cdd88c973e51a0f35c4cae8ada87e1781edd2e66e5f26e8f1e4f6af3ccfa9bc3

Sharing

Copy URL Twitter E-mail

General

Target
DevxStudioX-Phoenix-Clipper-Malware.rar
Size 952KB
Sample260913-wprc1a1drf
SHA256 cdd88c973e51a0f35c4cae8ada87e1781edd2e66e5f26e8f1e4f6af3ccfa9bc3
MD5 bf1b2e372001da37830b994d2548955c
SHA1 7670676033a61b6540f0b12bbc98636ec33640af
SHA512 ac40453745a926dac0fb1dfe6d299623e59d93ae3ddef06bc82aee879fc7e082d390decf68bbbf640b00dfb6be1a4225ed301396d8a31396cb1deeb0cb6f08c1
SSDEEP 24576:610gd67xXL0VxFNSoUoHlg0LBGWS4jOamUiQoVRj9:6rd2lCNSox9GWS0OamrQoVRj9
TLSH
T1A625336ECB3A35E8FA0382A062400B594C7C7B574F1537711CA68EA163FFA84EC9D55E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DevxStudioX-Phoenix-Clipper-Malware/Builder/Builder.exe
- Size 179KB
- SHA256 2fa4d5e120af2906cee7dcd5b8e4660d0ec7b5529416808d601bead957174c21
- MD5 18b6aaa8992646c76099543b144a798a
- SHA1 6686420299855243b0c362fdb3ff5a7a91a3186e
- SHA512 184a89f22161791e971da663022d8071ea2e45c4f9c08bc33e47e088ab75a17eab0bd703486e25e4e6b2bee07e8228f09bb5668b1b4cf95a9c04592ab1e7747b
- SSDEEP 3072:gvQSjr73EnG1qQjfVVIMoUtMYEgy8egi:Udjr7HdVAgbe
- TLSH
  T1250408242AF95426E07BEBF546E56582DF75F7373501D60ECC8612CA0D22FC18E8B62B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware defense_evasion persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  DevxStudioX-Phoenix-Clipper-Malware/Builder/IconExtractor.dll
- Size 10KB
- SHA256 2c359ce857982f45b09af49dbccfb2ae302839acf1956e8325e7f854b339a8c9
- MD5 7bcf61e29e5cbcd1b81d9ab72cbfed93
- SHA1 d082613177dd1711c18426d4f83921dd932bc7b1
- SHA512 ce84af38dc63374d304d4e3b6c098892588df5ca5e921505c410b2a24ec0137dbc3120bc713cc0e4bf7836c57b7db224dd3264ea454cbfdb1ef78c9ffb19b6d9
- SSDEEP 192:vyB0L3vIFktNlrgyLY5ZJeU5cs7hnvR952:vyeL3/gyLYPJR5RJG
- TLSH
  T1C8223C89FBE90A22DFB70736A8039E81637CF6149557DF6B08C901B52C667940F12FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DevxStudioX-Phoenix-Clipper-Malware/Builder/MetroFramework.Design.dll
- Size 16KB
- SHA256 0a4a96082e25767e4697033649b16c76a652e120757a2cecab8092ad0d716b65
- MD5 ab4c3529694fc8d2427434825f71b2b8
- SHA1 7be378e382e43eae84f1567b3570bca9a67e7697
- SHA512 02d7935f68c30457da79ad7b039b22caed11d8aedfec7c96619ac6da59ceb7c5e7a758dced64ec02d31c37a2befccdc8eb59be9e2dc849aa2bc22fabb5fa00a5
- SSDEEP 384:HYAB8KPALBamLG3gckiBTVU6sgFf5L7WTOYKpKG4rw:HyLBamS3gckiBTVkgiVXr
- TLSH
  T114723205B2FC423AE7EFC5336BA945503D74A90DA872CA1C1CE80AF959F67424AD1F53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  DevxStudioX-Phoenix-Clipper-Malware/Builder/MetroFramework.Fonts.dll
- Size 656KB
- SHA256 c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26
- MD5 65ef4b23060128743cef937a43b82aa3
- SHA1 cc72536b84384ec8479b9734b947dce885ef5d31
- SHA512 d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7
- SSDEEP 12288:O+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:O+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH
  T1D2E429B5760139E6EF11C4B7C260FD80192BB863A77B402A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  DevxStudioX-Phoenix-Clipper-Malware/Builder/MetroFramework.dll
- Size 345KB
- SHA256 c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
- MD5 34ea7f7d66563f724318e322ff08f4db
- SHA1 d0aa8038a92eb43def2fffbbf4114b02636117c5
- SHA512 dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
- SSDEEP 6144:M4S7k5hdCpU4YqfkUGz6KpQQZQHDXjNCdOZgLdL5DXBK:M4S7k5hdCEQHP1Zgj
- TLSH
  T1C8745C111399452AE1FF423AB457084187F7AE12F6BEEBAD69CCE0EC5F937414A42363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  DevxStudioX-Phoenix-Clipper-Malware/Builder/Stub/Stub.exe
- Size 22KB
- SHA256 c7c104700dce086713077817bd8d231ff23a00ae2b6d6ef112b9dc3c17535a64
- MD5 26b3fc8d02501ed91bbf7340503f8aa3
- SHA1 24dc54907eb2d43c8a88f63d80dfcc9599b0b232
- SHA512 a7b6a66fdcdcea7e5623b864e0220d1c084cfbb9975c1286f811d1950fbc2b032efa1447e87bee3fbf47a7a17f1ccbc728b62b3cbbe3770117144df412c73a36
- SSDEEP 384:vzFYQHh6+7XFtdXYAiHxSi7sEIvpSyCbxbulWARDxtJKJA1FREA+PSdVFfM:Skh6+DFtdXYAiHxrDbSB0ZA+P2Y
- TLSH
  T1F9A22808B7E05935CAFD0A7A89227184A7B1DA134423EF1F2DCDF0C996B33668531E69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  DevxStudioX-Phoenix-Clipper-Malware/Builder/Vestris.ResourceLib.dll
- Size 76KB
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- TLSH
  T13B731C1C977C8BE6C2FE06B9B422190667F0C706F22FE75EDDC8A4E97C957920612193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  DevxStudioX-Phoenix-Clipper-Malware/Builder/dnlib.dll
- Size 1.1MB
- SHA256 bdb84aa16678189510def7c589851f6ea15e60ff977ea4c7c8c156504e6ac0ff
- MD5 3d913aab7b1c514502c6a232e37d470e
- SHA1 28ac2d1519ec5ea58b81fe40777645acc043b349
- SHA512 311e8f73c52dd65cbaf9f6e008b3231090ea99edf3471bac63cca4156a37a0d874ac590b19c01b15e05345bb6a5b636a11698bbd4e88c59c138dd3f358800027
- SSDEEP 24576:2gW20arTgWkk7z2B3Kqwf11Ot9Awr89Iv7f+NGGL:XC3o4swrY
- TLSH
  T105456C1177EC9BB7E0EE4737E8320A5807F2D5066693EB4F5610ABA96C833589D013B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16