Overview

overview

8

Static

static

3

Newtonsoft.Json.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows11-ltsc_2024-x64

6

NvAPIWrapper.dll

windows10-2004-x64

1

NvAPIWrapper.dll

windows11-ltsc_2024-x64

8

RAMSPDToolkit-NDD.dll

windows10-2004-x64

1

RAMSPDToolkit-NDD.dll

windows11-ltsc_2024-x64

1

SiUSBXp.dll

windows10-2004-x64

1

SiUSBXp.dll

windows11-ltsc_2024-x64

8

System.Buffers.dll

windows10-2004-x64

1

System.Buffers.dll

windows11-ltsc_2024-x64

6

System.CodeDom.dll

windows10-2004-x64

1

System.CodeDom.dll

windows11-ltsc_2024-x64

1

System.Col...le.dll

windows10-2004-x64

1

System.Col...le.dll

windows11-ltsc_2024-x64

6

System.For...bf.dll

windows10-2004-x64

1

System.For...bf.dll

windows11-ltsc_2024-x64

6

System.IO....es.dll

windows10-2004-x64

1

System.IO....es.dll

windows11-ltsc_2024-x64

1

System.Memory.dll

windows10-2004-x64

1

System.Memory.dll

windows11-ltsc_2024-x64

6

System.Num...rs.dll

windows10-2004-x64

1

System.Num...rs.dll

windows11-ltsc_2024-x64

6

System.Ref...ta.dll

windows10-2004-x64

1

System.Ref...ta.dll

windows11-ltsc_2024-x64

6

System.Res...ns.dll

windows10-2004-x64

1

System.Res...ns.dll

windows11-ltsc_2024-x64

1

System.Run...fe.dll

windows10-2004-x64

1

System.Run...fe.dll

windows11-ltsc_2024-x64

6

System.Sec...ol.dll

windows10-2004-x64

1

System.Sec...ol.dll

windows11-ltsc_2024-x64

1

System.Sec...ws.dll

windows10-2004-x64

1

System.Sec...ws.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    FanCtrl_v1.7.9.zip
  • Size 25.6MB
  • Sample260907-er24vacl5w
  • SHA256 1c2284e523e9070c39708d7f2a3b09b8b6a3b840fe1c345061d6ad68cd5c9956
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistencepyinstallerransomwarespyware

Malware Config

Targets

    • Target
      Newtonsoft.Json.dll
    • Size 683KB
    • SHA256 9000cfcb27d21ff1d9f7196b678ecc93be98af2a14254c03a554318891e6cb23
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      NvAPIWrapper.dll
    • Size 458KB
    • SHA256 32c36be19a4b44270199d14e17e9a80c79f93ca34c3565794e9dadeb810ce1f9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4
    • Target
      RAMSPDToolkit-NDD.dll
    • Size 243KB
    • SHA256 a1ab5d8b01ac322ba94b4e0d2f926bfe1497829602de570375fdb5dfbdae651e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      SiUSBXp.dll
    • Size 81KB
    • SHA256 72b2ebc4399a642b34bb2244b1aac6c0873748d6ddc9bd24c9f61462d0c073cc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral7behavioral8
    • Target
      System.Buffers.dll
    • Size 23KB
    • SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral9
    • Target
      System.CodeDom.dll
    • Size 33KB
    • SHA256 674d4231c838937d9a6686ad9964e89b22de8029631b20a6700a5004dd06924f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      System.Collections.Immutable.dll
    • Size 247KB
    • SHA256 961da735a24dc0fe4edc922712c4601c5dbcd1a671103714ff7ba3e7fe1d69e1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral13behavioral14
    • Target
      System.Formats.Nrbf.dll
    • Size 69KB
    • SHA256 50daa20596fa0f3a84600397f3967bc982136742e52a782ca016375849a59d42
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral15behavioral16
    • Target
      System.IO.Pipelines.dll
    • Size 83KB
    • SHA256 cc463919ec2a647feb56adba969d3acce45a0a478d24e7ac67497c8440518df0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      System.Memory.dll
    • Size 141KB
    • SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral19behavioral20
    • Target
      System.Numerics.Vectors.dll
    • Size 107KB
    • SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral21behavioral22
    • Target
      System.Reflection.Metadata.dll
    • Size 503KB
    • SHA256 d4ead3158c3bc301696b7b66d759ef276772b74093aa9fa325401a3fbce13b89
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral23behavioral24
    • Target
      System.Resources.Extensions.dll
    • Size 113KB
    • SHA256 5ad6e9c9859b1c22c12550e4ddfa3ce462b331223a6c0524a3924191d596753b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      System.Runtime.CompilerServices.Unsafe.dll
    • Size 18KB
    • SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral27behavioral28
    • Target
      System.Security.AccessControl.dll
    • Size 35KB
    • SHA256 ff14c5f628b9a6798d173aefbba0a43d61e66f715108e2576ac0d3dfab9071d0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      System.Security.Principal.Windows.dll
    • Size 17KB
    • SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

pyinstaller
Score
3/10

behavioral1

Score
1/10

behavioral2

adwarepersistenceransomwarespyware
Score
6/10

behavioral3

Score
1/10

behavioral4

adwarepersistenceransomwarespyware
Score
8/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

adwarepersistenceransomwarespyware
Score
8/10

behavioral9

Score
1/10

behavioral10

adwarepersistenceransomwarespyware
Score
6/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

adwarepersistenceransomwarespyware
Score
6/10

behavioral15

Score
1/10

behavioral16

adwarepersistenceransomwarespyware
Score
6/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

adwarepersistenceransomwarespyware
Score
6/10

behavioral21

Score
1/10

behavioral22

adwarepersistenceransomwarespyware
Score
6/10

behavioral23

Score
1/10

behavioral24

adwarepersistenceransomwarespyware
Score
6/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

adwarepersistenceransomwarespyware
Score
6/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10