d418f5b7e8b11f1c302fd5d1a7df8dd2e3a9a5c9649046f1c88ad15a1eb90261

Sharing

Copy URL Twitter E-mail

General

Target
New folder.zip
Size 998KB
Sample260907-bfq1natxa1
SHA256 d418f5b7e8b11f1c302fd5d1a7df8dd2e3a9a5c9649046f1c88ad15a1eb90261
MD5 860a0ec00f3ff490be1f16eb9a3c2759
SHA1 bf64e2c7dc39ee098e2345c7e8371635d9d356fe
SHA512 04096dd48032a7e07c945677e874f31022f09e7688ef7af628e83bb9e58434cfb3fb6b42fbb5fc31653cba90726a4aa1ab339c005a9423b99421992c882ba291
SSDEEP 24576:2TjZUbzQkOLhSb4AK0nfVDNUUfjA67XfDpxK8LAsjojcsj:2Tjmb0kOdo4TkRUUbA8lA8p0j3j
TLSH
T1DE25338C25D942BE3929CF0660F294ABD7219F71E573681EFB5FA190AD81F10C2DDD28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  New folder.zip
- Size 998KB
- SHA256 d418f5b7e8b11f1c302fd5d1a7df8dd2e3a9a5c9649046f1c88ad15a1eb90261
- MD5 860a0ec00f3ff490be1f16eb9a3c2759
- SHA1 bf64e2c7dc39ee098e2345c7e8371635d9d356fe
- SHA512 04096dd48032a7e07c945677e874f31022f09e7688ef7af628e83bb9e58434cfb3fb6b42fbb5fc31653cba90726a4aa1ab339c005a9423b99421992c882ba291
- SSDEEP 24576:2TjZUbzQkOLhSb4AK0nfVDNUUfjA67XfDpxK8LAsjojcsj:2Tjmb0kOdo4TkRUUbA8lA8p0j3j
- TLSH
  T1DE25338C25D942BE3929CF0660F294ABD7219F71E573681EFB5FA190AD81F10C2DDD28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9
- Target
  New folder/Will P B Clayton 06-04-2000.pdf
- Size 410KB
- SHA256 167e8d568f2db40fe82422d3c7aca1c2b610e9492e0e733104087b89d0cb3a99
- MD5 41e4cc38a13f397d8816a1e447778cb5
- SHA1 1f2aa0766ee355a07fdf7142a76e1089ccf1b209
- SHA512 c4c34975839ad6e984c3c76f29073109b87eb4c4958347dcd3fbf9708e4efb0ec16fd856f9c99be0e35f9aba52d87ab54b79d951aa9d3676df1cfae3eb675059
- SSDEEP 12288:zJVIblWBUK6n7/+id4u8ZZuzALI/N10llJ7dzVV3bQ:zJNBUK6FdGXLIl1eJdVpQ
- TLSH
  T1C894027BCE337F1B6F2984F884005DC06CE468BF11A0966D3F8D9456D0DAE5289EC5AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware defense_evasion credential_access
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18 behavioral19 behavioral20
- Target
  New folder/Will of Peter Barry Clayton - 29 May 2024.pdf
- Size 491KB
- SHA256 d431d53cf5c5192da937739cd205bcb6ff40934f448341e070e91a9359799790
- MD5 fc46a499bedd84844d86177e013c27a2
- SHA1 b7221cf5ac0fa86b3835a8c0e8508dc54ed37001
- SHA512 393e2366a3e8ac430a2f8f05bd0a9685b736e607c48ae02fa752769247e6289ae3480dd5d18460c64464b29fc4abd106f1d26ab78416e48b6b84a8b81be2507a
- SSDEEP 12288:PDhR3RHg8qn7QYQjxD+luxEwmzfWiwvfR4PlIqGZlDC2n6i7:r73RrqnUYQXiwWf2vpilIqKDfn37
- TLSH
  T149B4023EDA33B51BDF5684FC85106DC4ADE08ABC11A026AD3B8E6545E087D2787FC5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware credential_access
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22 behavioral23 behavioral24 behavioral25 behavioral26 behavioral27 behavioral28 behavioral29 behavioral30
- Target
  New folder/Will of Peter Barry Clayton - 31 May 2021.pdf
- Size 494KB
- SHA256 33701219878b492ff5c5cacd52cc3ad9af67b3aa3828cddb52dca0e306825457
- MD5 81b4e26ecbe6ac22e9a562caa0e1913a
- SHA1 3d971be8276a24bb520ebc216ec067f8a5e66aa6
- SHA512 ccb7d3b87d286f3c569a13460d984d8e307f88f5c28736b32642d9be5c40f4ca2ef4a25b5178acd1aa64943bba92fec3d18766100ea484b01aa59dd3001ecbd9
- SSDEEP 12288:3dFUDwH9dDNXuCvbaLm5r09kvNPtyudj8NfJPTpUL5GLOJ:37UQ9ttuHcNhdj8NfJVUv
- TLSH
  T1A7B4123D8E23F927EF29C0F887149DC87DE047BD01944AE81B58646BD0DAC26CAD84DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Modify Registry

T1112

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

OS Credential Dumping

Boot or Logon Autostart Execution: Active Setup

OS Credential Dumping

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32