ab9cab8749d4065ddcb12aba8afddf0021690c01880b9f965ece76098bbdb9af

Sharing

Copy URL Twitter E-mail

General

Target
PoiTime-v1.3.0-beta.6-windows.zip
Size 1.3MB
Sample261102-nylvwaszct
SHA256 ab9cab8749d4065ddcb12aba8afddf0021690c01880b9f965ece76098bbdb9af
MD5 77996baa3b6c15279bd9871cb545a2d7
SHA1 bd17944771eb013467edbe15e52e8a38b4a2787e
SHA512 a44b9d89e7c64557a3c97851b07c75d8b84cb81bb99fae71b15d4b6e014fb8dab96f8be5817e7a42b24735ea4eb90845459d635b063db528048b22c5d622a491
SSDEEP 24576:AJV5NKhByP7PjefN9cWvcFRmXLSSJN6AAtXIdPsyY:zQmNOWvqmXLSSJNkSdP7Y
TLSH
T14F55336C7B6885FBD15225F5C7F8D696EC32AC5AC323F7371ED214A408035482C6EE9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Targets

- Target
  Microsoft.Bcl.AsyncInterfaces.dll
- Size 25KB
- SHA256 648e618c2a32867ebecbf9b39c6767d782dfdba3988702038bf4a7fdc62c0be9
- MD5 8dfe07dd49954b2275908cc0b5f6a605
- SHA1 b6b2ca2829b2044ab0b8b73fab4e5e1235cd8720
- SHA512 497ab200c7de477098e42687711279442aaa95ed8df941fe699a43c5b49ea787c45698db9f7b149f331b491c3e2f8c4adecaf809aff8e5b11731f2108d0b5e56
- SSDEEP 384:49OJWqnwKBbNA30VES2j0cX6dAl+NWfVzrdc4SWen/W3YA6VFHRN7aOoOYlORR9m:mulwKBhZVv2wK5hdcXkFClaOoFK9zW
- TLSH
  T192C27D0AD35C6317CF6B2EB5E5B4C6422E35D78A2C12EB3E1188E6991D47385BB31738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Microsoft.Win32.Registry.dll
- Size 22KB
- SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
- MD5 da40f3db8b34571684c0cb5bcecd2a79
- SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
- SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
- SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
- TLSH
  T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  NAudio.Asio.dll
- Size 33KB
- SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
- MD5 eb254b04d63a9f03b77563243805f68f
- SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
- SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
- SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
- TLSH
  T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  NAudio.Core.dll
- Size 183KB
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- TLSH
  T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  NAudio.Midi.dll
- Size 45KB
- SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
- MD5 3f5c79100f4f7902114c3fcba275c606
- SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
- SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
- SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
- TLSH
  T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  NAudio.Wasapi.dll
- Size 175KB
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
- MD5 278ebb79da14ecf8e0559530c2fda076
- SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
- SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
- SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
- TLSH
  T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  NAudio.WinForms.dll
- Size 40KB
- SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
- MD5 be8205f435b2afbfd178960c46310c17
- SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
- SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
- SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
- TLSH
  T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  NAudio.WinMM.dll
