81eb1139b76c2630e76c14a867abc81a92e5670cfbd82714aab658c5399c622a

Sharing

Copy URL Twitter E-mail

General

Target
Shaders.zip
Size 551KB
Sample260909-j9g9lsbf65
SHA256 81eb1139b76c2630e76c14a867abc81a92e5670cfbd82714aab658c5399c622a
MD5 a6c0b37f63ce9ff7931ea7ade834089d
SHA1 6ad63d7d2cc223abf1d260c8f880932f2b9c05bf
SHA512 5d42d95c7d7e7e8efe32f3408f1a6cb2c40d2e67c8c57b50e67902917fb13d2736f2c18c62c3cde88075a439db83329faf3a24949024f3d91ca7e87550ecd3ba
SSDEEP 12288:CZAAOwE8QSt0P7/g9Ui44jorFv7BN2lrL0X/N2lrL0XNM0S:VA0zRoiFTD25LG25LZt
TLSH
T1C2C42360469408D6EE7F70FA84C441315932FAE0AE33EA8A660E905F9DB49DBF5037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Shaders.zip
- Size 551KB
- SHA256 81eb1139b76c2630e76c14a867abc81a92e5670cfbd82714aab658c5399c622a
- MD5 a6c0b37f63ce9ff7931ea7ade834089d
- SHA1 6ad63d7d2cc223abf1d260c8f880932f2b9c05bf
- SHA512 5d42d95c7d7e7e8efe32f3408f1a6cb2c40d2e67c8c57b50e67902917fb13d2736f2c18c62c3cde88075a439db83329faf3a24949024f3d91ca7e87550ecd3ba
- SSDEEP 12288:CZAAOwE8QSt0P7/g9Ui44jorFv7BN2lrL0X/N2lrL0XNM0S:VA0zRoiFTD25LG25LZt
- TLSH
  T1C2C42360469408D6EE7F70FA84C441315932FAE0AE33EA8A660E905F9DB49DBF5037B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution persistence ransomware
behavioral1
- Target
  PACKED.txt
- Size 77B
- SHA256 e3dc0f152e765132422750c9381088d10ebaca8b649f094cb3fa38f6c3f628de
- MD5 3c5ef87592a05bba39d8388d36f51ec9
- SHA1 ae2d3731d8e4c5a607417dff674ac2e449dd426c
- SHA512 93d6f82db061d056011a328ea943d0a53b81e22379d79a8c35b3ad005261bb9e8c23815e2686db32e2f8f7662445bcf2de1a3986115c7f67b5ce52c19e49a497
- TLSH
  T13CA0243153C07104FD134144CC0F0411CF14773114407050D300C1741110305CD0C473
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  assets/slides/shader-1.jpg
- Size 102KB
- SHA256 202373600fdd4ae9098d13b09a8034de6fdcce0b0e1e41ac00b665dff35c30d8
- MD5 6f9856d9e41466334656979133b57919
- SHA1 c00cf5f31adbbc02ecc9df2390b1b3a9d790027c
- SHA512 b220418f1dd9c7429e48cb2465a164ea3079fd18bd965a2e892b48198bda030964c8d57e175199d507860c12eda3a9915a41397a9b8f657f62255371cf132592
- SSDEEP 3072:viL8hwvj6f+iqOddlnx1fx9tJbnriFAdO2cNzXUS+qM:LCOMmdrrJbrih28zXVW
- TLSH
  T109A312115B5E47D3F34262FEBB08966C40F7E9F35717E5CA4AB9A42942092CF235B00D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  assets/slides/shader-2.jpg
- Size 61KB
- SHA256 67147a0194970485057dd36a1acd799d9baf43fc38cc44e6d82d256d16762ac2
- MD5 62fcd571f97975482660032db86165c1
- SHA1 172b2d4d96f9aae2371589109a9f142dd5ff27f7
- SHA512 3c9aa5ac31be233f23002b31fb7042d7a5c9514801616b9b8b745225aa5857c483f3adf27f0501c4adfb2c224e3f212ece92fe7455b770b5e56c5c060a00cdbc
- SSDEEP 768:CbMPMDAhfzaJOwfujRdmjYq8/2i4tWHsMFnsd5fm/LSaOsjpKvihCevjyGDRjUmD:nPj5RjRoz8/tMrd5fW7ofvGDRjLaQR
