ba71e77d6420255775e32755d254466a08fd900b9ddd82a331aaa9e32e09a192

Sharing

Copy URL Twitter E-mail

General

Target
SeaghostShield-Setup.exe
Size 44.9MB
Sample260930-pay1zatt4k
SHA256 ba71e77d6420255775e32755d254466a08fd900b9ddd82a331aaa9e32e09a192
MD5 b3ee7cff95f4cbc0239e7d29bbc5a37a
SHA1 38b1915f8645af004dda4fc04817e7f655747a40
SHA512 474bde05fe3e64aedd20daeeff7b4326bffbdf6e06683b0f4b060291ae900fb4e85cf93b674272c5795a471833403d88ed5f50000045aa9e388ad57571d28239
SSDEEP 786432:QwSY6KesV0qqhlokOzr60h0huRYRTPBLaaRgXyuVldc/3SOxUXVaWS5fq1vgxBTe:Qen7VDdVapUYRTPcaoyWq3SOeIWS5f4T
TLSH
T193A7338D165EB794F1A41B3234B23419593C08648F6FA48F69EB379EB1737C838963D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  SeaghostShield-Setup.exe
- Size 44.9MB
- SHA256 ba71e77d6420255775e32755d254466a08fd900b9ddd82a331aaa9e32e09a192
- MD5 b3ee7cff95f4cbc0239e7d29bbc5a37a
- SHA1 38b1915f8645af004dda4fc04817e7f655747a40
- SHA512 474bde05fe3e64aedd20daeeff7b4326bffbdf6e06683b0f4b060291ae900fb4e85cf93b674272c5795a471833403d88ed5f50000045aa9e388ad57571d28239
- SSDEEP 786432:QwSY6KesV0qqhlokOzr60h0huRYRTPBLaaRgXyuVldc/3SOxUXVaWS5fq1vgxBTe:Qen7VDdVapUYRTPcaoyWq3SOeIWS5f4T
- TLSH
  T193A7338D165EB794F1A41B3234B23419593C08648F6FA48F69EB379EB1737C838963D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 db6b3d7276c551221d55520dfc94acc175d2dcd7370ade38a667bf0fdf6a9cfa
- MD5 d04a06a05a6aee6b49baf107edc1eebb
- SHA1 7c74c9317588dcb9004746d288caa82cf788c0ff
- SHA512 3e7ce0e10164f1c80df102066cf2338498fa0e35f425abfb698a1a1dc95c1bb6460e2e5c2c53a7a5d3843bb4480308cca35ad23e852c28cc9731941b85ba6c88
- SSDEEP 768:0S7Mk5dmwtmKInwop3Rrxv8UeqYFahSTmB9K:z7Mk5d5mKIRpBqUeqyfk
- TLSH
  T135D2190AFA42CCF3D072D67488CBF63789166D3AA72A4677FE6F4E197C27650590D102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 5683357273097ca8641a98e3590e4e7b75c972e1063299a1429abdee2d2b18d5
- MD5 b6c7dc4ef7032f11ecf005eea0724655
- SHA1 059e5da3c9458cbe95f458f139c23f04c20b16c1
- SHA512 0206f6f8295f02dad7f54dc656a448bdd5fcdd17cf38ca23b024732274e01aa712d8c0975948099c6c5803d946440fa1b53dde29e71bcd1082f61ba20b1ac909
- SSDEEP 192:qlWWGk581HwPf5G/QocFR1w5kYkv/RelBBoiE+6SZS7Emk8:ZPk5Sof5G/QocFR6OYkvUlBBoij4T
- TLSH
  T1A652E50EFB0A44F6C572D831648BE72F869DA415C66B4E06EF170B0CBCA72B5281E745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 10KB
- SHA256 61f0e47b09316d39979c62a05403a3baa3ee58841dfd97cc00fb4dc086843815
- MD5 aac4f3facf83975d0cf2b02200ae8212
- SHA1 8ea89129df40923951610b6f003c10ab7c5cb238
- SHA512 b0d4a5f2c129ac39e55ee20ffcf8fe1306b0ba791ec9ade8249a3304e091941476a032089e22a7e1ffb709f6e0a591d026091707754a387e147fcc6af996336a
- SSDEEP 192:CCtx8+SjrhYnUMu3Oad9z3Ykv/RWwCh3srduaO4:vx8+SvhYnBu3Oad9z3YkvcwCh3srdu
- TLSH
  T17B2296C9BB0579F5D0639934B18AF12F4DA97C31CA2B840EE89A1E35B82F5E4571DB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  SeaghostShield.exe
- Size 51.2MB
- SHA256 ab3dc33bb3bb80944211ecdcc94bd810ddd9ea8a2444a8a875d22ac5415afac8
- MD5 45c4343afd59f5cb2adb608b548a89ac
- SHA1 0b2a92a8dccfa40c267dbb4ef3939595041a21f5
- SHA512 29d088b6211b1147cc4f20b119a9b39fcebd1c1be9cd647221271aebf5711dd42cc0bb75f42f09be3955795d6165c900f4b908482ba7e2b6f44e252655410f0c
- SSDEEP 1572864:keryp+4F4AndVy2UmXrYGG1rallkcRfASAXF:keG2kryTWr/G1ekq5OF
- TLSH
  T14AC71256E2FD01E8D47AC0B8C6574617EBB234551334ABEB22A48A252F37FE16E7D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10