7d36ba501b11031b7f4ceeebac5a4441eb5f38f09cc2a263cc1f8b376595fbeb

Sharing

Copy URL Twitter E-mail

General

Target
amica_0.2.1_x64-setup.exe
Size 50.7MB
Sample260916-snretscp7s
SHA256 7d36ba501b11031b7f4ceeebac5a4441eb5f38f09cc2a263cc1f8b376595fbeb
MD5 6290d0235cae953f4c693c28850a5c7a
SHA1 28f6b6899eda14f1f5b2585516e7f1d225a9f168
SHA512 1e808be5b81f3ef3edebed636800596f4a4bb9c0600a96b0949047473c0a4bc8a454127c8094facaa2f7a03c194229b60156df8d856b4944d99ea4e5c9dabc05
SSDEEP 786432:hM05c7RpgREoYJvWZmjpGIbRivrbX12t8pdlU0zc0i6dCPH8FjYvNAL:hnKfcENvlRivrDpFcbPc4AL
TLSH
T1FFC733A5AC3799C4E7122E76B04319736837FA1E755B24638F017B193051208BB7FB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  amica_0.2.1_x64-setup.exe
- Size 50.7MB
- SHA256 7d36ba501b11031b7f4ceeebac5a4441eb5f38f09cc2a263cc1f8b376595fbeb
- MD5 6290d0235cae953f4c693c28850a5c7a
- SHA1 28f6b6899eda14f1f5b2585516e7f1d225a9f168
- SHA512 1e808be5b81f3ef3edebed636800596f4a4bb9c0600a96b0949047473c0a4bc8a454127c8094facaa2f7a03c194229b60156df8d856b4944d99ea4e5c9dabc05
- SSDEEP 786432:hM05c7RpgREoYJvWZmjpGIbRivrbX12t8pdlU0zc0i6dCPH8FjYvNAL:hnKfcENvlRivrDpFcbPc4AL
- TLSH
  T1FFC733A5AC3799C4E7122E76B04319736837FA1E755B24638F017B193051208BB7FB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/ApplicationID.dll
- Size 198KB
- SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
- MD5 91c2e2f34b5bba068e9a6178e13a4e5c
- SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
- SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
- SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
- TLSH
  T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- MD5 d070f3275df715bf3708beff2c6c307d
- SHA1 93d3725801e07303e9727c4369e19fd139e69023
- SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
- TLSH
  T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 968KB
- SHA256 2b454443f12806d9e531e18bf19933c0aad1cd8ae397c71b99e814566e6bb5fd
- MD5 0ba06473cec3f0e72fc6865d870b6bd9
- SHA1 16df1d1a5b4d5df3859447279c55be36d4109dfb
- SHA512 42b3c4ce685afb43b8ba235b29919f7fdbc1997618b74d189817d14d1d80e52ea67f6e614d4097bce6ca53b90d46a6d6a54882cd2ea176134a308b64a2b882cc
- SSDEEP 24576:v2zSi+70fdjsUD5Y/CjsS5NpIMDcuHeoPffPJT1Qn652hOfuvNwRnkYkN2IO:ivm0TYKw8DnVbTwbBInkYkN2F
- TLSH
  T1CE258C41FAC28BB5D90E1674105FE33B6B39540887A6CFD7DBA09E30BD623A15E3529C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  amica.exe
- Size 54.2MB
- SHA256 05b388551ead1007a6fe4f9c08f7e4885b6ce53c1a5095b05a1f7be79f35b39e
- MD5 1af8da41e52392fb4428c901f92e3839
- SHA1 a5781eb5172a7b5d87df9b26a822c76982bff1da
- SHA512 fdc5566f47d5cadcb21ad830bd379a0d73fe4b2d788c895f824c240fdd95f52c90ddbda5c5daf482b2faf57187cd455b45fda3aca25658a27133facfd8d12a2f
- SSDEEP 1572864:UCwQzkVbNCPgU4OidUml9yA+pvQrfmpzLah:xFzkVoPgUzi/l9cpOmp
- TLSH
  T100C712147F499969C45AC4708246CA765A313CCA0B35AAEF44C4BD7B3EBFAF41F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral13 behavioral14
- Target
  uninstall.exe
- Size 496KB
- SHA256 d534490466a0e335b1618e345e7f55471d46cf47ca0d7bf04f7b36ae1070c8d8
- MD5 5ad50b0c519c64afad5c8ebffd4dcb53
- SHA1 318aa1adb188caf5bd6bf71daaf8c06e5ce3f712
- SHA512 c71f12e82760163fd5f4c7455a5904bc88f7bc9911328b37dcd6a90923b3628181c1757bb9fb035e8c21c222c05d692c19e4c91ee8f0a3519674d10388c08499
- SSDEEP 12288:AY+hGA9y/OdnYHSl/ynpB0wdJfKD6IWct2C/H:AY+HXdnYHIyJdJa6xQ/H
- TLSH
  T17CB422026F6090A3D1B717314D3AADBD7EF9AA0386A8E32B0B0517153FAA145B61F731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral15 behavioral16
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- TLSH
  T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 968KB
- SHA256 2b454443f12806d9e531e18bf19933c0aad1cd8ae397c71b99e814566e6bb5fd
- MD5 0ba06473cec3f0e72fc6865d870b6bd9
- SHA1 16df1d1a5b4d5df3859447279c55be36d4109dfb
- SHA512 42b3c4ce685afb43b8ba235b29919f7fdbc1997618b74d189817d14d1d80e52ea67f6e614d4097bce6ca53b90d46a6d6a54882cd2ea176134a308b64a2b882cc
- SSDEEP 24576:v2zSi+70fdjsUD5Y/CjsS5NpIMDcuHeoPffPJT1Qn652hOfuvNwRnkYkN2IO:ivm0TYKw8DnVbTwbBInkYkN2F
- TLSH
  T1CE258C41FAC28BB5D90E1674105FE33B6B39540887A6CFD7DBA09E30BD623A15E3529C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Network Share Discovery

Deletes itself

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22