9ace8b82c412b86ed34084823e37c4c5033b81006bb00265f9fe6ca757d85a10

Sharing

Copy URL Twitter E-mail

General

Target
kumir2-2.1rc-bad-apple-windows.zip
Size 31.8MB
Sample260909-jd8rpatepg
SHA256 9ace8b82c412b86ed34084823e37c4c5033b81006bb00265f9fe6ca757d85a10
MD5 154c2aa7aae4fdad93b010efe82a3832
SHA1 7bbba8da3608d97b64ccc85b8ce3bfc7d726a5e7
SHA512 a19edd52627405de7c4d7e708b26fd71123561c31e5570b6d8231aec42ecf87a64d6f2e6fa9f57b19f67f2417491878a6b473fa77c6bfca1e1a76e3f5a8fb1fc
SSDEEP 786432:Yt/bB6cTnkD6wKo3IWPMXGucZQ2BL7RiKMW25joQUpXe:2/kOnkD6zoIWEX0QqLNEXsu
TLSH
T1A6773370EA11FC19DDFF483EE74F831AE02146584D65A98B38C11797F1490A3BE6AE93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Kumir2-2.1rc-bad-apple-windows/bin/docbook2latex.exe
- Size 239KB
- SHA256 4363bd6a4e7bab006b0a19da36317acd9df88d4c25641081b2454d13f0178502
- MD5 053024334940a277481ae7d08dcc2978
- SHA1 a779a4b6f72feeb6ca1589bbe1e356b9aec2cf42
- SHA512 f1b35b0b4709453815846555b4a84e983b9a77e3e8125fc8f0975f4e10ea77ddc122d021afe4215f5e9f777f93c2f9d69f1284df7cae0eb6a19b00729f85cb28
- SSDEEP 6144:niUbMAxl2fQjm4+O+l6Qdx4pM2dlzzVN8v:niUbMDEM2H0
- TLSH
  T1FA3419D3B7D99CDAC405923885CB83213378F9C587529B1B5B246B360F12BE03F6B65A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Kumir2-2.1rc-bad-apple-windows/bin/kumir2-bc.exe
- Size 292KB
- SHA256 11be0aeadbf86382eabdf94368a6e65ec75db1d6c053e301c80e2f2b3fa8b4ea
- MD5 01253070ff1c04b46a3d90afecaf5183
- SHA1 3cb01e44c6eb1e606c951b00028cf65340d78bef
- SHA512 c50db6ef1eb745da5268a6d91ab75b2dd2111ee062a00ed418ae628686b385a9fda27e05ca66b61761c57054a6686cacbdfbd1cf82041a033c1f28f6923caea5
- SSDEEP 3072:WhA6mSsrWRMiVatXqlszK1l4B1IsKbx2eSFJ6fT418PWZ8m1XxLQge3uttEfIhRM:WXmvSb5WzA4Ql2eSFtfIztSkl2xS
- TLSH
  T1F0545AD1B7C99CEAD605463988DB8369333CF6D117839B27192877311E22AD1BE8731B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Kumir2-2.1rc-bad-apple-windows/bin/kumir2-checkcourse.exe
- Size 292KB
- SHA256 26ef53f7a822bfb327fdf769ecc9e00be11d500a8e0a91c83c83ed5f768afa22
- MD5 b619ffb1f5613b59d3401b8a09ae0cc9
- SHA1 d5211379b4a9cdad8c0a33751872192e9cf5f05c
- SHA512 5481464e9f4dc6bc8b501b9c4277b480dc763d9d47d1d88634e19eaf90357a80dd5151d348b99183a0ed69799f122917fb52d37d6ab6680a565b3d4c7d9a35f2
- SSDEEP 3072:EhA6mSsrWRMiVatXulszK1l4B1IsKbx2eSFJ6fT418PWZ8m1XxLQge3uttEfIhRd:EXmvSbhWzA4Ql2eSFttjztSkl2xS
- TLSH
  T1FD545AD1B7C99CEAD605463988DB8369333CF6D157839B27192877311E22AD0BE8731B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Kumir2-2.1rc-bad-apple-windows/bin/kumir2-classic.exe
- Size 367KB
- SHA256 149f01ff81084ff834a2a3dcc382828c9f7bd8d135aafa11583a9da51f9d2f85
- MD5 07ea423a72127f926e76daa7e9677261
- SHA1 c0651f502c2ff092182099d29b134ddb95a314f9
- SHA512 9d4483d6abb8cd5002b21978b690113c064a6efb93a8ae00ee34cbdc1b2ece995d5bc401f73b4f4b3c6e763015bd27a5c2b40d09f583f180a29b39a70a06f3ee
- SSDEEP 6144:lIL+pcLlPA9dCvTez+Xu4VTAVXMmhybPSk3JlS:lcPAiHVAVXMmhgje
- TLSH
  T152846BD1B7C89CDAEA14863988C6C369333CF9D046538F1715347B352E23AC5BE8765A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  Kumir2-2.1rc-bad-apple-windows/bin/kumir2-courseeditor.exe
- Size 521KB
- SHA256 4e907b817ad3f40997bc87c23d80b948818280cdd5863b10f0981fbac6400405
- MD5 73659bd508c5f2cc59ea83c0f265dbdb
- SHA1 06e7fefecee5ac0b50084e56b849d456a7ffa63f
