15a7ae7b518a0f6683bd08e2b8ae931a1b80e84adf3b3077265ce24fc7ce9b2e

General

Target
Ashenova_Setup.7z
Size 51.8MB
Sample261107-p126bafa33
SHA256 15a7ae7b518a0f6683bd08e2b8ae931a1b80e84adf3b3077265ce24fc7ce9b2e
MD5 958f1af85c0a58100053ca68e0c76fad
SHA1 2aa3b14dede5a781ddc4ff0ae52a00f20058d53a
SHA512 bbc8e7aa744da5208a5142b68edf73d5d2e19bf581f4da22f7f2b19d29373af4ab6f865a6e837a0d84d38e1ab6ecd87831b040a24f21903d16b1f9f6555d993e
SSDEEP 1572864:VUw+O6wIcLv7nuusl725qwX7KD0L6Z/wN0zmPg:2w+0Icf1w7Gq87Yi6ZIN064
TLSH
T1A8C733AE1CCC0C366AC6CF8FED4E09B26588B63880E4F79489B1756768BC55B1DF019D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\__pycache__\_mode_siv.cpython-310.pyc

Ransom Note

o ��j�4��@��s��d�Z�ddlmZ�ddlmZ�ddlmZmZmZm Z �dgZ ddlmZ�ddl mZ�ddlmZ�dd lmZ�dd lmZ�erCddlmZ�eeeef�ZG�dd��d�Zd d��ZdS�)z- Synthetic Initialization Vector (SIV) mode. ��)�annotations)�compare_digest)� TYPE_CHECKING�Optional�Union�overload�SivMode)� unhexlify)�Method)�_S2V)� is_buffer)� bytes_to_long)� ModuleTypec��@��s��e�Zd�ZdZd5dd�Zd d��Zd6dd�Zd7dd�Zd8dd�Zd9dd�Z d:dd�Z d;dd �Zd<d"d#�Ze d=d%d&��Ze d>d*d&��Z +[email protected]&�Ze dAd0d1��Ze dBd2d1��Z +d?dCd4d1�Zd+S�)Dr��a��Synthetic Initialization Vector (SIV). This is an Authenticated Encryption with Associated Data (`AEAD`_) mode. It provides both confidentiality and authenticity. The header of the message may be left in the clear, if needed, and it will still be subject to authentication. The decryption step tells the receiver if the message comes from a source that really knows the secret key. Additionally, decryption detects if any part of the message - including the header - has been modified or corrupted. Unlike other AEAD modes such as CCM, EAX or GCM, accidental reuse of a nonce is not catastrophic for the confidentiality of the message. The only effect is that an attacker can tell when the same plaintext (and same associated data) is protected with the same key. The length of the MAC is fixed to the block size of the underlying cipher. The key size is twice the length of the key of the underlying cipher. This mode is only available for AES ciphers. +--------------------+---------------+-------------------+ | Cipher | SIV MAC size | SIV key length | | | (bytes) | (bytes) | +====================+===============+===================+ | AES-128 | 16 | 32 | +--------------------+---------------+-------------------+ | AES-192 | 16 | 48 | +--------------------+---------------+-------------------+ | AES-256 | 16 | 64 | +--------------------+---------------+-------------------+ See `RFC5297`_ and the `original paper`__. .. _RFC5297: https://tools.ietf.org/html/rfc5297 .. _AEAD: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html .. __: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf �factoryr��key�Buffer�nonce�kwargs�dict�return�Nonec��C��s��|j�|�_� �||�_||�_t|�dvrtdt|��|d�ur5t|�s%td��t|�dkr/td��t|�|�_ �t|�d�}d�|�_ t |d�|��||�jd�|�_||d��|�_|j |d�|��|jfi�|��tjtjtjtjtjg|�_d�S�)N)� ��0��@��zIncorrect key length (%d bytes)z?When provided, the nonce must be bytes, bytearray or memoryviewr��z*When provided, the nonce must be non-empty��)Z ciphermodZ cipher_params)� block_size�_factory�_cipher_params�len� ValueErrorr�� TypeError�bytesr��_mac_tagr��_kdf�_subkey_cipher�newZMODE_ECBr ��UPDATE�ENCRYPT�DECRYPT�DIGEST�VERIFY�_next)�selfr��r��r��r��Zsubkey_size��r-��[C:\Users\Admin\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto/Cipher/_mode_siv.py�__init__D��s&�� zSivMode.