20b9998d959f71e2ef1085c25f8eca4b24d9c7e69d2806d295c8615b0ce31075

Sharing

Copy URL Twitter E-mail

General

Target
sasuniviewer__94180__wx6__en__web__1.zip
Size 631.8MB
Sample260930-ysdmestgqa
SHA256 20b9998d959f71e2ef1085c25f8eca4b24d9c7e69d2806d295c8615b0ce31075
MD5 356b8ccd362074ad2335aac9083f1218
SHA1 d63d3d0cd5986040fc05ba62e5a7eab27b503939
SHA512 cf937ea90947edc36fb2b5f665a3fdd2996a5506c2bffb4cc252bb5cf849205461c963bcb799946d6c13db47cc904ecc2043c0371577fed43eeb26fda8009053
SSDEEP 12582912:9iLvYVuZ9ZU8MQ4/tYTUZQx7sMseQbZDiUsl4XTJ5nzET4EOB1UyRcZQkIutv:gYVU9Zz141YTUZQNb2Zerl4TnwT4EOBY
TLSH
T1516933FBF33EA827DF4E753390C28796FC226AE95284AA25F7046E0183546E15717F09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  products/cfgwizard__94608__prt__xx__sp0__1/Config/level_root/SAS_lsm
- Size 21KB
- SHA256 c7981511fce38026bf1077ee94ea163a7d60f152f75a2cb77b17276c5da77c11
- MD5 65d2f503fcab7035ff610a9fd7e21dc1
- SHA1 9b4c1e4647f37ecce4f54a970e8c5155ae933196
- SHA512 8c5f7690052c100f3c48e33e076855c8e770930c021a59919cd6da8a03747ecf2dd07d0b5a5a15035951ca7243dee5daf99598798322edfcd0d07a3d939da23e
- SSDEEP 192:hvyaJYQp8V3aAkAKMxyszb4cBaUSjDidGSHdNn2tFItDLGg2KUQGUNrQY7hdRu3D:VyaoXhq2OItZNMpT
- TLSH
  T10DA2C954F79C1DF4681042F26AABA4427C7E070B805A385672EDBAD0BB7052DE7F64BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  products/cfgwizard__94608__prt__xx__sp0__1/Config/level_root/SAS_lsm.pdf
- Size 1.0MB
- SHA256 b986269f19c57aa55e395315b5137f457d052d6f6f891427c15372dea77b55f2
- MD5 55cbed527f2d942062811057e1ab7032
- SHA1 e4e940d5db384316e7618dfadd30b05e70d2a6b0
- SHA512 2ecd387e683658699fb6107e0c1dd8e0cf80a39ba1d974a80e8d0bd2051d8a02deab01dc5f6a44dbed57a7ca4de7f670e466515df3954dde65b8ad9ada5f0938
- SSDEEP 24576:w2/Kd5eh9M2GL1KmBVG9l9BGVH5jhGVnswH1:F/fG5fVG9lkH5jYiy
- TLSH
  T1FA35E034485DBDDFC78653F0AB0F3EAE792E72B2E1D453060328C74215A4A7EA85764E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  products/cfgwizard__94608__prt__xx__sp0__1/Config/level_root/generate_boot_scripts.sh.unx.orig
- Size 28KB
- SHA256 350bf89e9742cded5d7a02a23acb9df5ce2516bef5086aab316da036f88b4177
- MD5 e566e36c55908c4b9cbe4cc7333d0d48
- SHA1 decf58ce08765a5cda3605efd9f78d68262c2f32
- SHA512 6e8895717b52220e83ade9d6e6b206684c52776d4888fca3d3fe93fb368a552e5a8c94aeafb9271bb046a3bf4ad2ce5d963f98bb1575405b756f65074c0d0604
- SSDEEP 384:9CrJd/wabxqlwkZ5g/kp52H9PO11uYdSPM8OBjQaU1J/VmJQwPF6ZLoxQh5jH3ZA:4rsGY6jdW11uYiM8kQfn0Qk6mQhVHtA
- TLSH
  T1B5D2B523A945D67B0B0B00A5275DB44C7325405F4B24E0EE3B9CA92B7F6594C42AFAFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  products/cfgwizard__94608__prt__xx__sp0__1/Config/level_root/generate_boot_scripts.sh.zos.orig
- Size 21KB
- SHA256 bf29e8791d48586238668b11554db5c5b8bed2f27d0921ebae3d99bdd94cc190
- MD5 540bf82d7cce92e2fcd7710bb92da2ff
- SHA1 572d380cb640cadb3062a65ec2ecbdbb53b4505c
- SHA512 822d6022c0abc53a7af3c7d37cb460d2eaaf90cbc701a7a9dcfa7119021bcbbb025ccc76064d5f95b68e8c5f7494594e76cb99984b56af7c70b596d94a78d08f
- SSDEEP 384:6VF/wabxqlwkZ5g/kp52W9+O11fYdSPHf3yuQMU1Jw0QX0iLoxdhFjH3ic+o:6kGY6jAH11fYiHHQBTQfmdhx1x
