13c02d096387770ccbbc3e1989bc9212a24f2c5e41bba5cce8f11747e1666308

Sharing

Copy URL Twitter E-mail

General

Target
CoreScope-0.6.1-windows-x64.zip
Size 3.7MB
Sample261102-fffl5ssw6r
SHA256 13c02d096387770ccbbc3e1989bc9212a24f2c5e41bba5cce8f11747e1666308
MD5 c85b9e92ce1d6aaf0b2d6c0470cb8165
SHA1 da75e860c55bce3a781e1cabadd83ad94eb5eac5
SHA512 f989bf997684268c5e270a88dce941d0c2d775ce3129c597ddacc4c5d70435e7989186a0cba94ad3beb9fc5e877c395996fa19c0f094aa561719f6cf4d01700c
SSDEEP 98304:Vvv/yppjoH/cqWBNUv24uqPMlCWpNEAHaSRAPUT4pbI:a1QkqWGWtCWpNEAHdRAscpM
TLSH
T1080633FE8877042BDBA721BA8CDC0D73325275182AA317649B75607A75DF3620F3A853
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WebView2Loader.dll
- Size 190KB
- SHA256 3426dcc55fdfb8b5e7ac623cf33b4ccf283fbf68a0c5a65bddfdb4d749a8abee
- MD5 f1426c839cbf0e9a4eae7c67916cedff
- SHA1 60cdeba80ce6357d9598947bd65f2db31e5efa2c
- SHA512 392d172f8e960a2d18d18175813e091c27d12065db06c4fcaabb6429bbb1306a3087fff33e51bf9226759b34d454109c11a310711ff9f7c6f9d8f78164b661f3
- SSDEEP 3072:hJoWXgNjIFnTf75x2v/KUUbPXGUIufAuzA2dTZnaZED3JU9jfbKuFjaS3:LKI175Av/KLB9zz3nyED3JU9DKC
- TLSH
  T142145D06B3E940F6F976D67C89A38A46F67278110710AAEF0360473D5F2BBD49A3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  corescope.exe
- Size 2.0MB
- SHA256 0a70c76d73b4598cab78f8edfc38da9ff01ffefc79f9ff61e3e96385fdd51862
- MD5 9e34f9f5b262a4815778d98518316503
- SHA1 b593d84bbe9d01b23059559ec025b4e18ab5637e
- SHA512 b1761ef83fb286856addd2552950f87b9f73a6f0db2f1045ac6c6cff7ac84f56be4a7aec5c844a020d6d3f61f401bd46fe199d0bb74ac2ba7eec42c0d9531e69
- SSDEEP 24576:noSZ6bay1su8ygaU1qQ5IFziiUE3GccnTspSN5SnpQF0pAe:n/6baUsutU1qQyFDUWFcnQUnSc0pAe
- TLSH
  T1A2A55B47E26690FCC16AC07883567636FA71B88A09227D6F36ECDB303F79A509B1D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral2 behavioral3
- Target
  hardware\Aga.Controls.dll
- Size 142KB
- SHA256 e9f4eb385359a6d51fcf88153c597e3d75b6e64d5f1c3766eaa2deee739e855f
- MD5 96f68175eb2e91288130adf06ca73101
- SHA1 cbbb53051268758076ff4b8ba7ea73a16e547712
- SHA512 2e3d06af8535574df983a4f59d52fd1c5c0b0a49c5a34004512b0005759562099a6bc72fbb4ec8f29299eb50a371da424dfe4f40d214cecf7a74915e1ed21491
- SSDEEP 3072:t2VDmC2JeqfVzFAEosNC8u/vxAGSslsyvDibOepRb:QVIvfp0sw8mqGSsK4ibOw
- TLSH
  T1D7E31721275AC62AEBDE857DF0440875C3F8CF01B56AEBAF6E8479FC24B33611646463
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  hardware\BlackSharp.Core.dll
- Size 32KB
- SHA256 cafb93afcc8d8a367e21f619673d05c06887d8964867fed1371f02ded1cd3e23
- MD5 af10d830d9dadf30fe9135802c2c2b3a
- SHA1 f8481a61aaa04eea57834f549118f3d31039fb00
