berbew | 0eb899ab3c1aa18518d7ad5716c35c260a0098f24ed69f472ae140d5c9eebeba

Sharing

Copy URL Twitter E-mail

General

Target
Qt4Setup.zip
Size 677.5MB
Sample260924-eradtsdg27
SHA256 0eb899ab3c1aa18518d7ad5716c35c260a0098f24ed69f472ae140d5c9eebeba
MD5 09488ae06e53ba4a42e89328b9d4be75
SHA1 e3dfc50a595592c3c0d2e127b41d7f1b8ccefc00
SHA512 d74051b9eb640b4a79dfec4c092cb592fdd7ed65b906d7d4e1f276b8c049d0e3b5d4b3b4ea1a071e51e2372424b24af597e67b58900030596caaa1ea947c3dd6
SSDEEP 12582912:evOw2FEik6l7wLl0N6KBZf/XxHqzLZf2w5kXJeIWdQXdRg4MB9ZSUSyupaV8C4L7:e5R6W50YsZXxHqzNbCXJeI1d+bdSSyb7
TLSH
T1857933D3B283C072F591547A10AAEB774B30FD240B1956D3B3DC3A19DA309D2BA3B959
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  mingw32/i686-w64-mingw32/include/c++/bits/stl_set.h
- Size 28KB
- SHA256 64f9ad1825bdce7a6ecae799cd64efe08603d39fdcfb3c210809a6c48799d195
- MD5 a1fde6d07a3e7127041ac50752eaf68d
- SHA1 496f800c77a230403f13fb8b28dfb49f92607fcd
- SHA512 79a72fd8e39db1883815fe4e0823424057c679256e5991f7d924060fecbc2e7d4791c6911421b9cb141d5a53bd82eeb455392ea4e51d99896e9e10d1444b0e54
- SSDEEP 768:MOxFxqURAamgfd0SY7/9RTBTq6ZhR+QSHV+iTSRSlKnOKF0dc/6/T0rz5yGe5Kyw:dFxqURAamgfdqRnS1JSRSlLo0dcC/IrN
- TLSH
  T16BD2416E38C1A562134926B2AB8B51D4D392847FF7E0898435DC8538BF13B3563BA7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  mingw32/i686-w64-mingw32/include/c++/debug/set.h
- Size 13KB
- SHA256 114a63c4af47a3e3580fead8fd96e54e546510b16fdad28cbd8fa74f88d1e9f9
- MD5 99535681a244ea594721ed0330cdecaf
- SHA1 0836780b0aad1ce5a81af9d3f93d34eecbb1579f
- SHA512 41dff024c9dac642ad77c5ef4afc970e9082bcd530a953bc3538f02737c7c06bc89f9071e0f6b5ac0b3b6cd840375c1dbeced602eaefbde944f4bff18b2ac6ba
- SSDEEP 192:mOO+gxvno8vQzc0FrdGN/gbopEx6zxqcHO8YrRB++tC9cYE:mOzrdfbcu8YrD++tC9RE
- TLSH
  T155520E2151D5FC6217CAB3A1EB8741C1A7B24113F690DE853B9C8938FF435A6A3B72B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  mingw32/i686-w64-mingw32/include/c++/profile/set.h
- Size 11KB
- SHA256 663b5725bcae6b5a4b8db24ad72ba3a0ab26a6e31cec5206517d9ed53d3043df
- MD5 2b2d7b8ccba5906275314e7728178696
- SHA1 56ce7ed227e7ceb06ce8b1f9b4ce0b5797b59023
- SHA512 9b2c750410b128dcf8970935bba361237f0b6b7ba30fa4eba00e250ff2bb4fab15c468ec50744e1eab143cfc62eb1d0db95992c7f6a92873e4bc4b5f0fc926d2
- SSDEEP 192:KOOKSSQUHoa0Bvr5MI6qKE77rbIAzaZ++tC9cYa:KOCzvSuIA2Z++tC9Ra
- TLSH
  T19F32F06150D5FD620785B3A1EB8341D0ABB24153F790DE453BAC4938FF4356BA3A72B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3
- Target
  mingw32/i686-w64-mingw32/include/c++/ratio
- Size 18KB
- SHA256 62262afb9a713785030e8c78ba694bfcc4e9f36e0c6e12975714765019a3cf21
- MD5 08f0081a7169e58b2b154e164b6fe32f
