d5623f0f60b1530f5073adc0a1872ac2d9f50b773fe501ef72c8641dbe6a79e0

Sharing

Copy URL Twitter E-mail

General

Target
Matcha External.zip
Size 11.2MB
Sample261030-m5cp4sec63
SHA256 d5623f0f60b1530f5073adc0a1872ac2d9f50b773fe501ef72c8641dbe6a79e0
MD5 bfca6812b4fee1d2720b9bef052691d7
SHA1 c568f314d4bca48a7cafd0f25e2d509c70aa53a6
SHA512 46a97dca9f50aab7126297f1829b707cdaaf4ea1c522bfc1e1df9308db233932f3e9f3099954a3c8f522647c19f4ea510cadcf4239c9ff15ef4ca6c0ee8c2502
SSDEEP 196608:AFRMhE/yjdFyn14mYY6oNUtVvD53CcXoLKpgoxgDdYD/BgxKqdBCO:mRMhEq/y+muom53CIgBYDJoKqGO
TLSH
T175C633A5E9922073E1EDB6B14622D556ADCC853CDD80EF82E2CA1917733F7F719482C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Matcha External/Matcha External.exe
- Size 146KB
- SHA256 dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee
- MD5 301a5357ec4151273a737a57a211c7a5
- SHA1 482fe3a0f2e701c69f40134e71faf5c134cd1fae
- SHA512 db8bef0960722e0372e1af2eb8057ba7640dc140d5710f301c2896d997fb1222c645e0b3b7a5a138b8a0fd4a1a316cc71f305b9a9170d728a4851f2abfd76d89
- SSDEEP 3072:QhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuGEL/:QhK4XycqgpfCup5sVxuZ04uhAD/
- TLSH
  T194E34A43B2AC00FDE1BBA3788AA21906F7767859477197CF0390C56A1F67BD09E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit defense_evasion discovery persistence
- Downloads MZ/PE file
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1
- Target
  Matcha External/Microsoft.Spark.Worker.dll
- Size 62KB
- SHA256 4674c82b4f6086d56e0a74aea72a268de453b94153adf591bb321a9faca5ff91
- MD5 fc5770e46d2ba46b53bfa6abef195876
- SHA1 da857c91ab8d7f839e94584ee14a5d98f6927886
- SHA512 5dace24959fae55c3126ade840a7a35e2508e165e8a2262b1f3efe9f9a917efa4b3e0a49fed39c687ab6f6b19cd95aa8662108569d73aa5dfcb4ea218401f8eb
- SSDEEP 1536:brLKvAu6oRsrqcQCnwwR1KQyT94xMQhmP8Hzs:vlu6oKGCn1R1KQyTUM7P2Y
- TLSH
  T16D537D0023DC8723D6EE2FBE54F120000B75A71B6962EB4E6D85B59E5877F858630BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Matcha External/System.Collections.dll
- Size 254KB
- SHA256 5b20181ee4e188aa6b328c107fee9506e63efe3a4f9d2c3517ef2972b6aa1211
- MD5 f79c5255b5a8113246917ae7681e4a24
- SHA1 cc1b9bed6269bb109657a3bbec56f54c31444b0e
- SHA512 731ab48b1913fc9ba4f8d25eb497ef860796ffca7364ac91d18be2dcb243cda6bae0bd141cd6b8cb77c940253fe642bd44d85999003dd5701be9242a6bdab5bb
- SSDEEP 6144:unxoXLUDXDiKNYX8qTKfAyryS1rIgD3lgT:mxCUDXDiQ+jTURrhFLlY
- TLSH
  T14744492A77CC4E12E52F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6155
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Matcha External/System.ComponentModel.Primitives.dll
- Size 78KB
- SHA256 304635dbc025b5c3bff78df48c19980e9b52c632a7d3c145b61288f546293bf7
- MD5 bc478fc2764a94c56e69e9e38a51452a
- SHA1 1c199bf6064992a5a81472b091a01f45b4442889
- SHA512 ae81a6ce5e66cdde1b074474459db6081c627b8b38e0f959ebcdee02ae935bb022e66f39a4451989aa59e3ebb15ce3052cc23ddee4c9db5e6649d33eaee484b6
