84e9ca90973fc1dad3f313c27272c05a277cf9368560011f3bc892f5fced7d33

Sharing

Copy URL Twitter E-mail

General

Target
Compiled_Program.zip
Size 14.7MB
Sample261027-eellbsbs6m
SHA256 84e9ca90973fc1dad3f313c27272c05a277cf9368560011f3bc892f5fced7d33
MD5 29ffd2e2f26cc142d2e8116492e35227
SHA1 1b3c0760b32178a8df873da9bd5bae6536b94c2f
SHA512 a06a24bba682fa7e5d4380e3bc9d5502b25410cd78ee35d9935f28086ebfc1b421f768523ee0724b3895a2ae534dd68806882d0a562fe92981710dc4438dc37c
SSDEEP 393216:0LVPw0V6d9ZBCJH+AvHaSCA+eR0a4T5Y6+mtQIbg1UHO+9O:uw0V6dpg+AiSCA+eRZN+Qgg1UPO
TLSH
T19BF6339991111B73FC71E7B8D0EE5D92EB868FEEC26F606F952A6BD298050C405ECD03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Compiled Program/Microsoft.Data.Sqlite.dll
- Size 170KB
- SHA256 86831b3786d98d7629c80faeaacf3bdc8caab18f18b2eb2905aade667127578c
- MD5 3044f5e0e7440155225cb68ec4c9ce15
- SHA1 009f24674584bf552e524ba6c1104ba75252f3b7
- SHA512 50988139f463e254227bc5539bcb90c7b1e8cb3d04ddd860ce6a5b5d0668651989594202e3d9a646aecd411e15349e0303459c3a0a0f5361465ff255ab17792b
- SSDEEP 3072:MQpzvBdNljSms0x8F4rKHw/UgMQrP/t2Ox+GBSilr7DSILhXPgI+OCm1tXr:bzvPjSKhmHwAGsC+G4OCmT7
- TLSH
  T1A5044CA95A985153C2EFCE31B4BDBCC94774919EE892A747AD00E4AC38237057F8436F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Compiled Program/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 62KB
- SHA256 67fa4325000db017dc0c35829b416f024f042d24efb868bcf17a895ee6500a93
- MD5 e61d0a82bb0deab84b3c1e75df6f5b0b
- SHA1 f1b7207ffc54183e96ad1da76401f896a030dea1
- SHA512 0f3cf57fd108ef397f510e6635dcc16568560c6d40600d80e27d2976d172b3ad8f43bc1970c771ca772090169333139be9ea00118958e1fbd47db395088b28bd
- SSDEEP 1536:+DHW/pHp2Dp9edpX0Pnaw2oR7uhQDt8TIg6dKdQ1W6azK:qakQWDqTZ6dEQ1em
- TLSH
  T185533A6473F8677BCBEF4A70267650204B74BE471043F7163A6AC0B519A3BC84961EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Compiled Program/Microsoft.Extensions.Logging.Abstractions.dll
- Size 63KB
- SHA256 45c22524218541717e4a0ade36847c1cda4921f5945b4975a1c78ddfe023d0b1
- MD5 ecebc7bc0237ef9ed6c12b9c6a38d757
- SHA1 fcb5492a4880763e727b5a5ba0156db023bdb2b9
- SHA512 ca7392ce00dc5bc4a7b16022324a53ffab30cbf62ec73bfba8387667371e6a8f097379b454aa2a308d5b294ea85c8b90e447844c250c19e1863cff0faec17d0d
- SSDEEP 768:mz7ouUrbVozuvO53ReiJdelmwSroV4RJJq5OkGkJJQiY2hsUBaIFClG9zu:1uOVozuMRhhq57QeBaUiSzu
- TLSH
  T133537D159BDC5377CBBE4C75E821D5834BB8D367A402D35B3CCCA428681BBC84A613BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Compiled Program/MySqlConnector.dll
- Size 837KB
- SHA256 731efadca1a81591ef16e3b07bfba679cd4536599da6f3137aa780e753ac1c67
- MD5 3e3bf005ecd968f29a32a4c400c34878
