80f73884289c9906f3f8ccfcde2da5915a2834fd7d8b060ae5516b13a38f24ff

Sharing

Copy URL Twitter E-mail

General

Target
de4dot-cex.rar
Size 2.2MB
Sample261029-1ep5eae13w
SHA256 80f73884289c9906f3f8ccfcde2da5915a2834fd7d8b060ae5516b13a38f24ff
MD5 b6d832c3fa38159651fc22548a30effd
SHA1 988f8f77a07cdbbb6b2af0cd909d479ce72df2d5
SHA512 197fe1061baa57372c2255bc569e58fa2ef9e24bc67231e2d80a109e9e686620cc125e69ca802708ce7c2048ab3b898d7ad39e7801c7cc2506aa91f93f8e4553
SSDEEP 49152:624CH5SABjw/dZwFO0G0NBIORvwnuWzalfg6wiYdEW4aCqtr3LZjv6McoSf9VsAw:UCH5S6swdDGnpahg6F0EW4aCqtxjv6rW
TLSH
T132A53301220FD2176F60EDD9E4E8EB22F6C2B3716DD0161685654B62F11DACF23ECB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

agilenet discovery

Malware Config

Targets

- Target
  de4dot-cex/Test.Rename.Dll.dll
- Size 62KB
- SHA256 bcd9fad8e3ab87b4be7d6996d1defcd96a8fe74b0a87a4d445dc34e775a85f6e
- MD5 262f0b45d67bd2c954b62a4968bfe144
- SHA1 1c98e9402a6e18df8298054d3bf9b1eeedcc1b36
- SHA512 e35848ee9bbb4b8d7742b5fa271e8be41e494c1c01a383f4e0a2e4a3310f1161640c15213d5f0b181a1db267230b6ff9cbe4edf332b43b1c93efcf11e59a0fad
- SSDEEP 768:42YNVNxeS9vKTuaNDpTT2u30XElfAdIcaVVQW1btdkGID/G:AkSpKnNP2uEUBFcaVVQdLe
- TLSH
  T1125372DC0B0A9772C90CC77AB06AC111FBBCE5AA2003E3536945EDB17897F6D0C53969
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  de4dot-cex/Test.Rename.exe
- Size 6KB
- SHA256 d1dabe9689eb3eb171cba233c700186016b0cd179db1b08f07338dbcd050d60c
- MD5 1c1ed9cb960d3f83894c6fe7338454a1
- SHA1 d992fa7e3f2f6c0047af7d6547686b0eb615d500
- SHA512 bca8b7dd25cb66a8a84fc7d71ed53c63f97998924d20b9818267fed70d7b882155fd340fe1e4c25441d13aee7bcf95f5deb47391ec4c0203dd5feee3ad82913c
- SSDEEP 96:weYG71pQt5/IvhnHT7ErI5Ke7XsuvKJUkzNt:B74zQXEeLsuyh
- TLSH
  T10BD1942CA7DF17BACDB31B35BDB703506B74F992C847C72F10C4A95A3D566418822A38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  de4dot-cex/bin/AssemblyData.dll
- Size 60KB
- SHA256 2e91c540553e6432f24d4fb6b6b407eafd393b958bdff56fafaf615def9afa67
- MD5 d7b52562e6512f3654ee10c3c9529ab7
- SHA1 576c20c832a50a5b21bb583a93d23f40099ceb09
- SHA512 890d39ee5d2d80c9a335de9466de9efe706c63a55d60a3b87940b7b3a18abe60d09684af3c0f3ab17be28fe4b593a1cba79fbfaf3c8827785dd6a0f41f5809db
- SSDEEP 768:CcIF1qiC5Q0tgHYPjIXt3hE8oeNxu4WGX1Y0FPbjoOCOoeldoeNxu4WGX1Y0FPbv:qLeeqgHYbIXN/dApKNQz6
- TLSH
  T12C5338A06BF88FA3DDBED67E6876150423B4F8215837D72B5CC9A8BA24537184742373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  de4dot-cex/bin/AssemblyServer-CLR20-x64.exe
