f9ed08ffc4be5bb22df952087413d0e0f98a1ca47b2515aafd2f50d3bcd7375e

Sharing

Copy URL Twitter E-mail

General

Target
f9ed08ffc4be5bb22df952087413d0e0f98a1ca47b2515aafd2f50d3bcd7375e
Size 8.4MB
Sample261002-yejaragf72
SHA256 f9ed08ffc4be5bb22df952087413d0e0f98a1ca47b2515aafd2f50d3bcd7375e
MD5 f2c3ad0c95502815dbd2ad0fe644bd7b
SHA1 a8d7ab636420712e881fdb972b3d86219e8045b1
SHA512 1dcfd50c40ada678d559e58fed2fbd816909d9510a199a12cfc5f2e6003b139768181baf85b52456447613a7654fe791db49cf76b52116adacf3596da6684ae2
SSDEEP 196608:6ElFhZHBiyFe9nHMFZVNnF5EHsCmWXbr3ZXkDv8DsSEM:6Et5Fe9sHbnCrvtb3EM
TLSH
T1579633806AC05E92D375F2B716254EF147D6D39F62A8BF1F1CBD23E1158ADA436CC80A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Targets

- Target
  DenuvOwO/runtime/media/driver_amd/SimpleSvm.sys
- Size 18KB
- SHA256 e07cbc3dbab8624940b1f733eaecc1a4eca7a66f09066b950b60c7b0a63cd08a
- MD5 eab73450573b7f04c741cef8b2473670
- SHA1 b7314ac48655abca7d8fceff519ae1e09173d47d
- SHA512 d88cbd547d1e67c10c6714e4d8490681e9121e8a4e35b91d17c06e81553c24f7ad4198de86fd153cf83f2feb93a5a9eb5bb8af4de12baa42e324e85c39ce846b
- SSDEEP 384:tnaH4wLTDK6ZoLze7qTMFdcRjnCpStVwCztxSd0eLt:RaH4wPDKXzOqTMsCpStrzyd0eLt
- TLSH
  T1AE825DD5B25D64F9C959C17CE2961323E0B0B4690B63E7EF846181982F2BBE07D3D702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  DenuvOwO/runtime/media/driver_intel/hyperevade.dll
- Size 6KB
- SHA256 8e5de6178e803624e2583601defb29e48de011ad0dd72315ca4abf8d76c25866
- MD5 aad200bc5d299d1bb198956eeb2cf4f2
- SHA1 57595348c59aaa92e76543b6fab539f3f15d3d64
- SHA512 85455ec600b169e11724500802ef95f768236e9bf62bbb69025f87083604240e855188fbbba5629859ef54d1b0e050670063b8c755e5b9ea959a94c2d95f39d6
- SSDEEP 96:zC2ifa8k/jeQMtjGjjlojbdOqgL42vYZj1cFpzwgX0xW:+2iiBSlavAbgL47SKW
- TLSH
  T116E1D9A6AA15E9F2E40B0B3C11D759163376F691079306DB35C6C0090C9BBEC6C38A4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  DenuvOwO/runtime/media/driver_intel/hyperhv.dll
- Size 525KB
- SHA256 d37be6db36845cc1e43ff2d2f267d04827c9d4f54d356d1e890ad8e66e23f2a0
- MD5 2f2947ea1c599da1302f134726d60e5a
- SHA1 f096e442a6d780a29e37d0558603196cd7d360cc
- SHA512 c5b85e94a4f9f103704957a6426524cacf152dbf70c66a4b736b2a4d540a7a5f24a1f852ca4fa99d42fc0111a0f55d8cd102a336dc6697056ec1191b54f00006
- SSDEEP 6144:RiJ1Ttb1+VDm7dWObG23uuGurUqLcowsEZyvUnrrR1Z:crxbqKCcuuGMUQox/Z
- TLSH
  T11DB4A4B7EC0474B3EC30613589E707AB267BA580976287C71659362B9D827D42F37F88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  DenuvOwO/runtime/media/driver_intel/hyperkd.sys
- Size 11KB
- SHA256 2adc6549d3a3274545f556f747f4f83f54bc5f3896d3899a2705327770dd3b48
- MD5 15fe0211002ad85ef7146bbb91f48be9
- SHA1 8ba37a7db0adc68f62884c1a16333c520bbc8be6
- SHA512 f0cb6ff4074cc5854aa1d1f08cabfbf16a20c3c2f6829c953443664ecc5fbbffafed9926eec7f6a9ad65d3727d2b94a5f741fd5de77ab95ee63072c8aa493e5a
- SSDEEP 192:V+Sq4qGmnydcI9U6mycymyJyJyC6AVJ+s6mwWAbgL47PKRL:Vzf7cI9U6mhnoQD6AVJlYBq47Kd
- TLSH
  T12742F951A39BECD1C91A827C81960C3E40A9E101D72707C79FA9D4B5CE8D7E16E3FA53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  DenuvOwO/runtime/media/driver_intel/hyperlog.dll
- Size 13KB
- SHA256 438200f9bf324a4f289afae3b55576739531f81b6a80c7586a24d0e4f1c3d219
- MD5 5c245861697bd5c13c10f7779b183e8e
- SHA1 983197d778dc7670c3e5ac8b502065dc8b4125b2
- SHA512 d082f4ffd7bd77ec76012e9c7160dde640f7350b1b84c870af71188e499fa2011f5a2aa2840f2ae3e317599ea5e0c9aab995bf6372a0fe53ef81d3165b6ebd07
- SSDEEP 192:HKCIkf6QZh7V77O7Tm5ITwHYcHyleUeaqyxU5tDvIesAbgL4762:H3zCSh7xO/mSwH5RUMT97q422
- TLSH