- TLSH
  T139530242C721257AF710FC34532E5555F268B42AEF42F3E825C53EBBDC266CA5A2E190
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  assets/slides/shader-3.jpg
- Size 74KB
- SHA256 aeb07465967e35f4f508c16eabda260c877c8d584dfb4081c732af98bbd11777
- MD5 9b0934a60c5d732095fd2004deb7e947
- SHA1 53c919dd780ba9de022e81d4a7e14c898293a08b
- SHA512 d3030bb9679945a865501562622b2b51df971ba3f5fa2dda6b005ca8209565e1d9ffa4781cbea4cf705007310739ea389b037ad75e5523aeea00042cb3df9c52
- SSDEEP 1536:J58FznRn8dO0Y3dCkOzoTMVrvXBIBaI3YraTbTA0VQ1qt9gzq3HYw:J5mLRYXYhXM9XBIY+YrAVQkC+3Yw
- TLSH
  T17A7302C86750628BF62027B569BE0C63F6A6E300CF02D25F560D85C5C876D9BBE9970F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  assets/slides/shader-4.jpg
- Size 98KB
- SHA256 c2cc822c580e6f817239d14bef483c0b40199044a48eba120c0b8b3a77130823
- MD5 ba729e4eaa8fcf04dd78a43c50ecceb2
- SHA1 2ae27ef83f9edcfc9335c81cf7ca4c624bb0636e
- SHA512 8eb01bceef4b6f52ff7211be8105034fe40d3577c9533a438d8c18cb0d2f774c3605b438d6b11c5484ff326be897db72dee36e0fad9cbcbfbb319efc11eaebb8
- SSDEEP 3072:lGnEu5nr7MJDMnekWgruMZ89kxw2dmdpw:lyE+r7MJwnvbuMJxw2qK
- TLSH
  T167A31203C6760E54FE916836F4066FA3EB41A2E9ABC3015B9FC10FF09901699891D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  background.js
- Size 11KB
- SHA256 b8bf60dd6cef341d38a5074e223f6d53d5c8c983c9849b1f1cdf158085636328
- MD5 c4733721305a2d8d356e505daa6f8997
- SHA1 44eb8d70a92aabbb60236413b0d6692a8de361e4
- SHA512 212e5f5ae193bf4216e8b7c63e87c928bdf7dbcec87efd8860249cfa73d0ffaf80877cfbf63d0a700005225389cf69bb2f7dbd1a7b6ddef571e3a4a81c47e96b
- SSDEEP 192:CEAwMniSqaOY5ni5Y057iA4zW4RFRNqE+kLDXpkuroqLArHemQWXulzgisW+F74z:x5Mcmw5Y05OxP3HS+iwgw+F7484rFHFT
- TLSH
  T1F532777A31BA20196522E07C895F5425A111F017B9CDF8B4F65CB1752FCC9298CE2FFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  icon128.png
- Size 868B
- SHA256 07a6fb923b109ef8e1dbc2aa63bcfe751391d39956b34eae3fcc8a8275fc8c84
- MD5 acacc636adf1708f77f0a1d9396c1158
- SHA1 535de00fe9f54878f1d31ebd8f23833caf26a762
- SHA512 3c9ceb991e35f009751797a6a827e030599c27449ec9d46ce6fb79c75ef81f9b711b80c21f4b434f660c9cd0c6eae5a9298f98e2450a65c7f6319bfe3f195cda
- TLSH
  T1EB1192D5EFD0AD6083A8CC380A44506B93220F40A2842B18CC1237CEE46D3B7E48F313
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  icon16.png
- Size 175B
- SHA256 9e9eed4b15b7b2946d11d81a98276b17509647a68d92ff0129cfdb674399ab21
- MD5 0b5c3ef798f427727e35f19084b0b961
- SHA1 f0ed7979a90069e121cabbb023bf4dbb8e5b567a
- SHA512 4c76413fde08384ab8d104d1b4aa5242898c305ec52a14657d9c6bd135ed45c06138a5ac1995c262c836716f0de58f9f32121b138296981d410b404ebc9c0d9a
- TLSH
