a9e270217d12867c2609d9423d1b2ed83fcf7cd08aeeee3ab09a4afdf9e9418e

Sharing

Copy URL Twitter E-mail

General

Target
DOSBox0.74-3-win32-installer.exe
Size 1.4MB
Sample260908-11tpqaydph
SHA256 a9e270217d12867c2609d9423d1b2ed83fcf7cd08aeeee3ab09a4afdf9e9418e
MD5 10f38d3d4b19c58c04d465bd1acd24f0
SHA1 c8c1f5a5d17336607c886444518e74e3d1a4e041
SHA512 c77310392eda80a98bbb6a5ac3446659b78ce85fdaaa2ef42b1d9b8ea1152722760c1af16696cf48cee43206c9da434fe191bc0b68e6fda99dfb33e479efaaf4
SSDEEP 24576:TA3AA3f646/58tQN2UR7l/TR8EalSxNhCkQTCE2wJnGl0uTskAs+giMbfJyDS:QAAS54K2UH/1xw2wJntunAGrjb
TLSH
T1B06533D9E3E20093DA1A1D34097A5EB7A2734D086F529B13E7863BE739F00C35636697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DOSBox0.74-3-win32-installer.exe
- Size 1.4MB
- SHA256 a9e270217d12867c2609d9423d1b2ed83fcf7cd08aeeee3ab09a4afdf9e9418e
- MD5 10f38d3d4b19c58c04d465bd1acd24f0
- SHA1 c8c1f5a5d17336607c886444518e74e3d1a4e041
- SHA512 c77310392eda80a98bbb6a5ac3446659b78ce85fdaaa2ef42b1d9b8ea1152722760c1af16696cf48cee43206c9da434fe191bc0b68e6fda99dfb33e479efaaf4
- SSDEEP 24576:TA3AA3f646/58tQN2UR7l/TR8EalSxNhCkQTCE2wJnGl0uTskAs+giMbfJyDS:QAAS54K2UH/1xw2wJntunAGrjb
- TLSH
  T1B06533D9E3E20093DA1A1D34097A5EB7A2734D086F529B13E7863BE739F00C35636697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1
- Target
  DOSBox 0.74-3 Manual.txt
- Size 62KB
- SHA256 63d0a0c6c2d3db9b070ce83c101ba06eb836f6a6bd187094e9fc6b78eed735d8
- MD5 f9f045ec1c5ffe00476599f50622de05
- SHA1 25dd09b4d9c3d8dbfa3f9928b5e408bcdd9eea61
- SHA512 9e9076940453e626f9e7d2bef410afd7f23dce09008f93983bb44ce7444134a911039bed208b1881eb994385a9071c4ed96d346f441612e73178175a8ef4ef3a
- SSDEEP 768:LHArrHava4FcgBHLjuKf+7f4p6dAWchiCxkhS3XxnO0jsUjhwh3V+6Ezje31:LWUju7fjdAWcu4BnO04AahREE1
- TLSH
  T1A653C74FAA4B177211320156F60FE1E1F32A81EF526A225535AC421C2F35BB683F79DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  DOSBox 0.74-3 Options.bat
- Size 107B
- SHA256 ff7605d991e0dda17221625b732cbad0c10c5a34f93957d148350a0ef4dc78d5
- MD5 f6513bd9176d025b1e0b713fdfa70fae
- SHA1 60cba55375fddc388bcb183cabb8b8786e45e6d1
- SHA512 8489ed50aac259f11494a9115191eab190d6bde248d99ec26f10288e6a4c79c0afab42dbcad559fec868a5c2f0a33ea83ab1b43c12a1462ccf2ee950227e309f
- TLSH
  T127B0921E920B481ED80CAE38794048993893B0E48808A08286C21842881A0A3AB30C32
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral3
- Target
  DOSBox.exe
- Size 3.6MB
- SHA256 dcfd46fa521f5ce89dce3bf026056f3a1d15533f80321ee887403e30d7949f5e
- MD5 90c338efc128025736084c05ae664a60
- SHA1 5c5c465b48d09c0586ee465dfe5df0cb0c1c1028
- SHA512 814d28162e68655088ff4b858274c3c33fe2b9c9dd654e7d0614ee5bad3c28a776ab7799efaea136a5cfbb93601fee5675b64eebee7722500324d896dc6f0ca8
- SSDEEP 98304:UOWQm9JBTsKEeiu9gByQUkIvTFRoLEYe:Ze9JIeiu9NZhvTo
- TLSH
  T110067D41E18742FAD01744F0807D7B7B5A389E189035C4E6DFC8DEE3FA63B82996B54A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  Documentation/README.txt
- Size 62KB
- SHA256 63d0a0c6c2d3db9b070ce83c101ba06eb836f6a6bd187094e9fc6b78eed735d8
- MD5 f9f045ec1c5ffe00476599f50622de05
- SHA1 25dd09b4d9c3d8dbfa3f9928b5e408bcdd9eea61
- SHA512 9e9076940453e626f9e7d2bef410afd7f23dce09008f93983bb44ce7444134a911039bed208b1881eb994385a9071c4ed96d346f441612e73178175a8ef4ef3a
- SSDEEP 768:LHArrHava4FcgBHLjuKf+7f4p6dAWchiCxkhS3XxnO0jsUjhwh3V+6Ezje31:LWUju7fjdAWcu4BnO04AahREE1
- TLSH
  T1A653C74FAA4B177211320156F60FE1E1F32A81EF526A225535AC421C2F35BB683F79DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5
- Target
  Reset KeyMapper.bat
- Size 23B
- SHA256 f494aa928a1d2e8846d1e911a51e90fd49149f612ba001cb5c5a144d5ec271ca
- MD5 723a54699e0bcfb1b7eebae7d89a78e2
- SHA1 3f99e284503365f3c177a58570beaa99595bc930
- SHA512 48de7717b32d078d58830629c7e2d7e200e31e767ab9136d5e05bb8085c17589a1b1c763f2288f84d6f9ded44234e2b7b2a33ea8865208a8ddeb30e5a7a0caa5
- MD5 SHA1 SHA512
Score