- SHA1 c5d108cbc652e5423f7316f93fea7859f3d9570e
- SHA512 82feb73c359cce6c97a163672d66012b6e02609d2d034d7572559afde553afa8ba35f890ed6eca1bacb1cf447d684ca593888467e009a81e78d469589abbd435
- SSDEEP 384:gOaOf+UxDdrup7zvs3rOG0RhIz+CApL2vqlgT:gOfmUxDdrup7zvs3rOGWyv
- TLSH
  T13B8242011899C991457437B2ABC7A031C356B1372EC6D4C17AAE8FF0CFEB62253DA2B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  mingw32/i686-w64-mingw32/include/comutil.h
- Size 30KB
- SHA256 fa6631827a3d8438398c9282f45939573e135bcf1fa4fa46cd74f515bf3daf58
- MD5 8d339d4f94426ea4fca9edc93d2f7ec7
- SHA1 ca0aaa052c41b08304394e437b63cfa16825e726
- SHA512 6f54b7e5c1bf210135668ec6a40b6bdfdaf9f164afc9f1e9ef104161628907414f1533c7c7f755beb68b8df8f26dad7eb31ff213cda7179b7e521d18e028fa6b
- SSDEEP 768:R2Lcxv6uWgSUqos748sI3iZgVD7b7Lyuheyl9l+EqZv6e7YAb+I:Q+Sk6b7NhftpI
- TLSH
  T183E2EBC0C6E28C00B16227E4A98EE168705C655732ADDF64FA0E5278BF9B718B7775F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  mingw32/i686-w64-mingw32/include/d3drm.h
- Size 38KB
- SHA256 60c99d375afe873777b7c423a8fd939da0197080c57effc6b328d164ca004b8c
- MD5 25f020e4b04b5c921ca612fcc38392eb
- SHA1 4835299803f3f938a7b54e2f3e5174246b58f3d7
- SHA512 4870667f4da7e2d89177586abb7bf00778ab1a6048739d7184a165e79899ee4ca59ef86a074871663895e6a9dc7fedbe98b7a390938621b610bb9c310de4b386
- SSDEEP 768:HuSE3vN5u+88zfKtxptNtu488jfe+J6B4N3uni88FfnFGY:Hk3vN5u+88zfKtxTNtu488jfe+J24N3/
- TLSH
  T13A03AC4470C7594EA5F32B043D6A5F40D8C0D4BB9068A99D384E9F8D6F5C6623AFCA8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral6
- Target
  mingw32/i686-w64-mingw32/lib/libgfortran-3.dll
- Size 1.1MB
- SHA256 52b5446023d7217c3fc154f5e35ac3bcaf2b8a00dd549aad3bb65f59fb5997de
- MD5 e36b2eafa1941cf00f99304d8290ba62
- SHA1 c93fb40017474575e7bf69acbb65b5bef6fcc4fd
- SHA512 05c888300a019903cf1022d1509966a13dfae2ed240413f895ab6e8d0ab9ec87f98f9ca24a8f480eaa52dd9dd634b83842347f19cd79062f80a28b13da8cff85
- SSDEEP 24576:nbRO5AiXUlRd1mXldHmbI6Hurckg1WzC+liMmZ51cHYYcg/hhkfAkUhVuYxwlNVA:NAyT1mXldcGJg1QUFe35
- TLSH
  T1DE353C45FACB10E4E79768708156F73FE6209F064029FEFADB4DDB56F8325A34826209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  mingw32/i686-w64-mingw32/lib/libgnarl-4.8.dll
- Size 208KB
- SHA256 887e6caba6bfcb45bb3af951422e245ceb1766a9c58e67982200fdb0291803b0
- MD5 2aeeaaac2db25fb681fe862495bdcbac
- SHA1 856f44988f1b1e9234ae681556a9b1858cdfb441
- SHA512 6005caf72a51864443945d9080cd887d2e0ac8beac4ec90962d2d4b21208871f08aa6d7178384253f4cf780b749c322a944e087e76c7409ccfb0c5c234ea60c3
- SSDEEP 3072:u9bRShrZD62YTYg20PQzI2RDenRVylVdbAyob:u9bRShxlYTFIzIRnRVMFAyob
- TLSH
