a11b1c1a42ee38232779b08d56959f1f1890f2858db679636ee8f594bd315db5

Sharing

Copy URL Twitter E-mail

General

Target
a11b1c1a42ee38232779b08d56959f1f1890f2858db679636ee8f594bd315db5
Size 5.0MB
Sample260930-v5f2jast8l
SHA256 a11b1c1a42ee38232779b08d56959f1f1890f2858db679636ee8f594bd315db5
MD5 8e41b3038e5fdec15e51c42b28dbe699
SHA1 9aaf163ec407be518e2ba8c2fbe553161146a8cd
SHA512 720170c88a88a01ac8e5e7a992e181b0a73892d00d62e5a151b817e6da0f3e20265f0b7e9421c60c991c296df41c06befc368be735db9b7f5a6cc9dd00bc968e
SSDEEP 98304:/REhwBw/OnM1BuohAo+Ww3N1xa26+YxPdXWKYdRUH5BZKt:mHOnM1BTQd6+YxP9WKoRUH5BZa
TLSH
T14E3633DC80D72D3BE593C57290005A06E5D6C4B0C6EF39391C4D99BB18C6BBAEEB5A4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  autoupdate.bat
- Size 15KB
- SHA256 6f888cf4cb68afa200ef74dde20b1354487ef20d11b72b897646048a12c3e62d
- MD5 880a54b81a01acaa580964209f1cbf88
- SHA1 24520893a55b657a269bac447c127f514e876b21
- SHA512 0c3bc0091a40fa75019ab22fa411f123c65863193743805d8b3d8092860e99fb2f00a0abcfc4e85eef63b6435ad3e8e451e772ab52238635a0152f2f81f63910
- SSDEEP 192:QW7Sc3vKVG0cBCm8wS+cA8UlUwT1c8HsW3JRzD8413WwuygDy/XfIpFpt/kK+8yQ:Q+SevKRUCm8wS+l8UpBFzQ4xzT/IN
- TLSH
  T1A16276AD2C13823406F2E675AA27DABDF312412B9661856C745EC2DC6F721C806FF2DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  helper/autoupdate__disable_autorun_on_startup.bat
- Size 197B
- SHA256 0569349b4e44e99363cc61170c3d0f76e2cb0245da3fcffc9050a892b8f2a237
- MD5 7fb1e6efe1e8608dab3b1eea43549890
- SHA1 5ddef036a577eea026616014f46b0db8cbd01308
- SHA512 901acd196c5dae4f54d89c4ef553735911c7cf6d1b19ee37fc7bf8c123f02efbd2c9d7b8f2fa4a53a7e6333bb6ec1d18fa266644f7b9ef209d273af1d13f28b9
- TLSH
  T12CD012A2411CD60692FB23F002D000B0600EC092513348E1341180767B7DE410C2F3EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution persistence
behavioral3 behavioral4
- Target
  helper/autoupdate__enable_autorun_on_startup.bat
- Size 191B
- SHA256 ed1634f0d2bc05be4ead480479938723c70a919125e3b80f9273c219bf246d32
- MD5 24d9715c7b22e358957d3d5a4a9d71a0
- SHA1 b9a9087794ef783fd00482e36ced8f4942784637
- SHA512 28fc25434d46f34fb692d4baad43b64cd50dc6790f087ecc7339d234ca143db77562bf603b9177a0eae104c4189b19eb218007e571ed2e7d7a0d1d29741f95ae
- TLSH
  T17CC012724118D205767B1BF002E011B1510DD012013358E5341040767B3DE010DAF7E8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  autoupdate.bat
- Size 17KB
- SHA256 2d7af99c2cf7e6b80056da5aa2e4a3a05a9e307f53cc8995c905de766aa054fb
- MD5 4f56be2601ff22a20971cdb15c2b08bd
- SHA1 5cf40dc712a3436e4509c8644c30ac6c483ebf3c
- SHA512 8b3f0348a58c6dd385dce6cd471382e2176bf599509a6e8f291993f662018837cdf1cf36920f64839c3f25c392d8d9346e9b7d5106b65d862a57f70a0bd0da5b
- SSDEEP 192:B9Szd80cBCm8wi2cA8UlUwrH1c8HsW3JRzD841f8tuqKVYB3rP7TXfIpFpt/kK+Z:B9SzvUCm8wi2l8UpL1FzQ41GrJ7IvGr
- TLSH
  T1FD8294B92C13C23906F2E6749A2BD9B9F312412B9261896C745ED2DC3F711C806BF2DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  helper/autoupdate__disable_autorun_on_startup.bat
- Size 197B
- SHA256 0569349b4e44e99363cc61170c3d0f76e2cb0245da3fcffc9050a892b8f2a237
- MD5 7fb1e6efe1e8608dab3b1eea43549890
- SHA1 5ddef036a577eea026616014f46b0db8cbd01308
