d4c67a224cd5b07dc1e06facc6c2b59fc19d4f39509ac06e5f617ac5600ee6e8

Sharing

Copy URL Twitter E-mail

General

Target
Aptitude By CR4.rar
Size 162.7MB
Sample261027-d4lf7a1thv
SHA256 d4c67a224cd5b07dc1e06facc6c2b59fc19d4f39509ac06e5f617ac5600ee6e8
MD5 e2bd7df6def3ac7d9c5c172516484393
SHA1 5c3e8267fbc00d8fd3c13e3f96185bd5ce538b7e
SHA512 84f398878c03b18306bfda69fe12c30309c1479a1d8a7d709dc87b898469ed185b7c089750344c8af1159b9f28ef642841a916bc184e2e2a5b3101819b36db06
SSDEEP 3145728:QYIR3L2LLqcKs23XNt3gAK8Up+y7ort4FBPZtiYVQs/FaKSEQ+3XATUPr:Q9KLLdKFN6OHPrt4FJeMQyFeE7nAE
TLSH
T13B8833F6582DED0B0C6578AFF749140B346D234D588B52169F7EC20D2AFE6053392EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  Discord Overlay/discord_overlay_js_payloads.json
- Size 48KB
- SHA256 afb2e06be8884b6f7033864e87fea96ae961a03d352e872daf364dca739106b2
- MD5 860843eb8c5abb8bc4e1c9e22dc0a89d
- SHA1 be01e2d467b41cb010b4fdb908daaca28690aa91
- SHA512 219916a576ea0adbc1184cdf68e7be510f58c33ad5a409056126c06d1ddd4e440a6c7e4e16ee913bbd4b6ff89cbff553083b61fc13048a1a595ddf73806957db
- SSDEEP 1536:pZiEvBgNgwghqgbmEZI0ryHNhPbZgRiYllzRgCl/SjXBv:jiEvBgNgwghqgbmEZI0ryHNhPbZgRiYY
- TLSH
  T1A1233F5B28A5303187727BB99BB7610637317B981134A5A8BD7C020B7792707E2B1FED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery execution spyware
behavioral1
- Target
  Full Decompiled Source/Aptitude.md
- Size 17KB
- SHA256 3fce36c018cdca844b2d133d76807fc16ca0e1a621ac3c58f4bf551811c8bc02
- MD5 08b0df818bc4a5dd9511d1e0a880acc9
- SHA1 1ed66b6c87d7a1b2667eb527484fffbeaca55f52
- SHA512 374f1b2690b9a137771629b8d60e325412e6c79d3c578cc8961f43bf27eca4bdce3ad5c075e9bb1392cb05e4cfc55b46d30f1d8105bccf0a42ccecbf31a77d9b
- SSDEEP 192:LvK0mT3pVPmr1jbuQdPGwYinUeIzKsP94BLA/t4RC6TybucXLJ5E2Lais:zNmTpgioGPK8aBLA/t0/TqLF5Hais
- TLSH
  T18A72D7CB47428621383D0264689E6DA2FB2553272EA966FFBBFDC4DC1F72164C12456C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  Full Decompiled Source/decompiled/Important/DiscordOverlayManager.cs
- Size 55KB
- SHA256 7a6f5aa8b3aadd2a9e03b9d36983248b2ff2f42994f7fa512509a21ea1564790
- MD5 60e78e09ad3f82796bb20391224fab01
- SHA1 f0f8ba02f8e534405ba392e74274f7bbbe0745cc
- SHA512 9abe15172b2a3d52d5299c7e2b7569abf7e36948f24cf16296ab931df08910b48df5bffa2eecc23deecf84c41056249b83458b2d11b2a96cf9921beedb8034ac
- SSDEEP 768:qBP9VEhg9cKTcy2rImrrZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZP:qehgyO2r5+a8o
- TLSH
  T1A143AD853A0FC02F7BB9520740340B79DA9EF82907B959F5F9DE1934AC6110A4B787EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Full Decompiled Source/decompiled/Important/FastCaptureCore.cs
- Size 46KB
- SHA256 8b71f1c02efe2b83270d81ba8ee3f26ff5aa1dea7bd0c51068183d3ad75e304f
- MD5 c91019de792a025101c0f59d87561b06
- SHA1 e413d7615011552414f1ff95b21cfa4352dbcebe
- SHA512 00d6c751c60eca656ede2157d793c03b1e8aabdbd7b20d77d57ea324dbc6b1dcecf99855e86394bc467e9d8589bf5835226b0478a1c8223e1ed204d055f7e49f
- SSDEEP 768:JVXYBxedJVksBr/db6/C+6DqHXiRYu4wZj:fXssBr/db6/uDqHXiRdZj
- TLSH
  T15D23F1557B4FC22E3B96204A99740A5AEE6EF53903F85CF1F88E0924AC65109837C7DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Full Decompiled Source/decompiled/Important/Inference/OperatorClassifier.cs
- Size 24KB
- SHA256 76203fb2df6a6e5f01835078f2c6ef33f21f8d26736293333dc87441e49bd47f
- MD5 f03a01dc1558cf8433c8a46083053583
- SHA1 27899cd976bbcf602c68358712d262902acda363
