c3f3e2c47370f19bd8824047b25ef6cd06738735579265dd39157e23c3dc50a3

Sharing

Copy URL Twitter E-mail

General

Target
MarmosetToolbag5.03_DownloadPirate.com.rar
Size 300.7MB
Sample261022-vmlt3aag84
SHA256 c3f3e2c47370f19bd8824047b25ef6cd06738735579265dd39157e23c3dc50a3
MD5 2ea825411fdf8a646527e39d5b2283b3
SHA1 a796acb1ca7f94b7e97a887cd26e84e2a1dad457
SHA512 babd0e3ceabdf609c3b53b6d70c2c852b20bd6ed3eb41f5fdb2bde28329f2fc5dd94cef843ab8b4d8960daa5da812e6737230510c8d68b1e9213e7ee3e43879f
SSDEEP 6291456:XkG8jfRxioILHNCYC2NBlrgZxudLqPshOdIuqnXMsq8y:Xx8jKNC5OlgjudrY6uqnXL1y
TLSH
T111E8231B326580D5F17AD17CD687AE07E7B1741A0321FADB1AD182992F27AE44CFE321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Marmoset Toolbag 5.03 (5032) Win/Crack/toolbag.exe
- Size 26.9MB
- SHA256 200e44b637b4d73a868647cf9da15994226a470f57a05ce1533d3a03883639dc
- MD5 56e6b7f4e2ba0fb9e706ea1b850eb4f7
- SHA1 3c7f397926e01233a0e406dd1720b1fa5f989769
- SHA512 99c7130137a086b17b9d64f6fe37434bbb63618dfd0cbf4682e20720eec3a8f8670ba775fc18f64279967e1397ee039bf58771bed00edb60242861e584f7f259
- SSDEEP 196608:X9+gmmBEBAFmLrkMP7MbNNo+78ut7aQKh9HJF+PAZZ4y5vAbWLeQk/yyde1WTP+0:tnmmBKSekMP7mNP4NF+2EyYe1k1Oc7z
- TLSH
  T170576C1B326550D9F17BD17CC6C7AE07E7B1701A0321BADB1AD182D92F27AE44DBE221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Marmoset Toolbag 5.03 (5032) Win/toolbag_install_503.exe
- Size 273.8MB
- SHA256 9d2d1a2afac267c4250b5fcb49a4d174b9f313884f079823e2d838b4a56172f9
- MD5 97373766f84d6a54ef3e09f973724489
- SHA1 955ac475a87e13a1892b1cea6860c23806e59de2
- SHA512 044266d88b2e1f58493c24c69c681c437295c954b631271d6d9e152073984d3e51449c4160279693feab2d5870646db7d133b1891c785ae862176d79d3bfc43a
- SSDEEP 6291456:RkG8jfRxioILHNCYC2NBlrgZxudLqPshOdIuqnXMsq8:Rx8jKNC5OlgjudrY6uqnXL1
- TLSH
  T1B9D8335517E1C4848156A23EB59B3B26FB027B1B3985FE2896CBD71FA08DCC02CE5397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence ransomware
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral2 behavioral3
- Target
  $PLUGINSDIR/ShellExecAsUser.dll
- Size 7KB
- SHA256 27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115
- MD5 86a81b9ab7de83aa01024593a03d1872
- SHA1 8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be
- SHA512 cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac
- SSDEEP 96:GFZf6PnleKYcBVGKLyhkrw0qyz/sRXQVgKXohw8FFtkqCp:Gnf6IKTAKLyGOCqQomItQ
- TLSH
  T167E1097A56D288A1E11E07746A975E7B13AD6A1203B00431CB471FCE2DF5456F42FA4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4 behavioral5
- Target
  OpenImageDenoise.dll
- Size 172KB
- SHA256 b0987ee4d02cde55789081d65ef1cd1fdbcc20a969bf59004ea7437cb0e43fc1
- MD5 589e7a694dcb23ce305be94484b2ddc6
- SHA1 c2f887424de89c42d5238a03726c5ada5279101c
- SHA512 e79e30525a6a2a6e168cfc8ddb32959b15bb5bca0e1006b5eb31509eab5de63519caafeb2e539786b0207e084be4fedc2c87c9e48a5e5d77c4e54a08ddee6b2f
- SSDEEP 3072:SuYhD0ZnD189HveBM+3X3O/+NX2R6jJmRBLg7qnunz72jIpMLR67l:kwZD1SveBd3X3O/+NBwRWqun/2pR67l
- TLSH
  T11C0495257B15A629C807C0B4D2C3556D2E7633CD4F35ABAB8F8793382E21BF46E6D054
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  OpenImageDenoise_core.dll
- Size 48.3MB
- SHA256 a22e6606aac7d270102b90e52397de2c7aec1e18b60f5bf018fe34d999efaa76
- MD5 e3f60f7e78ece8306327ac9e6b4ecccd
- SHA1 52456c876582db746fc76389590733599f6a744a