- SHA512 901acd196c5dae4f54d89c4ef553735911c7cf6d1b19ee37fc7bf8c123f02efbd2c9d7b8f2fa4a53a7e6333bb6ec1d18fa266644f7b9ef209d273af1d13f28b9
- TLSH
  T12CD012A2411CD60692FB23F002D000B0600EC092513348E1341180767B7DE410C2F3EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution persistence
behavioral10 behavioral9
- Target
  helper/autoupdate__enable_autorun_on_startup.bat
- Size 191B
- SHA256 ed1634f0d2bc05be4ead480479938723c70a919125e3b80f9273c219bf246d32
- MD5 24d9715c7b22e358957d3d5a4a9d71a0
- SHA1 b9a9087794ef783fd00482e36ced8f4942784637
- SHA512 28fc25434d46f34fb692d4baad43b64cd50dc6790f087ecc7339d234ca143db77562bf603b9177a0eae104c4189b19eb218007e571ed2e7d7a0d1d29741f95ae
- TLSH
  T17CC012724118D205767B1BF002E011B1510DD012013358E5341040767B3DE010DAF7E8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  autoupdate.bat
- Size 17KB
- SHA256 9b295000f29ad57ef010ff7c845b1a62715d706042b47f25714bea45f3807ff2
- MD5 099268c6ccb11db81e4a455ab3e20002
- SHA1 17303211ad7b31ad3821fe311559713d5c638a7b
- SHA512 20f46066620f86da33d5424b4d67d6be45cbe45531af97a9c3d0d274109576418427d3305d3c293de79deae2d27ab6ea2d2c5cd68cbe2833564e1e6cf6017be5
- SSDEEP 192:BdSzVh0cBCm8wi2cA8UlUwrH1c8HsW3JRzD841f8tuqKVYB3rP7TXfIpFpt/kK+Z:BdSzEUCm8wi2l8UpL1FzQ41GrJ7IvGr
- TLSH
  T12C8294B92C13C23906F2E6759A27D9B9F312412B9261896C745ED2DC3F711C806BF2DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  helper/autoupdate__disable_autorun_on_startup.bat
- Size 197B
- SHA256 0569349b4e44e99363cc61170c3d0f76e2cb0245da3fcffc9050a892b8f2a237
- MD5 7fb1e6efe1e8608dab3b1eea43549890
- SHA1 5ddef036a577eea026616014f46b0db8cbd01308
- SHA512 901acd196c5dae4f54d89c4ef553735911c7cf6d1b19ee37fc7bf8c123f02efbd2c9d7b8f2fa4a53a7e6333bb6ec1d18fa266644f7b9ef209d273af1d13f28b9
- TLSH
  T12CD012A2411CD60692FB23F002D000B0600EC092513348E1341180767B7DE410C2F3EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution persistence
behavioral15 behavioral16
- Target
  helper/autoupdate__enable_autorun_on_startup.bat
- Size 191B
- SHA256 ed1634f0d2bc05be4ead480479938723c70a919125e3b80f9273c219bf246d32
- MD5 24d9715c7b22e358957d3d5a4a9d71a0
- SHA1 b9a9087794ef783fd00482e36ced8f4942784637
- SHA512 28fc25434d46f34fb692d4baad43b64cd50dc6790f087ecc7339d234ca143db77562bf603b9177a0eae104c4189b19eb218007e571ed2e7d7a0d1d29741f95ae
- TLSH
  T17CC012724118D205767B1BF002E011B1510DD012013358E5341040767B3DE010DAF7E8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  rdpwrap-master/bin/autoupdate.bat
- Size 51KB
- SHA256 1a1b684e681f813d04f2dfe5c7e38286fcb1548091f3d4bbdafdb2309615d02e
- MD5 c6b65f0cb9ecd3a5a4aeb0ee930c7fb8
- SHA1 fa1a88948e92d3f7fbeda08ba42da74563d7c0a0
- SHA512 fee15d76b4cd5624f962eb7f47e27790c405a08a86126df075b33fce659b9902d9a005fd18ffb7c8206309b02c35bb270147976142fb83d17946b91ab073fec3
- SSDEEP 768:2SOZ+4+H5vxkNPmQe2oPiTRdW9818fGnQOUwZgwCVrGDIdTycfPYWoeb77EwN8wG:9+NOMOrGrWo25m9F
- TLSH
  T1CB33B46A3C42F27005B3D5719A1BA46BFA65526B4624881CB81DC2CC2F762DC52FF3DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  rdpwrap-master/bin/helper/autoupdate__disable_autorun_on_startup.bat
- Size 197B
- SHA256 0569349b4e44e99363cc61170c3d0f76e2cb0245da3fcffc9050a892b8f2a237
- MD5 7fb1e6efe1e8608dab3b1eea43549890