- TLSH
  T1A2A2B712A945D17F0B070091260EB84C7325806F4770E0AE7A9CA9777F75A5D42AFAEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  products/cfgwizard__94608__prt__xx__sp0__1/Config/level_root/script_templates/sas.servers.mid.template
- Size 21KB
- SHA256 6e92bb1b09f4e805e1bbe1f18c85ec392d5daf6dc3a1fe1672d1fcd94029027f
- MD5 4152b3468997142313eb899af2501904
- SHA1 f59d13715fef88219eb55fea113ba4f2c4f9b122
- SHA512 8225ad6df072e6d2f0088d2d9d4c15e56de690a893af137ddab13d9d815e48369110ad45e635755d6e51250a8dc749978f8fa8bb07c185b8343e2d3bc1148ca6
- SSDEEP 384:Q0gMf28E2eR9tWKAmIK13BxmLMflo/2jSmLO2zHFHbX28L1E2eA728f2evKQH284:xgMuwKEqI8oUjrP7hbma1RYpJQWc7WZp
- TLSH
  T10EA2631AEA4589B92D0C4434476D744E3309C04F0F74BF117AAD9C623FA8697B7F4EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  products/cfgwizard__94608__prt__xx__sp0__1/Config/level_root/script_templates/sas.servers.pre.template
- Size 38KB
- SHA256 03d4f163bba0eb977c22c6305c166fc9dfe251e162db93072e8fe3445c65c62c
- MD5 bd57452f71e7f587d81928bb83da72ba
- SHA1 023972e911a6ef85b0301a1b83b87a775aca9253
- SHA512 55b9df0458d76dbcd7c94cabff3febbbcaf32b74489db4c98ad4898e3a533c5bcba850b7ab2cab7ce689779f0e1fb1b6ea15591fd9aeadd80f14e58da593484c
- SSDEEP 768:2MXf15V8UmkFwgwlxw478Y78qtGIr3rTahbcj8Eyhe9DQMEze+gP573w59VwLU8W:795K8Ibk
- TLSH
  T12C03E151F9484AB81D8D40BC4606E0087705E4D708E8BDB67DCDE8A13F6A689FBF4B79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  products/cfgwizard__94608__prt__xx__sp0__1/Config/level_root/script_templates/sas.servers_aix.prolog
- Size 2KB
- SHA256 e5670cab3019544689334044b2dc77f5fabdc570a2c242752afefccfc2492196
- MD5 c1f25a7095ce6f921f48cd05a8117db2
- SHA1 e134eac006ff8acd2d4d265376f75e91bd879755
- SHA512 e49338e1a274a21430e1b157e6488f5114edc34810dd006da21a7cd0d307e5f57af7aef4e91b8a6fb3082af23344cfdc0eb07b88bdafa27f698b332900774515
- TLSH
  T10B516553B6258B731CD103516A1DB2EDE31D91BC035071A67A8DF619232A79E583F5E0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  products/cfgwizard__94608__prt__xx__sp0__1/Config/level_root/script_templates/sas.servers_hpux.prolog
- Size 1KB
- SHA256 96e0e105d4a7ab23b95f2af19655e8b8fb60537387d05369b631d6ffd1fa8158
- MD5 b294b958304cd274080ff20b569b8c23
- SHA1 1ad37fba6e88d489bd311c137d234f06c4d149ce
- SHA512 e16e4651bf36ebf307ca91b5a3305dc6112be206e00c24046c34e6778ec01f64efe49d0b1333f0196066ac370a2cb3646c4fe0d37842d00afda773c40232e3f3
- TLSH
  T1BB416117BA0647771E110392645FE6ECA70C507D0660F2287DADBA16231E7BD293F9A0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  products/cfgwizard__94608__prt__xx__sp0__1/Config/level_root/script_templates/sas.servers_rhel.prolog
- Size 2KB
- SHA256 f70b88aa909860987d0f692a46ee12653f3c3b092385bc1066fca0e207799437
- MD5 0b5efa1fea4f688d899dd26140d0626e
- SHA1 73b56292dad682b38e6bd3bfa4036da4a3099d28
- SHA512 a949a67295098e095b619fd061c94bf189234cec2bad9702bceb4bb86e1047d94f2ec7759f04a9f320712698bc49c8c2975f72d46c19a6603a5a77f6ff89781e
- TLSH
  T193516407AD4A7E7B0D960752A44EE6ED371CD2FC0661795835AD3E00230FAEE1B2E5B1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32