533bbdf4ef6fa43631edf6035d689ea41643b3afe833cb7476ecb2fbb932f137f3734df8462898c4837f6096eb
- SSDEEP 24576:6eBHJjZ6vobjZ6Mt3jK6DCHwR2auHxKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61J:6er8aeUSn8mMRx5
- TLSH
  T184E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  dxcompiler.dll
- Size 24.7MB
- SHA256 d8a6ff71c310c934cc859e3e9b1a2c34b0f38253bdc258c1476cbd9ccb633e37
- MD5 da07043f07a01969dc66b66e2c9021c6
- SHA1 84f4012019684aeeee29355f64d2bbec6ce47d41
- SHA512 aff96ee5a79b0156677938f8e01495fe1c37f92bf272c33ecfc5c889226d94ecc0be007f76440f05084874a5c4c42549fa6825f9865da50da942d7e6639ae959
- SSDEEP 393216:epLjH68inXc/GE+HiCt+2xwuQbgjvMCWT:yHiEFapwuNW
- TLSH
  T1684719122646D49DF059C878C3678716CA6C34EB3FA678EBC0B461152B7BEBC1B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  dxil.dll
- Size 1.4MB
- SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
- MD5 360c2ec3a4114840498e4b0f45820395
- SHA1 d5d4a71933fa25ec338cdf18d7a03281fe814d7b
- SHA512 257d1443341792587b0259d658a706dd8797a83644e451f2bd6d5b292d8259ea11c5d1b176541747a5470a2562615edd44b147e6ad752b4714458db28b07f9c3
- SSDEEP 24576:4Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kab:FiTMYxy0Sy66Zh7Sh/cyvS5Z
- TLSH
  T185657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 5c8c4804c266b3c0bd1517c42f9dd310c3733fc14c363fc151306166295af238
- MD5 2c834f16e319c48813a7366cc42d9c62
- SHA1 8caa32bbda1278f7e9c01fd4319a2af7fb3701ec
- SHA512 1b54edad363360ef99968ed2f38ecce0dbac5da8ffe265797719832e2245b17fe5f4f696cf5430fa42338c4e4d2a5b921e76b9cc8c6130bf8d1d98f36441ff65
- SSDEEP 49152:BP7qY4ctjNE3KrfHEh1UBi0L//+eKVmQbJhvTxDUG5t9xi2QMJxUVlEQj0Ey4oB4:BThPD41Uge//WPd5t9xi2QMJxUVlEQjz
- TLSH
  T101E59E03F6D650DDD029D57097AB9313F631340A8B205AEF268089253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 492KB
- SHA256 09dc89e7a401f272d29ef445f1825f4ef4422c6844892a6d8a56108b47a69504
- MD5 e795c02f5692460c2ac566d5d53972bd
- SHA1 80bafe27b2af747e768ab36cf7fa5c1f072ca530
- SHA512 400478284147691a25a6eebbcff4726dffceb4e7ef4e5a77ee170cc9fa1c3831d11138dac091266c017d2c4c65f93fd5141066839e80b05e001ea6b21f2d883d
- SSDEEP 6144:FUfgtSXLx7WDlUD3ntOb5EkMNvutTutO8PcRWLMJ85IeVeRAKx/b0:eZ7olUBObyNkutO8PcRW8mIegzb0
- TLSH
  T17DB49E15F3E545A9E07AC1388A434602DB76B8560B65FAEF03E093792F37BE45B3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 e5d96fb54dfbbf676b0b37c7915bcd907ff28f2ba63b49a72736a43ba3939a4e
- MD5 e83cfc0b54e74499d3aece7ecd449edc
- SHA1 cd18a077a977912fc16f6f9d77477bc1291b9b5e
- SHA512 22f00196d2905d50f62636e6c628efacec3cfba69981769cbf44806fee5c0bdc07b0c593cb0177ff94433eade1a7410298dcfd5a074abaf0f76fe256e0902104
- SSDEEP 98304:tsGAgRCWeWU4Wvy0jgjZQegl99ZmD3w4r/KlX26M:S+ervqggMqgUKpN
- TLSH
  T17B868C03F29640DDD05DE2B897579227FA34B8450734B2CF2A9457252F67BE0AB3EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app.asar
- Size 1.9MB
- SHA256 37352c0c82787238779e7e98e634a062ae872ae49b15f6f4c2d96f1db174a035
- MD5 729bc62992f65ae0df7ffe54c4ab1af9
- SHA1 36aa51b3607db1def1db0686810a2bab7a3a5bb6