- SHA1 5ddef036a577eea026616014f46b0db8cbd01308
- SHA512 901acd196c5dae4f54d89c4ef553735911c7cf6d1b19ee37fc7bf8c123f02efbd2c9d7b8f2fa4a53a7e6333bb6ec1d18fa266644f7b9ef209d273af1d13f28b9
- TLSH
  T12CD012A2411CD60692FB23F002D000B0600EC092513348E1341180767B7DE410C2F3EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution persistence
behavioral21 behavioral22
- Target
  rdpwrap-master/bin/helper/autoupdate__enable_autorun_on_startup.bat
- Size 191B
- SHA256 ed1634f0d2bc05be4ead480479938723c70a919125e3b80f9273c219bf246d32
- MD5 24d9715c7b22e358957d3d5a4a9d71a0
- SHA1 b9a9087794ef783fd00482e36ced8f4942784637
- SHA512 28fc25434d46f34fb692d4baad43b64cd50dc6790f087ecc7339d234ca143db77562bf603b9177a0eae104c4189b19eb218007e571ed2e7d7a0d1d29741f95ae
- TLSH
  T17CC012724118D205767B1BF002E011B1510DD012013358E5341040767B3DE010DAF7E8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  rdpwrap-master/bin/helper/cvdump.exe
- Size 957KB
- SHA256 7e643d8de5eeafbf88df8c1543824ac7ccf4fefab8560bee9ddbd45f8564692a
- MD5 fcdb51ced35a8d679e91b912b6838433
- SHA1 53f3834f1076defcb5ecbaf93427f236f5435498
- SHA512 1da1a9ef6141b59d6d4c217f72d3173b67c79fb7f5a3bc2eea7d61ec40c69aafa8bbfa3156b6258ea8518943446c38eae3e7c4ede5c00b4359f97288f66968f1
- SSDEEP 24576:LC+0000000000000000000000000000000000000000000000000000000000004:oZrw7+GAzdCZFREZ
- TLSH
  T1FD255C31B8944134F8F22132DDF9B5BD79BEA631273846CB638409361D215D2AF39B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  cvdump.exe
- Size 957KB
- SHA256 7e643d8de5eeafbf88df8c1543824ac7ccf4fefab8560bee9ddbd45f8564692a
- MD5 fcdb51ced35a8d679e91b912b6838433
- SHA1 53f3834f1076defcb5ecbaf93427f236f5435498
- SHA512 1da1a9ef6141b59d6d4c217f72d3173b67c79fb7f5a3bc2eea7d61ec40c69aafa8bbfa3156b6258ea8518943446c38eae3e7c4ede5c00b4359f97288f66968f1
- SSDEEP 24576:LC+0000000000000000000000000000000000000000000000000000000000004:oZrw7+GAzdCZFREZ
- TLSH
  T1FD255C31B8944134F8F22132DDF9B5BD79BEA631273846CB638409361D215D2AF39B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  rdpwrap-master/bin/helper/pdblister.exe
- Size 4.4MB
- SHA256 951d7fac932c5544a171a1652186e304db24ff05291dc0c53bb2f52469384e94
- MD5 3ce485184bfedc8174374a58b0000385
- SHA1 10eb1d7882c6be0c9c3dd07b44f066b40698bb59
- SHA512 5f97ff2145636dc0cfe3af9e02b255e9a80fdf473114b7c188f0fe6b94c0f9e1df8957492a48154b29029b1d85fb83805459b8bd59858edf1d439edc459d24c4
- SSDEEP 49152:Imf2y7XR4xZ2SU7HZbcKnxwpUkxHOTJWBRIuUVwapqBmGeG7QTtscj5jZdxvV+ad:nEXN0s5cCr
- TLSH
  T1FF2628217B5A99EDC05AC074C3864BB25E3570CA0B35B9FF448496783F69AF42F3D298
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  pdblister.exe
- Size 4.4MB
- SHA256 951d7fac932c5544a171a1652186e304db24ff05291dc0c53bb2f52469384e94
- MD5 3ce485184bfedc8174374a58b0000385
- SHA1 10eb1d7882c6be0c9c3dd07b44f066b40698bb59
- SHA512 5f97ff2145636dc0cfe3af9e02b255e9a80fdf473114b7c188f0fe6b94c0f9e1df8957492a48154b29029b1d85fb83805459b8bd59858edf1d439edc459d24c4
- SSDEEP 49152:Imf2y7XR4xZ2SU7HZbcKnxwpUkxHOTJWBRIuUVwapqBmGeG7QTtscj5jZdxvV+ad:nEXN0s5cCr
- TLSH
  T1FF2628217B5A99EDC05AC074C3864BB25E3570CA0B35B9FF448496783F69AF42F3D298
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32