- SHA512 5daf893dcf9f143ac00c637b2925be88d724df25fa78ef533c0cc8aa24464137c55ccbee18673b8795db20f6293fb4d655ab7ee505194cc74856a1bc00db52bb
- SSDEEP 786432:fKak7kyL9hJp3m2+85IyOmQbVHrIMJOzetlecil1:gV9h22+YOmAx9YCt4Rj
- TLSH
  T1A8B733A332E13DAFC586C97DC751E87059A7DC3B8B47E1867485826BEC2EA24CF15B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  OpenImageDenoise_device_cpu.dll
- Size 505KB
- SHA256 43960c59bc344cecfb5d7f15394368a097dc1fcc165c9e675f38f9548a490ca3
- MD5 cb8028029ad7e38ea7ea72086b23c8f7
- SHA1 7944c14b304c793a084dcf6a224023d9e2d31d88
- SHA512 11699083be8a6d9f2453b0bda002452290b694b6d6b0205a655c9236f3f795c1d069b495c6e691555f7c8d8d16d54eb8c30b4bd3b210ad6e3a318a812982cdfb
- SSDEEP 6144:59EkyJemPxKUCL69Y4iv3/pesp0ew6Sb8T6iCHQDYoSeJNS80ZHlh9ZH7Y:59EkcxKTWYffONsiMI39l7Y
- TLSH
  T12BB46C2AF5AE63FADA47D0B4812A676CFD20755F4B0A16E352C3C1282D527E03F79E50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  crashpad_handler.exe
- Size 545KB
- SHA256 b6e80b90a8c5c9f877a8965207c2a843b232e0c684cf2688751a662f07e7faaa
- MD5 28fdc25301deb70bfb80067aa072e88e
- SHA1 a9144e20875adf79b8c1e65e1b619fab6ed7844d
- SHA512 30b6dd63f79481e3388929d7f28273e714dff696ed83eaf1ce47e26041aa8c635fa0560d457b59327568c6ac5ab6654f0a7cca4a73594a8f4f00f5a803bec9ab
- SSDEEP 12288:IhvJlWNb188k/uy7WXEN5epZjHNtyNDCnr6Cto:uvLWNb18v/5WXEN5epZjHNtyNDCnr6Cu
- TLSH
  T1A2C43A13F61511FEC49DC0B8A74BE812A5B2784A4771ADDB23848B322F56EE45F3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  data/d3d12/D3D12Core.dll
- Size 5.0MB
- SHA256 40c8ab6800e0d107b73564c3e7a53f0d307b601ad15055445a31ba0ff3a793a2
- MD5 bdc1a7301baf5bd1ab6d995b2d6b7dd5
- SHA1 8e1f5cd7413301e7a478f9788f16d666b9be5fe5
- SHA512 9abedfadfca6f670dd65c7f6d66eef0b595435cf0004c908672b7c26841a34a8dc134771a0c8e47074dc4deb3453ca8c3acf7ab619b449357faf52e172b5ddf3
- SSDEEP 49152:+sQFTCsFJsv+3Wn5J6Uu1Pvpb0TNQTp7BJehNu+Egeq0SpVSQNcJ057UUGjW:gT9sv+GWtTxTqAzd
- TLSH
  T1FA366B47B6E801A8E4B7D07CCEF7461AFAB2742153715BCB11514BE92E13BE04A7B3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  data/plugin/Examples/Adjust Render Settings.py
- Size 1KB
- SHA256 e42c862583625cc725338c747f8839a7cea25641f0321f5ea7cfb722a83ca017
- MD5 ee8bd0d1dd4adfc5fd71b243a34edd19
- SHA1 612de88cf1290e52344e16070a7ce683447da6b0
- SHA512 885e9599e65715a57840e120f3ad34f1925972a6350d9fbf632d4854a8b9acc6bb3ffffd127f1d3dcc89f663943dab1c4029bf127846ccd41fd6e34e590162db
- TLSH
  T1A431E32A9D47BB85087392FDE4056884C3551B37C039A494332E97FC5F3C76292C4D4D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  data/plugin/Examples/Arguments and Environment.py
- Size 517B
- SHA256 df111ca9b964ba377230af21e27a106c136e27bc6a2d56a101198e88a3efe9f9
- MD5 a86354cf47cc3ecd5782771242f87980
- SHA1 514c5e9310ad49089984cc0b0e32146aa5c27112
- SHA512 2c8492b5413b262cfc882a355659de0440dd17c3ef141464e555a16f0383c3e4dc149723e4cff499d6cbddf94bc31d2793407677d2d1153ceeacba661e8ee409
- TLSH
  T18CF00E022C5790E2807A6345C508EB340B330B6D22F2B40332A88239CFD6CAF0363979
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  data/plugin/Examples/Baking.py
- Size 1KB
- SHA256 566956821db6b3aa47534970334fa13ae37f58b6461a10e7e9ea9dae60f209ce
- MD5 a6a67434ea1c87c5c88e3c86ccecd72e
- SHA1 fc47101b307a80c865e193382a6b46077a724201
