5f3f1b96bf0cf7355afa217030cc51ada2ad7dac44fbe5f2270780266e0c021d

Sharing

Copy URL Twitter E-mail

General

Target
chacobot (3).zip
Size 10.9MB
Sample261101-2fnteadw7v
SHA256 5f3f1b96bf0cf7355afa217030cc51ada2ad7dac44fbe5f2270780266e0c021d
MD5 c4d3912e5bcb47f79d0f65e8645de151
SHA1 a21b6c51a774cba3f2b92abf890886497e87b955
SHA512 c7ff52b4aee578d019e6c41beea04874a9359d9fad70c53e5e60ba21c4ed62c6cd977bce825cea5ae7659b5b88e9d14f808552c4bbf0503d02ad837d15095512
SSDEEP 196608:Qf8+IRHlrZNYhYYN7kjjXxji6JxnwXYSp4/E+GBkO4/gFISvWv9kcmNd8+UDnssL:QfORFdNYFcdi6JxngzJkO4/gaSCqc+G3
TLSH
T132B633088A3BCD608476BC7B11336FBC2E5BAE532C515CEA5A1D756638475E3CE818BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  chacobot (1)/brotlicommon.dll
- Size 134KB
- SHA256 b3eb3f58a5586036cacc0c85c82ce822a6f7cd05903880355374a4eb64978cad
- MD5 af257e898fc4d8698e29c16c5e7916d7
- SHA1 a719be885574bbcb99561c74a14b2b33628d4d1d
- SHA512 5e7952047cdd54e6a1a5acbc17aaf1382d78dec3c595facea53d03135d416a407e996ae16334acd3d319b7870a062cd60e96b9eac81390c0fff4c7955c614349
- SSDEEP 3072:N4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxB4:N4AhdNorGvHdbi09GJS
- TLSH
  T11ED36BA1F3051736C26B227AE45A6BB8F33582B493630551B4A9066D60C3DE4873F7FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  chacobot (1)/brotlidec.dll
- Size 49KB
- SHA256 b8e3a1da8b255fa51f76f912e2f638c6342f31d612d0522ee23710ceb55d2bb1
- MD5 8cd23c8634723f4fde1cba57275edb3e
- SHA1 e7266f916cfd939aea91d9453255e8cbc3e992e4
- SHA512 70526dc392b650764014d34cf215bc2a0445a059ef117cdf0f18145ae2896b5565892fe1c5196be75ff2952af7f09092c71f25197ba2e425a29adf4f4bc4b28c
- SSDEEP 768:2UwDM0oE4j4vwyu/x6oOWIH880mL/RkeqW/azQxARbYs3JNmG:2UwA1ewyu/xiHfL/vmrmG
- TLSH
  T1A7336D41B5E65A58DD13813883EB976BE7BBB8499301E3E7F2D0F6223E07AD113B5244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  chacobot (1)/bz2.dll
- Size 74KB
- SHA256 c05cd98210049cebd99dab3706fa91899db34315066d4187ff57137b741f7775
- MD5 73f6b87164c68ed987a005e253e52691
- SHA1 5b88715255336dcdd1b12bf0d7b0a576033d89d9
- SHA512 fbb7d948eae46309bcaabbf987cfe45427c55f2fc6e85766cb6ee9b40d439ae40b9cfc47d90ed551ad3d36d9b7ed6004f4bf9436052a73b5b1ec445d761b84f6
- SSDEEP 1536:maoPj/yb4mgmidK3qFUYGwrxgaE7eJ6yUnz/2l/JYp82:7Ie78BUnyrYm2
- TLSH
  T127733B81A7A6BBEDD61B857982330212FB38BD3C0B5157BF22A4C7362B41FA55C71319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  chacobot (1)/chacobot.exe
- Size 8.0MB
- SHA256 ba538b3ccc1277478ef37de4a51e1a31c63ca4fd794539b68683628fdf6a1dd5
- MD5 14899f31b45f896ea8c1b0f535a53dbc
- SHA1 dee950716ecf7b00ec07605d6b905be051d26128
- SHA512 68ab6604dcf5525a6e16d918a68c5b2aada07da6653502655040342e13e7e0eb7ff2820629ef7cda8c1276e59b5b8d48d92c425080dd0aad56fb92d3217dc490
- SSDEEP 196608:9cT4YviQy68NRpo2TEg7PAmkG/0ZqL1lF+QEd5/gklQnAP:w4YviQy68NRpo2xPAmkyvL1Gd5/gklQM
- TLSH
  T10C86BF82F3A181E8C167C139C647D767E7727C08172157EB329CAA6A2F63AE05F39741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  chacobot (1)/freetype.dll
- Size 672KB
- SHA256 6d1f5033f52f098ba5445e2f7b058f83c25d7894119e6f3c721c025156c97ac9
- MD5 a4c6917e7ce10c3cc81c2ead434ca20d
- SHA1 7fd822c56e9e3fc066f1d3ed1d2081ea6193bb27