- SSDEEP 1536:MI5/UZMu4Thd+Cv8A/oqevD2olsmIbktDinxze:Mr4X+S85qKD2ommIiOK
- TLSH
  T1DE734B1823EC0216FBBD46BC9573A821D575F6821713D9CF4AA0D90E1F9BBC2E27152E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Matcha External/System.Console.dll
- Size 170KB
- SHA256 8469deb8c7d532e8857f5c68deb291035103dee3698bf5005f4e08c5bd05775a
- MD5 e58a5726978b1dfd94b6b4cb38102340
- SHA1 d1a561662830fd01351341ca862bb93191095338
- SHA512 2d7b698720d7ab2e8535a68afa3aba41d39a888d05e59454cb7e35ee04e9e3caef52ea9be46bcd8e28c7ef4e4098f168d7d0580347a9f980893198995301a388
- SSDEEP 3072:zqPlmXCzdfd6+Vfz5mDVV9evshARZvgL4OUgZjZXR1BB1GlKi7:uPoXifd6qwV9eEh2ZvgmQ9bB2KG
- TLSH
  T1EF047D2AAFE8252BE77F857444930301D637A9C70302D6EB61C585892F43BC6FB726E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Matcha External/System.Diagnostics.Process.dll
- Size 330KB
- SHA256 7bbca593ed7f5b8f8650ecd5e597190d7d55bc4b1b9d8a992c7a1f887e65dcc2
- MD5 634fef75870c6c036fb4132a4e4d5b63
- SHA1 9020e99507a27d3009b5914f0e73c91f39c1aa1e
- SHA512 03b92b87e25344f425ab05475845b14bd8b320e8c09e5b55d94f8fd284097f5226a99720988ddcae025b92c60847f04ad60d74c0e4e90bad380eb0a5390251dc
- SSDEEP 6144:PZkDfqaP75HL9eEIdanhOe9jb3b41PlmFFVZTdiX2JD:P2DfqweDdSo8D
- TLSH
  T1E3747D247B980506FE6E96388C63D502EB78A49707D1EBD743A4D7DA3F4B7C2E632112
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Matcha External/System.Private.CoreLib.dll
- Size 12.6MB
- SHA256 4cd6810b4ebe8d6e1f5928f2026d257c112380d33b557a60bcfa9c7f2bb012e8
- MD5 8b5ee62abdb7b72f418d797fe73f2521
- SHA1 77582007964cbb215278267691a255b63abe5ffd
- SHA512 870ef275e1e8d1607e2b22eb25f1f05f99346b54651bc119d809bf21f1a6f041eff801b3b5e1ffbb1897975feb2c3aa47b3699cc4c63eca8e3e6a60387ab4bd9
- SSDEEP 98304:FdVXzmQ6u2Pf1F1HpwajX4p92QKxV36FChEqiPVGK5+k+uiCi:9WuuT1HSajXgJgV36FDqM5+tuxi
- TLSH
  T15BD6AE21A3C45F16E56EC739C6638292E2B0F492535295CBC05DEFDA3F13BC15A3B262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Matcha External/System.Runtime.InteropServices.dll
- Size 94KB
- SHA256 127ea3f2ff47cea14c082b2ed22066554d22c9d8f97dc0d403b17042fac62a5b
- MD5 1df866f691def4290407f5cf01b996ad
- SHA1 b2ba5af3f80aab63ef2fecf6341b44deae201ac1
- SHA512 6f96aec2abf7f6e96b7699f67cc8547334277c8e502e6ed357713c54b68faf264b1843ea42e6ab0f7c6ad7dcc1098b9042e1d5f15e93db6f8d346f613d1f6a1d
- SSDEEP 1536:4o6MupEelCtJfKS6+67NspnSPM+l5+CkmVhKWHOiOyzUizB:4o6R3lCto+dSPM+rJkm7NOxMUil
- TLSH
  T1D2935A2037C84666CA2A473C9C775D50C9B2F6C613A2E6DF5781895E1D9B7C0C3B23E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Matcha External/System.Runtime.dll
- Size 42KB
- SHA256 9c506c9347f872c3375255f744dcf83b71a96ff71cbf4a19b39873fa22f73c22
- MD5 dac7d72763e59a64c0d706325b747d92
- SHA1 5890f0ee30b86e01ab55d6017261554d16f6c916
