bf9b5ce8a89f244c376a9b1a946276eaa06463dde3e33069a34d7f102f5878cf

Sharing

Copy URL Twitter E-mail

General

Target
Wireshark-4.6.9-x64.exe
Size 93.4MB
Sample261029-1lfvbatsa1
SHA256 bf9b5ce8a89f244c376a9b1a946276eaa06463dde3e33069a34d7f102f5878cf
MD5 ea1d9567c0f097305d30821a56373335
SHA1 3d270095a411af2243cf57dada523cc21f52ab76
SHA512 2dfb6fd775acb53fe07c7af0a525265911e09e89dd808306f4f072a6fea1db16f1a1e90fa91e8b8bb770ba867324c0a42a7ec17bdf15151c30dea2219f94f0c5
SSDEEP 1572864:aRcXPVPYxmKmEsLJYbygYQ5AjYSkTPJy6JzzBl5M/CahJg+/BFUaAOzQCTIaltnM:aEPVPMmfieDQ5hSkTY69FilBFn5rzUV
TLSH
T10E28338956C3D2E2D6B512318191F7F3A9C225FDF6F00049BF49DB05A829AC13D7A39E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Wireshark-4.6.9-x64.exe
- Size 93.4MB
- SHA256 bf9b5ce8a89f244c376a9b1a946276eaa06463dde3e33069a34d7f102f5878cf
- MD5 ea1d9567c0f097305d30821a56373335
- SHA1 3d270095a411af2243cf57dada523cc21f52ab76
- SHA512 2dfb6fd775acb53fe07c7af0a525265911e09e89dd808306f4f072a6fea1db16f1a1e90fa91e8b8bb770ba867324c0a42a7ec17bdf15151c30dea2219f94f0c5
- SSDEEP 1572864:aRcXPVPYxmKmEsLJYbygYQ5AjYSkTPJy6JzzBl5M/CahJg+/BFUaAOzQCTIaltnM:aEPVPMmfieDQ5hSkTY69FilBFn5rzUV
- TLSH
  T10E28338956C3D2E2D6B512318191F7F3A9C225FDF6F00049BF49DB05A829AC13D7A39E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
- MD5 7854290f8bc473fb9fad1917b0065731
- SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
- SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
- SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Qt6Core.dll
- Size 9.8MB
- SHA256 a1eb6ffa8e326f34ab3f8166f75d983829f2424a2aa442e8f2f756f7536c4a88
- MD5 cee303e2f726ae6212a659b1f21a6527
- SHA1 3ee74c7b09e4a3a7e3cf09565812a55157876f43
- SHA512 00d1b902dde6f2e0b7bc46143e736a0b4f3558bc1ceac4f25a5f8ea0baa2f1eb649a7b800abcf1154c8b18fefe66316de7c176270c3d450cd8220be7dcf6a2e9
- SSDEEP 98304:B7ULMekqCZDPAlKFdu9CwJsv6tMYdJMS2r/384:BxoKFdu9CwJsv6tMeSSa/3t
- TLSH
  T141A639036AFA0102FAFBDA34DAB71252DBB27C46673596DF025461185D337F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Qt6Core5Compat.dll
- Size 857KB
- SHA256 1a8f463e32cad44964086a0febd5108a6121460b9070bafa008cb358d09cc198
- MD5 a80f1dff66849af46da6a2866a8c3a26
- SHA1 2319beebe64e13fe0027c53fb74f3e367610898e
- SHA512 869ae9862ecdbfb91054e4271e7eb53cbfecfcece6bc276afb482ce2c707bc01264cd3098a91b1ad7e7752b8c0a2c1d3974d4b63b7686423824886585009fafe
- SSDEEP 12288:7jAnM4mR8zu/r5hBdXvPGE/4717VKIxBDPzHkSrGGEfvrfLO6i:F4Aj/r5hjG7VRDPTwXfLri
- TLSH
  T19315BE7772A80956F16BC03DCFA3A913D7B73016536286EFA66087067E63BF1297C211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Qt6Gui.dll
- Size 9.1MB
- SHA256 ac231ef843fb628f0c1edafefc12a0043e1eab1e37cb62e98e757792873d74c4
- MD5 6bc400c93c81e269d11e905e1f574940
- SHA1 1391bbb6c53ab6253b5fdc4494f9154bd46302ce