- SHA512 421f4d0c6c54902c37c32630dccc6e64df234a8ad6328bb4dd29e86294be47221d806b853c1e30f0d04546d5b71673dba12a5556ded19edcdf0691c012e3338c
- SSDEEP 12288:R3MsyyjCWxY+zvYw/uInbdh4y51OL0qVTJwBJ0vUFTDPVWTJKLqWMlzn/OWBdi4:EWxY+F/ln0wTo
- TLSH
  T185B406D3B2D59CDAEA64823C41C6C321237C78D2C6729F1765342B362F51AD13E9A36E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Kumir2-2.1rc-bad-apple-windows/bin/kumir2-ide.exe
- Size 369KB
- SHA256 85328bb996604b04d8cdbdcd7b2736a9b749d6e6957f2552bd2fab1855c48572
- MD5 b63c4f5c9ce4098a22324f5a11bf86e1
- SHA1 96db0511595365212ed53a536f01b8314b84cdf2
- SHA512 40da7a3031a209451f4fcd709d1177306b17371a1cbf89964d956c76c42f209c217f03b9df565983aa5fe11cd86b3cc07368562e593e2af2dd3db0dd83a8b91c
- SSDEEP 6144:e/IQ4qJ3T+E89TiezYTj854PFFVXpQiDbPSk3JlS:jyDkQTj80FVXpQiPje
- TLSH
  T156845AE1B7C59CDAD614463EC8968335333CF6E556838B23093877311E62AD1BE8772A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  Kumir2-2.1rc-bad-apple-windows/bin/kumir2-open.exe
- Size 240KB
- SHA256 7597cac67e1368aa2a80fcd3122f444aab907f4f9b16c511c9726417c4379619
- MD5 a31b4fc8b52b5dca43089b1056733321
- SHA1 ff35b895def448224ca6d561a7634e4a754a3a69
- SHA512 30bf946e6bf3d141d3d1dd450e9dce5b66c91f75e313d17dd81cdc1440efcb1eca02a3a97fbea99f56d04d35af2667e98db9d781baa1be76e29c23ab2557ad46
- SSDEEP 3072:PdXtB4IzNlO4LjxkgCoWNor1f4fLTaMCuRB9jH1F4ni+Tc917qMSNhvkMh:P5z9jxkXU4/lF4ni+Tc917qhNhvkMh
- TLSH
  T18934E5D537C89CCAEA54863C84D6C325223CFDD587528F1705307B361F22AD56E8BA6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Kumir2-2.1rc-bad-apple-windows/bin/kumir2-run.exe
- Size 298KB
- SHA256 52ed68c751cfdb7413045bec0b2eccd0e8aaa6d02b827a0187123427f65e811a
- MD5 b25b4f678ea887723d4970dfcc39b430
- SHA1 d2b958f93fa8ee59091fca01c0500a74bb90356b
- SHA512 5f4fbaa9596e6d30bc30c9f148ffb59e96c7aefe5bb6b3502b3fb08c9fa9a00dd4e64a78818f7d2b3a69866711a9df52948c924e4bfae0db1114365a4c946f3c
- SSDEEP 3072:utbXw95srUNMlgrLo21nrn4qZtM1l4BvkyNyJ3kbCJ/a0418PWZ8m1X8lQLcbu/x:uq9+Ivr8ar4qq4J3G3kbC/918A+BZGQ
- TLSH
  T119547C86BBC55CFAC5058639CCDB83293338F9D11BA75B1B1924B7340E136E0EE9761A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Kumir2-2.1rc-bad-apple-windows/bin/kumir2-teacher.exe
- Size 450KB
- SHA256 4a51c0c1686b8b53b3361faa01b809a8121d3e7c77f8a6741cf068f322bd0d94
- MD5 3f6ca887ee4e99a38f03b51aa9cce91b
- SHA1 1ade56a11017f3bf9df08b771057d65e5c50ae45
- SHA512 5b59a5a481559b242062cf3c95ea85c093b5dc39b3a9f078d14e4ab4cd7d8ffe07814cbec19aadd2b0f9d36013d991f3db87d6db5b590f7ffc3c4bfd8e295780
- SSDEEP 6144:HYAQgvHznbQ8+zocOeg544i9VXBg7EbPSk3JlS:v7bcgO9VXBg7aje
- TLSH
  T114A42995B3919CD6F114C63DC886CF296738FED116468B5324603E73FE31AD6ED8222A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Kumir2-2.1rc-bad-apple-windows/bin/kumir2-xrun.exe
- Size 292KB
- SHA256 cc4278b4cce7362e702550e5ac666aeb285d52b855c5a6592c9e6cd8aece0514
- MD5 eb04abcc5a2acdd7949edac76a132417
- SHA1 08bbb54f0a8dc7f84d9ec29415c5a8c3958ad924
- SHA512 fd35c9b75a4b76b85a589a83a5da8bc5773e7f8958a04c9d5cdb6e790e82e15d6625f4979e964ac080f506b08bfae54485347d801540a518e28d7fb1fb6700f4
- SSDEEP 3072:8hA6mSsrWRMiVatXLlszK1l4B1IsKbx2eSFJ6fT418PWZ8m1XxLQge3uttEfIhR3:8XmvSbIWzA4Ql2eSFtFhztSkl2xS
- TLSH
  T1DB545AD1B7C99CEAD605463988DB8369333CF6D117839B27192877311E22AD1BE8731B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10