- SHA512 4218ca96d6d2d4e24e3b6a70a87890a9035156d522d217f48999870f644548a7bc5c09b78b23de41c5974c375f9d03ed49054a173b4230ae835ff808469ce50a
- SSDEEP 768:2+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLu:KB/LuYdy50b4b7RSHTSkingzIh
- TLSH
  T16D13D5A0AE485333CD8B6B72DC73AC810DF233C4047A597ED88EE51A13867748236B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Matcha External/System.Security.Claims.dll
- Size 98KB
- SHA256 9aedeb23632f45084722906ced314074fb14e08478545a221ab6476febbaff0b
- MD5 31e935263d51f39c224e403bd5d7cc00
- SHA1 8af5efbc150d8f944adf84f89bfd9c11d00183e1
- SHA512 6b95226c760de73c85a4a9ed972c1f51f14b50087bccac290a31813ff3f6f882f7b5c7ee21352f504adcb7324214827d32bf9fe1dc34447520d97a7c12758d1a
- SSDEEP 1536:mt2q/as3w2pm4X+bX5SdluDQu6O/UZxOQwQ7rzUU3q2bP64LrSjYFFQWEzwC:mMU3LpmG+bJS7uP+pXSsFKvT
- TLSH
  T138A33B6437EC4222D2BA0F3C55E19909E9B4F9825772C7EF0A39CA4D1E97BC1D930A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Matcha External/System.Security.Principal.Windows.dll
- Size 182KB
- SHA256 59815feab7b47abf6e7d4231a7081452b256704a3834c6a927a9e74c03897b9f
- MD5 7c560e02f8dfd723471f71cb71c0ccaa
- SHA1 c1ea98009aea6c3b12e078965ca3472e44eda305
- SHA512 32120bcf4d3e5c7a5ae676688fa8f0102c752e059c5eaf8987b37eaf3436c6892f9d1e7b3c531db808e1e554316e24abb0e3848705517833309954ebd537b037
- SSDEEP 3072:72kZDNC/sCTyRdtl63xJYrwkpDCRi1CSB2TOK1BguZbKXm:7U/sC6Ll67YrLpDCR4B2rPjxK2
- TLSH
  T11D045C16A3C8090BE6AF967D81639201D6B3A4570706DACB5591C9DA1FB7FC2FF32213
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Matcha External/System.Security.Principal.dll
- Size 15KB
- SHA256 902d836b8cb066dc2279e4de0979b5a380bdccccfa69634ba51111cac2be2f44
- MD5 c9285d5497f2850234f48a0cf5619c0f
- SHA1 1b3aeaf0c40e401c1a2b4c19ead12314b5782ddf
- SHA512 5ee72864a21c23b1af540dad95d67348837467a3ce19478b02223ee220441e40388b97c8e1110452f32ec2fb04bb63b649e49860153b5b1df3f4d37d1c37866b
- SSDEEP 192:CB0LZxAyk4jWVUmfW2fpWjA6Kr4PFHnhWgN7aIW5agiZTOebR5X01k9z3AZZNFrg:zLD+uWimfWcYA6VFHRN7b9bt5R9zExr
- TLSH
  T103625B96C7A88203EEBB6E70A2B5D5173D3C63C69D51966616C5F2082C533C9DF3076C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Matcha External/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 a875d0785cae18ee30db531303c166ba1a1d30c0ca4ab8edd38fe04056f91eaa
- MD5 7b3bded48604bacf38173a19cb38f269
- SHA1 9d15d2ad99f7437c9ae1775898c739712f8e5f93
- SHA512 a34cad7dc195b6c5b8a5c89e3a93083b1d401b5f772807524cede69210b04bf8fe746d9925c2fdb18b8d0f7636cfdfe48cf26fb0095500739cdc48e141bf344a
- SSDEEP 192:h7mXhp/SxgZW6sJWDWWxNzx95jmHnhWgN7agWP3zzccADB6ZX01k9z3AqRrimR:h6xiUW6sJWDdX6HRN7azzccTR9zlRrT
- TLSH
  T160724A918BA84207EDB75EB0A6FDEA823C3C67C25C11A66B16C9F6541C633C1DB3063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Matcha External/System.Threading.Thread.dll
- Size 15KB
- SHA256 ecbe1cde0de93b08489005de9b2ba627725dc55646735dcf0f027e0e1fce6f6c