  T12FC0C0B051917C9CD44500638938EE17EE280708008B089C2236001002D24040EE2542
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral9
- Target
  icon32.png
- Size 262B
- SHA256 19e6a6d60c24cdf4a68ea0ad45b7628b3e17329c1b7ecba81ef8479c458a3a6f
- MD5 439f9cbf33710c69a29574281cee2c03
- SHA1 033288725c08e1f1b53048be052afa55e0f8e8be
- SHA512 83b74ae55400f63dc653641be2be0e46763e37171d8611842036da0345d7c4d2b2383cfdc0c0544ae7bd2700b7f369424b62e0de831a3edfce0a8d6cf3634f88
- TLSH
  T1BBD02B9B622B28A89F77EE071583A3806E625E184A7691988012127499A9E40D18214B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10
- Target
  icon48.png
- Size 375B
- SHA256 265cd7e796adb5d2ce5206bbf0bd84f3c8a7b3c28acb4f8593847c8a1609f9ec
- MD5 0e6037dfb6e29197ec2b0c418225995a
- SHA1 6f62c77405f6839202352638922335877c3094df
- SHA512 cdbcc5bf8e27515374ef6358ff7560c658ff8771b532f9637a2aa435459db665f00b5911a362fa4019dd6bf874cfb6e7a255e298e08972b8069eef10003a5273
- TLSH
  T1F4E068DB7D542AA19D49DF1862A9158D992AC7014B3A129B4123267A5434605C2217BE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11
- Target
  manifest.json
- Size 6KB
- SHA256 80b7d658323e01169bed528eab11800b5a123d9cdca4531e5cb0bdb928bd7eef
- MD5 30816ca7f63a68b3146a4e97299b3426
- SHA1 3565fb67e7870b15c6311cf66e3606cf5c1ee297
- SHA512 ef958b5a2dff595d5596a60b1a287e73f894dab557f24773c2582c56fefcbea7f801fb89269f5b960170be353eab39ef8e71c7db3540cbb2d9be9e580432f683
- SSDEEP 96:/faPZSj6fy4uRgsHPsjsqsssPiXYFjzFo50QjoVDorb4H5do7HC8vtsh1f:KIH4u6Z00UdH5O7HC8vO
- TLSH
  T11ED1B7EBC70498192B548996A465770DF706414F7CCABD8AF360843E1F8CDEF687926C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  popup.css
- Size 12KB
- SHA256 8ab96af48265392c32416fdb9d38448eaca956937861769e1c4cd2665d33a0e9
- MD5 1e7950304ab3bc80edb3ff0612a6e08c
- SHA1 a071495b6f7b7b2b085e1cfdb38d2e5f4e9123f0
- SHA512 bdb1db7f348d4ca8eef97df5a3ded537dac2f4441942be135b5051358aeb14ba7ae029976822554324346277aa19f894dd5b785bc2902c1778fa28dedda64e77
- SSDEEP 192:kkC54eoz/11y5ZNvi9wRp1zIy6zcHEc3tq2BvSO8UONqz3pOPP8OOuyFyu7UDkBz:kRwzd1EDzUqvA+Uajh
- TLSH
  T10E42516673540604B253C1687D93DBAB732DA002A60BDA7CAFE1309DCFCE1C996767E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution ransomware
behavioral13
- Target
  popup.html
- Size 4KB
- SHA256 740ca1f175f04c6a03e98c97003f17547d6f7d7fbf21cfcd7df6085667b24392
- MD5 e90d31b251abcb247c7ca391bfbb81f7
- SHA1 086754d694596b70261c4bafb2bbfbea79864e65
- SHA512 c8212f104fd2448af2285be4db2c68324ad1a298ee13f130f811acfe7807ad324e7cd3e42977576fcf3a6334051aae563606ab78ae0d57b20b54cfa5cfcf760b
- SSDEEP 96:fvj5SsklSkPazeHeVPeNexengVCgFVI6Pze:fv10vPaa+V2U4KvF+66
- TLSH