  T19624F850A7155CF2E5A3F33AD487D277C371F88416609A33EB9EC928D477382A602F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  mingw32/i686-w64-mingw32/lib/libgnat-4.8.dll
- Size 2.8MB
- SHA256 3b900ea953ab0919ddc04fa906d05a414f096dcf8b468331b9987aac3e1dd23f
- MD5 a1b38b153ce38f0c8ded3264e8402d10
- SHA1 5f29c9c9f5b4ca970753dbaf76697368e52da22e
- SHA512 feb4a10569aea76f26b33e9ec92349a39698350ac8ba72957dbfcad8d1d36ad2d50c72689991c5058410b6923d395b31709b314fd9c73f7e397b106b35c51f54
- SSDEEP 49152:KDcNGLIGAImIZzzQdiNJGbKLTA1o7hVvBj/ANLeeFZTMj6PLDK:KgIrzmsQkNwbKLTANLMjL
- TLSH
  T1BBD55C64FA4B84F5F5E3B971C55BE27B86306A010021DEB7FF1EE909E9B3A130B12195
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  mingw32/i686-w64-mingw32/lib/libgomp-1.dll
- Size 60KB
- SHA256 a3c29bce50533a3d58b9dff3ae231425ed28c15eda0e6568ee6c31762a211475
- MD5 40b78344bd35014aa6d7ea270177aec7
- SHA1 161cc29037414a852c79e0d8f7438044d73a0820
- SHA512 ad1e092967285bf3d67412683b6ad38c59a59ec45b4bd5231fb22db0909b26bb29cbccd2afc83ba0302677d25a5cc3f3984d3b69dfd944c8898b59fb8d8d7394
- SSDEEP 1536:NB92QkKaF3ZCSnAmsK1h9rJ8IXQSgclq1gUtpS5OnYckuNDR:l2Qs1hdNRLUtlnrNDR
- TLSH
  T1B7532B02FA179CF5F67393314A9AF67BC16166064025EE7AFB1DD39DB4330AB2806247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  mingw32/i686-w64-mingw32/lib/libobjc-4.dll
- Size 107KB
- SHA256 63dd4dc6d894fc1852803b5c69eae5c6bb1c5a9f037de1dbc9606e47d2789539
- MD5 97efeb28532718a2ccd039dcb14d743c
- SHA1 64d7176e53a8dca37c74de5dd8307aa32cf28bbb
- SHA512 2381c82bbd55307a14158780c93c0300d246fa89663d44b1399132ee1936d0035484ae2e0a2edac438636414945962dd1a5c6dda7ab41d63e6cc0dbf0c2e7dd6
- SSDEEP 1536:4xb7dPHig+ll6U2oKimfk+EzysHg6stmItoXZ8BrBtM/g/R6hhsiGe689UsKdjnT:WJPIyYtGBG2REhvKVnKW
- TLSH
  T18BB33B8E7A87B8B2E1AB347B49EDD336863A754304D1EA7FAF05B55C087709B8409D07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  mingw32/i686-w64-mingw32/lib/libquadmath-0.dll
- Size 457KB
- SHA256 d436a384f4e92b0c84a8820ce672ff4c0e239a7472f4fd30620bfa5d178b48a8
- MD5 d2a6525d3671805d6423fd172d5caa1d
- SHA1 e302e0bc124c3ad95dee6bfb4b92c4b3b313fc0d
- SHA512 290052831622995dea3366cd7fcd0a626899589c24ea3df3f32673f7b02490ffea92da6f2e21fcad4566395f241da362b92a59db1f986b3fe5d2adc49a8b2f71
- SSDEEP 6144:Ivp6kbAxwMElxiz1ynBu9ksAEQxyz8Jh9c:/iXM2M6u9AEs9c
- TLSH
  T1D9A47321FACF61E9F8170CB49157B22F4A342B098434DE74FF596F42E778A53816A60E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  mingw32/i686-w64-mingw32/lib/libssp-0.dll
- Size 18KB
- SHA256 33ef152ed0ecc1c295c71d50d484f4cc5881c4f4a2f39931d8ae08f2c02e39b5
- MD5 f6a4e344ad81e3ac30611985983f590b
- SHA1 4dd37a68936241e1c374ba9541af8a79298cf5b2