- SHA512 5a904ad1ee2267b04d9771288a607834ee97714d4c214a90d0c982c9d185265354fec12974b7b1e6435b02b61f1e3846f7fe3aff22cabada37ff5ef4785550fd
- TLSH
  T16E216822ED23FAA60EB205E89C7C932AC335D52344A35947375CB81D9F70A1731A2E28
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  data/plugin/Examples/Batch Rendering.py
- Size 2KB
- SHA256 98e2137144bb16190b59914db0a7bb629459bceb2c22fc1d4ef5fc1e3a082ede
- MD5 92ba6dc978e114040a75c61560b0ca3e
- SHA1 094b5557492fd80feef4bf62f46f510400c688e5
- SHA512 930d9fdccd71827d0a83789f929929c483aa8278d4304633a4a84c7d39af3c1e8d45aa85c6b22ea862535250a274ce648d86e7531d38beae9fadfe2ec3085a9a
- TLSH
  T1CC419B91AC2738D182B2004D6D0FED4AFB4782B78174A181BB2D81D23FF45D2969C7DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  data/plugin/Examples/Camera Object.py
- Size 617B
- SHA256 0112a8c208a7ee3d75d1201cc776760fc0f1a070f2e10649d03c6b911ce33efa
- MD5 53cc3b5c2a63a778ccab100bb735cbb7
- SHA1 048541a0425e8cf9a4cf98e15d7b6de0a4580704
- SHA512 9c0d098936cd791651307a4b5895ca1cc7b63661444ec6dd59329d0016c0dbe60a5d968813ce028696311a141d2319bb878a84c42f85d628555b4415c98f2c01
- TLSH
  T101F07D0B915F4E9D0FE1145028199A20EFE10065AFE348B67E6DD828938DE550832B3B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  data/plugin/Examples/Console Logging.py
- Size 644B
- SHA256 8636e792d522c24308903f739adbf6b7bcdcbfa3f2d2b307768e8a4b80b61184
- MD5 0668a3f2b21c61a6d42244773128f7bd
- SHA1 791965f447fc0a77167f110f6d17ce92935a3fc0
- SHA512 4b4922762fdd26027ec0389f43a6704294a2fa111c87388497ce50ec2c3ccc1992d482b66f348534759503703eaef25cb4e8bd61218e2c976ed559d24a072d67
- TLSH
  T1C3F0D801F68BA3FA103226C8C009E3A0A322483981F1F0F1B420C6ED9F328A345469FF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  data/plugin/Examples/Creating Materials from Images.py
- Size 7KB
- SHA256 46ca0ad57c129308d50efd93cbddd8d8ec3f2ae406e04c7dbfdcb2db609b4655
- MD5 3cb5cc0b0d84ca1799d416fce1b182f9
- SHA1 c41febf8abf9c6dd60361191a1bb87fe537c039c
- SHA512 509f9debd5f04975de4d555a9aee2867717bbc8c8774f2c48f4c26893498d0096aa8713f0d4d9a086b588570d31a2e9471ec5bd80361829651225026c08a7e88
- SSDEEP 96:5HkyLxbDQU2bG2OJ3e5GR5pZu5Nzdj6WMJtbDro:5RlDQUMG2OruLzItbDro
- TLSH
  T190F15237987E186607735236951DE989FB06C32F4EA79481BBBC904C3F31A5053ACAAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  data/plugin/Examples/Creating UIs.py
- Size 1KB
- SHA256 1b30527a4e9964672f53f96697bd9bf4309ada18e026a98e8d6e0fd84bd85446
- MD5 606d4c53c9b1ddcdc3501fc9ba177b5d
- SHA1 669e3646de98001ed6a9f85efd1b87adbcd8f686
- SHA512 038e0279a3ad58659d64ef50250d6608251f95548755de4f7dbbe5501c4bde3f560cd0e06f5e60101d8f281044d92a4f82fcd322d05c77bec375c924cef66ceb
- TLSH
  T1A8419B50703725D811BB24C8971BFF1DBC88A2A595F0E441741250CEF8F5AF3E66A4DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  data/plugin/Examples/Editing Library/__main__.py
- Size 1KB
- SHA256 67ac4170c9d7fb5eb884324162c727cc37789d1443fd4b425e54e25c692d3b59
- MD5 51f4ee73e2f5ff33bd71eff570a10fd4
- SHA1 e2acbc3692899c77c29c7c42f26f489524bb18dd
- SHA512 5d88edbd8465f4ee1092691b1f85b0e61e80df3b61111685ebd85ee9655e0bb6bdf5087c4b81871de5400e45a83143c68f6cc718ac16d09dc9141addeb350acf
- TLSH
  T1B62100D74A27642A02F18399198C18ADC905C26B5FA3DCDB7874546C36F3A465B39B3C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32