2cf19b7d5348001b2164378edd01ccf126cac45e1794cc024d310fa639bd422b

Sharing

Copy URL Twitter E-mail

General

Target
nigga.zip
Size 61.9MB
Sample260910-ry5vjavdrb
SHA256 2cf19b7d5348001b2164378edd01ccf126cac45e1794cc024d310fa639bd422b
MD5 b82bc637fdf3526bebbc955efb00d8dc
SHA1 c791d6fd760dec6faad9bbf5e496c92204a9e64e
SHA512 6e24a813bf3862ae4e5ace8016672a6b12cc7cc778e48936e232b26a2338b6ba4ad657bd28268355b61836973b5021a3b88ed269c2b1da0ece67cf5426cd9c92
SSDEEP 1572864:vGx+XR0kPzhqucb5E2uU0iI6DgVINkfq0JpfoSqi7o:vGImkPzhqbb2+VgVIef3ki7o
TLSH
T185E73339B22AA4ABD8714C7DF5D3F172395600B1C62CBA8B654825814DC3E87A9773CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  nigga.zip
- Size 61.9MB
- SHA256 2cf19b7d5348001b2164378edd01ccf126cac45e1794cc024d310fa639bd422b
- MD5 b82bc637fdf3526bebbc955efb00d8dc
- SHA1 c791d6fd760dec6faad9bbf5e496c92204a9e64e
- SHA512 6e24a813bf3862ae4e5ace8016672a6b12cc7cc778e48936e232b26a2338b6ba4ad657bd28268355b61836973b5021a3b88ed269c2b1da0ece67cf5426cd9c92
- SSDEEP 1572864:vGx+XR0kPzhqucb5E2uU0iI6DgVINkfq0JpfoSqi7o:vGImkPzhqbb2+VgVIef3ki7o
- TLSH
  T185E73339B22AA4ABD8714C7DF5D3F172395600B1C62CBA8B654825814DC3E87A9773CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_buf.h
- Size 9KB
- SHA256 9ca4dcb07478667668f6e0b8fa113a6cd285f1c723d1144e5ba79501573288d2
- MD5 d5772c8d3d227752092168f69fc8fab6
- SHA1 3158de82adff7b38e7cc70b1ffe0e36addcd8817
- SHA512 90ad263fdca5955d00d674643fe2d1c2bc6c277f953057706dcdd414b87288b024005d9f4e257734e290553c151539142b6be90d8d017c4c3803414868416798
- SSDEEP 192:y/8vFDa6/kJcWZJ3Cudqv611Gg96P9zT6SJnyDbX+:y5WZT6SJnyDbX+
- TLSH
  T12112D04E9FF6A463A685FF1C26A32DEFB5F891F41A50E10440D3DDA91C02CC6C57CA65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_cfloat.h
- Size 3KB
- SHA256 483a9b0a6f6f2532147588597a077260faca4af1c6c4eca50053e08cc09a3a58
- MD5 59bd370a54c02cd545e0e57d1bffb07a
- SHA1 031ac1ad2c58ebd2e0f6fdf84c0d7258fd3dc0b8
- SHA512 dabe9bbca429eb184f6053f70a3890f933bc0cfdc07a3e970d07d31e6748c9b3692a815c029f5726c0b8f3778592a19b1e93b90a25f506015edd20cee5c580ac
- TLSH
  T156615BAB1DC5216A47A0B842A7054A339C0584FD3DFDAE9D7046558F28E380D66FFDCE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_debruijn.h
- Size 792B
- SHA256 79d99dcafca8f62a6dd3579531eb2ffa44c4217cdf8f4525b5f72d1224da34b9
- MD5 0a876d62e559359a109fd3b1cd999907
- SHA1 d139f330afb4661bb41e9a2530241b755826b5c6
- SHA512 d1f2ca15e5db8cfa0b62ab67609daf8f77e944cdc6ab22ef598b9e99449aac96fcc68a30aa7af389602b42a55d2af6627587da409c23d2dc5f70bb03b34d7850
- TLSH
  T10001CE11B599A0319A051A26E50942B4EA1C75B5F3B0BCA8E845F27E3A03C07867AE9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_diff.h
- Size 3KB
- SHA256 95b3f949023ec3cafb7de12d6526e968eab348034e09a246b50d3b700c3a68d1
- MD5 0b18ae1f7c1dbf14e758c93e38f9b90a