- SHA512 157f5ddc9e4d25eb86fe1ed489a7f2bcc360ba9023a52ef57b4ff363af3fbd8c438aab00a5c4f2384d22ae1b5e6c7a5b11f065aa137a0ce535fadd70d838b70a
- SSDEEP 192:9nQIjEf5zIKXJRi15JDTi5YYYYYYYYYYYYYYYIwmOtiO/xB1W8WQjfZowUNf8Yj:yz5RX30mOtiO/rsJQlo38K
- TLSH
  T1E082B50EA6028CF4E2A7F7744E9B9BB7C2697D2785256C3E7B69EB0CB47B0C61446101
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  mingw32/i686-w64-mingw32/lib/libstdc++-6.dll
- Size 948KB
- SHA256 48d32b83482cbec1b5ffca0508fac511fa32c2d217ab4ceee48ea491548ba0a7
- MD5 de4c043bc519c0dcfdcea0c082e0a237
- SHA1 5291f1f946550f888a4dddb31118b8b63acc5eba
- SHA512 9f0d07beb8d26e16f09e96bae8f4d2fc602adfcc0ae6cba3a05e425b7f638086f307db0c14e08e98b32abfa8f63c0d0849bb98ff14bffc17787a224af502d113
- SSDEEP 12288:XHeNQPLhxoY4aHDcsMuvfGdXJPz37hTaxb6mdo30b4TcToDSw3kfj4lmacMc1:3eNqhxoY4aIsMmfEdz37hTaxbBo30b4q
- TLSH
  T13125192AEB034DB0DAC3FFF5858FD73BC704AD6584255E2FBF5BC61462A2106680AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  mingw32/i686-w64-mingw32/lib/libwinpthread-1.dll
- Size 47KB
- SHA256 d2f6047c67fe36e0b83f7a0df17bb93d74c671d450ead2545235027fa2e22fb1
- MD5 ce3c27d07c6695c917b8543f76848da6
- SHA1 6b4d1f9d3c866f7631debc5c0f808cc0274d65c3
- SHA512 8d42bf6a438681b4c277540f74fc6020a66a8853bcd0fc62b94d7d514549750770e6cca4ae68cdb5c1334a8caefaff1d560c62ea8c99b23b591e1245d571cc27
- SSDEEP 768:p5B2Z7AlAt36Qdi1GxG/qfcRIrfGiYhvRKTO+m2hCcqakWNZi4cYY:fwZ7Vl6QdWycRoONhvRKK8Adak0Zi4cX
- TLSH
  T1A2231A45BB174CF1E46328705DE7F7BB8A738A46542D8D64E7A8E8086E3F962E20F045
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  mingw32/lib/gcc/i686-w64-mingw32/4.8.2/adainclude/s-taprop.adb
- Size 38KB
- SHA256 35596c4e254479d70ffd2256973d440f2048a9244e966e086362f3bd051c4456
- MD5 4b17e2444f40937e991937f3e1b1364b
- SHA1 b2dca80df18e8120111171106ef93eef746c7184
- SHA512 33b5d0b26b7d754a12ea5ce9e95abda05b28f060d28b0dbe3a566645b74dc89491aee846d5773ae46a81c9d9380f621e56e7d69cd3790e97afc5af75f2d1fee7
- SSDEEP 384:1Woy1j19t14x4ZlAiYMs1VPs+J8Vu7QyEdErze3JVu0iYXg0lzbFSupyEz2LKYoh:1Wr1j19t11wVl6WAk0lgupp4Kq+
- TLSH
  T17F0361075D1A167000B2D3BB77D620A3C7BA172F5708B15074DEC0E94F69B64A2BEEE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral16
- Target
  mingw32/lib/gcc/i686-w64-mingw32/4.8.2/include/objc/message.h
- Size 5KB
- SHA256 46a0411eb4d7644c0c1aa5dbdb7a7d060c766403049a18628f1ca4d6d8516245
- MD5 a82bd92a20c7d2183752a437a1783470
- SHA1 9ffc7827cf24c66b13e67804960c4ee1efee3467
- SHA512 0e25a768099f2632a87bf455c848292dde16b55d50cfbbbde515bd0f6208ec62ef5d55c525f05a7fce044a3a6a071b9e81f7e8a2b4b086afb3f0ba930dd5082c
- SSDEEP 96:ewEvowplZybjfscdMXw6XbM07Um/pxJVdk45G3Ns38zXBib:ewEAwplZybjfscdchxJ08G3Ns387By
- TLSH
