df40e8f54045015104009bef3123a9d23a3a193506c95dd959be82bfbb028cc4

Sharing

Copy URL Twitter E-mail

General

Target
Hatsune.Miku.PDMMP-DenuvOwO.zip
Size 15.5MB
Sample260907-2qmdbshm8s
SHA256 df40e8f54045015104009bef3123a9d23a3a193506c95dd959be82bfbb028cc4
MD5 85046e4da24c19a3bf3ed8617a3a5713
SHA1 079be26370a363b48ada2af2dd899b30af9506f7
SHA512 790b8dc7d757e33e1a2d7683f4e9a9923d6af84141660e74cdd62ce83219e5af5cda18908d30ccf3ff043ea033967c3e00853a68ecc2baf668ad1c7cd4aa47fd
SSDEEP 393216:7ONa1kR7SVq+5OXsueohAagkFHIPkE2dD6FUFK1z0K:7+a928u/hFoPkEm6vAK
TLSH
T1BAF633603582B854CA099B32ECA3B75DA770981C6D3BC51EA095828F711B5DFF05BCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  HyperKD/libraries/DIA/x64/symsrv.dll
- Size 413KB
- SHA256 fea493309d3d5640df85f4b5523ea0091d4705780df5ca471a75cba9f0bac232
- MD5 837eb266ee187c14160ed9918683380b
- SHA1 f5663762dd0f24435412531de59c52e1f1bd4d5e
- SHA512 a7dc96c992a1566a8954e817aadff42f92fb092c0d5a35ebf12c70f36ce37e8bcc22e9a790add7eb41198359dfb253136d1f23caf287d5b30767fd04138cc753
- SSDEEP 6144:vYvMwXLY++txRdoR1XlVaoQbvnei1uppJXxBVuiHqYs1QarNrFdkbB69RYxP0j:2pedoHXioQb/ei1upvXtuiHXeQj1mRDj
- TLSH
  T1D794182DE7E80465E1B2A5788AB3C605D7B278A81735D3CF1194C13E5E27FD4AA34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  HyperKD/libraries/DIA/x86/msdia140.dll
- Size 1.5MB
- SHA256 b67cc613e8430aed0a1ff719d692c1abb253deaad30b6abf4b296dc4e183f407
- MD5 9b20e5e58875e8f539d7cb15e4bc5264
- SHA1 0238affda205901cd8ea7b5a70b924387b7cbd78
- SHA512 91693f15ea0cef90c888bf1f22f5e5f78d06d6cd1591dfd6edc0c099dcd219f872364e408a438f1fd4f79012b36a3405301820e77397b2e77d51541101f15b36
- SSDEEP 24576:SeTOnzBodF44rfkANejlkadMkl2mQ3IdvvzpwdpDg0n4c2Z2VcATIYsspQvPg:3TqzBsF44rfkA0kadMkl2mQ38udpDZnH
- TLSH
  T1B1659D21F5C2C131D8D91071A53EBBAF167DA638072494CBA3982D2A7D722D37B39793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2 behavioral3
- Target
  HyperKD/libraries/DIA/x86/symsrv.dll
- Size 311KB
- SHA256 2aeccb5107c9d189950b04952e7e7ab83bdb3ae78a02b6acd80477d8d1f2900a
- MD5 1c67ba13af49ab1210f32dd23f4fb84b
- SHA1 c8c6d51ba614ec6ecec9fb67c004e3e60df15199
- SHA512 cb05d5f85f397cc510d6af9356c3db450b7dc3edf0e2b9d2caff70cb6eb06fbed823b560d5862222d0585d67d2fc36b69b2248c6d8924924a34e04c9fe95f6aa
- SSDEEP 3072:eS+Y1pTeM6laXNBmChVTUqpCqL2eO53ALZ46vLDWN9fxhFo7EYXZLwbRez9WmKXB:eSd1pqazu9fva7E+qbMzQIDx/6Is
- TLSH
  T105644A2366E84174F6FA3A707AFDA668967E78A04B71C1CF1240929F5C65BC06E30377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  HyperKD/libraries/pdbex/x64/msdia140.dll
- Size 1.3MB
- SHA256 f86bad471b1153cac543a164f44a504687b2b2f5862a25108ab824443f2c5d0b
- MD5 5ec4b5198db1188bd0a2fde58bb16746
- SHA1 5c7c10eac678b83dbd8577d89fc65e940d95bad8