- SHA512 ac42f1ff162169994d7a9956bb2bf47dbf5feaeb71efeca9d4ee211d02701946a5c49fb6e3bf5fe67009c28918cb310d00c9fdfb8be982bd9a5f34a0a044d2e1
- SSDEEP 384:7qaRZjcjabuJ3JYKcfiq5E1CyLvbOHGBqMdVNEYDmmul/N/z:7DZjMabuJ3JYKDsyLvbOHGBNPol1/z
- TLSH
  T162B21D407BAE81AE2A95319F99346505CD2EF93F123DBDE6FC5E9816D040804C77CAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Full Decompiled Source/decompiled/Important/Inference/YoloOnnxDetector.cs
- Size 26KB
- SHA256 a94920cb887daeb2f280b8f1f48b0d29beccf0316a62718bc542c4816478d4f5
- MD5 138af29265810f99b7e3c8de8cb2ae7f
- SHA1 7b5aa9f1e28b5d0934e6aceadc1801b44ba5156d
- SHA512 4e151aad3e0ed9cc77b4462025d1812ee812c6b28b4b464727be5a898252b2f44b14c36a6f47aa0a26e2e388e2d84a1b392b730ec31308294e0c6bdbe43c72c5
- SSDEEP 384:Z1KDGfkCyWQskZdo+VUNjd4Fz7QkwvS4BvZHY/IO1h7WEL:nctWQrXGiFzmR6FWEL
- TLSH
  T168C274857E2FA12A26DA301E58340D07CD3EF56D62B528F6F8AE4854D860844877DEFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  Full Decompiled Source/decompiled/Important/OnlineUserTracker.cs
- Size 100KB
- SHA256 47aa709cc836d990d7ee0a1452f7455f1dd7704f8e0e5050c634668b5613e033
- MD5 d5844e262eacd744c55f3ea96139488f
- SHA1 906163bf98f4b60aa4d06f66a02bac8889bd0d5e
- SHA512 5a57a54dc505a42c29c337c4cd5439c29a5dbe79a34c2f907f74138b4bc0a4dde6bb05cf5590664c3042a6544f2f3a588a4070a56b81708b1c75a6ecf6178968
- SSDEEP 768:AdwfxlP7FQ6TjxlP7FQ6TbVvbFL2mCbzeQshi0a92lHfhY+BgfoQo5VtJyL41N/h:0wHt1DH2qr5+mR2Wt
- TLSH
  T122A363417F4FC03F1AEA6546C5305A49DEAEE438A2B825E2F8AB5D51D88411E433CDFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Full Decompiled Source/decompiled/Important/Protection/VectorConstants.cs
- Size 1.8MB
- SHA256 f034b286b9d16d5e7ce3ffe0e3ddb1d1b3bab392d210287c295bc856bc216393
- MD5 41e4c67d93a7417e1b31dbb2a61f83da
- SHA1 268b4f6a906c75d1447ebfb553f46638557a307d
- SHA512 b01ddbbff036e2e6c8790a64c0f4aec13c48ef4fea5fb846a35d2a5d67e39657a4e9c19519fba8f5b571e32a935910bf6d63ed65c3d7a1360561c798981c912a
- SSDEEP 6144:qkiLws5av/baNQGqfR8la6to1nnSfZV56kp6Ner74srKUnoVT1FicdzFAbOBp:qkeX5av/6Q7cp4er8srJn4XdBp
- TLSH
  T11C9510417F4F803F2BDA1546C5706909EEBEF478A2F864E2F89B5911DA91119033CAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral8
- Target
  Full Decompiled Source/decompiled/SecureWeaponManager.cs
- Size 12KB
- SHA256 03d510255b8be68a3ebbd76b966f7038fc5f1b8b1f93538bb22a21e882a7499c
- MD5 1004b86293c0c6b4135aff8e4e9148bb
- SHA1 aff2223ee955048f404469b21ad6006c317ab3cc
- SHA512 03019def1391c818415ff8b5e83b808f12ae298a1160d285924aa506fe5bae3cb751bd7cc08efa77a9f9b058a85fa7ea63468d24a2dc5001a139bf8acab30171
- SSDEEP 384:YpNmCA4Qr6i799vIeZsvqUOlswSPIHJzn/RfVqBwGiOgegRa2:WmCA4Qr6i799vIeZsvqUOlswSPIHJznh
- TLSH
  T13942AD95360CC58B3DEF55C620304FDCED0BF22D97616EA2AA4EAE744C00689479F5EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Full Decompiled Source/decompiled/SharedFrameBuffer.cs
- Size 4KB
- SHA256 0b28f81fb320750a5082c2d6ec0f1edd99ac29f95555db2a623d8126d87daa37
- MD5 55722ba468625641e9e1ef10e33d340f
- SHA1 05c8348385a6b0836111826d03bbf08fe0f397b2
- SHA512 34e950710046b6899206e321154d1f4336821aa089b3c85da1da2a8f9489ddac5a1079127447a38ca87d4d84ddf901673c2dab31120b44ff198e75bf070274e9
- SSDEEP 96:CoOt1VFp2OQBlfIqjU6CzJQS7KmpdyxJyBpgz0:2TZQBlfIqfC1p7Kmpdyx4z40
- TLSH
  T159A1EE82FB7F942E1ED1205A44344957EE7EF52023BA90E5FC9A1118E9A8059C7BC3E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10