  T1F2B1971B770F6373964612B7A38E10DDE35BC1ED629E98A15CD883642E0713243B36ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  mingw32/lib/gcc/i686-w64-mingw32/4.8.2/libstdc++.dll.a-gdb.py
- Size 2KB
- SHA256 e08d656770513d0cf23109ea38142ed1bdcbcdff4fb55f6158c767c92298fe27
- MD5 3ed8fdbf61ce698489b32c924f6be053
- SHA1 2f4ec4a40a23c3ad07f2f5558195ab73a27c2047
- SHA512 3fe7395c87e10fe8e512db39b1a5f0f5614e501dc2fc7da6ce985fb6196242c6741996a554fdd16c9257bf327c254e4abab8be3e9546caff993f1def75b9cb63
- TLSH
  T15241957A00D9A7F6A80103C976C641ED5687C3F77BF940887A9DE20E5F06EB802E67D5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/cc1.exe
- Size 13.3MB
- SHA256 362bc5eef5cf62432899a9522ff4bd4c2da19b95ce50c5b22b51a0c1e95b1eb5
- MD5 2c9336f09c4a5fa9ccc4afaa32001e45
- SHA1 2244a33c71da6e0c5a415bb1e5b591105db82781
- SHA512 2b7dff620c2b87dbea8ebb001da25f08518f8230bf8540db25ddc2c72b94af52d318d74a95c782b3084165967917027dd8e959fe011c0f661e9edb8998c8398f
- SSDEEP 196608:NvwHtBEeVxDZwwpnma9wjN2a6vC6us+5deDqTaD/JyDc6hb/A5sAwwTCjr+AHSxG:aNnDks+5deDqTaTsFgtIESAS
- TLSH
  T160E66A4AEA8751F1FEA71531928BF37F9B22B612C020DEFBEF4C2815F9736521019256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/cc1obj.exe
- Size 13.5MB
- SHA256 303054662b836c4a416ca1e9bfe64847913a99e330a6034395c04ed3b7d51571
- MD5 8132a89778d6843217402f8ccd2ff304
- SHA1 c238d03a284cc9ddf441788681f6d359872ce0c0
- SHA512 5d8acea3b851618ea200a6abe927eaf62bc945f606111c3d45e09e65491c7128ed8963c9863d54bd2f639292f66cbb7a69f15060825d17198dfefc0ebeb6d3a5
- SSDEEP 196608:sXdOASZ1MDKLhvVESpVARJGs+4V2vD1WoUatuQ7yVyDvDXwcVavDA5IWi/ZPPXSd:OvmyqvD1WoUatu3rDrwzfR
- TLSH
  T103E66A4AEACB61F1FEA719319187E37F5B22B612C020DEFBEF4C1955ED336529018246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/cc1objplus.exe
- Size 14.4MB
- SHA256 303b1fd9b9d118f992f3b3ff5aac479540b94c09b091ce5d50b1a6a888b136b4
- MD5 9bbc5b2ca2c909d8d61aa7ebe3fe43d3
- SHA1 9dd2700385188db815d56dc23535ce0c962d64cc
- SHA512 47e920dc90bc836083fd01e61729511157a06cd66f0a76f19265ab835c68ed1999b766db4364d7e0a52d1090a04414c5cf17b80097faa0aa5488a13165c7f6f3
- SSDEEP 196608:30xpBnRH0FtitzTYecRRoR8M+soHrbdHUUPTAD+A3cvG6n40Rh6mbSDr79qVzYbt:IUejc01aAi40Rh6mbSDrl/lbupKEq
- TLSH
  T1F4E67B0EEA8761F5FE632A319187F37F5B20A611C020EEF6EF5C291AFD776525018246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/cc1plus.exe
- Size 14.2MB
- SHA256 110f4a87e9d95d7b0146a44000fb06d7d9a16aaaa81c5b32a9f4cb5a275f9e45
- MD5 09e8f9dd302df6e4ea1846112d8ff78c
- SHA1 347b82cfdd6aaaaee927567d5a19f15a0b549a2a
- SHA512 c89b955a6887989d96c929790936b03f498c9a098d0483f1228cc9f12729789935b69d38141eec942c255992d34dea71b758067ad2ecc12a6fa48c86c3e35f79