3^/10

discovery execution
behavioral6
- Target
  Reset Options.bat
- Size 21B
- SHA256 4b340c08696aab9b06742c763b332f43a4de9930177a4c9d240b2ea1a0e5e75d
- MD5 029a3bef661b34c3f7c4713544a28da5
- SHA1 b33c6d18defe468bb70b0ed7ad46223303cd7be9
- SHA512 3bc6d801be82303d60d761deb878cfcaf7d209b216acfb9ec355c420f98711d157f73d1aaf35a00783435d3d9940a780d76802cb128c9be576a03dc523ee7752
- MD5 SHA1 SHA512
Score

3^/10

discovery execution
behavioral7
- Target
  SDL.dll
- Size 437KB
- SHA256 69037ebc43755296c0cc292d57d560028d7f2265f7b86ca84e714835c19bbd58
- MD5 52726f9e11c4f2af64033ee17dae1fce
- SHA1 a6f2589a6878e7c3384d9592077900c747232b0d
- SHA512 e075c07d8dfbe027fc9fa9f8874ec117e2f17ab7683fc8941e4fe5a0b4ed0ee26bc0a8b8ccb0f0a79a1a200220d39b6820a480be720b68091a5550798f93a1ad
- SSDEEP 6144:AEH2f6Zb8uDLeq0vRBaQiiPOFG5dCHiKudo0KmzHSgwhyZwCM:AEH+6ZbhN0ramP7yHLuIoCn
- TLSH
  T164946DC0F6D70CD9EA06063849E2E33B5A7C39908317C755F694EF3AAD13BA1359660E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  SDL_net.dll
- Size 13KB
- SHA256 2f39dc04acbecf47efa45034891602b6ea7bf6fd2f27b5c0a5ca8d7fb155c929
- MD5 7db830b9fb29781f86cec2a1bbfe050c
- SHA1 e8adb7e4821d98bd26062c793288dbf7754f6978
- SHA512 e2934aac58377d8a5adf96633b55eea63bf689872409270bbcf98097a36ca772194fa12c2b287bba0a76109ae62c575beac3b1192375c4e06b61640cb9e4a14f
- SSDEEP 192:E8UQFh8UMKd7gvpK3mmg7xluXquc8miU1ebHML0ow1w0c7xGf+u6QmeMqmf/7JCz:E8B/MmJhguaGmioebdoELSdm
- TLSH
  T13F52D7037621C47FD22286B610834BE37E60A37684591E3FEB885C74B779825925833F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  Screenshots & Recordings.bat
- Size 37B
- SHA256 9b235d133481e85bf12e2ba5bea2aab5e87b54404de1a06c58ff4de1e5ad9560
- MD5 49c28d6953fb810692795a8f93e894c5
- SHA1 7051a5d0551303d87e175e44ae84e02d19bcd82a
- SHA512 c7b4220ff7e5529b3108d61c83356ba12d67c65b7707bf259dbf25a0edf76a595bd6e4270dce41353f2938b1058e0cf6b78f92dde7bf4be5ce51e8bc7a16486e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10
- Target
  Video Codec/zmbv.dll
- Size 210KB
- SHA256 71ab9fc1fb533eeefd656d621912cbe381f6cafb84a87593f731514f01e8513b
- MD5 16454a4e99ab40925b5bec533a9013a4
- SHA1 554aea271dd28f6e677ac0277625578aa763a957
- SHA512 6202af833a40b321f82ac9ea7ff9d0e19254d863631263358fd395f28b5cfe69d2dd0d046e2baf29249fd273bc23e0c0b73ba29f3ec759ab5b39ec060b3b4acc
- SSDEEP 3072:q8vxFGRXqk/JwHd4u1X8mTpGOx4qaYlTBf7UQwHNwrwz:q8k/JwHd40fGjYlTBTUQo
- TLSH
  T1D2243954FA4369F1E3B30576858FD77B52657901443AFBF3EB8BEA5A7833513080828A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  uninstall.exe
- Size 36KB
- SHA256 a3df234c142dba1389b3efa0407449c2ef3b0406a363765151b95c53042ac412
- MD5 502919789d5e283a23a3fc84637015e3
- SHA1 19311d8241a5f60c56cbdfe286398ad7c648e490
- SHA512 7ff2bd4e377ff199c1db4006cdf2d8c49e0d600602f7b4d63454872e6d470208122320db360e5ecc7901a3f573682d249caa84863f2694cf792e7f24a29e12ef
- SSDEEP 768:x1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJTJRnqNCokhB:fQpQ5EP0ijnRTXJmNCbr
- TLSH
  T1F8F26D1636F5C4BBE45A06711AB3DB7AFBB6F7011711061B6B601FBE2C21183DE1628E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12