0d0bb7dc87f91f955ef5784d0ffed12ca8d0289ea6cfcded5ab5127c33798e8a

Sharing

Copy URL Twitter E-mail

General

Target
AhMyth_Win32.exe
Size 49.7MB
Sample260907-nbmhwsvgrc
SHA256 0d0bb7dc87f91f955ef5784d0ffed12ca8d0289ea6cfcded5ab5127c33798e8a
MD5 9dd31a0caf283eb8ac021b2717bfafe1
SHA1 2e7e3e89b515273b10da6d96849aedce329b56d5
SHA512 f9b055eb8da9e4e638f483fd41d72e0026f19bcb21b98fea4a906a8aa540c368b62bff7b1e611408262a5caad140e00449798d5ada26d0e15685f8a6f900bde8
SSDEEP 786432:MCPHEBZ+uqZLC2VYegaPk/60foYstnmPpMRcDCjIqgWFr6vkdUXWApF4HdGcbIza:zkB6Y5ac/FAYVRDGr6iUfpFmdGuIdZWB
TLSH
T125B73370EB78E95CE6C925FA2873438AA4C7EFC8523491442F2B79D67234E554C0F6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  AhMyth_Win32.exe
- Size 49.7MB
- SHA256 0d0bb7dc87f91f955ef5784d0ffed12ca8d0289ea6cfcded5ab5127c33798e8a
- MD5 9dd31a0caf283eb8ac021b2717bfafe1
- SHA1 2e7e3e89b515273b10da6d96849aedce329b56d5
- SHA512 f9b055eb8da9e4e638f483fd41d72e0026f19bcb21b98fea4a906a8aa540c368b62bff7b1e611408262a5caad140e00449798d5ada26d0e15685f8a6f900bde8
- SSDEEP 786432:MCPHEBZ+uqZLC2VYegaPk/60foYstnmPpMRcDCjIqgWFr6vkdUXWApF4HdGcbIza:zkB6Y5ac/FAYVRDGr6iUfpFmdGuIdZWB
- TLSH
  T125B73370EB78E95CE6C925FA2873438AA4C7EFC8523491442F2B79D67234E554C0F6D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
- MD5 17ed1c86bd67e78ade4712be48a7d2bd
- SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
- SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
- SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
- TLSH
  T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  AhMyth.exe
- Size 54.8MB
- SHA256 9434f275a80d8064c16f9d1a227acbf239e2b347a7cdaa8f4afb3141fd90ff55
- MD5 fbb6a5403e28cbd61a563ae3511932a3
- SHA1 fbceb3d6f570f72ba267ef45f51bfd14640dfcc2
- SHA512 84a8f860c43d7205d84bda92fe22ff87fd580844dcd54182b9721490273979b047678a5263fc4d74611902e04159e32247527d3eafce798a6f205ebfb0be3c98
- SSDEEP 1572864:VVmoioc5T+etWVAEWSMdK92hR/fqJ/KG0ciayC3:VZVUjUQXqJRIC3
- TLSH
  T19CC79D2368815039D79353F2DE6D7A2997FCBA71033595E75B9C08888BB08E2B336357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 1.7MB
- SHA256 54449495c558243f0638efaf9a70cf294c537815e999fab69aa1006768f4f250
- MD5 0c81725be6a38f8df9b8feed8421f777
- SHA1 09146930107f1fd49eaf6afbff0cbd49e30d6840
- SHA512 eae5901a1a97276106e67b7ddfb762609e04a9b96333897420e8a09aef08da7147c9fe669402405d6781704a70752bbe1a0b1cac3df4eac99853d3eb983f848a
- SSDEEP 24576:+mnLiLqepwmBNu1BJrCr+KD4clkUFsQqo:+mLAXD41Qbhjqo
- TLSH
  T1F585C62BAF4507B306F2C2516A5AA4CEF31E903E37171904346DE25C277F92983BF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  content_shell.pak
- Size 9.6MB
- SHA256 e20a142f2bb0f9016d5e9b948d37ae49f4d8a2c8b4059ac162ea12d2cc4a62c1
- MD5 88876a5c274ffcc61bb037f7b6831313
- SHA1 d36bb2541bb1ec302537be9dd3454e5def2400ce
- SHA512 4fc8e473e6bf57ff6fe19f1c25f2e22ed049dbbccca88867ecd1110fd45e3e74c3bc5cb7f052f891de600fec13a1eb0d2c4b48f008d6e5d7102a21096698dcc9
- SSDEEP 49152:vUTjfHWhao9dFz3YF2j4Q+BWu+vGHMnMFcwsISvQpfomatZwaT3qb0GGRsbMFsEn:vUGeFnBW3N+07qeGGG2pLTu31hHwWnde
- TLSH
  T1DAA66B467794103682EB527E6ABF1202BA3750479815D06CF96CCADC1FEDE0182BBF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  d3dcompiler_47.dll
- Size 3.3MB
- SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
- MD5 c5b362bce86bb0ad3149c4540201331d
- SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
- SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
- SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
- TLSH
  T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  ffmpeg.dll
- Size 1.8MB
- SHA256 59e7c824d049ca0de7d9bb5f5ef3788c7fbdc4f8a1683ea5c9b62f011ef647c0
- MD5 3993dab9717779bffae6ac1b3c4faacc
