46f3743ffe481f87721a440cf6ede6c101b01dd5251705b8585dd86906b1dac8

Sharing

Copy URL Twitter E-mail

General

Target
alquerez.inputbuffer.geode
Size 2.7MB
Sample261023-r2jfpsda98
SHA256 46f3743ffe481f87721a440cf6ede6c101b01dd5251705b8585dd86906b1dac8
MD5 3fa003b56077eeb61e27bb747b571c4a
SHA1 e2b9a9b39906108ba70eb7d3c135f02eb05bf404
SHA512 f4eb042a282d0e8cbcfb4de0048741cabe36ade441011f5b04cefa6cf183640a7ec73351444acce5dc0a042cf14ddaaae75bf5542f7f94e28b08221ba5a9702b
SSDEEP 49152:6ioMq+T6fPem2uBbx8ZIcfntAFGSOiAe0df5UpXDXCYoesmjEZxSGvmeVK3:6iEu6fPemRBidntAIS1Qf5GTXCZxSGo3
TLSH
T1E0D533E2A426D194D607841E23108DF26E2FB4F7D57AEC125C7D809EEABA517027C7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  alquerez.inputbuffer.geode
- Size 2.7MB
- SHA256 46f3743ffe481f87721a440cf6ede6c101b01dd5251705b8585dd86906b1dac8
- MD5 3fa003b56077eeb61e27bb747b571c4a
- SHA1 e2b9a9b39906108ba70eb7d3c135f02eb05bf404
- SHA512 f4eb042a282d0e8cbcfb4de0048741cabe36ade441011f5b04cefa6cf183640a7ec73351444acce5dc0a042cf14ddaaae75bf5542f7f94e28b08221ba5a9702b
- SSDEEP 49152:6ioMq+T6fPem2uBbx8ZIcfntAFGSOiAe0df5UpXDXCYoesmjEZxSGvmeVK3:6iEu6fPemRBidntAIS1Qf5GTXCZxSGo3
- TLSH
  T1E0D533E2A426D194D607841E23108DF26E2FB4F7D57AEC125C7D809EEABA517027C7C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  .geode_cache
- Size 142B
- SHA256 0f217b285c0fcc35482fa748458937eb83c0135ad105e83d0a878f4300ddcf3d
- MD5 d3423291900e8d4b04b71e85dba3c5c8
- SHA1 bfc5086e2db99a41c6fbb6288e325094a5eef0f0
- SHA512 1dd6174bf0a6280e13dd2e45c63648d4df9f76f14ebaddf5bf83080304146255584d8b84de861071e90205795e4d3a383ececc6523cafc8c2ea4147dd3b36d70
- TLSH
  T18AC02BC60881F0900707E00D8003FAB7C7714812C3140EC45DF11491F1F30CC4190F42
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  about.md
- Size 1KB
- SHA256 885f9b6086ba03590ef3df3d00f5349b9d88a3104f6591a12699048c6d0d958f
- MD5 7314c18cb3fe7d86ae4bc7e6bd11c15b
- SHA1 46311f88b932a6ac7d603080c7aa4dc97dc86233
- SHA512 45b022efccadec047c742ac1ce31123afd011319d50a74dd4eeb086ea9b730c2c4814fff953b70d4177a32a914ea490170cb0f9a9bbbea044c095a41739d987c
- TLSH
  T14B41471B6313A37A40B2006232DD31E5BB2764152B3B3ACD649C790C6F989339ABDDDC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  alquerez.inputbuffer.dll
- Size 1014KB
- SHA256 14210d3163f513cf4d4ba8083c7100e1e368c9434589b19656ffefb56cfb8f1b
- MD5 8a6fc102543b24d5358215e229742ef7
- SHA1 d0429e81283a4c8455fcd4bbbc13a78d53ea0bf6
- SHA512 4551195eced04f899a063dfd41382ce6caaabb11f60740f421ca20011bbca08e2b8283d872a00f1966f246a3a94f1197a355ba88273834641fee44ae3a5f131f
- SSDEEP 12288:7Vj992kjU0UUddeNe4tgiSz4L3s34w3Y/gdu:77QciUqU45u4w6R
- TLSH
  T188255B1A7947A4BDD886C4B4525BA8574A2174CF0B35BCEB03C4A6383FBA3F45F39606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  changelog.md
- Size 41KB
- SHA256 1c3032ea52d0226229c85ad4ea073419a59f14d642b9c82938f0d6b3e93bb219
- MD5 bc7030cb22e25a1baf77ba6a146b6bd3
- SHA1 80a9c90dfd3203791d31405fae326ed1527bbfb2
- SHA512 15afafbafe94b16f71cf2b2bedfe795771d6d4ff764995e49279aac7c22436c06930c9fd7b9de43271851322ec9fd6fd3e758d11dd4c70e27368602a8b1b654a
- SSDEEP 768:EUmfCkoevyb1kgSmHd6lGvyVGpPCBDMfKd6QCRcP:EUmf3Nau+HkGs0fQ4cP
- TLSH
