8eba737cb6875d9b3709228d37893f71125bdc50d7148e24d9cdc755259e9c3a

Sharing

Copy URL Twitter E-mail

General

Target
Wireshark-4.6.8-x64.exe
Size 94.4MB
Sample260909-kb7x2stgpf
SHA256 8eba737cb6875d9b3709228d37893f71125bdc50d7148e24d9cdc755259e9c3a
MD5 f518ff8bc0dbe3337453c1a0443b5d60
SHA1 25d7f6d113c256c07e8d670429c25f3bc8283be9
SHA512 0756a6c2d64379f4186e2fd0ba021f1103c036b235613751d370aa2a89c7670c5b85ed964d5a75284161ff6d644c216ff3ccb4b11c4a5d6c9c10e82fbeb0c66c
SSDEEP 1572864:/c6uC5xfdMoFjm0nFo4AoUzH9HW45TsukWsraZSKfbm5duy4UMvWSXTJLkYjaRB:/chiVMUmu/AoUzdHaWsraQKfbm50SSXs
TLSH
T1B5283378B9E9D724E9F00B7B915773A82C8755EC6AF7146DDB683B8E38744B018FA400
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Wireshark-4.6.8-x64.exe
- Size 94.4MB
- SHA256 8eba737cb6875d9b3709228d37893f71125bdc50d7148e24d9cdc755259e9c3a
- MD5 f518ff8bc0dbe3337453c1a0443b5d60
- SHA1 25d7f6d113c256c07e8d670429c25f3bc8283be9
- SHA512 0756a6c2d64379f4186e2fd0ba021f1103c036b235613751d370aa2a89c7670c5b85ed964d5a75284161ff6d644c216ff3ccb4b11c4a5d6c9c10e82fbeb0c66c
- SSDEEP 1572864:/c6uC5xfdMoFjm0nFo4AoUzH9HW45TsukWsraZSKfbm5duy4UMvWSXTJLkYjaRB:/chiVMUmu/AoUzdHaWsraQKfbm50SSXs
- TLSH
  T1B5283378B9E9D724E9F00B7B915773A82C8755EC6AF7146DDB683B8E38744B018FA400
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
- MD5 7854290f8bc473fb9fad1917b0065731
- SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
- SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
- SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Qt6Core.dll
- Size 9.8MB
- SHA256 3296266b75c84547176faa407688165eb15d250946b0f426fdbf0cecce272765
- MD5 22e2353c6fb7795702f2df3b9917e47c
- SHA1 6b036e4ee4ce9d98dfffa28d9be297d4e30646a8
- SHA512 32ab02060b7dbea029b85a0a2953cfee73c8c8df600248017eacf9538fc5341436fbc10696f059b0551d29bed2b97e13404b0152a7bf4c34753eed0d62369829
- SSDEEP 98304:37ULMekqCZDPAlKFdu9CwJsv6tMYdJMS2r/38o:3xoKFdu9CwJsv6tMeSSa/3F
- TLSH
  T143A639036AFA0102FAFBDA34DAB71252DBB27C46673596DF025461185D337F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Qt6Core5Compat.dll
- Size 857KB
- SHA256 bb334cc27df48d626e696872b8faeddf66faf3e75dfb445c2ce9a44f46de1ccc
- MD5 c420325168656770db1b302728a35acf
- SHA1 4f61e18148033eb29f3b96ae5cff979dad12541d
- SHA512 ba0f867c8167ab274dcf3827fab776768d176427a4a495fa6381c7a8d2faa377a6bb91a71e47317080735ec7eb56d05bced44293c03af42c6e135154dfae381f
- SSDEEP 12288:EjAnM4mR8zu/r5hBdXvPGE/4717VKIxBDPzHkSrGGEfvrfLO6d:G4Aj/r5hjG7VRDPTwXfLrd
- TLSH
  T10915BE7772A80956F16BC03DCBA3A913D7B73016536286EFA66087077E63BF1297C211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Qt6Gui.dll
- Size 9.1MB
- SHA256 389443e4f159eda43cf7ac383e20eb2196a7626286549e6ae1fff53f74ace902
- MD5 7468a8056bebcc7f1adef8022cf67f8d