- SSDEEP 196608:/XguJk35sEAqHIkFTmcemovISPfPVZ0IjNUBRlFfz+7c0fwqvhKpfn2rGQ5KhYzb:6pDfDiWcc0fwohKpflFEprw4T
- TLSH
  T103E6594AEA8755F0FEA719318587F33F5A30B602C020DEF6EF4D295AFA736522119346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/collect2.exe
- Size 1.3MB
- SHA256 bd5e721579ba858895d785e330424887d159f4f832f2571584b62ab469099024
- MD5 c16f468bb47cd3758e04136f5930c3bf
- SHA1 f99b54020fba6b770c276878702448f975576db4
- SHA512 5a2acc75673a96646a1aa95e0c9b71066db4ffae0222ce249ebc1a1dc74abc55c5152f1af7c2e0c6a60f3b925fe53b3efe04925d50eb6b55a9ba1082a4190f0d
- SSDEEP 24576:JFLKlDCED/SBnK2Roj+MBAUZLYbBlbbTmpGavkg3NyeuQ6l9fHufwj5+:2pNrSBnEBAUZLYbBcpGaXBuQQ9Omo
- TLSH
  T1BC55CF95F7838AF2F923857089ABE73F9122EE028A16DD77FB5C7B49AD337910444106
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/f951.exe
- Size 13.9MB
- SHA256 4511ea4df7afa5421715d5820d6752c9eb84307d53c87604f16d65721eb84be2
- MD5 2f7e9903637c21b9e267e7102603c358
- SHA1 99fcb7524d6e1c57e6a67f52cb30028f50ee8aae
- SHA512 26eb7e768637b1de1c73d3350325669ec9ea9adcdcd816d721c57f05d87c17cc936ebe1a69b395586a83e4c28cefc90f65c5d2254403136973f4953ff1ff2849
- SSDEEP 196608:fzogZpj1AtoRNp0RjY4+Rzr4DEJTYpjZtNRhjnIRx0q0CbZ9CbRczmxWa3yFeK44:L7VlJ0mZ9CbRczA1bch6k
- TLSH
  T17CE66B4AFA8B91F1FE631931818BE37F5A20B602C020EEF7EF5D295AF9735521119346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/gnat1.exe
- Size 16.4MB
- SHA256 37556d1548798bb35901578d14d4d93bf52230e3df0022766da98fc98c515af3
- MD5 9abc32629e1bea15a70323971dba9282
- SHA1 874e1cb3c4dcdde2a1045efac58dbd9d07423d25
- SHA512 94489605af5ad2f12204f6c7bc14e77a39cc7916f6f6ae9f71f8c27944c57876cfd8e4e5400614e4c91f811b0fad8bcd009006a19d3caa92010fc4b28a22ba27
- SSDEEP 393216:s3fw5Q/b4ztjJFvusxf3ozD7mRH+2mu+M:s3YIojz2VI
- TLSH
  T1ED075A4DEA87A2F0FEA719319187F37F4B20B612C421DEF6EF1C6955F933A522019246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/install-tools/fixinc.sh
- Size 18B
- SHA256 a25e77caa0e16d25d7475cf5e9a161717d26a3935f2119c99550957168a8f6a7
- MD5 e5936a434fd4b3f1345ba03f2b7b93bb
- SHA1 e34e2a11a161eee0e718338c27b1f97d4bead19b
- SHA512 0f47ad7354bcb0a930021f661394131e30031fdf789386a7a4bb4ecbb60a095b6d7125138ad8546ac4fa7411fec68d1d7ace0720cf093d135ff7b265df5d4ed3
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral26
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/install-tools/fixincl.exe
- Size 123KB
- SHA256 6089954d9fd331c92a11f0cb6120fcea96580fc5fc878147d74401ef4495d9a8
- MD5 494a9c53e5bfbfe9dfdea57fd8d6c9d4
- SHA1 bb637adb999540b3faa5e0fb927b344b4cd6bd90
- SHA512 3a5dcff5ae70c740593d78aad48270bbde1379e422eb851d13382fb39be685eaa6099f1535429a1615b0ba731c9e1b5fa7855b4fefc65b021ca0cd644f8d3afb