- SHA512 0baed44567ed36e801abb52f0e79c4ded943fb13b8d9a20148f33fdc2c40ec691238fd254d136bda673d6041d03a406f0c0a8747f57e30930c3661f9414864ec
- SSDEEP 768:3c4f44voYXoCA1lPKLXSIptrxH7iryQgbmefLPGdGD0I7riiD:bvoBL1lPEXSe1xGgbm2+d8PD
- TLSH
  T188E26B02A3C88733DBAE46B8F8F112614B72C762B563F71779C8A5EA4D537154A123F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  hardware\DiskInfoToolkit.dll
- Size 882KB
- SHA256 1acbf51b3c10c51c986cf43021680d34a2e38d9a5ba652bcfa9a1b5f7fc09800
- MD5 0485939203a30164063ae25e10b8315d
- SHA1 d9a34d47df2e7bab2cd7ea12c054b761d918f9e2
- SHA512 b90a216d43a0198765942b27db36b6f933061d9da24b44bdc4d097e82c162619a2906ef51676d5d4f95ffdd7f50489a4ed9b15669a2ce59c030a00339a30df80
- SSDEEP 12288:bGB1zTwxF4Nd8FmqqNASPciHXE/ywo1MsCgqivn72Gt6rFI4nLo4v:bGBxwxF4Nd8wVNAYX3u4Mxmmq4nLok
- TLSH
  T12E15BFB443A92D23F6AF1FF288A350404AF2B02E5637D78DCDD5D8DD98A9DD06818727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  hardware\HidSharp.dll
- Size 256KB
- SHA256 d86690efde30ea9179f669320f39148853793b743a98b531afeaf30598e22f54
- MD5 3876a747858ca11995f25a8a4a8db104
- SHA1 4094d7e274f9d87d8c93f3a8aa14606dbf3994d8
- SHA512 c67545f6ca74dc59690e12b00a8c0ddb848926c414f8d8af14a2290f5ed647a481542f90c7b47522c1ba32116ebd3f16a49315a86c8a8d7508759ab7335add78
- SSDEEP 3072:E1lZKoJKw/ATXA2okJSY4tvmWB7pbDXQrKsbiffsv0JKdyxCCqIZ2nyreCoe+:ERJ+TXA2okMjv3BlYKYAs8iyXWyCCoe+
- TLSH
  T13C448D0D5BEC862FDDEF4735B43298148BF1E495A212E7AE15ACD4EA1C937C089413E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  hardware\LibreHardwareMonitorLib.dll
- Size 1.1MB
- SHA256 6ebc194316536ba61af5be24508ad9fcbb2ecc685e716c12e787c79530f66bf0
- MD5 ecc49bd21fc187ba1a39b2f84bcfb9af
- SHA1 eea8552e5ed715ffa6882a2c6335d4c1f9fe5ea9
- SHA512 34573db40fa4482953146e852015d3a802cac263aa78910cb33f0aee271e2412494a4a6c219c785f6c7696d3fab0f79d2b257b69c5ba7b62fb424e473ec7e03a
- SSDEEP 12288:oULSvX11MU8+ylPuOvUnp5U5y2Cobblutpd6d3BEv1Gy7:oWSktWpw/lgdm
- TLSH
  T1C645290176DC6E76C49E0A7A28705D0293B4BD53E729B71F70ACBA4E0ABB7412F54393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  hardware\Microsoft.Bcl.AsyncInterfaces.dll
- Size 27KB
- SHA256 bda069b17261a50f36b3a79a88b0243d7b9f6508725598adf88d42471977720e
- MD5 6b81ffcec37066c94500d0845f580e91
- SHA1 795e193099214a767cb642c2b48022ef3e59e63d
- SHA512 9213cd310664c429c4d1981b530639c33104b9d17ed8121304af6ec48ee6c3095f4d78365ad7d6141b2a18a0acfaabfa63211420248c0d891c6078dfb2608c45
- SSDEEP 384:snuDmDZGXTmBxeg0ZrS2Yh0WXIdGl+IWY6FU2jWeT/WjjPDHRN77LDGTYAsR9zJn:suwIqBxEZ22LwJgFU23EvyMj9zGxji
- TLSH
