73c814147f750df69495027155641d9c6807138ff9c9dc248aa1933dabf442e9

Sharing

Copy URL Twitter E-mail

General

Target
SANALCI SETİ.zip
Size 998.6MB
Sample261002-vb22xasshy
SHA256 73c814147f750df69495027155641d9c6807138ff9c9dc248aa1933dabf442e9
MD5 254a3264e72327bcb3e4546c5b578022
SHA1 8b919734c50744a355407859735833cd50eeea4c
SHA512 049975fe2f8767f8091a7fe043ab095654d71801bbf1f14e545184132b87548645df96a0702b63d5f58e4de083acd2029255598b8332854b746f5ec1df9933a5
SSDEEP 12582912:W0eSZ5cM6T9wPdWcLV+k3HY2UjHjzGRalWadAhQUtQrgKBL0TEYOpkwok75BwP:WnSncgdWcht0DzG1U8Ro97cP
TLSH
T1D6B93348B7F96634D264F8BD1436833793357492BAB0CBA7FF725897438AC86CB65240
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CARDİNG/CC Cashout.pdf
- Size 196KB
- SHA256 f558c433b2d617606b49793245b31e9c1c6d229bddfc10bd85e1a21cb23a456c
- MD5 19384c1772281ef0212756ce008b66e7
- SHA1 f545706892ea071349365433ff859e65204ec5eb
- SHA512 5ffaa10797c4ced68208895e32b4c85798661ff0b89e187153aa32c9053e33233ce475e9f407e1c2fb77645a2846862e776498f296ec8b0932592bda70133ff9
- SSDEEP 768:tOH2/rJ8SGuw0WareeeeeeLEELIAE3333gXbXQNzF7wllh/v8q0xhwWCijd0t9:IHe98jt0XrVXgzFUlIwW/mb
- TLSH
  T10714C0D0922E1CE4EB809AFE1F79B0866D4DFF07DAF549F71079C9960003EB096A9359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  CARDİNG/CC EĞİTİM SETİ.pdf
- Size 459KB
- SHA256 441b8b9890438181ae095327d3ea949e00df8c493ff206a1ffca92f687ad8ca1
- MD5 11308e127d08075573462016c35bc1b2
- SHA1 c40972d59b28267ab69af81c7037e1b81adb42d8
- SHA512 57d3177bc03862e264eebea25029e6d0998f8fdbdbde5bd5a1e5fb687a9fb048306ea06f096a5b5899db87ab24adb730bb577bf8204144f66b3682fe6abdead4
- SSDEEP 12288:VjkcbYEiXguyRWJ8I+bIyqy5EklRWPebMB+h:Vjkc0EiXghxBb7qyXlRXlh
- TLSH
  T151A4E06088ACBCDFDB9A87F06B5F7D1A302E71A2F2E902A90364C74A4560D3F591715F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  CARDİNG/Stripe Üzerinden Kendi checkerınızı Oluşturma.pdf
- Size 1.9MB
- SHA256 d7d9829b69bda5d6013353cc94e79682943ecd78ee86169998e2535579b4da0e
- MD5 c70877ce1ee5e331318d4da5b68629fe
- SHA1 2d31ca72cdbff6757af30fdb739af18b5f83b0f5
- SHA512 225830c4b6c0b539d83b1d2abc6b9a946b0561de23f99bf5f8da0d95a5596b9e987b48a0074cf6287f1b9b45d124ab47207b13f80bda8a838f1d29ae0a742cdc
- SSDEEP 49152:PgQvtV1Lpr302b7KhhE+oAuXtWAH0bcquQ/chLkH0:PgQvtVxR30A+zE+GXtHHyuQUhLN
- TLSH
  T17E952214A1BBE8DEDE9B46714B1F3F933A3BB032E1C50255D370D29E4841E3E661299B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  CARDİNG/android ile carding rehberi.pdf
- Size 124KB
- SHA256 d0dc48ae002726880a3ebd9693452f5a7d8a103fc03caa26af5686188ef95886
