8ed102fa31981f8e65c442a83e6c986515223b0e58d670cc360dc1a3aed99701

Sharing

Copy URL Twitter E-mail

General

Target
NavisCortex-v0.2.5.zip
Size 36.0MB
Sample261029-ylvmcssxew
SHA256 8ed102fa31981f8e65c442a83e6c986515223b0e58d670cc360dc1a3aed99701
MD5 6d8e56215bc9523e0608664373fe2283
SHA1 41dfeeb46af745c8a4b571894dc3a7c85cf4e82f
SHA512 b7b266a4dd442a78f404fb3d5c95548e225eb11c2f8239f08c3594e3f5bf3b23ce4a6943b26b6b35de8daae5a72567239ad9376eea39da5c85c2b92ea5b9baaf
SSDEEP 786432:SjIsIg19PgVHc6KsZg9kUkCiumZ4t8K5fcfrF7ejepGABUZuuQScUqX:Sj5I2aV5KmncOwF5UfrF7ejUGaUQuQdH
TLSH
T1F7873368A8253E7DD910FAFE9DB8BC88079651420393EB6E4FE652F31573AC01535E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Targets

- Target
  NavisCortex_User_Guide_EN.pdf
- Size 296KB
- SHA256 0c839b8d56125131035b996dc717501a4fd5dced5506dda7529d79a3436b5e66
- MD5 c4f866b5e109c730474359d9d9641dcb
- SHA1 876168ba16f86287ad14cd25cca1e49313b98910
- SHA512 8f97e21d51802cc0d0aa16eedda030ba11917902f6824195a245765823bdcd14a93906bc593235b9ea8fc87bfbed7f722af5fae09e87d3e28eaf8c2db8cb57ee
- SSDEEP 3072:EMRm2aM5jMisEBg23CGYv7Js2UUWzSOr1qYkgQWI4kkgVn8BvIr4eaGZ0:T9aMlMisEagQWI4kkaUvw4eK
- TLSH
  T12154A474F89DDC8CEC86C20DC5BA381E5E5CB51B6ADE388801290B25F103AD97B976D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  NavisCortex_User_Guide_IT.pdf
- Size 299KB
- SHA256 d350a2524fa910d1e46486a24df3bac65a4f81fca8b64cc1b36a45c302ea2673
- MD5 8dd85395c4a5cd7070d575599da9b6e0
- SHA1 0dc097fa1f0b3e3b1069849acab9d53b9b9813f8
- SHA512 c875de67218459ffe4b634ceb871d0bd3a38e501d500dc7e74e653d8183c83c711dc23ab9e026931f63f3ef92a8042e0134659c92f755cc5b85b840cb280ac74
- SSDEEP 3072:o4yktyhstEqIYUVfz+JRlkZbywOdusKwdIL4zVammENZaEFs0Pk5s8hSsNYE4JnE:NylhcEqIZVfUHkZb77Enaag5BJN+nLg
- TLSH
  T1C954A474F89DCC8CEC8AC24DC5AA385E5E5CB11B6BDE3888012A0F15F1036D96B97697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  install.bat
- Size 372B
- SHA256 29a610c58a6a7f0dd6ed57dd13e1fe9ab0c26ad51ca9a9e7259c9cc313fc728b
- MD5 d8229d8da67378082229f6995addfb83
- SHA1 137ef0b1c39961d9922fd9ad3766944e71390867
- SHA512 57016ee162ee3dd4433dcaf388e9a77bf570e586e3d91af436f6721f11d1ed05f7c5162822d39dd0c359fdf12b8f2defc86c0ca4467c419d9eba1aba15fe13e7
- TLSH
  T18AE0610756C74B76AB618753409A823FE54D010B9A0549D571FF43393F1F155C7F90D6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  install.ps1
- Size 4KB
- SHA256 bcec81d842e5467af21e4dfa3b7ad2e6ac205e051b00bc73bb58b99dd4283595
- MD5 0535f02624b8b67ff82a150e1411f2f3
- SHA1 d24ce97cd215dc15e409463b838139c43062b220
- SHA512 70f897faf2d3fdfacfceca06167f60cf73b9e4993ce2095d9ddf533a159e930ff28f3163b31335616f57f32cb032f5323a57b3ab4e5697dff7325422d844c393
- SSDEEP 96:U1D3p2zjzkGlDF4cJsq0qnbuGKvCK7jSXcVRiv:UZ2z/dewsq0qojQEiv