- SHA512 fb5011dbaa36eaa3f4ba8a815335578a5c76436a15facc73e38ef5e402454c2b09f1a128dd6ad97a730d1694f5c51fe254cdf420f1f178314d6b619afecc7fcd
- SSDEEP 49152:SSKD4C7AQDt7zIxJsvN6qVGzL98cdYFvhUcxJsI063:it7Ei6GhUQg63
- TLSH
  T18D95D76514E79635676322FE298F0096BF34F547A508D500384C9265AF82F38F2FBAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  resources/golive-audiocap.exe
- Size 195KB
- SHA256 057907af30048e15b4e81460e71c5597c82af665bd292567afc0e98089a5596a
- MD5 7a2a7c75417aae0648430195734c057c
- SHA1 b6eddf7b6461c06934391655aa33960d9bfc26c0
- SHA512 61ec13beb6e2dbe3c0f5bf38143af6a3b6fcbfe312b6d68d43546e5468a8b63a2d79b9eea15faff2c6c4f105079f0cf4ee1845f658b653ac691dec0a66a43e6e
- SSDEEP 3072:S6a9zFqncI2KIfMLOXwxvCseznrfRzRbNMQeLntSs5VNvstrsng:S6abUNSgxabdR5MQwSsr
- TLSH
  T1FB147E15B7A950FAE27B8538C9424906F7737C4647B0AADB03904BF69E237D09E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 22a2305e52d6cded30c0606c7cb44e25c1374dbbec08f5da183f91de0b1390a4
- MD5 57ed221051a5124546848d413c7bf534
- SHA1 37fa025e93d7fbeb3a6eeb21660221a35b3bc917
- SHA512 c9ce057dd2f166cf75b2d4a4d8a6ef90376cba15ad182708ba24504cc7ee11f7937feb5414a874df573a1aa7e51c23e257e611300725315a11de6f34fef3fc09
- SSDEEP 49152:ljso2Wp9s18LbsQCgJxAhgK4axTciCuE2aRj6q8U45uqPppkBXqyWwBgVGdWyKQS:ljd2WpM99ZKtA8h8AHwv
- TLSH
  T1E7462703F28680E9F05DD679875BA622F632F8814B2276DF56A01F192E77FE06739704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  vulkan-1.dll
- Size 917KB
- SHA256 457ac4472ea01cdc7bf483629eed2118814611c79e39ea69304adb2509fe28ec
- MD5 84ad45974c4d28380280efe0c25137c9
- SHA1 0b6740c39c53fcfcd98c0e82bc3878ff0371d2dc
- SHA512 0c0d7454cdd38146e9ee7bf296bde8fb368e3131a6da9b204bd4b02025de1cf9a44085c5f6741159f39f82284d7dcbb9078389bd9960d9d9da08b3b7ff2b5ceb
- SSDEEP 24576:FgQmQinxRotX321+hvdK2S6Z5WGcSDYsHQDi6g3P0zAk79oOHHe:+N5nfotX32qFKb6Z5WGcSDYsHQDi6g3L
- TLSH
  T1DF155B1396958569D57AD038CDD28607C9B178822326B9CF02A817087F6FFF47B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  $R0/Uninstall Go Live.exe
- Size 158KB
- SHA256 a000ba6b2b9a32896ceeeb3298e24abc2b0a55a51cc8826153496ff58692e680
- MD5 cb29d248e928b5afc1393ba8cdcabe23
- SHA1 b4b4ba73b38d1cd4f465233bd232fdae9555b670
- SHA512 fd1ad19918e48a509d56642828602bdcefcd52fb06ccc7e40ee5a4e1228715617fca70596037022210f7c6de40b248db5651194fa7badf50e720d7ee6fa47712
- SSDEEP 3072:Un77v00hEoDEtaue29mFlWfhxL+gTL2ga2MNUa8b32tvhOEA1RJCir86SrSrv6Id:U740Iu29AWZxL+oLh2Ua8T2t0EyL+yaO
- TLSH
  T1F4F3F120B7A0C077D8F75F7117FA43EB5AB6B12128299B4377822A4D7C93294ED2E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral22
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral26
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Network Share Discovery

Discovers running processes

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Reads ssh keys stored on the system

Network Share Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Discovers running processes

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28