  T1D5A1992560F8A573528340C8B9D5AE2F39C6F643DA8F1208B6BE17D10FE7C81DD0B06A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  preview.jpg
- Size 102KB
- SHA256 202373600fdd4ae9098d13b09a8034de6fdcce0b0e1e41ac00b665dff35c30d8
- MD5 6f9856d9e41466334656979133b57919
- SHA1 c00cf5f31adbbc02ecc9df2390b1b3a9d790027c
- SHA512 b220418f1dd9c7429e48cb2465a164ea3079fd18bd965a2e892b48198bda030964c8d57e175199d507860c12eda3a9915a41397a9b8f657f62255371cf132592
- SSDEEP 3072:viL8hwvj6f+iqOddlnx1fx9tJbnriFAdO2cNzXUS+qM:LCOMmdrrJbrih28zXVW
- TLSH
  T109A312115B5E47D3F34262FEBB08966C40F7E9F35717E5CA4AB9A42942092CF235B00D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  profile.json
- Size 114B
- SHA256 817b5ba1ba789b594cf913214bc114ed8d388e3c519ec83973f14174e14a743a
- MD5 77c83cc0fac493f71c5134e1d13dd9c1
- SHA1 7e89e6d73e11a20efced43449761220fb441242f
- SHA512 26336392ca2b232bbc9db040c3fd3c0dd589cdd71f59664fb288c6bd1aa623dd587c891afc1d058da650f6d898d501d5dafaf7c61802a7b5d1c0d6a1debf384b
- TLSH
  T184B09226C8E03C3A2923C5DC889C399725EE881740AA4C200824A52E85BEE4DC309E2B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  roshade-mark.svg
- Size 287B
- SHA256 f12560b86e86f1d9128fabe7525fb735d8392b08781832b2f836610b7658da84
- MD5 7b23c367de4c6b91343e096c7ae91e68
- SHA1 415499ba7ed45bd58981e26cdf541d929228cae4
- SHA512 4f50ef139e452c0db5cb08dfff36789a5c941852e81f17cb537ece9dd9a619aae5fee5d8a543e5ea9ab9270f3f78f9eae578252f43005b5cbccb6a490ebf95f9
- TLSH
  T187D0C269E0AC6529D610DB026DB834ED7B0FA0CD9306C18AB6C51F71426A8AAB4059A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17
- Target
  scripts/popup-bundle.js
- Size 289KB
- SHA256 d0ab71b69fdb2f51a907af09e22c6f58a3f6694e93ba155c4348684d7ff39a7a
- MD5 4cbe47f87fb1d28e732dc1a56ed09809
- SHA1 7ccd44068cddcc466fda4f69797a9bbc8359dfd6
- SHA512 28a56e6a7f3b92bc0cc35ac1c83d6660baf84a03f6e7f7bb1c953e0eec2ce9e6aeb54d4610ce9b7fd33ec3068313e689b21c2c042ed611b586fb0fa57c3efbb8
- SSDEEP 3072:XnTrhybjqHz0vPA2kwU4JlDD+W1m9GhAjLVZmeJ/xeA99X1h1777b7Yx:XnMIz8843D+WMVj3esE
- TLSH
  T12E54DAAE24F720260563707C9B9FA005B235D023288DEDA4BD5C9324AFC5E3956F6FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  scripts/sw-bundle.js
- Size 153KB
- SHA256 6f155f5632ba210dfe6ca92374dcd3c7194186d6108a60704cf490185d09947a
- MD5 79d5cd9006d7911d64058aa89e2797bc
- SHA1 737a07cbe82cac4a8695dbd7c9086dbe50d7d4b6
- SHA512 68bdab646cc3f0fb028df2e8f15a20216cec088eec2ff5b5ac116f17bd925811e29533634cd2da61adbd1c96faf6158c94e3bc66f1b61189665705747017a7a7
- SSDEEP 1536:ZDFVrPO3i2kb47Q7QLBXxzUlkXCib/40EaCvGQV+n1ki/ZQZDUikOtWsBKBKdmz7:lrGybjqHz0vPA2kwU4Jw
- TLSH
  T140F3A7BA14F720250A63707C5B9F6005B23590136C8CFDD4BE9C8624AFC9D396AB6FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19