- SHA1 4ba98911d8b5dfeb97a38d8e7df51ce42b1f7777
- SHA512 0df7b1a4696ae3eb7ffb80e88dde29518434b183fdd149f3311f364e2ed09b326335ecb7e070b445c6e401a0aec84cc24e77645bcf13dcef02c10e1a9ce69a16
- SSDEEP 49152:yqfxIvLQjPTgli+Um6qmLeisSggSLzdf4r+o80x:XfxpdmX2gpzJ4m0
- TLSH
  T1D295C052B2B19523D4520071137FBBEB3A7C6F380615D4A78B587869FEB89C0A327793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  libEGL.dll
- Size 78KB
- SHA256 fe99c01942877eb3374603b393c2ba00232427e7b0a8d4a3fd45ff94e97366ef
- MD5 f355acd8f498e6567ed569262658b1e7
- SHA1 bf2d5b9bd7e39b1e0767883c6c29dac61797924f
- SHA512 fd7d9939e0bfca762c912ae6535dc1d3cf4c93121992d764d9cdd3882bc71d1b2123ad2695b2dc5da905302ac902945747a2b7b1c61b70bfe2651bae77d6d7ec
- SSDEEP 1536:Sr95hOk/pmLLBZ9cMtwFghzQspTKsWGzacdA4myALlXem:SJil2UJV7AjLFB
- TLSH
  T1AB736B01F2D1D872E5BF0E311974E5A16A6E79505EF0DE6B3B99122E0F301C1FA35E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  libGLESv2.dll
- Size 1.8MB
- SHA256 2fef3cdd0065776c3fda837544e0b80094905d8e339b46ee0beea8531538366a
- MD5 51ba4bcef2cb97d64838519711e4ac77
- SHA1 12ef3eb7fefbd824ac15e410fa765eb878b53164
- SHA512 3581968004aa1f593f61b84f8a7e631f58bf093c543c7923fbcba106345d98a76adaca8783d142891a71c4dc93ba7202ae975778e1495c60309f28035722703d
- SSDEEP 49152:hiWIhdjz2tPCSaLSSnPfC8LuGs6GygpCp1bhWZf:hwhdjGPdeqBGs6+Z
- TLSH
  T14095AE13B4C1C036D66B02728E553BADA7FCDA750675860BA7DC1D09ABF0992F32A347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  natives_blob.bin
- Size 334KB
- SHA256 ba2f2ac6ae9bc67399728f25772a0eb3e840695395cc747adf4b2f8b5d6d9a46
- MD5 a58db728b50e6b82cbdcaa0db61d36b1
- SHA1 7cd76526cb29a0ff5350a2b52d48d1886360458b
- SHA512 0db9afbdada44364521d89bab6055458125f4f3c8c1b09048eafa4055a194231ccffd82fcdada9360ab2b19f472b893330ebfcb027391e7a0c2b1100fc51e673
- SSDEEP 3072:zRAHowF2N4C56MQIi6dD3nhvAwlFUPcm4s9r4V7d+SSo3:zRAHowF2N4C56MQD6dD3nhnlFUPcm4F
- TLSH
  T10574FA59B9F5AC9742F748B8400F050EBDFC88259468D494B19DC8F01FBB26A963BB3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  node.dll
- Size 14.1MB
- SHA256 bcdf2bc464bbbaf975d4f032ada1ad67836fb6dba78a4ebc945dc9ca0e87f0e3
- MD5 0a099571179caa80a039b44e63407a8b
- SHA1 c1fb53f09a450d179e5fdb3bc539fb39f7f2e12f
- SHA512 94dbdca6f78bc1eab3075ec3deb664c8eeccc72f3a84c5c507eb08443198078278576a2598248e2d507365a2fe868dc3fafc27b291437805febf7b2de0c80811
- SSDEEP 393216:Z9vGLhAGDNqgJI9aIpRyxDRfFrDjZd9peDJeF2w0LiCfrAIj:zuLhAoNqgJI9aI/yxDxFrDjZd9peDJeq
- TLSH
  T17DE6AD33B4404131E9E241B1D5AE6A2B217CD922433985C7B79C2E501FF15E3BB7A7AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  pdf_viewer_resources.pak
- Size 140KB
- SHA256 7a42228190983ac5cf572ad417cd4a49a1b555e305648f01794068ca15e0e293
- MD5 e194a32fdf0a700f19e7dedda5bd4759
- SHA1 c54ac90bbebea55e4e5645675728c3ce0871a703
- SHA512 06c76427a40ffb275c1fa62326cbefb2fac8ce0d39f4fee366104a741922fb199805cf5b895dcf19cfce795fe9210550147e9e5cc6bf8d4251a5332fe1a17bbf
- SSDEEP 1536:mH7VjD6ZmFtqswc30/9MDodCMllHxHqHFJAEN3rojvPVycWz:lZmFtqDy0lMDoMMllRKlarM9z
- TLSH
  T12DE3B51966D922758437637AEF4E6218E735402B5603649A7CAC97E02FB6E3003B5FFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/bin.js
- Size 2KB
- SHA256 74942e8ac7e6f032521d0b1d28c140332eaab93e495a3b077fefe75e49a654cb
- MD5 8f7c9d597be4b1d6ded85859bbc674b7
- SHA1 54629a7a5bb7cdc6ace653ceab1ad53c18814051
- SHA512 d76b821c5aaddc52fc7a81b7b74228f267aba82a20df57d999667a469134fcc0b462b506894946171a2985afd818970be462cbce0a217c4cc96e4673b3fe92fa
- TLSH
  T11F41024E7CF2A51457F360AA718FA116746795114208EE247B8FC7C86F98178A3F3A78
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery execution antivm
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32