- MD5 59b60e148c0d97a0502ce7890f0ce397
- SHA1 f0e5554be97fab00368eca86126f651deea714a6
- SHA512 071674fbe46fdb99af3405c04438a5f51a5eab1c7824317fb748552e93fb232f796f028eaf7a9c865583784c68334f00659b81bd48883902ded5981a0c6e9f8e
- SSDEEP 3072:Jq2DTqBlvmI7dH7AEIMaRbeD1muVseFOhHa+3:Jq2DOBm+dbAhMOY15seGaQ
- TLSH
  T127C3DF60A1CE6DEFD76687D0A72F7C5E34ACB222F6C213981225C74A4030ABFA51755F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  roslyn/Microsoft.CodeAnalysis.CSharp.Scripting.dll
- Size 32KB
- SHA256 c73df52503a4290120b5894b32c6e6e75e563568a010078936d75f4438f20b59
- MD5 06f99470ebf9055fb95907ae782d8a13
- SHA1 ca9052e0075b7a32c07677ba58d5e0363391bff3
- SHA512 1241bead8a39ca9dfc0bd1b17acf6d841e8439e20a58f042e18f94034a57a9dc282a824448c5caf447b1eed63770cc8bde9f3be1105b962d62f3466b42a00440
- SSDEEP 768:rbxWUfTF+8oD5Nfu3WX2AmjKSZPZ9za5G:rbx4DD5Nf0WmAKKWzj
- TLSH
  T155E24C96C718824BEED65A31396EF9A26E3CB3C258C1D678355CF98C1713B904F1163D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  roslyn/Microsoft.CodeAnalysis.CSharp.dll
- Size 6.1MB
- SHA256 dc98e2308ea0ea762100323c9d0f9844df0636721bff28ad1e62fdbf83e69870
- MD5 0f6c6282a200b4360c80c909ce835bc5
- SHA1 cba54b18cdff3c217c7d87f3c703965fa5bdec94
- SHA512 39ade4945b74be18d7f000df08629019c4c9ba5f803094a5e681db47c26d7721441da6f4319e26eef90e052d6e6253cb0397a8dd88f0c97c1a9361fc6c51029f
- SSDEEP 49152:SjbVp53TBcJbx0NGi3lqNTG9rC2fOyyyvXCK5BgR8X22MIoXk2ZLbKRTxXog:SF3Tc0NGqjLfOyyyvXCKQgMXCxYg
- TLSH
  T165568C05E7D89F2AF5AF4335E4B3250697F5E8844362EB8A250CB9BE3C477504B092B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  roslyn/Microsoft.CodeAnalysis.Scripting.dll
- Size 133KB
- SHA256 84d6b03ec75343c38ec947deac0b92a56e11fe246151807a424d82e52b091254
- MD5 25f740d42a8538d61dbc507d6a412c83
- SHA1 980deebc57ef0b750b7a3e53731a66899bb6231d
- SHA512 86908333194ed0e7e823f6c5238830b12f76ffc30b71c92ffd8ea1e2f8873aca0c9d38f41f6963f70c57439863d1109bf9cfecf90d48b7968d915ad448f9e19e
- SSDEEP 3072:cLLACAGLGV8EkThMzqsi2YWT4wrCD1JmoDC5Kaklue0W79M:mLGVkTKzqQYafrCDrNLliUi
- TLSH
  T177D35B6063AC575ACBDF5E7AF2B8B0051B76F303E542E78D8C08B9EE18537A05912673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  DARKWEB/Darknet OPSEC v1.pdf
- Size 394KB
- SHA256 ef0f331a34a7edfbf1f5770a85ece30f1a3c3dfbdb64bf77df5f64ddec9112c6
- MD5 bbd4aa7aef5da54cefc5d74c13642b98
- SHA1 152cb7b709007b69c967b46c908a5b49142cdfa7
- SHA512 a6bfb267abf8a1fdde7685e4eaef48008d0dd172eb1a3adb79dacdef5bab2a972699631333c17bdf613df9b0f21a20a3e8b6e9c195149efba9913f1d6c8ea21d