- SHA1 6b3463e3c1f02d2cea0c5c8543dcb6af9554e6d3
- SHA512 72b51f0eeaa487929b028ef0c42e7b774824b11615a9ce6e1567dc38e05d0779eac0fc2c16dd980dde3899083cd06298dcad1294fdafaef07b4f58dcefaa92b2
- SSDEEP 12288:99PECC0Ju15Sfs8Oqds94Wr5WRiVhsvq2WXSYtGtVywDXubboyvgRNFkBl271zsw:99uhTLl2ZsCtrgzwPjjYb79VuBn
- TLSH
  T107055B5433FC0A16E7EF2BB4E83942848772F9067AE5E74F12D491AE0DA27558E503E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Compiled Program/PharmacyIS.Data.dll
- Size 126KB
- SHA256 e7f4e04dea50e223b1d3bda368fa5cf7713b88531a191635884d477079f7dca7
- MD5 8221e17763ceb134358ffa3ff8f6245f
- SHA1 9bde67912cf5c93cc06403842661e6e92733179b
- SHA512 6ea783f0f60aef38215317400c9bd4a3690e8a68d9cef68a2931856956c3149e30c4ddeabf8d18ddcbef7bc070a6c8182e5232df92720b61c68956091e13cce3
- SSDEEP 1536:1yqW3jcSie57mxEzRuJgBVWe2Jc0k4Q+m4nBT8OndO58x581b7V58xo7ELHNtz/l:1FSVWEzwgBSupbwoALHNp/rlD
- TLSH
  T1F0C39419B7ED0205E1F7A6B19DF4C01A4A77B9169D3AD35C309C124B0FB6F909A21BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Compiled Program/PharmacyIS.Domain.dll
- Size 31KB
- SHA256 64d8c929688d58057d311e418d89c49096298d3efa4dfa2021f2170182853a11
- MD5 8ec8107b6000e36d78c4d9516b8f182c
- SHA1 655baea6c4fc1ad23d2d8d2ba03af5fdcd3f8c4b
- SHA512 10627a1b9ce41c6afefd3a9f7b8dd4e49fdc0835dd292978306db9421be0a84c22ec070a9bef6c13cb06e690f250b8426a2c54d3b821a9ac991ec5c0680675d5
- SSDEEP 768:8ZzKkSLYRntnmL0bebUQP+RgOBDmoBRWhQTC:8FTtnOGdldRWy2
- TLSH
  T144E295E5032DD32ECB6C073DF03082760261DA4D726EEAB5C768F85B7E1EB1512A4679
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Compiled Program/PharmacyIS.Services.dll
- Size 52KB
- SHA256 949869d71927f2b9cc069cf08e1fb56d588b5fd3cacb2c3e203b0de0706155cb
- MD5 9ebdd244f79f0b1d6e8f9588e61eebb8
- SHA1 4d146b57138c75b2eab07ae4c723c9640f4f43c7
- SHA512 c7263ef181153d1838140c7686a84e443359edc3e194a2024944291f2e5950db6f03737f4924769a84a5d4423a2980197a8a4a8526855b5d3573f3f0a47311aa
- SSDEEP 768:Q1bXvD5CUy0hVbEAydOJW6ipqC7GjBC0WD1Bsd64f0+U:cjvdCpwV0dOFimjs0WZBsdNf0/
- TLSH
  T1AB331A0F72B88B24F68C437AD96245D213F1BB421792D7C14E8FBCC6392AB7163059A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Compiled Program/PharmacyIS.dll
- Size 194KB
- SHA256 bd9a93aadf52c5657a999da5d10a76d631c31486f59b9f93768600bf06f82711
- MD5 6867c4169225309fbb0d00d6c23cb9a8
- SHA1 420ba0089a22ed5bd26795ea443e7b1879403991
- SHA512 dde5bed20af1656822c95ce910b3129c787af56641e0dd113c7e6fca5dcbc9b5f212924fb99641636b52dbc2ef82d4ae8380bb5cb08cb3b9f01adf459a93571e
- SSDEEP 6144:drqCJHaSppgzs9eR+m9+ltJjoSkr5lsYbC0FQj9p:dBVzCdgj9p
- TLSH
  T1E814E60F357C8602F26AD3B94A6115C543B57313E311D7C68E8FBCE928A9BB1731968B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Compiled Program/PharmacyIS.exe