- SHA512 50866502238940302b6325d33ed1275bc9076051ef09a4fb682968932a319a2566b4e1af91837ef6c2ff2b234c04eed454a69c7e0a6ddea81d212757eacb40b6
- SSDEEP 12288:LUtUgXEfGZhHpfOWVl9mqNBvaYbRHfY/IPQSlZzE4d4TnabE6c4x8Jy2I:LUtRZGWVlgeBdbRw/IblW4d4f6zGfI
- TLSH
  T150555B97B2A841A9D57AC13CC627851BE7F2B8050310E7CF126947AEBF17BE46A3D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  HyperKD/libraries/pdbex/x64/symsrv.dll
- Size 224KB
- SHA256 fd8f2bad394115d994971cda8da750a4694bdd0754885d870fcdcabb933f6617
- MD5 854be973b70eeed4c4602563e5ce33c6
- SHA1 c95cf19dd8141fe2947c0b0298f40a79a0fa9bf1
- SHA512 0906f818954a0099c105a6a5db0c99259689c54f5742daffb363a2f4a81480a09db2c06b21de68bdc3284b3c885c2b349a43073c7bad872ec2ef620d59b8f480
- SSDEEP 3072:IAH841qLi17Cckj5Nxbv8c0l1WiIUf+/vU+gk1aVKNymp1TnuAj4t5UT2YRM1YQ:IAr1qm1mVrtR0ON3Uo6A0tP1p
- TLSH
  T1DF24D61163E80029F5B2BA749EB78516DB76B8A45B75C3CF0150856F0EABBD0EE34732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  HyperKD/libraries/pdbex/x86/msdia140.dll
- Size 1.0MB
- SHA256 71c83334cd524382772b49e9b7f5edebb50eb35a1fe41fb9592d58edea081b0d
- MD5 2cbb80716fdba7296f367537ed6aa100
- SHA1 7179f1d0ed5ceb7f24c9595b78958b1fc334916a
- SHA512 e5ea1c2d8e09a0cfb1c5bd5c1e11803a3d181c65f40e6ed1894e2efcfaf5d5e2283f50de25dedbeb7b967a998abc65171fe454473cbf0c32a362781e8108cda1
- SSDEEP 24576:RIJO0+dk9O1oZ7iVIaUHPUxYdSj7MBTL2Fjh3soEG/JdV9:RHQPspKLch3soE2dV9
- TLSH
  T1B4357D21F4408176E9EA1071E67DBABE26FD92361B2951CBE3481C366D712C37F38693
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  HyperKD/libraries/pdbex/x86/symsrv.dll
- Size 175KB
- SHA256 c7d5578ac17de9199fe69d9d6918b1383ad6a7e868e6c79ed1c3fe523ff0d346
- MD5 a3b016a8464c6dbaa5584cc67bf888ac
- SHA1 e9d9bb23a7a4dab35d2e2373c73d464fb4562304
- SHA512 aba5851f226e4fd8b3d2b8f9841eacab182198fbedbbb95d257daccdede026853c84da610cd26e4fb299a83e769d2368f9ec01fe1448a4d50f547593ae0395d4
- SSDEEP 3072:s+HkF6laNymcWFTOxgmxZgYdd6rOTWx7R6qQ+u+P2YnNHsY:sJonxZgYkQG657S
- TLSH
  T1F104E811A7E850B4F2FB3A702EB9D225897ABDE05BB5C2CF5154858F18A16C0DE34B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  HyperKD/script-engine/python/generator.py
- Size 6KB
- SHA256 a05caa5f7e0cbbca528fe2bf3aa815130f9ff71fbdd579e98db5bdb0dd7394cb
- MD5 94042a24bb5d464f296a898b367ab318
- SHA1 621730797c9a134e97beccbac9b2ae149922d13a
- SHA512 aef6f11ab5340d8cfc366c04b117df42095d783ac6500cd2dd8d3b7b8089c5d68b2058ef78ea98ef53012373cb554092d58c7c576ebac81262ef414d70762af4
- SSDEEP 96:lUkJCpDMjmfC2ee9SauGO+KEvsdl3Rmg9mqNcbWYagUOoOgAU71U8y9wnnna4v:DuMyazoadxRmggqNcbEOoOGvy90a4v
- TLSH
  T1E2D141096E71B1D010B19A32F11E3447D51EA453716AB27878ECA6C90F3584EEADFEEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  HyperKD/script-engine/python/lalr1_parser.py