- SSDEEP 3072:uY3XDAwG4XmZpGnKK707hA6iH+esI4CxqUrto2nlPnUr6idS+TyYJN7S60qJPSSH:NXDAwt2bAZ4EH+esKxqUBojTD
- TLSH
  T17D842060D5658D8CECC6C67EC079383D4A6DB26B7ACC7C84012E8F61B00578E9B976DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  DARKWEB/Darknet OPSEC v2.pdf
- Size 3.4MB
- SHA256 3268ffd969d2c5a3948fb26db6fe4df4040cdbf8386378905b21d0429d3a037c
- MD5 5cf20975f4ca96bd994d2e38b46ac72d
- SHA1 b477128260194f2dbca0532d08a177216bfedb91
- SHA512 f87d73df2278a62b61968a5391b8444b6404802655680b2f7679563a713798e350d7538267bc088107fedb111f42ffdc385fccb1db5737785d5cb8dab1a6ca5f
- SSDEEP 98304:WALJKeO4skDJfHGbRaY4zMIn3uwTYJd7Nduo:WALW21HGotYInjYHf7
- TLSH
  T1D2F5C0A0D5668D4CFCC7C67A80393979469DB2AB74CC7885042F4F61B009B4EDB936EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  DARKWEB/ÜST DÜZEY ANONİM OLMA REHBERİ/ANONİM OLMA [001-017].pdf
- Size 1.8MB
- SHA256 78cb78b79b3a361ada7d3940593ef6a8e4d1bbb0dad3983fa74b3619c6818839
- MD5 05e7bed1649a9e73f129e3d45e77f76c
- SHA1 5101180afbf6d63a59ccf9c06d326ee1c05735da
- SHA512 59e4e9e4100270e0dbabb243f9b18e58de096b63b5446e28a4902d2216765e3bddc900de5ef3adb146048f08cf3d1869de758515e4d9dcaf9e40a077214bcc4c
- SSDEEP 24576:o9ZJJCCtUHQ44Cx/zrMPlbY0dytW0zauLJlqlDJxsvHO1p:o9x9nc3MPJjyE0muLLmjsvur
- TLSH
  T12085D534E21D21FF8E4BC677AB1FFC881B29A0D1A76511BA330D62669B83F1D8D67054
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  DARKWEB/ÜST DÜZEY ANONİM OLMA REHBERİ/ANONİM OLMA [018-037].pdf
- Size 2.3MB
- SHA256 f7945fd59158fad9171543b4b81e2e282997b800bcfb98a2b50d95d92f710050
- MD5 d55348cfebf985c30380552c59483878
- SHA1 53940e8332103915184c3673ade3cf8705b58e4a
- SHA512 5ea8a6921619dd12ec24fa62602a8bc0d36a2a3f234dc907e5364c56809cd1610f8f7ce0ec95256ee6465ab75ac78613635dcc3ae086be349ca929cf0e8c9d6b
- SSDEEP 49152:P0U0U0U0U0U0Ip1Z52t0FGmtavod18ZC5CSkSHx3S:P0U0U0U0U0U0Ive0FGsavodOZC55FS
- TLSH
  T13AB52A35725E22DCC247C677E70FEE881B2DE1A6336561BE114DB236DBC291E8EA3054
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  DARKWEB/ÜST DÜZEY ANONİM OLMA REHBERİ/ANONİM OLMA [038-089].pdf
- Size 3.6MB
- SHA256 d3a1fe36c528f14b0f35967f0149043d3b7456e087f073e3f42d01e0eabcc9f1
- MD5 14cf5b27b948caef271c1bbad7cdde22
- SHA1 6c7f46f239adccee0d7a307ac58ce5bddca6ed4f
- SHA512 5513196af316693241ab73e5cec5ddfb7cf458e4dd71124ed3d17b8dd7484dffd64f37f150e84ae410cfccc897ca87f49009251cd0b959878ef7d9e3978b963e
- SSDEEP 24576:xBAEs9ZkxbyJqK7K6ZqXiWf8b7I35PaZriVOYILWZSE02VjyJYTy0C8IQmBoPWPJ:xBAx9iRiKfbEb7Ip0CxC8IQRpRheFuf4
- TLSH