  T151525B1A714134F4E51F5A7991E71A2E9EB1B8111B2262DF257AC3BF4F26BC1323DA03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  DenuvOwO/runtime/media/driver_intel/kdserial.dll
- Size 30KB
- SHA256 75ea54ec02f58ec8ab9f015787fc2e7f66ee328b5c9729904fd8d9db760dbaa1
- MD5 0d988769f84e83c86f84ce854363e062
- SHA1 2a126541cf89ec4196a907c694ee6ecb5181600d
- SHA512 a7324eba36eacfa72628bb6c4ef41406a7889fa5a0e63c52765af01043536eeb28282bfd5478809d477392794740731b4b47a6138feda8f8117497f74447baee
- SSDEEP 768:5KRkD9uVFoZpRZ5Z2Pz7iePkO24lVvgA+8yfX0jxh6Ed+dycbcO:5QTofZ52PPkO2/AUX0TNdUyPO
- TLSH
  T1F9E22A9A22F424EAD559823DC9536D1F86FFF428131196CF0720627E5F23BF05A39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  DenuvOwO/runtime/media/hypervisor-launcher.exe
- Size 326KB
- SHA256 f0ae38c70c0e48661e1cdfce2ed191fa6032cb637b7004871786413c49560301
- MD5 bf62961f69381282b60013924b0a6ec7
- SHA1 2e319a23c3fd1e1d8be65cc7b4c894e5df790f50
- SHA512 97852a932bae2ac17998b7d3503044b9a4c32b38908a9b73868cc7d203fec6340be18c2ced587497229b488fd73617c9b828a47eeb8f17f9001052efee695c4d
- SSDEEP 6144:uuVoknXaZPeoDcbovTx2LDdE/29RZGhnd91D:uuVokol52vcVD
- TLSH
  T171645B03B64495FDD05AC075871BCAA3B627748A0B36B4EF1BE562343F299A46F3D708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  DenuvOwO/runtime/media/reflex.dll
- Size 107KB
- SHA256 2f010fc229a68bf1113e4a00faadb1c3a7147d4bcb501cc44c22def9581b032e
- MD5 03592252f7acd60520ed9870d727cd8b
- SHA1 41f2d5e222b91ae7f401bea14f4c50678eb070d8
- SHA512 0e6f1d5d90341648fff150a61f7badf8fc3ee4f3e85e2f0837471a385a9427f46a306c8139b3e8787c830b22e022437733a18a3030d789fc036683a493a63795
- SSDEEP 1536:99Ka0uplYeH32DQCAKQFk14cY4AcUK8dqGTqWFJnLVlSHp:9EbGdXOQD5cY4d8cGTp6J
- TLSH
  T112B33903F1A440B8C49DC275835BAA37BB76BC885621B7AF47E45B112F69F60AF0E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  DenuvOwO/runtime/media/steam_api64.dll
- Size 17.2MB
- SHA256 c2256febfa617f9bf52f98c651d70a0175fe2675db1b59dfb740a60df32a11ec
- MD5 057a38ca8dd48269356a0a9d07296726
- SHA1 8d7dac966ca5b7b1902eaf31408268fc63bf2544
- SHA512 9cf12de5e3948818a72a2dd6f66cdd477ed42413d5578848f7daf00b5e356407ee53906adf1de1a342e59f72743fcb1675f6c799960bbbbca79b58e277bd25c3
- SSDEEP 98304:GbtJa9WDkWuEskTxx3uMaApj9eFy71y+4AxYZgAE6EZDi7QZaoVarUVAqMS:ncswpdsFy7wciZgA72D8UfVF
- TLSH
  T185077B47E7BB11E5D6B6C03896B32227FA717499833097E7A6C056064F66BE0ED3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  DenuvOwO/runtime/media/steamclient64.dll
- Size 108KB
- SHA256 88800b33cfd02c3a3133116fcc4947a3fe2b968f64906e12d646bc15834ca3d4
- MD5 4757238d50cf1154b1899cd55e14b708
- SHA1 5aeebe1d36c6fb2639e01cd26efa4ba5dacdfb5b
- SHA512 ce66003677ad369f53178e89311cffbbf0fae2c2e7b3fd3038852c053adf80880768a70845c57607820694b15ab1392d78d04270b75ac5977ef49b88f9308f6d
- SSDEEP 3072:aQbt3HjsdsfOjWo2W8RjP2ZsdtV0hOGOl2rzSiJRC9:ddHjOwiz2BRz26Lezk
- TLSH
  T131B3165776E530ABE1A6C6749B773E05D3B6F81107619BAF03A0425A2F233D1CD3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  VBS.cmd
- Size 53KB
- SHA256 e5033ef1d49a3a1f38faa49298f407973dd2018c66eea651e233537bf3bad383
- MD5 4166480d1d83975c1995bd79196b410d
- SHA1 60a3858d010159f7eeba2132bd01b6f45859a53c
- SHA512 c1c75341c2a37bb82d40ae3f03a464c5d8b2cc2bc0dfb89022b57cd246d2a0d88a44d596a33c8f449e71fea331c60a13e644be81f891febf6f6c6768cb23d9c8
- SSDEEP 768:zhr25VF/5VFv5VFyu/23cyjsAdQIPLF0QwCdEqAI:zhr+tlMu/hyjsAPPLH9d+I
- TLSH
  T1A433B9223908146419B6B0776D63C15FF799C0C3C16296ED388EE05C7F7A09BA6F66EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16