- Size 152KB
- SHA256 147b12adda76b0e3cef6bc4cdb6cb85dbfea785b6a2699caccaa4eb4cba0ae83
- MD5 31375082ad4d4a1f98e72984bf5d45f3
- SHA1 3de95bdc40ad4385e93a1b24337fb5b78093db10
- SHA512 ed9590bea7d3e83a8b4de642b50ba7b022d9a300c59641cb63e22b5d7fca1a5f36589141b521d9253978b09100770fc67527b998c5090b2c5bd9a931b59d3bd2
- SSDEEP 3072:x9G2U1qr+L6n2dIrOaWkwI1RcCtZKek7GVs58h:xMCgIrOa1bvDtR7
- TLSH
  T10EE33A07A6A850FEE1B7D679C9924941FB7238594BB1A6CF03504EB60F777D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral17 behavioral18
- Target
  Compiled Program/SQLitePCLRaw.batteries_v2.dll
- Size 5KB
- SHA256 0981b1e1e24ddf18e42d0f6cea7a318e735b875f987b3e306f555118726b24a7
- MD5 6fc95b565bdec3a76e3da589d1b8b4c2
- SHA1 f40e88e5fc80d1bf1c304d8d16b89b409d1c267a
- SHA512 82c5e60473db128158f637e9300a961c78547cf79379057f107e0c9e23c3ebafc6c86aebd007c745752308fee1bd56223287fb586ea3adff35d8f13d2918a21a
- SSDEEP 48:6o+lPLvBaMW4HQEcIcU1N4zOuSOiW2VWCzTKVsuAAwnakl4LsnOVjddi6:yVaMW4wEcI/Yz1SOxGTidAAXMe
- TLSH
  T101B194A0D397423BF97B8FB3BD7216414370B950DE73AF2F8C85820A5C129199A20772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Compiled Program/SQLitePCLRaw.core.dll
- Size 50KB
- SHA256 dbcfd04e95aefa9ef0dcad4cd20009b018dd3d2943c8ccf3f40597b9ed9161b8
- MD5 46520c910e0a9dc3a36fc5470b0092d5
- SHA1 43f32308463784ea6913187b1648f18519366df7
- SHA512 0fd6cc8d9562f6294c86841954b6bfa3ba63c05382d79192c413917f86105738715033c328e4016035bdfa242208f963845d648d3ee14674bba4180448741b61
- SSDEEP 768:sUTwxD03Fy5WiUxBPHVNaDJqq4qLN75Z4c9q1ITd9P581I9m/DshW:2AFy5WiUx1PaDJqq4qLN1OirPi1nLsY
- TLSH
  T18D33E7759396DE2AF4CE5130A43B00D5A670C118E7BBDB23FA90E0B06D723CB59751BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Compiled Program/SQLitePCLRaw.provider.e_sqlite3.dll
- Size 36KB
- SHA256 d4d3797e9aa3e3a9465aa5e3682d34a3303feaf429148aaf1462e114a319dbbe
- MD5 4a50814cfb2ca238f59edfbba442cfae
- SHA1 fc06d07aca973eb8f38cd6195ff0bd4608dd83f3
- SHA512 2515b08f3742745f1a0799956e9843986a4bd4e7f847f137ff482a201267fedfd7e759dbfdf519fb7d93cdcd1c3c18e0593e4d8bc2bdc3d64d93aac35a97e35d
- SSDEEP 768:ILpUHDBxh/eF5nnJSQPI/3ja9qJqFT6E43isTa:ILOVCn9PI/3euE43FTa
- TLSH
  T197F255E5978F2A28F29D07337C771E8952B8E391FB372B139A53C339DC625944D842A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Compiled Program/runtimes/linux-arm/native/libe_sqlite3.so
- Size 858KB
- SHA256 d39354a7f5a345a7d22d9da13303cfb9168745f7f4ba428a23ca11555a76efa3
- MD5 8f90d523c6a090da001394b9c41bc121
- SHA1 0e754cc95100b93ea6cf1d553bb29b6adc766b75
- SHA512 25c9f7b209e0f0bbf6a1ed43919bba67847e163d8238854293c22eb8e46cb9e6f2c1c6041b19f34ed031532f01e2e6f7f471b3c305c3781755eda302bc473119