- TLSH
  T1D7817537552E50A211B2877ADE5AAC48FF8E416F8049A340799D908E5FF223E0773B96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  plugin/N23/NavisCortex.Core.dll
- Size 32KB
- SHA256 f98c991c1a725d895631f5c68284e9fc2400f6951ef9977b30e9442001681f42
- MD5 ba24071ee03e8ae10ccc9a81525de9ce
- SHA1 4ea13bf92ad50362a829de0c8877df4ba50d6c7b
- SHA512 f9b27bc0603f5f261ce585bb50904eba44ed5d3a09c920496bd72b78674e053ef12a150600ebf70d44141ceaccc4b901e54d49d8a8bac6878f667fef68b7c99a
- SSDEEP 768:CwV5tRrHHN3WKC2NdcNkPwUJ+IoDFB4qc0cpbQ:CwTv7N3hNgDUJ+ICFiqcrBQ
- TLSH
  T148E22C2153FCC21DE67D4B76B871041907B6F29A3522DBAE4B58F44D2F6B70215A0BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  plugin/N23/NavisCortex.LDA.dll
- Size 99KB
- SHA256 d38e0b49dbd7a8c2055eeb9434942d50895bc0d2c29db5519983a0556c66814a
- MD5 b4bcc65c9f36fc720489428c760a24e2
- SHA1 40c7e25fb305385256b11e29efc0091cb7e3afe2
- SHA512 a14e02c934a882507bafcc9032ac985b021c10312c142cbf170cb60e9ef53971e98d0739a5116ea76a73175c29087b6a6c240c36c133b2f563732d38c8d2f9f1
- SSDEEP 1536:6X2eP3Pp0MqzMLpLIt1Kj13cGZOA3yUhjKsdzxbySfCS:6map0MqzMdj1lAOyojvdzDfD
- TLSH
  T171A35C6023FD8F55E0FF5FB5A87642000B34BD67E821DB4D0985948D2DA7B818E6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  plugin/N23/NavisCortex.Tools.dll
- Size 205KB
- SHA256 2f15e3c55b93b3ba1253489f342b2b22d2b0b0f1c79504c14b2f35456d1b3c75
- MD5 d04fd7375c049871e4490ad3af6c07e9
- SHA1 0cef58f2303ac5ceb2e4c43123212bec6f6da92f
- SHA512 fc020c61a2d3e9f7dd049e82c80a1fa219448f29f89e4be799c61af110bd3d708058bacdebe929408bfda2da4860ce27f4e1f767ef8f97c255666f9e7b760aac
- SSDEEP 3072:twEF0s6AUShcSIXBmTkEJm3R/PG+RXEFl/0Ydt3p0FIWQfTTyeHxC:i2a6gBmTkEJm1u+VOl/0Y2bQLhx
- TLSH
  T1E724E74463E90944E2FF6AB3B4B4194B8B7AB523FC71C6AE4BC8909D19F1B02C955337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  plugin/N23/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  plugin/N24/NavisCortex.Core.dll
- Size 32KB
- SHA256 fc2f315e157f97a5d211b62ad09484349a88d15302fbf405d535e5def2fdfc69
- MD5 94ec81395f454f91bbed2d41eb8ba405
- SHA1 7dcf61d6d8b908f3502afbacede6657212a4e63c
- SHA512 c2b13395695feca53c1313c62ef4c64667a127c3a5dd06a96babc7682196bc8b9d4b6b0f2cfa17db41a52ed36fbe0f510c0525e569fb95581770a150bbeef430
- SSDEEP 768:HwV5tRrHHN3WKC2NdcNkPwUJ+IoDFB4qc0Yp60:HwTv7N3hNgDUJ+ICFiqc380
- TLSH
  T161E22C2153FCC21DEA7D4B76B871041907B6F25A3522DBAE4B98F44D2F2F70215A0BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  plugin/N24/NavisCortex.LDA.dll
- Size 99KB
- SHA256 f9cc28479df0ef7d386867d81246f4ba0d672e003b83912f89082500b164b82f
- MD5 22815a8b3b61e0579757ccae4830cdf8
- SHA1 ff532815d8d8e8ec87cb9241a6246b087cbdf094