- SHA512 6f7a3d668caed8c436a47ffe58f6659a80d3eff64a89b77c5d8e731b193a26b1995b2bcea6e52ea0235dbd91ba1b12e2424c1a2bb63e248d6234699e5f705166
- SSDEEP 12288:5UfzJWl+OzQHDaZsTfJepcW6amB+ImlA1afEWmNRK:5UVWTzJZs9ep/6amBNmlUZ
- TLSH
  T119E48D82F3A016ACC667C27C8617872BE776740513109BDB56A05B6BBF13FE16B3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  chacobot (1)/libcurl.dll
- Size 638KB
- SHA256 9883961d1ea6b501420b8d57ac4c22e6786874fc5c33a60f51f1092db6b6d503
- MD5 406828dfb7b5b0010ae6ef42aa191edf
- SHA1 15d3aad6fb91a25b40589e6a7ffef706171ca709
- SHA512 2bb385b88c08c8cbb3679b378d5f88ff6d2a734aec38ba5d3c0735159cf013d5467e873de82853eeb1a0baee2edc1ff7aded7a6b363c2749170795570c58eb03
- SSDEEP 12288:W/clYFXBoBWhlYxOw+CyB8nRfTed5/gklQnAPlgTgc:W0lYFXBoBaYxpbBed5/gklQnAPw
- TLSH
  T1E4D46D55B3F401A9E167C17CC2439623E7B6B0546321A7DB07B4CABA6F13BE2673A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  chacobot (1)/libpng16.dll
- Size 192KB
- SHA256 f7df77f05d2656bc682ef6e24a6c9a6ab7be26c3151b94ee0b3099b10aaecbb4
- MD5 9a2493daadb8794fa5c46b1f513722fd
- SHA1 f4d1e96db6b6fdcbe4551b9a2c137690a070042f
- SHA512 0718dd70a9ea5037813bcd107c463282cb4496eb7f0d352a3a3cce30ef0ade781d6ae110b9ec5b27603813f5a718256a7390b7cf29123c59e6a98cf78bf872e8
- SSDEEP 1536:pT3c/bKXjGSEomYvonfuQ9T4eYvoHG6n5FWt926Mxj7YAklqqZlLfyxLJ6bjK5nz:pTRtEHfu6TvGm4bn/bsLJaCuKZGS8G
- TLSH
  T11C147D87B2650079ED93D13C8607A117D2F1796813609BEF0BD18BBD6B23BEC693A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  chacobot (1)/xxhash.dll
- Size 57KB
- SHA256 c3af6cb87a7f70b2d8546bd01c4875bd1ff6ed9daf470d98c6da55c800f9187e
- MD5 466300a481b35f64f8e1478658b0a2c4
- SHA1 95fe877d0ceae5b52a6d9c2f063a5fa4d2ffcbf1
- SHA512 37e8b0a69fe66549985794e6ac2a48e9725d6027cf78c4c1390007fe63cb7dbd4a787807843cdcc9ec55c67dc7fefad3a2e6b5f2e4b3b5797ae42542f21fb571
- SSDEEP 768:upGDuJCwTes5ovICVq1XwxMBP5+injQZOl2GnWrkiASW2fJ:KoOcxKxPjIY
- TLSH
  T1A1435BDFD952A87CC7C6C33CD79F6D4649B6F6200170472583A361642D136AC8FBAE92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  chacobot (1)/zlib1.dll
- Size 86KB
- SHA256 16214e465d14ed2badb0bfb00ed2f9797ca9bb5f380e463d464caf9c55ebe2e5
- MD5 05b8f5143f3d082213e4d1e0a1a50695
- SHA1 74a71d9c074459ed0c9671dc402e697053449d85
- SHA512 d113f58040f9a4ecf4316fd2068b33180c010747999f1aba2e0d5b073d8580b6118d09d303eaa2f82dd54bc11e015c59045bae935f78cee4396beb5f4fe69d5f
- SSDEEP 1536:Lo5L+dFVRXa8tQahDhaBJeJ6FQMhX/FexTIOcIOZEcydZ/:Lo5La9Xa8+EgJrdh9C1SZEcyr
- TLSH
  T190838D95AAB422A2D6B34178E8D3479DD335B01403645BDF938CA7691F23AE02F353ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  chacobot (1)/zstd.dll
- Size 640KB
- SHA256 d580e36ca1480c544c7bf8b036dcd8062168fc966a9761358f12149a22767a23
- MD5 be019017d876b97e3114d10fc38c80cc
- SHA1 92cf519932d4a1f104c9f74c6094b46bd9ad4964
- SHA512 3d39a64f5c618e81efd749edabb3a3888ec4ab9b139221abe570a683890bcf97e73c19d792058d3a65aabe1a5efd92d252a6de6476204d1b84af201bc1690524
- SSDEEP 12288:udFgvkkkrBELbqJBPWT/ZKg39+Pedp1FLuOxAtGdiNyb:winGtWT/ZKgtqedp1FqObx
- TLSH
  T199D48D83F29592ECD02BD139C6565363EBB67C4513006AEB83A0EF653F13AE55B34386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20