  T1FC13C56B735123361AB31133B38EB2D7F72540B9A3275664A89EC01C7325D3A5AB36DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  logo.png
- Size 69KB
- SHA256 682161dc30855b8c9c1ff4b8d1c70fee39e4637a4d24d3266a7bf979329b378a
- MD5 ff567ab21c9d854ad803c49f608318f0
- SHA1 5ced0ec84dbff7246e98b305fd2288f31973a3ff
- SHA512 2b95ec97f3e90b5e0833da372dd55f2ae71051dc9d267a5f4bdfd56f4422f6b81d95eeaef40ae521bc588038a25f1ba0c607cbcfde2df12666eae9a7871b2781
- SSDEEP 1536:TSVwDyzP0aNMpS4019MCBZh+N8jL6S04odHUTmNDmrQEC6:TSVYyBES4OMCLICjL6uoZuEDmMEz
- TLSH
  T1A06312FA1A4D81EFA4E41D08CCA20AC779DB0576B20E4DB2AEF0EB8E15159DC56243F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  mod.json
- Size 2KB
- SHA256 269f8971b9a987902a45dcd90007c4c35553e6ddbdc3fa44afc595b43a189405
- MD5 fda7adb2862160faaaf8aea42171dd03
- SHA1 c29ced133631f67e8f26419ac06a3baa97a4721e
- SHA512 8b0e5bd3cec55206d2c75d16988b378e0c0c450999fbd25435b8ec261f6f9534af577cbe8c2e9b6b6895c4eb5b0ad7a7c6680f82eea6750dd092ad6ced1f271a
- TLSH
  T16641F9173AACB137409816A536BEFBDB892DC51D812559FBBD882812E2CD0B34137B9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/alquerez.inputbuffer/ibFont-hd.fnt
- Size 8KB
- SHA256 c811822f850c81617ebdaf1e8476d9b73839c2c4d85a5200eb2950cf8a86c00e
- MD5 9904221403475b2a483f3f0695e4017b
- SHA1 21a0c5833eec0d33e7796c5a3f49c8713b99ca41
- SHA512 fee1d80025129339519c51b4cb26f83982c2f9f4d6d363145d5fbf1c5ed4225a1e78d28382d2ed3d403edcad26c98b70d6238b2abc28429a9cb1363716d7a9f7
- SSDEEP 192:JN+Gpv+0u1xGXJ4KH83FEtENUapiNxRuBBU8FitaLJV+MGaiT7nDEmHQN+LEtbPK:hGYW6VspnslpPC+eubfz8nyOTI
- TLSH
  T130025E6C8777F15B9071C289799B17FB12B2B8205B0ACECC4A6D28018CD91C72BD7B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  resources/alquerez.inputbuffer/ibFont-hd.png
- Size 11KB
- SHA256 90eaeeabd797a4338a7a821fa57b77ecfcda2f6713050643343e83f3224ad734
- MD5 08ffdf1139ded2b82d40d4bc23e22fc0
- SHA1 f7d499456f046843278165bef377f534dc93a70d
- SHA512 03db7f342679544b4faf1d0d4f5ebaa9dcb97f37f520cfa2271d28fcb514c0740da3f873ad5442ab8454ac19391681dfd60f35d212f58c8d28234a1bd9c575d9
- SSDEEP 192:8JP5jScoFaDO0BnMPjdz4FKdIRbccm0sh4CXHvVljUcuwGIW2vVgSZboZ5xKDS6A:wtzxxnMPaFKdICYsh4CXvVlw0G9kno/L
- TLSH
  T1C632CE4857B8534163AF616631A97B70A9F81243E2892CCAFECD1FC9295AAD04448ECC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/alquerez.inputbuffer/ibFont-uhd.fnt
- Size 8KB
- SHA256 db14acc2a68ed4cb327c6d0550f1b6fb60a9e696747bb512016c4d85dd456100
- MD5 3cf2bb3fca7319a13a2e63373cab7fa7
- SHA1 b4f52782cd2ce91bb748da9cd2ecc46ebefe01f8
- SHA512 cbcb6bf8f342424ed5e4af0d7114ab31195caf8c85baed8c7f566bc6426f4bd713be9aeca65f69222491903e480cb3220cf3363b4edbcea32dfb38e8907037a6
- SSDEEP 192:5QbqZO+MKf59KET0BDLF+1PasZl1K+dgEXrDJa+blsZA83fKREEB1EO4huuQwnu1:145sInQiu
- TLSH
  T10402626D8376F11BD472C189799B16FB12B2B8516B0ECE8D4A6C2C408CE55C72BD3B6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/alquerez.inputbuffer/ibFont-uhd.png
- Size 22KB
- SHA256 5f1727269df7f0d2b061e39ac432aa9ee79f705ce9b90330b998ee1a446c5463
- MD5 7b32291e3b5368dc15fdc0942e8b85a7
- SHA1 3a1f1d682ca26ba881c72c47319f997e92cffda9
- SHA512 718f82cbede6cef80104194031e8c09d8ca4bfabb8578642ee40a66f4469b853196c14de3560fad8662fc4cfd892a6b0b93f0252ea599e9a2bf60bb979c166c2