- SHA512 bb03490373c1ae747d43bb35d9da1ff29b39ad46b099a57991d94ec39a3f7d27b871747771cd434c72abf19518bc91ad836556db0d99ca5a99649a0340ebdb97
- SSDEEP 98304:1LWJ76kJHgTZg+ZC/PVqGJ6Q/Sx5kPthKMG5bpZa5M2EXU9:mFHg9g+0YQ/Sx5kPXK38z9
- TLSH
  T1C1A68D57B2A911D8D57BD13C8B9B9507EBB2700503629BDB01A4CA562F33BF12ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Qt6Multimedia.dll
- Size 1.2MB
- SHA256 0fb8099ab783840ea5d4840ba2d500144c355cebecfd0199b75bee08d315df38
- MD5 6141ca3b960bc1c51fdf0243a52c8d97
- SHA1 0c79ec531c5452b99469d944852915210ab96257
- SHA512 bfa8ac2b49889570da01697cc22e385d34516e05a1a2fc86abab3edeb5f5a7a354766af64f6e372be2b0f53c33712906b0d2c1208c9374045a1a541c40e50f1f
- SSDEEP 12288:dO8y5eo5K9Kqtc0SU1Y7qZzQpl0BZ8+Wb6+8wC97lg6WETF:dhyeo5K8Ev1Y2ZspU7w47l5Z
- TLSH
  T1C0459D5BF79441CAC46BD13DDAA78A16E7B2B0141302DBCB12628A0A2F77BD11F7D760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Qt6Network.dll
- Size 1.7MB
- SHA256 339141929b2b72fd1d870cac8a9b3cec9758fddbac376cffeda0750e8b628627
- MD5 ac1d3db122a42803e83847373b8bf915
- SHA1 743554a4ae44fe4ed9f9bf0a0235c80b9f80a0a4
- SHA512 4fbc9ea39f587a08fc5f2494e740ac0dc85777248717452668ca4337dc0e0f7aa47f04508153935810c0a9829bccc837cd8856b3ab76a2779198ff690a2a2c87
- SSDEEP 24576:aaNBuUZQb0e9m8EPrcoEuyRhOaUVhYpflc9J:aan5Qb0e9REP4fu+UYQ9J
- TLSH
  T1E9857C57A3A442D5D96EC27DCB4B8A0BE772700543669BDF02648E152F73BE21B3E360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Qt6PrintSupport.dll
- Size 399KB
- SHA256 88d672662b660f7bd1ce6b4c47072540afe90854d74a272693f4f50521ad7c50
- MD5 893614981d62cb2f7f4a506cc88f2de2
- SHA1 591f1a10081b24f51fddb0c282522e8a50ff4cad
- SHA512 ee9a4b24a52bd1e67f4032d26c79ce1a7a6e28a98ca8df3e8c2556538e0f0693b120c4a355d8607ec84f639eff9e9fc5a2916178e2b82987eb84ef5b80f1f1f6
- SSDEEP 6144:eX3Mtg6igp6Uq1rYzOGhyDa11KnW+3A2Bqa5sGc4rZHYGpxgiWbMEbN3PBH5AYli:eX3N6icBqkOGhyDe0WFWV
- TLSH
  T142942887FE660181DD5AD23C8A7B8506D173B0D90363C7CF022E9A09AE6B7E1797D394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Qt6Svg.dll
- Size 620KB
- SHA256 6d342088f890d53899967761286dbc5314ea5a5574b9e436669c0b7d28a5ced9
- MD5 8115da2254e8862c61ad3559d0901939
- SHA1 3294c86d4148de688eb9437a2d71c395d26c5000
- SHA512 4f357576de5e172c9d6e0f7e79be91ec847f0e7ff983370aab3059a042bd3ca5ae43696b6b02dbd0370bb14058d57f2ec556705a57ddae40636c4954272fd0d8
- SSDEEP 6144:t6HNycivcATzSTN7xMeheA74qaBaj7TfAAgutn2ru0Gf+crP8Sx5Yj7yEA3+ITIj:t6HNbibzqfq4j7TtNQuR+cvB5/W
- TLSH
  T1DED45C57B3A60786D86AD13CCB5B8423EBB370440362D7EF41A58A552F23BE16B7D360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Qt6Widgets.dll
- Size 6.3MB
- SHA256 b2e33e81de710320535fbac2bec601bfd433ef403c0cae4501843b10b50af306
- MD5 9d48009240df21760017dfb3bed7edba
- SHA1 c54184e8ff3f890ab121e40dd89dcf90c16b8306