- SHA1 da14435d851c2eb8e6b70e9307dff6d447539ac3
- SHA512 ee68382237717bab3628708400770ba4db4e2cd7e40f5a77045753b71fbb30a6fb689c082d4a100abf8d5a9b4f2e995155e37d846c314d746eb9d8504f916d8b
- TLSH
  T144619F6A76A16021B99077EF57AF1C136107F2E43391E5A8F70BDEB82102067D1BD4ED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_file.h
- Size 4KB
- SHA256 693aaaec40f8bd7698b432e78a6062df37b34d486cce7b431cf1e9936f9d8686
- MD5 6da3abfd4cf012247085abf60b853df0
- SHA1 8a5d7f9431fdf66f9a5edadeebdcdd20064d8284
- SHA512 fbfbb9d45588daad17caee3eb1571d149df9fd6534586fae9f8cb0dcb5c84a99dfce35434b29422e7602ebcc9ca815e0c176bbf297acf0a1a13ba852b3d7cc34
- SSDEEP 96:jH6U8aoX/aztN67aCiqpWmZJo7i0ReSu1BbW:OdaoSzt2ZZJoASQBbW
- TLSH
  T1A981440A27EC6853D94093D5660F149FA848B9A675F1FCF56F0BB56882830C3A2FBC25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_graph.h
- Size 3KB
- SHA256 60a2a19a3c44ad9557a362dcfc85e98dbb59d0e4e515a2bb3cbcbc64e1c2036d
- MD5 cc44f491dace60140a938c27c598ed16
- SHA1 54c4e6cafd0098264d4b4857141e54d705b03aa4
- SHA512 2b7d27d1e6e79f906b2326dd6102f5de6d89547c41f1100ad3d23ee9a44dc7937996d235eb025dc111a49764961095a5d600bc19fbfe3598779d6f20e04071da
- TLSH
  T166515817E3B7E083B9B44960AA1F2DEE68CDFD483217E97CDBD6D51DA1226016D208F4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_graph_drawable.h
- Size 1KB
- SHA256 81268dbf25b42f1fe52c13656c68e5c6ce6cdd3b39ac2aa09d2ad4ca3f9a242b
- MD5 bf7833cbedccdb904d0069bc47c2c17d
- SHA1 fc85b5781a343342e0384d95d6a0fd6056f8ce2c
- SHA512 a69bcd10239a4a70cf5165d6c20a7b5157ed37ee3f557e3d8116f5d32d1e9bc319d8818c7fd8f307e5dc8928ebed4251afe09e530de4865f27cfdde6960323c4
- TLSH
  T115314535D68EA023693D4260622BA491D5ACF1987313F3ECF578F4AC6D011808527EE4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_hex.h
- Size 1KB
- SHA256 296b922286bc9583a5acf458a9a03ffbb2f7acc7958515838c3700455d4c8bfb
- MD5 b7c9dec2cae8abe017130eaf74446a20
- SHA1 a949dba5c24317b2f20b87e185bbd599ddd80e92
- SHA512 23a8dada41d621c548eae75f3507970ffe7ab064683c1217d9de015b2ba997b9d5c4144f23ecb2f22a2bbd000c155ef08f9a5e12a3b7d8ddbd5dd315e351ef4e
- TLSH
  T10721D41855ED44B3CA9017D2D14F23A3699D7B76B3B1F49A2E093B688A420CF6074C89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_idpool.h
- Size 3KB
- SHA256 f8a14edcd40e4be62d3bec881b1889bf4bd59424763e77075c33b82fd728749f
- MD5 9fdc0006c44b3e7b714c6f7b7d24fe68
- SHA1 b5f690462be60023a4a1204821b7356dbc3b9c1f
- SHA512 9496290ae67b03e0803c6f910e62ae4644cf10d0e2b8a5042ca4a8c060f27f651c1fb7f2f02645dec8d56fb3f94330d444e3eec1e6d4f55d370610315297c8a3
- TLSH
  T13861EA2DE23A85A54E80937DB91E7499AC3835E0310EF33C5647506EFE5C506B3E98DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_intervaltree.h
- Size 4KB
- SHA256 195a763c2d849f706d811a5239f59478953fc5ceba23519b15e541d571cbc2d6
- MD5 812af2f9d196ed0b19aeb4ef6568e03b