- Size 5KB
- SHA256 e2d749f5b5e7eb849ab5cc72a19481e569335fc6a414dc65ab570ac0f6ba70ea
- MD5 a91014fd0864eb9b06fc0b2b5648cf5f
- SHA1 abd3e3eaa301c8ffc4a2f60d275458724480a35f
- SHA512 f67cb7fbb871e3f90eef9da68ece6270eb2c9da3a1003b4a85d7f01d86be2e79133d3c15b119a36ef88bd650cab8f141e20100ebcb008c75eaf13486fbfa33f9
- SSDEEP 48:6TEtCnmh+v4q9o7MMYInFmX0P0DCI0qkKKrILZLCVCGpfbNtm:ymkp9oTn0EsWvr0kUIzNt
- TLSH
  T146B1C810C3D543A2FAB30BB37DF3A6819738BA11D9A75F1F55C949139D123689D63B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  de4dot-cex/bin/AssemblyServer-CLR20.exe
- Size 5KB
- SHA256 4cc35f8e121ae20b813aeefb9beea4d20e5d4b70c86292f0f335469fa6da9ace
- MD5 078799c45e47eca7bf28de5d144c728e
- SHA1 084ab951e9f01088769202904a01a5e710e4796d
- SHA512 5b9a34aae7201514c9f85f8454d7218c7a5658adf0c5f0ddd24283d23aae04d194539653a26f4501522e7e30aa69d7941c64998d9f4aa04f8e72c4cd1eaad75d
- SSDEEP 96:QKUzNDCJ7C3bwYDBUKOtxl7sjvNYUozNt:dUcKbwEBUPlsjV2
- TLSH
  T10BC1955183DC47B2F9B70FB27CB376409728B611CA635B2F65C55A17AD222A09D63B30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  de4dot-cex/bin/AssemblyServer-CLR40-x64.exe
- Size 5KB
- SHA256 0276195ef3678753d666d556aa3154bc5103eaf28bf484f07eda6e3d3228dc0b
- MD5 6b5644d487b8a5eac008534de55c6ab9
- SHA1 54b670b4533ba471b535f6a1d000f7b62615fc55
- SHA512 82c0cfe3f7bda68acd24102ba3d07070c5bbfd6f580d31947b74e8c4335783c6ebf3463cda55ed56c6824e43cf0934829e4e75b90b31905b50255e05bbc0dce4
- SSDEEP 48:6yF3Bmz09uX7NMG3iPxizSmi2+0P0ZtnC60qOKKrKLfNCVCGpfbNtm:XI09uX/SPxjp2TsZtSvrekUIzNt
- TLSH
  T1E4B1A41193D88367FBB60B727DB3A2409338F740E9A35F1EA4C45A439D236648D63B30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  de4dot-cex/bin/AssemblyServer-CLR40.exe
- Size 5KB
- SHA256 a222c177c52c07014542abced00feae38889f9aef7cfac7227c3f5feeb7d1eae
- MD5 4624ab4bce4ccc53eb7c0d4f1788447d
- SHA1 1d495243614d075d924d68d84c3f8901b3fc553c
- SHA512 cff66d49968e33a191ebc9f73740a93cd3823680d828cdbd9c4752920f50dd1b2c8b501a82eb2efc3d86aa1a31b293dc0df088da62a89ffa72fbb5829cf70af3
- SSDEEP 96:ZXCJUbDcADVl6wpGBVkXms6vLYUozNtd:kJGcQQw4BVhs6T2D
- TLSH
  T14AC1850043D88372FAB70F72BCB3A6419368B711D9A35F2E258A9517AD313645D62B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  de4dot-cex/bin/AssemblyServer-x64.exe
- Size 5KB
- SHA256 d20081dfe78fe10346d70644d92b43934a703dc9207255a3a4ab88ba4246f00e
- MD5 90d8eaf5e4f3d8603d6e55f18bbabbff
- SHA1 49212f3602fb7a5d9400bf8a6755f9ffe8263bf3