  T189067235725E22CC8657C677E70FF9881B2EE196336561BA124DB236DBC2C1ECEA3054
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  DARKWEB/ÜST DÜZEY ANONİM OLMA REHBERİ/ANONİM OLMA [090-124].pdf
- Size 2.8MB
- SHA256 14884c4159ec440a12e2408e6e9182bf94bddeb446a0164fd48d2cca40f97b49
- MD5 e511f90524786ad4a780340725647151
- SHA1 3327044a44e92ccc074eeed209bfe3fa639696bb
- SHA512 7a76f6faa592c1d3dea2a0e773c9b1fa68070785efd35359b0480e540d7b704f9207584ea6e27533d9f81686d1aeb54a86706cf83a0c7b46389b158480b81bc8
- SSDEEP 49152:JWiFx6fExLZJwRBl+shdddGAoF95vyGQ4he3:JWiFxRx2ashdddGAoFfyHMe3
- TLSH
  T149D5D635725E26DCC647C277A70FF9881B2AE1E6332461BA110D7236DBC3D1E8EA7095
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  DARKWEB/ÜST DÜZEY ANONİM OLMA REHBERİ/ANONİM OLMA [125-162].pdf
- Size 2.9MB
- SHA256 9c19a69543e9ffb6646c127c86b295b68d48eb95a66aed1ded0a89f2347dfee1
- MD5 24392af241ae094fbf5cd97b4582f1ca
- SHA1 12bd2449bf7d059e731c9b3349d998425aa9db3d
- SHA512 a1e693ba9455e24b9103d5c84aaf29b06161e8d21d0dad336aa211bb9ee7d97f39a707915153f8a77af04dbc60481bf4b93d62da6e45264ed5988e2242b2bda5
- SSDEEP 49152:HkjpxZ+JXD7xggx86m8VVMhW1/pheQCsvr:EFxMJXD7xNx8BKtdeQCI
- TLSH
  T194E5B639726E21CC4647C277A70FF9981B2ED196336521BA124D733ADBC2D5ECEA3094
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  DARKWEB/ÜST DÜZEY ANONİM OLMA REHBERİ/ANONİM OLMA [163-222].pdf
- Size 3.6MB
- SHA256 27cd4a7fa397571f303674c0e998f36cefa8a17ae71eeea6823f5028099b51b3
- MD5 54b6ee320925d38344e66a6fabf6383e
- SHA1 c613fa3179c15f2588dd0c5cc202dc5e23300be9
- SHA512 c2a1db4ffce6e8fc5b2b3b745226711880d46791b1c716fc3481be0144de6d191cb8f80d409819f6f25359703f8c7c581ae7e82d9199c5ac0c08ada9bc8b21fc
- SSDEEP 24576:tM6ugeTXqdoGgkJaE15HeEvsZhZp0FFz5SD1RNBRirpbNM/xdQSVzdr820Sdgk7o:tM6xueoQv8oM1RNr1VVSYMyGPAThep
- TLSH
  T15A066235725E22DC8747C277A70FF9C81B2AD196332561BA124DB236DBC3D1E8EA3059
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  DARKWEB/ÜST DÜZEY ANONİM OLMA REHBERİ/ANONİM OLMA [223-243].pdf
- Size 1.9MB
- SHA256 54826519fbbbc2bb45741878558f87e20276bb48b16750ba36b8551746a6d01a
- MD5 4dca0c46e423b26fb94816858b93fce5
- SHA1 e263f81e3e52b82e5b304bafe56983de7282e7cf
- SHA512 ee55a906e9d91c3da74ac69b9af5d98786850c36475ad7c71b1cad16557b755b38dfcbfd424b83e80f3cf2ef1b640c1b527d9515c47fe4dbc4c83e90aaf4423c
- SSDEEP 49152:9AMJKTNOLF2WsekvvQi9BzvZh5Z06heiU:9MTNvWBCZb2CeiU
- TLSH
  T16C950A39735E22CC8647C277E70FF9881B2EE196736561BA514D7236DBC2C1E8EA3058
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32