- SSDEEP 12288:gJXB9Xk1WkHpLVLs+fBiSPQYCD9Zji+7CIdb3VOFK/t14LS:ge0kHpmILY5/JxH4LS
- TLSH
  T10215BE91FA8E6F03D9CE833DB82A42A545729C8B67F3CB06993455B63DE77911A303C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Compiled Program/runtimes/linux-arm64/native/libe_sqlite3.so
- Size 1.3MB
- SHA256 94c5e823d851c4235815702a8cc6c42c83e05b31d825e790770b8291f9b5c325
- MD5 2461c9224f828b43adb0808aa134c061
- SHA1 5528f2e9bc1fc68944c87e4b4026fa169cd51fa4
- SHA512 f304dbdfdb7d95ba9070f7d4d96fb9a187e88c4451204be7592ee762d573dbb80e831fc07578aa6f7a0188ca5670c7446547094cf4a50e1bbc381b45f730dcef
- SSDEEP 24576:YvF5QOXE1xXa4jFxyyyyyyyyyyyRHyyya4FzyqULC:Yv/NU3Xa4hxyyyyyyyyyyyRHyyya4Fz1
- TLSH
  T1EB556C49FA0F6C42F385D2BCDF5DCEF2723B3594C2A340727964525CA9976E8CAB2460
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27 behavioral28 behavioral29
- Target
  Compiled Program/runtimes/linux-armel/native/libe_sqlite3.so
- Size 1.2MB
- SHA256 0ca87dd133948a6bc1649749bc56cddd1d195c2fc6f95c97cab1def6111acb8e
- MD5 80fb707a9e3e78c2bf08fb3424a2f11f
- SHA1 af0e5e939bea7c91734667387667b123849667f8
- SHA512 fea1be2d6ff0653e0d76d4efa860d0c1c68eb2cd332c79ebbc493c5ee81c03f80c2af5d73d572959026f2c5f1ee1ba3a7b38e321cba0c1a3eb4f5761141de115
- SSDEEP 24576:XQ9epUpY5BWTar+kbD8SXZcY42tvfLZc0UMmiLVLLh:XLByJ+LZXUELT
- TLSH
  T1B7451A91F844DF62DAC46679FB5D52DC33230F78C2EE7006C8259A347BEB55B0A3A681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Compiled Program/runtimes/linux-mips64/native/libe_sqlite3.so
- Size 1.5MB
- SHA256 9fa90fa31c5693ea0b9f046e3bd680e4424e802e9f03f2fa38cf969283dbd615
- MD5 1d14fd9a9e092e7183b398ea1599f782
- SHA1 57a31d51b72f634c1b71065d643d4a24388ef22e
- SHA512 ca00aec98db6d84f7695ba33b0c04a075a90ecf2041f2b3122934b7cbfca0be363a8db275eb7fe9ada666f161ba54499932cf54fd5c21d387a33fb79dc560a8a
- SSDEEP 24576:i6iejMJC6+h4ceeay/OYNdoLO8oPDvOQo9iu0LHH:i6iekyJ7vho9DyH
- TLSH
  T19A754C829F0E5F56E4DFCF388C3A81BB017D2DC7A251867665AC294D7E253E90F92C48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  Compiled Program/runtimes/linux-musl-arm/native/libe_sqlite3.so
- Size 1.1MB
- SHA256 6f49106488567b05397d48169347ea215f584daef456e6f14fb5796017a35315
- MD5 66c71c43735bf739c449c9fe3f051b23
- SHA1 24d9a64a2015e590187edcd8369af9823c7a75c6
- SHA512 6786a57270965dfd6e92bab796b617979dcb3c9dd0eecdec8e85996e0af8baa2d9520bf206f6be22dec1fd827f12d709f6cbe866d4add0bd58acf581b7fcceda
- SSDEEP 24576:BTW4GWjjLEc2+IxJWzoDjAn7fmJqslxNp40d7Lc/:B9HuGrhyo
- TLSH
  T14A451895F8508F22DAC46B7BFB1E469833630778C2EE7509D81456347FEB64B1A3A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32