- SHA512 554928d1eedf3b2e3b23d8d658653776139fe8e3e500847adcd7ac95aa9db2ea612cca7f352424e1fff273eea6195080d451e106fb33cd70fe25e15025d14b47
- SSDEEP 48:6qRbCmHiMMoQvPt42Sq0P0vvHKM/MiKKQl3VpCVCKpfbNtm:JGmH/QvPGstfvO2UczNt
- TLSH
  T1C8B1954183D44363FAB70F727DF376405738BA11C9A75B2F6A855507AD222688F63730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  de4dot-cex/bin/AssemblyServer.exe
- Size 5KB
- SHA256 1e9c9f02eff87555bc4bb7c59346fc194fbea3e91c4f9faa61609382735fcc40
- MD5 21b9eb044ce7e2be2324d1f5862bcd26
- SHA1 5a85f1e96241e65fc4d74a7a85dbd9da8dccd1a8
- SHA512 3a21c0a4356397ed1311530bfe98853906f9759271451ff3a3fb6c63bc8c74196bdb7bf516ef8afa43d1a034923bf3c7f5bcd44ad3a5493818a3fc5bee2ce64b
- SSDEEP 48:6zfGCAhefCRlFXK/MMk+vI9TNALm0P0Pa4HKIQbKKJRQD0CVCgNpfbNtm:QVAhe6RT6dvYMLsSHvPQRUgPzNt
- TLSH
  T1A6C1B44043DA5327F9770B327DB3B6405338BB11E9A34B2F51C656076C222A48E63F70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  de4dot-cex/bin/BeaEngine.dll
- Size 245KB
- SHA256 2fbe38190fec83b2414ea50c137b1cd12acfa0b8e090abb7afdf56e20357968d
- MD5 91f428e8b84a48b6d768b0c30176daaa
- SHA1 18bdcf92dabc0e8a1d399737d49a6db42f28104b
- SHA512 788349b814c9feadc7c9c483e0fef6af1a4ab5d76db7fdf76b478a368cd6bcd7b59ce58fc2436629854a307ac6e853b60a06d3be2f3fa203efc310994c7a4bcc
- SSDEEP 6144:HGK5Ty9/cqrWBeCFASajDuXOQoMuA+X6bnHXD8Her23IDQ2FmdODehF0q5pjtAQT:xbFpJnlolzv
- TLSH
  T1613484965670C9AACC2E4FFE16260376297667943C9154BA4BEE3FF88F426C0142DDCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  de4dot-cex/bin/LinqBridge.dll
- Size 61KB
- SHA256 acb589d7708040e016cf3f25dfc3309d2366a58c85fdb79fa6295c07f95acaa4
- MD5 b1d401765196dddc72cd1341a684debc
- SHA1 e02bce01f4efd3a1e34edab54a55832fca9ca5cf
- SHA512 893fdc5c009fb6826228f3ddcea9195cb235feec4d125e157b4c6c13def28e6ad98f6aaba32295f1db316fb9b8c60dc518fc6877fbe621026953cb36b9ca650e
- SSDEEP 768:Vv7jPTwNjih6NhbY5/U+R+ghvgUu4Wlx8N8eh/HyoaH3Eozfv92cLv:VLKji9VvhvgDx8THyom3xzff
- TLSH
  T14453F60973880723D1AF0ABFA571328387F1C59B90079B476BECDEB56C12B591D5B28E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  de4dot-cex/bin/de4dot.blocks.dll
- Size 143KB
- SHA256 ba197b4b6a19ce6242256639a3f641575c77108a07d5fcd3ac13f1d38bfcf98f
- MD5 cdd68ffe464313c170ef8e98b37204c7
- SHA1 9fd1b8318a333cd10e017b208cfbbb71c6868d33
- SHA512 684b50c63c832aa62fad5db675a8037fcc0b5f91c76f21fba99e3c240c5f0f06786f5e240c4019697e5b4d7b924cb3522a2d8e2565d45cdf9ffa3303dcd86f7d
