General
- Target mesa.zip
- Size 13.4MB
- Sample260907-clckwsbl6w
- SHA256 9dca1d9f4bfb1df87f93134ae20dd08c843e04e3ddf9477d0b401231f2eb4b00
Malware Config
Targets
-
- Target mesa/Microsoft.Win32.Primitives.dll
- Size 25KB
- SHA256 191ce24960a2d1b22d6333f85bffe1c7050fe920c558cd39e51e48174e86b391
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mesa/System.Collections.NonGeneric.dll
- Size 98KB
- SHA256 702eba63368c2cd0c12321763913e8661805ff3506d49fc4499c38da93c9cf90
Score1/10 -
- Target mesa/System.Collections.dll
- Size 258KB
- SHA256 05b1364b1f6e37f089e46db060e0708a5d2cbd6da2d795cf69956b84fad1097c
Score1/10 -
- Target mesa/System.ComponentModel.Primitives.dll
- Size 73KB
- SHA256 96789fbde342be57152e83b20e833bcc33f12cf30a7b5c9c0790990cf5886d48
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mesa/System.Console.dll
- Size 153KB
- SHA256 ff3e09ec8ef8dc096bad8e1e9dcdcaf2367f63509179dcb3e5bc4c6de102b59b
Score1/10 -
- Target mesa/System.Diagnostics.Process.dll
- Size 283KB
- SHA256 8ab493c640c85b298553d27db03244c4e76044c2a724fc896bd5085ce4046563
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mesa/System.Linq.dll
- Size 525KB
- SHA256 eb5c46edcafdfbb7fa4d4c47d9510ad4bb22309a786e75153de634020d380d65
Score1/10 -
- Target mesa/System.Memory.dll
- Size 169KB
- SHA256 71590855c91416c5c0eb0b3eae631ac0869de17242435ca82e0b4e85ec5d0200
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mesa/System.Private.CoreLib.dll
- Size 10.1MB
- SHA256 c173a4a6030b6f0b32416623cf798eab45abf2d7dd38565aefa2fe78965452ca
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mesa/System.Runtime.InteropServices.dll
- Size 50KB
- SHA256 4ce05de829e9ab9c8617492ef4b6cac595e5e5cef2815fca7a3551ae7f627c40
Score1/10 -
- Target mesa/System.Runtime.dll
- Size 41KB
- SHA256 82fa676a897296ac6265e63bb582d03bf7df54e59c83e6bcd08f6f99a3249ba9
Score1/10 -
- Target mesa/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 30ac13bd317d364b3fe4ad42bc45ed418fbe4acac9aa8f376a8a5fcea964bd54
Score1/10 -
- Target mesa/System.Threading.Thread.dll
- Size 15KB
- SHA256 047dbd73dc9a8e7a4d7e516b323877d2a538fd525cab04d1d42fb5b2a7f474b3
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mesa/System.Threading.dll
- Size 78KB
- SHA256 6e646460ac549ca63883e78e739590f4a400f8d2e00bd9e99b0f02102dbb812e
Score1/10 -
- Target mesa/WinUpdateHelper.dll
- Size 85KB
- SHA256 09b72dfc0407bf14d1f99605a6f5292dd763a56859bd178af39853d01e7cb4f1
Score1/10 -
- Target mesa/clrjit.dll
- Size 1.4MB
- SHA256 cc9c853642c185b17d18f189c5e80928963bf485b0eeef7714e94339c5858e88
Score1/10