- Size 22KB
- SHA256 b4f263a3d72f07e17ae2b892f0fa1c3503c145864363c2483f7b266b900c082f
- MD5 4f12b9c2033b89da209f3083efb3c9a7
- SHA1 3ad4b452c06c32b845ae44d26302bcdc29f5d8c9
- SHA512 e94b3e59644f12399fdd0be6d9e3199687b1fb24f79d8e71b575bffc50a80787a9f3f7b860a454e3748117ad7bcfbfcd2046d4515324ab0bf8c5cbc805b233ea
- SSDEEP 384:y/NjOSRjJ2mQgD7SCFgDlnze4EFZtk+QHpCNjJVVLWwyDGe3VEqDHS3w5I:INjSg/JFgsFZtkyNjJVVLWwyDGe3VEAI
- TLSH
  T1F9A20F119C12AE289173CD6DCC8BE45BE32F0A23567C1966B87C40996F758E583E4EFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  HyperKD/script-engine/python/lalr_parsing/__init__.py
- Size 136B
- SHA256 c74723bb748d67f3f62c60131224bbb6cbec846d7cda8d56b20b6de2485c36e4
- MD5 1b07bc6fc27b3bc52a4eefa390cc0f7a
- SHA1 92ebd57bf8e7e5a6260a0b7a9f4206717b905f80
- SHA512 7ea3e719be9c3647d41a708865168b008b2c1349e12e7a881c0b6f49c118d36d406da992a78ffdcb89c751c3c90fba769776784d38d32e2f796abf7ff06bbd71
- TLSH
  T1E8C09263980502608032E2E8899E3BA4FFA0C420EF6188828F180F376F8CE2302C2120
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  HyperKD/script-engine/python/lalr_parsing/grammar.py
- Size 5KB
- SHA256 7e9e6e8ef2972b914a566e1d667e41c94199b0051ab67ab6646858765f9fd2b4
- MD5 bac08bea69db794052241835ba25daa6
- SHA1 98eebd6857335cc38446decc890bb31f55c77919
- SHA512 d2fcd0c135b3bd219c7bc4fadf96c8e14f708d2319bbd440cc396ec2ad5449ac22158260e4ba7dc47001befe9b9f7c0496261ae4befdb734eaa06933030478e3
- SSDEEP 96:BrxLvXWR5IyAR84Dvl6OErFk2qTytDx/f6OcTJ:JxDXAIy4JhEhP/ynd
- TLSH
  T190C1DE748D227629813BC43F8D63E187F72E5A630598912379BCE0516FF689182F8F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  HyperKD/script-engine/python/lalr_parsing/lalr_one.py
- Size 12KB
- SHA256 9b314104317ed71ad9dad65a77d6b769612f92cfe6ab3d8aea21892c528c682e
- MD5 a6252abbecaf5c990dea7b66dd216ffb
- SHA1 c8fdd95131f742f0fe74622efbf96b204c95f8c6
- SHA512 d6a4f6007ed282cf5261ad6bfa21943beef2db32936b5adc8cd10419ef3069596b55fc1637a8e8730a7b0d6574e64512da9e60c95275c6fa9c0dfdacb921fb55
- SSDEEP 192:b6PgI0jcVAGUCxqAe22w6IFAOYKCcgojPDkO29r/ve3j+mXiZW9AMhIsBQBQUPs9:+P6uFoAe2FBCOYNMnSAxXioAMhI42Q
- TLSH
  T19F4293656C02AA1ECA32F86D4CAF9567E35C521791655203BC7DC3521FB20E082FDCEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  HyperKD/script-engine/python/lalr_parsing/lr_zero.py
- Size 2KB
- SHA256 e126c37bdb78b3d007d8fc326de99dfe69470b1216af15d97cd51a635c177dfc
- MD5 203470b60884274b156540c5b77cd2c2
- SHA1 b0d96ce78a90f2175cc9da8506f8eec5e9ee37db
- SHA512 94db1d2b7f0063656b8ed0d0ef5990d5a3756d005a0864680814d3df8477d4abc585dc872c0b042360d27d0eeb3b4e96a79aedde7faf19c93a0a726a4d33b026
- TLSH