- SHA1 da8b4ab2c3ffb772a1f888c84d8b466514d7dfd4
- SHA512 48c5d719befe61691f45b99f4c05a892dba144db5a1c9652c28d45bfb78af9bb2a532e7385f093c7183437863401952eeadd9362137a6b79e0b54fe3fc336fb2
- SSDEEP 98304:ELWJ76kJHgTZg+ZC/PVqGJ6Q/Sx5kPthKMG5bpZa5M2EXU:vFHg9g+0YQ/Sx5kPXK38z
- TLSH
  T190A68D57B2A911D8D57BD13C8B9B9507EBB2700503629BDB02A4CA562F33BF12A7F311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Qt6Multimedia.dll
- Size 1.2MB
- SHA256 931f749632342c2e635af2a198ec017024db9ca6dba4a0f46d364bb6200c119c
- MD5 3dfac8af603547b4b6e21bb0a1157b5d
- SHA1 4009d1019f289b9c005c239a630966b928984735
- SHA512 35ce6c429d1f1aa644a32c864241a2d33366236a7c0df4bbb82da463833553688c262be14a1a0af8edacb1ceaf28a18d4434862cb00617192cb7b28685c742e8
- SSDEEP 12288:lO8y5eo5K9Kqtc0SU1Y7qZzQpl0BZ8+Wb6+8wC97lg6WET4:lhyeo5K8Ev1Y2ZspU7w47l5s
- TLSH
  T18D459D5BF79441CAC46BD13DDAA78A16E7B2B0141302DBCB12628A0A2F77BD11F7D760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Qt6Network.dll
- Size 1.7MB
- SHA256 ba7e9b4934d0373a054d48660226a34ba3f5b2abb0bb351f21b021a2b84d4ed9
- MD5 ee99bd10ad90c2311e85ae8fcff669cb
- SHA1 2824437f468579e431c869d91870ecb7515980c5
- SHA512 7d46c529ac445b226efacf5a2e00ded609f58f5886624f1ceae91b27a09fa692e9a1788a532d1236392cd41d934c68fdc60c3ee60d28d49d88e839f263244d6a
- SSDEEP 24576:+aNBuUZQb0e9m8EPrcoEuyRhOaUVhYpflc98:+an5Qb0e9REP4fu+UYQ98
- TLSH
  T1A3857C57A3A442D5D96EC27DCB4B8A0BE772700543669BDF02648E152F73BE21B3E360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Qt6PrintSupport.dll
- Size 399KB
- SHA256 8c3610c50fabcfe8bba2f11f2ce3794ea72b512d12f2c4aa7fce5a56cd339261
- MD5 b723bf38a8697b956635d35ad7638165
- SHA1 ccecc29c03cba3e1a32b30f9b2209b9e41fd4074
- SHA512 6be76a9e6f64170e92a96fc2f006d96acabd53997ea4158f67e88a1bd181c608b837addd1aff0fb85a59b4e590208fd3888da49d0e73e545995772a93e40df18
- SSDEEP 6144:3X3Mtg6igp6Uq1rYzOGhyDa11KnW+3A2Bqa5sGc4rZHYGpxgiWbMEbN3PBH5AYlu:3X3N6icBqkOGhyDe0WFW
- TLSH
  T113942987FE660181DC5AD23C8A7B8516D173B0D90363C7CF022E9A09AE6B7E1797D394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Qt6Svg.dll
- Size 620KB
- SHA256 6edcd61a57724e73dd309f2cd7201b892c2af82cac93736e3c3a08d94dac8518
- MD5 3510543ee0f8e5ed68f9e5ce03a308c5
- SHA1 3d1641e65f3f5953164181dc2295a1f1529cca63
- SHA512 f80ea19947f3e1fa5a40bc793723d2251425e64031e0c590e5102ee48b066adfb25a20e898687533d0bbd843c9450693f84d57844c36eeb2675ba95d7c4327d8
- SSDEEP 6144:n6HNycivcATzSTN7xMeheA74qaBaj7TfAAgutn2ru0Gf+crP8Sx5Yj7yEA3+ITIT:n6HNbibzqfq4j7TtNQuR+cvB5/WX
- TLSH
  T1ACD45C57B3A60786D86AD13CCB5B8423EB73704403A2D7EF41A58A552F23BE16B7D360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Qt6Widgets.dll
- Size 6.3MB
- SHA256 5d47c508848f44e2a1387d7718b016b6e4c9aa7164790ded6b760cca900e9315