- MD5 00fe534a33b1f18dd900df89e17f73de
- SHA1 0792678a143e8abdd57837d4b67d187b74570835
- SHA512 5ad071c4574453fe242344696db8d132386cb05398c241f003c5643cc843c354288bb2c9a91bb6e0b8db3e126b747c34bfbd01b51255c82dc6c237b86686e73a
- SSDEEP 384:u4z2EI0W8tWcC7WGkX6HRN7cN8KER9zlZ:uOQvEWcN8R9zf
- TLSH
  T12A724A958BA84243DCA72DB052B9EA833C3EB7D39861D96B12D5F5841C633C9DB3062D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Matcha External/System.Threading.dll
- Size 82KB
- SHA256 15cc9db291b87042f1ab4319f8d04f4cd226f15bf88bf0810b31dcd50fb0bb7e
- MD5 932a0c2978b649703c40b260b1955d26
- SHA1 e9a4c055bc14b3a2db5bc5d0cf838e79838ce8e0
- SHA512 51d6d767425fa1afa0acd5a149b99d4c62bab174ecd7485211e9b9635eb876319e8ad2a96d9a7cef26beb855da3661b26912f05014f6dc22cffe33306d9988e4
- SSDEEP 1536:AWgoICPLdImrmODZcUBeZ8j0GEH9wd633GRm3LGgLWz9zu:AWgo9PL6FtZ8j0GEH9wd6GR4GgLaS
- TLSH
  T1FB836B197BE80416FA3B47F9EAB69906C472FCD20710C6DF5049910C2E67BC1DAB227B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Matcha External/clrjit.dll
- Size 1.7MB
- SHA256 0dfe34be78144cad7db5b66a7fca3d86178ec0f353aafba6c81eb72e797e383b
- MD5 cafab1ff05ff429bd46cb78b2ff8e9e8
- SHA1 e02b3b243b6993c0add46cab15bbb6549c602700
- SHA512 f19b60d26d784b2000e67a8698f8915ef623eee074dab9b853ba927a20ff11ab267c4ba385971620470987240263f917199e1424f3d23d263382163d66435639
- SSDEEP 49152:OkM51Lv2FQJioLYRa19wEvKugOQY5iW4WGGzgdZO3Ebz8d:OBioLQi9w/5ONiVGzgdZO3P
- TLSH
  T1AB85AE46A6F805FCD0AF9534C6574A1FEBB2B81A13209BCF43F409A56F237E2261E355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Matcha External/coreclr.dll
- Size 4.8MB
- SHA256 b4375494bb10be11db6134d361df2f39a7a2c7f6696ca8d239a3ed424ce66de7
- MD5 389f964635cb95c6696744f56cbc092d
- SHA1 f133da56b7ad65d162656e052c358328877db1b1
- SHA512 49dbab9c3d1e9fe506ea7e0942d431559dcaf406c8e8233afdd234bd8337f735e1d9510861c1de00b7295d5956ee166d0ad55afce2142fd75a876f506f4dc661
- SSDEEP 49152:jh3nYAkdW1bIowGlFCJvETHWzaK6YL/XPSpRdUWPfeSk5GjyuQS7bPdB15i9FqeV:jkdW1bIowcrW6p0qnWHn+2OSn
- TLSH
  T14C368D56B2BD01E8D4BAC078C9D70A17FBB1B8590738DBEF02654A651F23BE16A3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Matcha External/hostfxr.dll
- Size 342KB
- SHA256 130a3656b07a317f859d542c0f11339f3d0ba4198169853781a3fc04ed64c907
- MD5 00f6fc45937b885439cc6c1a34dc96c1
- SHA1 5df3efd8a49b91e5af676d35c02e75a640f4755f
- SHA512 75f088c244271142c58a7ca8f42ee68b910332ac2a23c44f7e6f6c38ff2334f96b8f28ef312a79461f5c631b07110403523b67245be8d3c7b6d0368913438085
- SSDEEP 3072:zoo0qOJezezqrPeYvCuV10J3keQRJysmFTHABK/o3BCLNzWNxEvf5NCnFeotrcRw:0o0qOqqYvCuV1jyFTuKA2zGxuIeotdt
- TLSH
  T1E3741906A2F801BCF1F7A7789AA64901E77B78454B70D6CF0390846A2F67BD0DE79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Matcha External/hostpolicy.dll
- Size 384KB
- SHA256 65d61078b6b97884ad09aa12da97d96f50f7d98e6d163c926ae199f9bb58a3ce