  T125C26C55D36C4313CFAE2FB5E969C6822D74E38A3C33DA3E1248E6550C97788A63523D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  hardware\Microsoft.Bcl.HashCode.dll
- Size 26KB
- SHA256 3a4e851ee5fc0f6182aa5a3d65dc56fcd6979b65334b5c3b92fbdc791457c0ab
- MD5 64f530f8ddbc93262732071b4db864c5
- SHA1 7c2f349da43199522756e3c8a1d9ec94780888ca
- SHA512 f7f3375ed6325bfaad82ff1817ad434c0ffd113b1175fbc4bdb1507e745f3a9fdec12cff9b2100c7ae96350c91e6e0b0ec24a1c569eb9bfc6b6774d7460fa223
- SSDEEP 384:B0/kajL92ajiAOeRqwDpPIwcAakgj22WVr4WNYA6VFHRN7WszxIPaR9zeN:B0792ajnFRqwpPI4DFClWszxOW9zO
- TLSH
  T192C24A1E829886C3EFAB0D7025F5EB5B3D3853B59C1293B612CAE9181C437C5D621F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  hardware\Microsoft.Win32.TaskScheduler.dll
- Size 325KB
- SHA256 5e64f2b0912f3fd60d62c4907229033ef22a349791843c0a0e748b3260e3fcae
- MD5 692499d2aff48e4ac7cbe522e4d751d3
- SHA1 2f9dbc8480a9020c201265d89b74afb2a52bc95f
- SHA512 2037be19bff47efda5334369531621e0e91058889e6d111ab0e69d4bf100766747c3dcc4cf058370b61045ad0b031410ce5fdd14e5b06b92212d7f191fbc30f9
- SSDEEP 3072:AJA5RylsHmD5+nGklYTkliWHOdjb9LH4+SiM57Yw4Af9ekaGDaTAFnb6aKCaV8wM:JHmDnklYTkoWHOg+De9ekXaUb6wg
- TLSH
  T16E644B1127FC862AEAFF4B79E0B4021187B9F446E46AD71D9990A5ED1C23380D963773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  hardware\OxyPlot.WindowsForms.dll
- Size 32KB
- SHA256 0758b8a4c129730e4585e717d4183d48b1167a78e4955ce704d9e6cc204148b2
- MD5 a47766112e104a7060eaead11596c0af
- SHA1 a162547204a7e83faf3bcbfbaf89c9435f7a530f
- SHA512 920d78bb9ccea7c9a9fc565c813783ef7c8dd6f9e9c809c30f98468c237eb9964dea7a8bad4f167cef620a535b64cd2ab33b8fa19652cadbc80a1df2c8aa0439
- SSDEEP 768:KXIX0HO32phEI+9p+fq6gABT1vocBKbat51:xX0Hm229puq6gABT1gcBoav1
- TLSH
  T102E29E12A37DC33BCE6F87B0B1E551000B70921726A3EF596ECCA4AD69633541B083D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  hardware\OxyPlot.dll
- Size 684KB
- SHA256 da767e3d8c10674e6ffa72670952d1274544b453b68e774b29f03b5160a4a034
- MD5 e177d22c95941607be268b7ad74c905d
- SHA1 e3143c1d28c1ec9c0618603e948a14e60b7dfe16
- SHA512 9ff86f6b77341ec9443a02722a2c8e63340fc87b742346ef83d3a432b92e93064d32d107e61b64497d41f763d4c50950b448dc3288c54fe097ceb3204de61206
- SSDEEP 12288:Jf3ct+EtDf7QfKu0wlEyC/wN7DiNgrMYYq1zdu:ltE9D1L/wN7DiNKMZh
- TLSH
  T104E46C15777892AFCBCE4335E033C52E8AF1C01EE364BB5B851565DA3DAA3826D074A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  hardware\RAMSPDToolkit-NDD.dll
- Size 228KB
- SHA256 b6882354c7c8ec186617e421507743dbfae09c5c1fc24cef76a1d0c0c26651de
- MD5 91ba44579c19986cecd0751eae236849
