ee30c697426b28b5a804096183eb80e3b4a6167f54d47d832eb7b77b2703b761

Sharing

Copy URL Twitter E-mail

General

Target
Froststrap-windows-x64.exe
Size 17.1MB
Sample261006-vc4l5assft
SHA256 ee30c697426b28b5a804096183eb80e3b4a6167f54d47d832eb7b77b2703b761
MD5 5c174414c04903ca8e3e765aa44b1f2c
SHA1 4b7f0c6cd6bbfb119910d7ccd860fc0447663439
SHA512 8e2d15fe7ac9f65ad3531b8a8874099556029ae24f99c16b6fef3d4aa4c41df65629567eedc7bf6431b357cce5a1985ece0ca7985266900526f8776092afd811
SSDEEP 393216:eAVjJy5UjJGpsZJinIX0gLbPGJMYI5wZR/LOf:Lo5qeuGy0Oq4f
TLSH
T1D307336CF20A7496E212EFBD63A7B242CD044F21DB888D17E77A392474FA711191B7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Froststrap-windows-x64.exe
- Size 17.1MB
- SHA256 ee30c697426b28b5a804096183eb80e3b4a6167f54d47d832eb7b77b2703b761
- MD5 5c174414c04903ca8e3e765aa44b1f2c
- SHA1 4b7f0c6cd6bbfb119910d7ccd860fc0447663439
- SHA512 8e2d15fe7ac9f65ad3531b8a8874099556029ae24f99c16b6fef3d4aa4c41df65629567eedc7bf6431b357cce5a1985ece0ca7985266900526f8776092afd811
- SSDEEP 393216:eAVjJy5UjJGpsZJinIX0gLbPGJMYI5wZR/LOf:Lo5qeuGy0Oq4f
- TLSH
  T1D307336CF20A7496E212EFBD63A7B242CD044F21DB888D17E77A392474FA711191B7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 34da723ffa683311cdbc98fafdf963f8793f681d02a47c1419a1f1584a416dcb
- MD5 c9dd2491b3cbeb7fee4723ebef1d81d8
- SHA1 4c534568a7a1734282eb62ce09ded92afea1836d
- SHA512 a0fbec4a01646f10ff7ed8078401097f30f6a342ff14a5eab28016612980eb8a563e3b59ee35fefbea2613e13a33f7410e5685036ceae63121a0d5685b01ba7b
- SSDEEP 768:PEkXzxSnoTw4+8F4p6doUbt9qCCCCCCCCjT9:DXzKoTw49I6d
- TLSH
  T157D21E1CF91284F5D433A2B5C0DBD63BD9249A1985611D17FE7B0E5CBF672909E2E302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 2222fe1337f1bea92bd0859cb5fa19e838e0c08ba3346147cd881956bbbbfe50
- MD5 e39cb978003fb67f11cf710fb6fc2088
- SHA1 bcb131591fefac731621785b209d9cf43579a3c6
- SHA512 564f00cb20c23adeecc607e00be20c488d037108fd1cb666e1d31f2cf0f2bd044c7acc566452043e3d7483d3402404c850a78afc24742a7eec760916511745f0
- SSDEEP 384:+0dUl5kStC//1RRhUhiIklcCCCC7uv417:+cUXalRRkzCCCC7uvm
- TLSH
  T1C262B50DBE1189F5E571D23081DBEB3FC1A8556BD55F0E0AFF760A0C7857271A92EA02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  FluentAvalonia.xml
- Size 473KB
- SHA256 c453697df25740a22a8e12c02ce270b9203ba7683e53951075d6f1cea153692d
- MD5 eec08478185ba952d146c29bd317c272
- SHA1 2ff2ed5b85523a7c858d5dc48aaf55e045eb44ea
- SHA512 85ff989193389cab09ef9f5fca4ff4297df4293b54784e3532846816099ef9fc41ce2de7aa903e3c085aa59142cb74a12000d6289c871c126d58f5885a0f46ae
- SSDEEP 6144:DRPyGoulsBsDisiMiKoTP+E4TphDZDisZwOiGF20u5N51nR3hErruxsIhQyWK3jD:W1GU
- TLSH
  T1AEA46B92B6C95F301C724256AA74B5CCEE8A48730065EE1B38CD7F970FB1C9272EB465
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  Froststrap.exe
- Size 66.5MB
- SHA256 351fd2417d5bf644698e32f57328fc366736077b9ea47fab8f450091cc907e5f
- MD5 9454e645e8b4a3293f33b0d211894a35
- SHA1 a933c92aca461bbff4babfccadcd2fadb20b23e4
- SHA512 d050a06a1451a9e77ec5a57ea8e606a6dc1c6b426967c6f7d02abfe13c64070c67260bd243acb932a53fb6fc84928c44d7b24bd2a97dbbf589fe1d696fafc90b
- SSDEEP 393216:SUs/B77rsRY5iybyoc8QYLeA09Bw5lQN5AGUipol1DVjgjrFMxE:IsVuNbVmBwrQ7pfvFx
- TLSH
  T17CE77E0973D88A29C47B933852A3410256B1BE1AD711EFCF358C75AE1FB2B805E77B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral11 behavioral12
- Target
  Froststrap.ico
- Size 98KB
- SHA256 d6c4f9bc0ac7861972bef3b9c20b29159c9621ff9e9ba6c512fcbf78164fe652
- MD5 c19ea220eb9b500ef86f8716d02cc18f
- SHA1 a3364c72e86e44039050da3b881578aec9b59d29
- SHA512 67b989925a66351a91049d4705797a2aed10151f77f907b01703e2ddbda9f4baa462c7e67b8a3a9b4187be5c5b8875c5c4ff352aea1c3d3a0bdeda7c1e4c6b3b
- SSDEEP 384:GOLepQdI3WXquZrrWoEKfJcMUb1Ty0Qce8cgnhvk/FVnqQ+fVYDbTX+gHO:GCekbZVPfJwZTVQszncVnqQ+VUbjTHO
- TLSH
  T1A2A3F28EF800299AE066CFBE53233506AE569F51EFC01D1B2A34794179F2342153B7EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14