- MD5 25fd4181ab8b572a1bbfba2f4a9ec239
- SHA1 b834dfc4c908b3cb8d3fc40771e6d0e900c7de64
- SHA512 38b708595e5a91194fdb089ae56e4051841c27406f8e770bb720ee9a5d66e6fb1ce8599f224071c2c23d30d832315c2a51a532677f121b383547f149385d1246
- SSDEEP 6144:Ux0Ke3VmzsnHpYHkGWqTRDERqBwT5eQC0+1Bs2u7FksfEXk0Pzfw:k0KWVmzsnKHkgTWkBDQq1K2vk+4
- TLSH
  T19D843956E2EC01ACE1BBB2785AB34901E7777C49077196CF13A0946A1F77BD09E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Matcha External/win-64/Components/System.Reflection.Emit.ILGeneration.dll
- Size 15KB
- SHA256 ae47751a2d032d7269759daa1ee97a6ffb0a0e63a6aead090b009592a469eb1c
- MD5 f54481c0edc286a11b63fb95f83f35f0
- SHA1 270a9ff07e5fb7c50d047d243d81689615dd8b84
- SHA512 b4fdaa291994599d5d9017fe34c335ac9d45b50854ef3f2b0d0ef3822d3206a59b0564a1f0331ad0caf4fb19ad1fcb89f4554b3ac4ce6997d1c2644d7a855cc8
- SSDEEP 192:1KWKxvXW6UWIZWQhFJtvUmmnoHnhWgN7acWGOlo+DF9X01k9z3AHg:/QPW6UWI/hljHRN78Bp9R9zug
- TLSH
  T1927249E287B84243ECA75EB082F5DA933C7D77C78900A62E1695F6882C537849F3163D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Matcha External/win-64/Components/System.Reflection.Emit.Lightweight.dll
- Size 15KB
- SHA256 fa08d58251367b33b95d75252cb835cb710adf9a220099eb30c96264a3b73a71
- MD5 e484270ccb881e590a2c0bff3ec15c25
- SHA1 ee8f2075f2e9c25a60fd6ab167b0df733d309dca
- SHA512 00e218890f037ea15222565d2ba314a83183003d21b4a43f80b422f611215e6165aeb2bc34c84998edf1f32d8bafa647727c47615ac28362cda71ac9e4a0d768
- SSDEEP 192:+XwGcQxYbW3VJWNZWQhFJtvUmmnoHnhWgN7agWtWUTzlgnKug8X01k9z3AGqGUwy:+FrsW3VJWN/hljHRN76WIl8BR9zn6H
- TLSH
  T1F8725BA18BAC9343EDAB4D7086B9DA933C3DA7C64900D62A06D9F5491C17384DF3063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Matcha External/win-64/Components/System.Reflection.Emit.dll
- Size 126KB
- SHA256 8ed2694b576381e59866836b36fc0ef016140224e79d3e6a905324ea35b4978f
- MD5 a9db034fb016a6c4dd399d90044dd359
- SHA1 99f69df1e52edad4a7e0e552c7ec73077e8bc07c
- SHA512 ba01752fd47134bbe026a9070b61ff841d92b44daa73601f3885b15990402523a379e8382e5374b3dd9fc1ed9024f0f4ef94bc59d161d6cdc375aa9e656834fa
- SSDEEP 1536:aMKS54uaKi6blHXVZImoH4blYxM6pADtmXLJ1gEsVlcJrcBy0FugBR7y8szK:a254xKiEAYbKatyLJNsVkrcc0bBR7y9e
- TLSH
  T1B4C35A24B3E8462AD6AA82BD94B34952E373F5D31302D3DF08059A8D0E97FC1B572767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Matcha External/win-64/Components/System.Reflection.Extensions.dll
- Size 15KB
- SHA256 70235a191c9bc308a34c25f32232f0ac685da6c431e2d1ca0cc00d9c402e227a
- MD5 8bc2694609814b23f6f3322f34910979
- SHA1 184d3f6b5ff92203398e28ef108ceb897095b512
- SHA512 1d4943db79b871c9ba84d5d511c5dc0d8c2ee7272b2ddb843218b8d3f8d714cfa9375fe4698d6d5cfdccbeb0041806fa2584861d37bd1a839e3d450a4ce24c23
- SSDEEP 192:Iv8XzKxAGHGW/WW1fZWQhFJtvUmmnoHnhWgN7acWDj74zaSv6dlX01k9z3AnkuvB:IEDQvmW/WWN/hljHRN72jpS+R9zklpMY
- TLSH