- SHA1 5c17a766ca09660937f28eaf70eb04501aec2fee
- SHA512 17efbee011aeb61388e4174cb55c80fc110d4aeafa4ef869dad2691de0fcdc7c9b23142c561ea14d0abe250bcf3cbe0728d9f0615292867678b1843cc584b009
- SSDEEP 96:SLi+JlEmAi3jBffzoquASvXymHqECUPHVgBw0gY/ZxKlHUgfHwJQtOpA0zXtOdAA:EJlbJBcNAcHpCUPHVgBvgY/ZxKlHUQHF
- TLSH
  T1E391EF143B471E360EA4CE20B91E25A1EE5C6072D2EF0954A38190ADB08BC57D0BBFFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_itv.h
- Size 2KB
- SHA256 05a36c78027b4429412c3fe96915ba1568a8bfca65eac3cb74ce2bd43180cb58
- MD5 da87a38cfeec6a3f1c06580daa71a695
- SHA1 812a10e58f5ea8b787ce5e2f82efe17ae07e104c
- SHA512 228e6bdca8c9dd2e7b0f4eb50b8de49a7b18162d0af26600c147243ae4113e7ec1832cbeb915384fe6acac89cbe956c1f356fce13b6de027c415224022919f21
- TLSH
  T15541DE66778B581C6FD4ABC1762708A0CCD940DECF5B0D45B29851A638CFC00D2AD30B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_json.h
- Size 2KB
- SHA256 5930d40685c78d99f2abb7e70eba4d96f2cda87003665ebe4695114363bcb072
- MD5 460ca1bf46fdafbb1202aa0758ca606c
- SHA1 a07f6a6ca47af43ececf7ceb07aa57206b217ce6
- SHA512 79d4a26b72c838986f580cc8cc24d8226c72d5969bee9eee20b0724b1b80f02d36d7fc17c03dc2f17fde2c3587821a3fa8f88558608b34758494bfa218eab657
- TLSH
  T1A4513211398C6983CC98539C2756AF939E487B14B322F0E6B50F5AA67B22846077BCD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_log.h
- Size 4KB
- SHA256 116d432cffb7cbd0b46d3fcb1de46b6edd8d64c221fe0f1a73765a54ae26472e
- MD5 79731d9bf5c91ed68405baeb276ace91
- SHA1 efb9b7f7a85d44a92be8cdabe5e584a68610a2d8
- SHA512 510da08963a06c21b0705add598f0a53ca9e20060911dac86c644e64f62f72fb9ccdd784f772d4bb917670f617d7e1e449c3573b2b58669b155ac83214211158
- SSDEEP 96:fQryWEU8fHO2V2RVGEOCJ4iS2CTE1/a4zvGCbt8C3cLS5g7:IrKLURR+lLS5U
- TLSH
  T100A11D780FDB1C478B907725652F8A071C2751EE39D2F1B8BA0EA96C46F2C4151F6D9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_mem.h
- Size 2KB
- SHA256 194773ef17209032f9511d606daba1250d62f363d7ed7e6e1effdc23b05d942f
- MD5 79badf336eddf6e7e849bafcb26e285f
- SHA1 ca87a988fe517745ab243008f842078d6fefcabb
- SHA512 a8405f69aa40f713926ce88b40a136710128ddaad52cef609e0165f5098e63d0545ec556658997aed101073c120a6148773b445da6b46c874ddb3bc45f233e6d
- TLSH
  T1C451AD1D13755071B9C44B66A1FF7562AB1CF8A636F0F8704E4E9FB81A42842A13CF68
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_name.h
- Size 577B
- SHA256 5af5bf27d7bf09ab46ca78587379972f5207350fef3fd330b286a8eeb969001e
- MD5 2822ef8c2e007f2f67b59a54d192756a
- SHA1 3daf92d2be2f1c59ce6cbafd4bd0a6b6be89dd5e
- SHA512 db5a21fcc9a8b6075586ade8f137c8282cb63f148140fe549f242eb6ab27f8285f3d689b55e4cd87747d9673dfca8139310525f60d741606b9e801281b29d6c1
- TLSH
  T132F09A3822E8E443DD5113A2B08B1A92880CBCB3B766E5B4BB4EF68050879C761F6C4C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32