- SSDEEP 384:JMdach30T4tq7PlxbtgqjUe1aVTHGgKa5Iaah7Ovn05Vwjjh4QF7qZDbE:49G4tKPPlUmaIvGIaeaMnsRKfE
- TLSH
  T1A3B2F28CA575E72BBD5FF2ED49549B4DDC23E02AA2045D302E5EB02C66FF172441E21E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/alquerez.inputbuffer/ibFont.fnt
- Size 8KB
- SHA256 a2c72bfc191420ac7ffced7add02dcbfc16b07b7e66611059a1aae7183eee287
- MD5 c31acd74f5a52ef4779662bb94095709
- SHA1 96fbf7d7a1fd70a24aa594bd46c2852749ea02e3
- SHA512 32d73aecd07d8ca6bf94f80f9e638632b8081b877e632c70a351cc7a8e54cabcdb1d1b1c7689be9caf1bae2c32243deb4b6feb1e5e56e60301db7ad59284ec3c
- SSDEEP 192:uA8Evzwprgt9Kppk2T+m/QaGgJyRC2RR9JgQtvRIhgiGshUVNUG7Swr1B0BJIGlo:2X4bgV4
- TLSH
  T141025F6C8732F21FD135C69A765B56FF10B2B6606711CACC0BAD24444CD92972FE3B68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/alquerez.inputbuffer/ibFont.png
- Size 5KB
- SHA256 9c7de4f21045d41da54089bb72cecd0f134fd1eb1f930c2dbaa4ec246e229212
- MD5 3f7a8fedd1398a1c3de4f89b5d03e7c0
- SHA1 cb0fc5864eb20efa9a5c279dbfa9baf13ef93ad6
- SHA512 0504bf4df6e0097e17bcaf5b52dab9a59868a9d44fec5d70e31d64b31ec422752ad8df55dd279e624882b1e05f7b9a7979761e4c883e3989e187e5f1e6fbe919
- SSDEEP 96:gJuhH5IFEZk+fHxbe/jUEeef/sYLg/jqpNXk/IgJREjYNWt3gspdzN+FdTrH/mlV:7IFoksRMoKsygLqpNXk/IgJRueWBVrKS
- TLSH
  T19EC18D1E13F24A58C9544E422A3A022FD01B89FE72954E69D2E47122F08B77812CF16E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/alquerez.inputbuffer/pauseButtonIcon-hd.png
- Size 26KB
- SHA256 37ad1f0d63342100ae97bf92a4de6eecf4f9117a04b49af8dca90d606c3ebe34
- MD5 5c411a6b23fd93c53f9bbdc19aae4264
- SHA1 64d01a481f134e69df1f2873ba0b4b2d2a57c013
- SHA512 7c9dd7f802a0a662341165d7b2b7aa024ab9b616111d3921a9edba33ecbd70e1030f83ee1fa3dee271ae157d162844574d3aec220a8c9b5934b8c6f40289d20c
- SSDEEP 384:vm+rtiiREpd1QF204s060Dbz7Hkp34gw56Dl6ZzCqK3uQqlFNy16AzBwjA:BrtikKd6Q6SbzQHjIZznKhqmDyjA
- TLSH
  T16EC2E093F312B6192986930BB25972153ACD639D1654404337ABB7ECE6838C2F764BE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  resources/alquerez.inputbuffer/pauseButtonIcon-uhd.png
- Size 49KB
- SHA256 8237548d99599b5ac5475367554428fbee2af2eaa3469b550aeccb58e1d95efd
- MD5 854bcb3c6a4635abc774b3845091c7f5
- SHA1 3bfd586eb82e1f97ff34fa42e698ee0efcec564f
- SHA512 addc18ac3657a187b70654f4219888ad7f42d4de9846fd26dc27d17c776fb343274cc506e2614f6f9f478bc92d5e6007e56ec365334d1c00c9d6572db29cee3c
- SSDEEP 1536:PbykinRKrD23DttSlNSjvmPczr+CmZvJva:TyBKQtsEivJva
- TLSH
  T1B333021BF1ABBE41EA539B607BEA5D7AC5E3176D7B138FF0D44203838D051E66314582
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  resources/alquerez.inputbuffer/pauseButtonIcon.png
- Size 11KB
- SHA256 0325fb5307b4da168d187b982b36254c6a07c25a31aac775cea20633ad15b87d
- MD5 d6d1751f598786ad3a74c6b59e1b2658
- SHA1 d09934b4b698e90c448bc650bc1a2d472cb4d7c1
- SHA512 1294040c28ce301e6d4436211775dcab9d63aacfe3847f616605d0ce3ef2ba61b5d0f9092b5559ae034f972178fc8cba774e43449aa00074240a1bb313382c92
- SSDEEP 192:KVms8TIsynCyj5KIIT5sG3xyaCiYQ6lYMdPdN3gRMyZUeXg/Giwjc1ktY6P:scK1otGGsKkVFNrz/GDAMP
- TLSH
  T1D632B00CAF1C39346B9EE4EB516CF4812A09985273E9412D411CABAFD13A6920EF77D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32