  T1C66239929B6C4207EC675EB0C6E9DE833E38A7C69D10917B19C5F6491C673C4EB30639
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Matcha External/win-64/Components/System.Reflection.Metadata.dll
- Size 1.1MB
- SHA256 f3ab642fc2a102efd465cb49f4998524c7572228be4b0d2e70bcb1b8bba4933c
- MD5 f5f2e5bc330c80d7469daf08bc62217a
- SHA1 e337f060b545432220845d1444f4029381d3bf2c
- SHA512 bb74542be612f0eb0c0ddbf4567238d00845fa14c61bd0f58bc757d15ff221da0168627150d7a64de37cb5a2811940be692da86324ae90a3e996fbbcc9991e5e
- SSDEEP 12288:f3e0zGO6AJ8+utVRA8WDlLeO9om5EoU/mSdWTURfeGWhbrWAoDzgVdt:f3e0NlJ8TRocOWmc/CamGWhb/J
- TLSH
  T1E7358C21B3948B16C62F8679C0E34412D531B4A35BB6D3CF4A44FF1B2D53BD29A36A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Matcha External/win-64/Components/System.Reflection.Primitives.dll
- Size 15KB
- SHA256 657ed5f5cfb406b806f2cbc34d4dfbeb2e9c6b65f8d42c41dd5ff3ff46e4001e
- MD5 a2697f20a90f27d9a4828b0c531b77d1
- SHA1 c28cd15c3ec7c0ee646c8b4c17ce176c634aa550
- SHA512 e3055bce1c8067254145c95e02e2694a341fbaac41496aae7a3a03320016ec1e9a104522d8eef29b6297e1f3c8673998e1f46d6015cf9989f92c1d7faaa82e5f
- SSDEEP 192:ntCCMx1OW/+WTGeZWQhFJtvUmmnoHnhWgN7agWwItG7mCGZBX01k9z3A2fqDRgQ:8NMW/+WTGe/hljHRN7itoGR9zTyVgQ
- TLSH
  T10D725AA69BA84313DDA70DB096FADA833C7C73C61901E66E12C6EA491C53384DF31739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Matcha External/win-64/Components/System.Reflection.TypeExtensions.dll
- Size 42KB
- SHA256 bf6490c507914c480247e30260223b9c8851101c0c734c7564cd79d63decb393
- MD5 eb3d1a98d68255b2f7dd2d37f701e691
- SHA1 380edae9e466c15939c34d7e46ad544609d36cfe
- SHA512 24346d84869566c3f0cc11508665f887fefe326e45c1a3e4bd44ac1699a31767cfb515007b495c9559285c25a30ae82043fc9c69c562a1b5b8d66001801eaa99
- SSDEEP 384:XWDeWHaAYx1YcyPuTNtyVHL0a+SKRDIt9jRSBPDHRN77VpyjR9zjr1E:gHaRGcyWTU/+jRiYzc9zf1E
- TLSH
  T17E134B55FF90060AD63A157C8AE28B02DE38F3D697539BCF346DE10A1E637C46A7242D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Matcha External/win-64/Components/System.Resources.Extensions.dll
- Size 134KB
- SHA256 1d393bc4164e01d0229d6bdab612145fb9df51ee1f600840d3c3a54c50ec55e4
- MD5 95dcbc2bdc16c3f225059f810f04da59
- SHA1 380cbef904cd03088d3c158c31153b9018659adf
- SHA512 b22202e3e78a6f8367ff339ca9c483a141cdd28091a180eb43f7956dfa273e818a07e3b394441d60e7527678c5bc1e2e6b3fb6808dde6d935d671045eb0b20a8
- SSDEEP 3072:Dn4+QFoEaEKuh23IIBbLf1Z76oREGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG:0+QF+Ezk3bh7meEGGGGGGGGGGGGGGGG7
- TLSH
  T1C8D3E714B3F80925EBBA5E7895F29511D677B8836B70D2CF0594899D0FA3BC0BA70723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Matcha External/win-64/Components/System.Resources.Reader.dll
- Size 15KB
- SHA256 ef6c5b7d4c0e79fb6cded4a4b5c3a50d9c8fc8810eedf3632fd6620440fcc91b
- MD5 45240e0daa6bf13bc8ec7f912e0adb2b
- SHA1 159b43708119ad967f1d6c5cf28c2b44d3ccd0f1