- SSDEEP 3072:7+2Rcoj5UXFbvcbj8PQVdH5G/h/9+263MPTFu71De98X:7+sZ1rJs+3F71DvX
- TLSH
  T1FFC34B0DBAC26CE1D1635171458B83BAC11BDD33B380D9FBF64E8E5D4D1F48618A7A8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/install-tools/mkheaders
- Size 3KB
- SHA256 570ff3a7c07c2dec317b878f860212568dc1a8cb37f15b7e98983872d09affd7
- MD5 64c06282087a53d18fae9c5f2a2ad082
- SHA1 a1ee8010ff61a778c89b88baca3fe9652f226670
- SHA512 1e5170e3d9b1a0b72347631cc18ddd0a537e8614f2b2954308186fb541eb45839d5b5f8d802daf0c5c8bc6081ac3c70526ae119ff043502c661ba193fa310cef
- TLSH
  T1095196ADF118D2B3200503F63583B285B16B859FA478182C351E97C4BB2AB7AD1FF187
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/install-tools/mkinstalldirs
- Size 3KB
- SHA256 e99c53f339aae38b0b2320d2e15d8a92ffe6028da0ab485b17bf57fda149110a
- MD5 766574f467c38d27fc7604ca8eb6734c
- SHA1 d64f0f2c65638246d21b402803e42ded5de40016
- SHA512 c01d3f3a86732a47e51e9a94b29803f0572fb6760a30e471f4b9008afc85c3d89753f1de82d499a6f9f0262d038604558d878ee3fc8a2efa68e650adbeee0d72
- TLSH
  T1FD713F09A124567418DE53B4279EB8A2DB62915FAB213839BFCFE3512F03124B1F5FE4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29
- Target
  mingw32/libexec/gcc/i686-w64-mingw32/4.8.2/liblto_plugin-0.dll
- Size 80KB
- SHA256 8dfdfe21f3c7089846444dbb4df47667554af3e80f71c2919b21babb0b63f7cc
- MD5 ec7c8c2c4fd39e929efa5a8c0d293e13
- SHA1 2af259b45c2d519390938cb3b92670a1ec1e21ae
- SHA512 8d120fbe5032ba77e7e69338edf00be3ff5fd6ad053bc8e177c1599a8682ae66f9e982292184e5c30d731bafbeb54bac57acbd765e1db6a13efb9f155920bba8
- SSDEEP 1536:rL4sBqvzCrst6dM6mGeSrtnCKQt1qF4WjpCnyHt6M1uJtiuHrCrPm:rL4sBYzJtAGGeiCK+1a4WVCyHt/uJTsm
- TLSH
  T169831A28FB0758F6E69359748586F23F83756B02C511ED7BEB18EB6CF5733A2580A009
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30
- Target
  qt-opensource-windows-x86-mingw482-4.8.7.exe
- Size 328.5MB
- SHA256 aa501a84095de814bff619b9919b1f1bd4b3921049814c4981c01263379f449c
- MD5 e44929c709f9a70df1bdc1f551c01710
- SHA1 ecd289c0272d7f55391acc0f7b7091bfd5dde500
- SHA512 09149441f3e22d45c27fc55cb83b9e6faad6fa8c1e19c0b20e39d83c958d2b3fae159d15738962f41d1fd531a93d2f7e00009174863c38243fc5cda1620dfe90
- SSDEEP 6291456:9tdoyIK+ZyMH/f+sKj83FNeA8xwoDz4e5sC2dFA/+7BQJUoXkAjm2aVI:9oy7+ZHesKj83Fxqw0zF5sC2MkBQxUuf
- TLSH
  T140F833E2B1EA475AD6705E3005A6D5F49B91EC78182F314B9702BFA4E236DC7C686CF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery gandcrab ransomware
- Family: Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral31

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Family: Gandcrab

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31