- Size 56KB
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
- MD5 faf1ba532964984a34d60674fbc7a5a7
- SHA1 0999178949de510a47d87de3b8a117a003c572ee
- SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
- SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
- TLSH
  T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  NAudio.dll
- Size 7KB
- SHA256 8bf0f2e8dadf3967757191c2212c269333ccd9d7e59839eea968212c64787be9
- MD5 c583aa3819b16ae53859f728f59ea9a0
- SHA1 b699e8e2cfc52bc3cfba182fdabfc7f6ff8f82de
- SHA512 580fa002b890c6c36dd907b40a121153eb12192721e67b7209c9bffedf8e18128b75ed454d813b67c67040fe5869816ac10e624cd8dce68917a85dd5426a490b
- SSDEEP 96:GBFskeJHn4jZkcLqEm5Nj7AVUhkon1MrtrRGD5pkQa1LrjSd2V:G7kHn4kcLaj7zSon1MRlvQa1fjSm
- TLSH
  T14AF1D729A398C676CA674BF1A42703400339EB40EA57CB2D0D9CA59FFD133185AB27D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Nager.LicenseSystem.dll
- Size 9KB
- SHA256 18dd31c24b67d72d78dd0a56e52f12e8720ee08a5eb460b4754c6df3a5c22d43
- MD5 391ea369dce6acd24a17f44d5f60b571
- SHA1 533a93fcf227eae27f54aaecd92b8a637de3cc71
- SHA512 6cd511e3a7df08b21a9017e7207f1b4058d40952688904d7d283104d61ef1328498a561e31bca4fa92c2776d98ac90e5f3eee844ea91ac52646c84b4f67a1956
- SSDEEP 192:NsHgcrcZWj4jyDilaVZxEJ1an2ZoFbjvTf:NUjQZWj4jyDilaREJ1aiG7
- TLSH
  T11612E875B3E88336CC7B4B7AECA3938106B5E704A947DB7E5C08E10AA8123515BB1737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  PoiTime.exe
- Size 189KB
- SHA256 0d1a0ea614ef173649a2e1fd319e8b575cacdd73959de77080f37ff06891bd00
- MD5 460c58e648b529a2cd6b62dc92048ecc
- SHA1 26f4578c16daeb93f5bcfc7e046b3c55436b45ab
- SHA512 0e0c9be5de76fb58817d917251f6f152bd97ea9b8d33702d68302e6b402946c4e539094793655efa775b48a2989a2cbc38aede29060a14221f37deb20daaa103
- SSDEEP 3072:XQEvViCV0q4DQAcBUMmzXAUSJR+I1mov0E0vurAvbgQNUhphdQFA:XQEdN4DQAccbApDAm80d
- TLSH
  T19614D054337CCE27CAAF5ABD6098405247B2D207E602E78F1DDEB5ED27A63D00D06A97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral23 behavioral24
- Target
  System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  System.IO.Pipelines.dll
- Size 82KB
- SHA256 d416d440146494df80ebf328595fe8f2719d26b3993ab69233d93ee541dbdbc1
- MD5 cc99ca48eacc0dd56ddd1aaddc39f4ad
- SHA1 88a7d61e434d2def4583931695743db0953dbeb2
- SHA512 3c4f727e2f2d7e78483ae2496ae09001bbfb7d485a30fd574ff253ae7f52cfe4e16307342fdcebac24ddce9d01f2fa00c355abec55d41ca14c85129930ca9047
- SSDEEP 1536:gOBEtNwWq02pH6ZafBzoGrriJNNjrgFXjfYbsA+Yo4bgN0xeR5evOjvjTT4Fo/tu:XBSNTAl6ZcBzoGQ8XScYo4bgN0xeR5e8
- TLSH
  T14C836B6857BC472BEFDE1EBDA17095020FB7D7166913F74AAC8CB99D188738046242B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH
  T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  System.Net.Http.Formatting.dll
- Size 175KB
- SHA256 00664130b963ace5f1243ae4786926ea81bc181086fc7149d6123567c304d35b
- MD5 4a7816cb1067972450045e4afa50a0b8
- SHA1 b92c69941c66d5526ff151e523eb92a8a90fc06a
- SHA512 5d26f6d696a4fdf2eaf204683ed18e8baa75c88fb78eabbd478bbe4f91f46243a2bbf0eb0a6137dced21c112662c8e431a8b4fe88dcf669d5ceda0a860798c8a
- SSDEEP 3072:MXWun8fS8fCk/Difbw37DVGbG8pwp2UuRLYs1+6fS:MXWu8fS4L/DS8rZGbGb5
- TLSH
  T125044A2967FC8B1FE7FF59B8F430A454CE7AF2065416EB4D2849A0EE1493340E521BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32