- SHA512 c1a11965b080ea11589ea1c8b029e07e472e3d41daec6e1c085373f4d075d4d5ef73f397c35337648547da3112a249e24754aa1c9fcc24f8cb00e2d57b722a36
- SSDEEP 384:2oOW+3Wy3PDHRN776QTAcUthXBnR9zXP4:2ou3mgCf9zg
- TLSH
  T1B762499987A88202EEAB5E7086B8D9477D3D77C79D11993E06C1F6050CA33C5EF31A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Matcha External/win-64/Components/System.Resources.ResourceManager.dll
- Size 15KB
- SHA256 cff1457cb342f0b97c8a032aece249fde6eef25e9ebb5ee0a603b30fa505aa08
- MD5 994df3a52f0f7b6f1fd2baca2feddc37
- SHA1 7bb52dc1ddf4b18ab0fa44067913547b8bf28427
- SHA512 78704cd114f5b2104338dc15239d20c6a682439c642b1cf207152217f5ee7cea93f4e112abf460083dcce06e4ed62de277852ecd9a63d9f40a7b8f46ed901be6
- SSDEEP 192:96tbZxAbznWDzWYZWQhFJtvUmmnoHnhWgN7agWx0VekQKgvkctX01k9z3AL1tdxZ:9aD8WDzWY/hljHRN75tGkeR9zs1eJ6
- TLSH
  T1337238D68BAC8243EEB71D7257B4E9433C3D67C31960A52B05D2E54928A33C0EF31A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Matcha External/win-64/Components/System.Resources.Writer.dll
- Size 50KB
- SHA256 001dc22d5205f5cdc3ba7f1a99fc6b9f825947eca8dfa1605a8b192ccd7b4ef6
- MD5 52ef163b32baac62f993c1fe5175c566
- SHA1 5ed35e234cf0f466f7dc2f89783188b3cc1e3e15
- SHA512 ea42cf4fb5c12318dbdcc23d407be66300d36d5f7b9cf423bb5241b939c668b73ae5807b6eb559d6774885928ecdac17e821e89059214599651de77816d06763
- SSDEEP 768:ChG32Xb2i171RsnVA3Z2/+L04I9QDjJQZs49zhnY:C0Gr2871qAp2q0S/wzm
- TLSH
  T17E335B5997E8810EDA3A863852F2B986DA74F5861720D2DFA9C5FC5D0FE33C5D330622
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Matcha External/win-64/Components/System.Runtime.CompilerServices.Unsafe.dll
- Size 15KB
- SHA256 bce80e35df5dd35dba96e7c402ff7e0c3292fcbedd08086e1c536a3b9bad819d
- MD5 c2ee0ba88ce44c89a003421b73f49f58
- SHA1 cb9ad9764d5394332fa7bac9119df6e81001a9fe
- SHA512 fed76f6ac566782786a6abf76c1a5da35e53169f4c006ca2bd4579d1ca6004a31e0c6c553a9c43ba1af2deaf98890bfbaaef0deff80df24bbf0c0c0cc68b2c48
- SSDEEP 192:M4xASH61WR2WXZWQhFJtvUmmnoHnhWgN7agW3okQKgvkctX01k9z3AL18qZ:tUWR2WX/hljHRN7cptGkeR9zs18qZ
- TLSH
  T19B625CA68BAC8203EEA76D7097F5D5933D3CB3C75D509A5A0685F6092C53388DF31638
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Matcha External/win-64/Components/System.Runtime.CompilerServices.VisualC.dll
- Size 30KB
- SHA256 fb0af73ffa2fca9112fd7c3b87c225152d6ee46f9d5a119941a8f5578d4c79a9
- MD5 4801be519952b4b6ebffef2721070be0
- SHA1 d11883c371f42ceaf57786e07fa04b4f983cd12f
- SHA512 9a0b42a53f9e359e3115ddce05b976181a8f0aca5d5de8245bbcf00c79b60bca464448cab755f9b77dc7c3a6ad1a7dae564013e98f8dc07c3254bd7ca4f92491
- SSDEEP 192:e8RWOLW6HbjGa3HVilUcoOxH1lzWVixaEMF1WgVuAwmbxHnhWgN7aIWaVVIiz5jL:VWOLW8bjxo+0V+EEPDHRN7/VCIR9zv4C
- TLSH
  T16FD25B659B9CC61BDF6B0D708AF5E3036D38B7866B52979B019CF2061CA57C48B30738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32