- SSDEEP 3072:e16xabl5Ifu7aVv8V7LjQlFnbH7QTjpJ:eMxapy27aVv8F0FnL7QB
- TLSH
  T198E31B119BB88A3BC6AF56BBE4A50605C3FDC41BF693E74A9CD4B0F66802321F5112D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  de4dot-cex/bin/de4dot.code.dll
- Size 1.1MB
- SHA256 c6d7d8616d74179dbef9ce441f02cdfd2b0eaaec55bce1d209c86f196ce55135
- MD5 e8a0659bd6a0de12bc61b4087adb9996
- SHA1 844dd095dac2667bf19d2e9e161f39f1d1aed67c
- SHA512 431cb41a6bf7324654179b91e89b086ac9e4040ad34d809b2ed71bad85d6dcadcc90c4f5bd449d69ab26112057cf41d4ac4419ec0f0abef0fc552166fb736845
- SSDEEP 24576:uvNg6tCYUV7XnZ0J1PK0Kq/f/19glYbrZqSBSw:zDZ0Jpf/vrZqSBSw
- TLSH
  T1D5455B12BBE94B0BDABF077AA4B5451903F1E955D3ABDB4F4DD2B1A92C42350CE02363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  de4dot-cex/bin/de4dot.cui.dll
- Size 42KB
- SHA256 ac7b8dfb428d46cd31f3fca3c4002ba01a3acd67dc2998e11941d519f34cb792
- MD5 5ddc6ba42b288532d57d7809dce2db1c
- SHA1 1968d7374674b9c9aa04a9604c813c9490f3f9b4
- SHA512 dd7d1f3cfd61b5c0fbf24b590a7aaa7ff0cdcafa303c2f7f00a71f5d8703e398643ececfb94d6b8ece8fa3051480667c5df233ee7bc0ac70fabc606aa3a59428
- SSDEEP 768:zEOAXehvKC6osqb5l8Jh+2F5pqkGOlk3BaCEoOLpX+Ipdmh:zZ3BIqb5Qh+2F5p3QgX+5h
- TLSH
  T1E613C44237EC8327E6BF3FB964B4522016B8FD67A531EE4D0DC121CE2866B40DA64767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  de4dot-cex/bin/de4dot.mdecrypt.dll
- Size 21KB
- SHA256 1f765abd720d9b38561826b4c034416156bf9e9903d9062c83e6aafc0b197d47
- MD5 3ce65d3b080b42be3d95200d985b0d57
- SHA1 f80d1054d0ea22aac598754c39d3b1f664dd5b71
- SHA512 6d3491dc63a6b00bf9a1d58ad1f78106c8790a5696523b8ab08eea64302423ace0a6a19171c1776ba988e9a327a6e792e6857b1fab90c6cf13e7a73a4fe7bc4e
- SSDEEP 384:5yCVfkl0dZk4jq5T0T9W2Eg6qHbQprXtQSQ6qt07gq:Y0kqdZk4meT9hEg6qH0h6VK75
- TLSH
  T186A22905ABEC9337C9EE4BFE9CF5104247F5E492AA13DB244DC8306D4C43B940992B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  de4dot-cex/bin/dnlib.dll
- Size 948KB
- SHA256 1b9e108e458c30655f98bb681bc6162b39c08e781264f2181e18be297d7b22d2
- MD5 6e803cedc518f40f427be4ed6bf77553
- SHA1 6cbf298605c4d236f88b4c77435a55dddd9f4a57
- SHA512 75e077872e0d0ed19657d7d0bb456ff22a53dd72cd96cc08841f3bf516822a6e07cdc3b25429459cff9e159e4f56104ecb6ce6e062d30d90bf50ebd56f7985cd
- SSDEEP 12288:qnRCeKXI1U5NjDEtJ29lsX8n5+wGIJTBtO9jbWAIG1Ml9lUfqRhFov7fUMD:qDl1U5vWo/qWATAhFov7fD
- TLSH
  T170256D1237F86727D0AE4B39B472881C4BF2E9597763EB8F2651E6A61C83754CC113A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32