- SHA1 db14f94ab9538b7fbedd0409d85bc812c586a500
- SHA512 d29dfc0661fd92917f42ccd9c0b899fd69fb6df41de961a4328601583c659b111c042537fc12406d38bdb52629da8cdbd9be57a1d8342da07d32f1cdc4211043
- SSDEEP 3072:iSIMqma7GgOgBfLH6tuiaHG7TYpIc7cxoCoYe3KpMQ38kpoASwM4RO:ihMqlGgOgdLMuiaHG7ECwcos
- TLSH
  T12B34FC6833F9694EF1F6FB78587641214F36FDAB6831C24E2A10998E5971DA09D30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  hardware\System.Buffers.dll
- Size 23KB
- SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
- MD5 902760412abffbd10be14842e83f0c09
- SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
- SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
- SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
- TLSH
  T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  hardware\System.CodeDom.dll
- Size 33KB
- SHA256 e9bca8ecab5f02df389ee4b306c32a93d7822b524a6eca90e449e13d4b4283a3
- MD5 85ae0b26e5e0b10eb3ee462219ae85b5
- SHA1 4c913cba7be160984d3bdb60c32f28f11ec7c9d9
- SHA512 25c7230c01b429cc0d369ded71c0a749424986ab0145b27857ea5833302c1c2293e805ea90404f175d773cc2fc93a538e29973c7a5bc33dcf59078e0054f128b
- SSDEEP 384:qqwpvR+I6Ai82PR3P8f41AE2YrqNdBxehzsCtZ7U6rtk2SBymvWBuWW/hljHRN7p:q/vm825UQSE2YdhzZu0mDjKp9zLjQ
- TLSH
  T1E8E23B2557EC47BEDFAB0B3029B7D59A1FF5A2D33821D31E164884051FA2BC88532B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  hardware\System.Collections.Immutable.dll
- Size 247KB
- SHA256 8c0f09a8b1fd730da3f3d2c4c831cdd76e3fca6bc588523d8f7eacf16d5a24e9
- MD5 d934981dbfd333ec46065d1a07fe519a
- SHA1 408bda88cb19963ab5e475b72fe3ff33656ea3e1
- SHA512 b630c269dbdc62cd0e5788f3d90cc33f32ea013bdd4a7d17d18d42288cf47d8ed2782036d97ca70b84be1d841718f4031c7f6fa9ebfd3ddb6af2fb5d006ddd02
- SSDEEP 3072:5qWFCj166bM6aJAw3DtDbmTX+/iFE1DN6n7vEuKy/i7OXMaUh78VE7rBJsqibnwc:5qqY66/sqVEUEudyCM4Vwshwc
- TLSH
  T1F9344A11BB9C9B32EABF4C73B9B094A94A32C513919EB38E65DEF7F018E33145C58065
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  hardware\System.Formats.Nrbf.dll
- Size 69KB
- SHA256 27514fbffb0776c37ede88ec371310844f7bec55a017627aad60180f268769e4
- MD5 5bce8d9f4c55c07441c4bed1662e4624
- SHA1 849776926258b181d4b31f94cf95b929e995a024
- SHA512 89312940e90da50793721747218f536b3983bd061582a157d9af1f1ecc145bad1ea554a7fa61c07fcb6b5cb9724b4a556b3254d590a9c43ffb42ff9107e8df53
- SSDEEP 1536:8fefdoRvZ2oYoKiuQO6elSEPc7ijvUTNyi0lzEt:8fefiRAQ0Qi3Pc+wPE6
- TLSH
  T1CA638D5D63EC5B6BDFBF0E7978B8E1150736E54A2002E39D1CC0B9D9094BBC85A2077A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks whether UAC is enabled

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32