- MD5 bbbae6115d385b4dbc136469510d7764
- SHA1 5ef23f70c93d82a4d656e0d01e564c1f7f0f2fb2
- SHA512 8fe83069e28911a3dc2731fdf85c7a6b4343eb68a1a04329bb0ca17ad7ca15225f1362ad8dda7d857e008bc5c119d7f5aa028c2d2b45d9b86b561dc0b063012e
- SSDEEP 49152:r/jhOtxRzXn31a0R+oiSl8U7jtRtzX1s3e8fCTjjvDsXjnq7TADWVb/G5ImjNyzN:WRNj5zX9jrNkwqZjSayK6gckA7/HTHa
- TLSH
  T167666B57A3EA0195C4ABD17DCB0B8A17E7B2700443229BCB11698E592F737F12E7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  USBPcapSetup-1.5.4.0.exe
- Size 190KB
- SHA256 87a7edf9bbbcf07b5f4373d9a192a6770d2ff3add7aa1e276e82e38582ccb622
- MD5 93c9b5098b1d42c53c7bdd68fe9cd6cf
- SHA1 ccfb1497abed432844ad972dea65853dd0e7cba1
- SHA512 dc6b84d0784ae36941615565ff21e8634bf36e3efdaff598d470035157a2f148cd1f10031504476f821cd0ce0180c61ee9fe6a7bd0beb3721c4b1c738f61fef1
- SSDEEP 3072:PQZmPYFFiorvcQNpDjrc5nMDi93g6HC+0vaiFxMv6mwSARrwPKVvbygEXoHApLG6:PQLFhJXrcVMDcgoCtswShkTAoRA9
- TLSH
  T14D14025A23E1C0A3D797063098F66637BEF5E2100152691F63B0A6673E872568F5B1CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
behavioral25 behavioral26
- Target
  $PLUGINSDIR/SysRestore.dll
- Size 5KB
- SHA256 9176c65e37d931edeeb51f9deb1ab9b5ac2d1c6311ad85339bb79f0f2840b2a9
- MD5 c1e07f0ea14ebf4142176d340ed421f3
- SHA1 f3524213ebbb53b4ce9ae1a1172897d4438445ed
- SHA512 3e69f403bdd041ce9da91307659645f44a760360e69e986c1740b04be0dd66bfa017ce8783f9f4f81d545eb43eb68df09c90c8391c2a417cf611064dba5453a6
- SSDEEP 48:KSOluw74Rqzy+uMD2CWoI7Npom7QEDQY/6232uK6hmX3//fTQvSl5B0KQg8mmad8:Glu03/Dwz53dKNEv05B030neZV36s
- TLSH
  T1FBC1C736BED159F1DE950A372CC7089916B6662183C445F31E239D8E2E00CC5EE3A306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
- MD5 0063d48afe5a0cdc02833145667b6641
- SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
- SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
- SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
- TLSH
  T1CB326D5503504AF3E996863C00263BBFAF796A2095F14D53CFA394C0FE2E5C9AD78352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  USBPcap.sys
- Size 51KB
- SHA256 f340a8cf2f127be2e6b558586b76b51ba5e8c58c462a8d9eecc1955771cb2974
- MD5 01304fc31498030c789e80910a356e6b
- SHA1 8a8da048c75a6a587b7636ade603cc611b3c4833
- SHA512 48921040e1108478f5bc5969ede09c9fdc1cb76df05cee47fd97502343e2975b0e161607596eaf6e384586e006da4820adbd65937d65d51e14fb9bdcb4d4c7fd
- SSDEEP 768:Fv9neO3gPvnCORE+KvWt74cTuzWoYKpuYuYZFb2aL3hP0p33b0gj:inbtYUYfb283hP0tI
- TLSH
  T122338DD326B868D2E597DA3082E8D65BFAB5F2C2271187CF0228D1951F137D1AB39309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks for common network interception software

Drops file in Drivers directory

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32