- SHA512 e824b6acca86aa1fb65ace2a02e949c34f21875286f97f36874e8fd1fefe09a98b4002f2e239feb2953669c359e4d2686667dbb090ad77378b21762c5d35fdb3
- SSDEEP 1536:FX2eP3Pp0MqzMLpLIt1Kj13cGZOA3yZhjQsd2xbySfCF:Fmap0MqzMdj1lAOyXjFd2DfQ
- TLSH
  T16CA35C6023FD8F45E0FF5FB5A87642000B35BD67E821DB4D0985948D2DA7B818E6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  plugin/N24/NavisCortex.Tools.dll
- Size 205KB
- SHA256 87a31df92949815d4ab3ddfb1299083bd0ff521c1916fe0674c508a524ba8476
- MD5 eaa678cc3f0864cb62a776f9d44546a0
- SHA1 2453d93866feed1200099d971f7444878c16cb09
- SHA512 18f32f77b9c24e68214a6d4f00cd14c7b7e6d1bc6cc28ea22777f66221b25182754c9cf8a6dd6ee23dfc3bb1282fc9866a9b0d3d46442aea639e767673f9aa0d
- SSDEEP 3072:PwEF0s6AUShcSIXBmTkEJm3R/PG+RXEFl/0rdt3p0FIWQfTTceHxf:I2a6gBmTkEJm1u+VOl/0r2bQLXx
- TLSH
  T18624E74463E90944E2FF6AB3B4B4194B8B7AB523FC71C6AE4BC8909D19F1B02C955337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  plugin/N24/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  plugin/N25/NavisCortex.Core.dll
- Size 32KB
- SHA256 9c1747e7560e2e1c10e32c0ff0b959b1e958c65b744b1dfc9b94eecc094bb700
- MD5 f1928739d30237afd188b2fd83aaa597
- SHA1 07336f315900826b4b59a0eacf0d36345c1bd60d
- SHA512 a20ae9fb55e7084af0b3c7eb42a23c6473ba01f89314bd63b5dfa88b4516897942d6c63b274e1a7fc06df3a59d3a8549eadb0f0959b4e33baa462a52b22db64d
- SSDEEP 768:vwV5tRrHHN3WKC2NdcNkPwUJ+IoDFB4qc0dpta:vwTv7N3hNgDUJ+ICFiqcCna
- TLSH
  T1B0E22C2153FCC21DE67D4B76B871041907B6F25A3522DBAE4B98F44D2F2B70215A0BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  plugin/N25/NavisCortex.LDA.dll
- Size 99KB
- SHA256 e4e4e228ce08a933053f76b39d0162ded8a7a226f38732a8ea7f40be39dd9030
- MD5 8f20bef6fb066d03b5cd9ac2713e7e76
- SHA1 58e436d8e8b8148a7644bbe1374b4b056d95b578
- SHA512 ef93e583352c27bb48a7900f0c16a2a21397e736ea17d614956ff89e3f7b1388f51fe1184c663d66546f9fc9d87c4ee1b5209b373978dbcbd22075577f6b1cfe
- SSDEEP 1536:VX2eP3Pp0MqzMLpLIt1Kj13cGZOA3yMhjxsd9xbySfCY:Vmap0MqzMdj1lAOywj+d9DfN
- TLSH
  T174A35C6023FD8F45E0FF5FB5A87642000B34BD57E821DB4D0985948D2DA7B818E6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  plugin/N25/NavisCortex.Tools.dll
- Size 205KB
- SHA256 f3978854185aa16f6cc54b73f69495a7536c6eeb71f737416950da9e6ac7446e
- MD5 c52f6afb50185e44ff5ff00f479fbc14
- SHA1 8f1ac9bacfbe7789095157adab62511bab8c3608
- SHA512 c46110ed2a645e333d13ec4cd102ccfaabc8c25b859d3ae6ea1cc9665fc26049cfbc754ce7177a5292faac5b447f0f44e2f2215523085b4ced99a60db1539c5a
- SSDEEP 3072:7wEF0s6AUShcSIXBmTkEJm3R/PG+RXEFl/0Edt3p0FIWQfTTGeHxD:82a6gBmTkEJm1u+VOl/0E2bQLdx
- TLSH
  T16624E74463E90944E2FF6AB3B4B4194B8B7AB523FC71C6AE4BC8909D19F1B02C955337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  plugin/N25/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32