- SHA512 b016d7a6036f90f3ff8982d4180643c8eec0fa706a9dd8e4d8f68c2187d7fc34292c472d8e582d71158de8e7b47083a843c9e870e4f416f95c539f8fa758ce77
- SSDEEP 49152://jhOtxRzXn31a0R+oiSl8U7jtRtzX1s3e8fCTjjvDsXjnq7TADWVb/G5ImjNyzN:yRNj5zX9jrNkwqZjSayK6gckA7/HTHa
- TLSH
  T182666B57A3EA0195C4ABD17DCB0B8A17E7B2700443229BCB11698E592F737F12E7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  USBPcapSetup-1.5.4.0.exe
- Size 190KB
- SHA256 87a7edf9bbbcf07b5f4373d9a192a6770d2ff3add7aa1e276e82e38582ccb622
- MD5 93c9b5098b1d42c53c7bdd68fe9cd6cf
- SHA1 ccfb1497abed432844ad972dea65853dd0e7cba1
- SHA512 dc6b84d0784ae36941615565ff21e8634bf36e3efdaff598d470035157a2f148cd1f10031504476f821cd0ce0180c61ee9fe6a7bd0beb3721c4b1c738f61fef1
- SSDEEP 3072:PQZmPYFFiorvcQNpDjrc5nMDi93g6HC+0vaiFxMv6mwSARrwPKVvbygEXoHApLG6:PQLFhJXrcVMDcgoCtswShkTAoRA9
- TLSH
  T14D14025A23E1C0A3D797063098F66637BEF5E2100152691F63B0A6673E872568F5B1CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
behavioral25 behavioral26
- Target
  WinSparkle.dll
- Size 2.4MB
- SHA256 2f15b2bb863eb2e0369982f89fc176931015cc07ec4d179d1fe908fd592a3226
- MD5 64893f033d19fa861fc27a6daa660ac1
- SHA1 788c3ad5cdd9350dbb1aed8da8904d0ab50bf136
- SHA512 b88802076fab588a3dc9b71cbac405ca84f235854871f49427c5471bf660f03843fcef31b276807713658a07b26cfc8236d6c2a4a6fa2260cde2c2fa51b89738
- SSDEEP 49152:AXfRcalA7wchHjSjSrb3cAAutEWWP6QzylkwAd:IcaPS/ZltEf45i
- TLSH
  T192B58E0BF6A441BEE4ABD27CC917AA06E7B2B8570270E34F11D049AE5F533654EDE321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Wireshark Release Notes.html
- Size 67KB
- SHA256 9d5dc1a4fabd47dca50d9e748a4beede410c342f5e965a446ff10f2a93ef44a8
- MD5 965f250fb2509b1ed1c5232a73b00271
- SHA1 bf8d6c9ae05cb345ed44c439e54cbbbe26f1a3d2
- SHA512 09f29db0a65e9d771c0cf851d2efcacbd78ff1a9ae36651c859c1a4f7dfecf4ccbf8e5bcfb82b049683456d4e3b07b6eb953123db6028ef970a03218776b8979
- SSDEEP 384:OretQOhxPFdrHPcLs0ayI3+YTROO4EbLdcfCLFNI16Yl7T6tiYs6qN+IWGImpHo4:nQOhxP70s0an6uL2QNI8OZ5lppI4
- TLSH
  T18C63E0ABA4D071690B878A737F3ABD7C590301FBCCD5366E52F38A25F8446B24D40A79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Wireshark.exe
- Size 17.9MB
- SHA256 46607ebbde185584acf166b0c0970998ba1ce7315d5ba1b28dfb05005c59e84e
- MD5 6ec77ef2664ecfd91e361587f3cdb874
- SHA1 a02c3a62bd63e65ccd395557536cd874a873136b
- SHA512 bbdb3c5e0ba3d95fa996074b63a2881d50fc77f99d193fa440dc8f34f33e8352b4dca3f4a59f774ded4f4f98798e8570b3376ff8731f159f32c1a0c3a740eed6
- SSDEEP 393216:F56Bb+snV4LKCjjCkuns/WPz2yVm13LGj:mnJCjjCk2s/WPz2ZJC
- TLSH
  T11A17BF5F22A842E0F136C0FDCBDB8E06E6B2341A53115ADB0555D65E1F3BFE80D7AA12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks for common network interception software

Drops file in Drivers directory

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32