  T146419B5B9D5AA50BA631BC7E48ABC10AE3199223E114CF0BB4AD81D59FB1050ADFD8DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  HyperKD/script-engine/python/ll1_parser.py
- Size 37KB
- SHA256 386a6d1b7f170cae91712782aceda7eee724ffd7874a245ab01a043f18bd124e
- MD5 6d5309215a48001bbb905862e3f1f59a
- SHA1 997cacb3565efd027ecb1a8fbbecbed6fffebb0e
- SHA512 d6bef5bac9215da8fdd1664221101f8bba7aa0cc5664c3509db1b9f2681ec7a0ea94b0304234e300c1fa7498ae28f5a763f7159d304332a085e30d7af67b6b64
- SSDEEP 768:WVmDMssqP6eRr5dJ9/ZtMNkwXWgcCUz0wJgpWUWmWowWNgmkFg5qdk+c2:2r0vdJ9/ZtMNkTCUz0wJgpWUWmWowWNA
- TLSH
  T1E903ED008C025E2961B3EE3DCC8BE82BE32F4A13D57C2566757C51855F758A983E8EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  HyperKD/script-engine/python/util.py
- Size 205B
- SHA256 748db2142bdbe6690d27c5a92f51f332402413f88ff5a030f70b185cf36aca93
- MD5 1ba5ec289d56fd87c2fee4957a2e0c51
- SHA1 9437be071ed03400ebbfa82c84ff6678588843df
- SHA512 3369dad0634ab5169de013d5391c42e3ad74fb066a3a120be432817edd0473f1c29ac20f542a96593d9c6314e5c1de6a077c73f801c3768a31983b77e5603bf3
- TLSH
  T16ED023503D83701541F5900FACCEC114D148C403900E6305775C11E03F31C23D1B7146
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  HyperKD/tests/script-engine-test/EvalScripts/Eval.cs
- Size 3KB
- SHA256 6189413e4fef2f5328afc62e6bf7dc644eaf54954b16d3943313938ebe8425c1
- MD5 7a39d7bc68b2cfa96ea3197a84a8daff
- SHA1 82f09fbf914fb92e24065d0a124ab4b748e69171
- SHA512 ee8d0e61b91e346a3c8652a9cf2e41dc17cf711b950382c23f634dd4561af71bcd3974e9b4c09e0e4d51185c45f506d77f2a100fd5a4fb1f207fdce54b3bb2b8
- TLSH
  T12371AD8DB943EAC95DB376228F6BE118FB52912322DCCA40B54D0F115F74072DA39DAB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  HyperKD/tests/script-engine-test/EvalScripts/HighLevelScriptGen.cs
- Size 2KB
- SHA256 fa5eac28fa22c43b9c86e4ecd369e315cc1833f5b91a7033b7586ed6902050a4
- MD5 009ec2a2eb94f685573aeede3ae63c5e
- SHA1 b4ba7631fc8703cbecf273519b7a0ff88f9b9764
- SHA512 d6548baf45fbcc160b6e3e98d9b9ce53b979b6a7c2fc814310bdc533a0ce4e4258a7c307291b19ef99d8ca8f9d270415c322b72d0b35cd2982256ae2e744d7bf
- TLSH
  T10D516C143C02A5E65DB66222CF97D03DDE22359392ACD5A0BD8F4B801F35C5CB9B4EA9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  HyperKD/tests/script-engine-test/EvalScripts/StatementGenerator.cs
- Size 23KB
- SHA256 279f1147bfd8e1766165c698ef676bcb7089c3e6014069c5081f50fc39b010d2
- MD5 9dfbf06128a8c9dac93e4bd141192259
- SHA1 c059717123c9e4a97340c0bca264b1fa9efdb2b8
- SHA512 9dd5f78aadfa3a2892f0de45be943309358154310f9dcfcbaa2d8f727651aafa3985eb36d08ecb80e4019c5243996d5a6e876d66cefd57e71d2c0ae1470efece
- SSDEEP 192:9UFFEwYO/h9YyXM8tK8Vxd+3TsgZFRi1HfbJ1WSXNw:98ar
- TLSH
  T1BBB2AE842D27621D0D77E625EF9A905EEF563413566D2AB0FDCD00C06FB1858AAF0AFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32