__init__c��C��s4��t�|�}|d@�}|�jj|�j|�jjf|dd�|�j��S�)z*Create a new CTR cipher from V in SIV model ��)� initial_valuer��N)r ��r��r%��r$��ZMODE_CTRr��)r,��vZv_int�qr-��r-��r.��_create_ctr_cipherf��s�� zSivMode._create_ctr_cipher� componentc��C��s>��t�j|�jvr td��t�jt�jt�jt�jt�jg|�_|�j� |��|�S�)a��Protect one associated data component For SIV, the associated data is a sequence (*vector*) of non-empty byte strings (*components*). This method consumes the next component. It must be called once for each of the components that constitue the associated data. Note that the components have clear boundaries, so that: >>> cipher.update(b"builtin") >>> cipher.update(b"securely") is not equivalent to: >>> cipher.update(b"built") >>> cipher.update(b"insecurely") If there is no associated data, this method must not be called. Args: component (bytes/bytearray/memoryview): The next associated data component. z<update() can only be called immediately after initializationN) r ��r&��r+��r ��r'��r(��r)��r*��r#��update)r,��r5��r-��r-��r.��r6��o��s ��zSivMode.update� plaintextr!��c��C��t�d��)z� For SIV, encryption and MAC authentication must take place at the same point. This method shall not be used. Use `encrypt_and_digest` instead. zEencrypt() not allowed for SIV mode. Use encrypt_and_digest() instead.N�r ��r,��r7��r-��r-��r.��encrypt��zSivMode.encrypt� ciphertextc��C��r8��)z� For SIV, decryption and verification must take place at the same point. This method shall not be used. Use `decrypt_and_verify` instead. zEdecrypt() not allowed for SIV mode. Use decrypt_and_verify() instead.Nr9��)r,��r=��r-��r-��r.��decrypt��r<��zSivMode.decryptc��C��s:��t�j|�jvr td��t�jg|�_|�jdu�r|�j��|�_|�jS�)a ��Compute the *binary* MAC tag. The caller invokes this function at the very end. This method returns the MAC that shall be sent to the receiver, together with the ciphertext. Returns: the MAC, as a byte string. zAdigest() cannot be called when decrypting or validating a messageN)r ��r)��r+��r ��r"��r#��derive�r,��r-��r-��r.��digest��s�� zSivMode.digest�strc��C��s��|��S�)z�Compute the *printable* MAC tag. This method is like `digest`. Returns: the MAC, as a hexadecimal string. N)rA��hexr@��r-��r-��r.�� hexdigest��s��zSivMode.hexdigest�received_mac_tagc��C��sL��t�j|�jvr td��t�jg|�_|�jdu�r|�j��|�_t|�j|�s$td��dS�)a<��Validate the *binary* MAC tag. The caller invokes this function at the very end. This method checks if the decrypted message is indeed valid (that is, if the key is correct) and it has not been tampered with while in transit. Args: received_mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z3verify() cannot be called when encrypting a messageNzMAC check failed) r ��r*��r+��r ��r"��r#��r?��r��r��)r,��rE��r-��r-��r.��verify��s�� zSivMode.verify�hex_mac_tagc��C��s��|��t|��dS�)ak��Validate the *printable* MAC tag. This method is like `verify`. Args: hex_mac_tag (string): This is the *printable* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. N)rF��r ��)r,��rG��r-��r-��r.�� hexverify��s��zSivMode.hexverify�tuple[bytes, bytes]c��C��d�S��Nr-��r:��r-��r-��r.��encrypt_and_digest��zSivMode.encrypt_and_digest�output�Union[bytearray, memoryview]�tuple[None, bytes]c��C��rJ��rK��r-��)r,��r7��rN��r-��r-��r.��rL��N�&Optional[Union[bytearray, memoryview]]�tuple[Optional[bytes], bytes]c��C��sn��t�j|�jvr td��t�jg|�_t|�d�r|�j�|�j��|�j�|��|�j� ��|�_ |��|�j �}|j||d�|�j fS�)a)��Perform encrypt() and digest() in one step. Args: plaintext (bytes/bytearray/memoryview): The piece of data to encrypt. Keyword Args: output (bytearray/memoryview): The location where the ciphertext must be written to. If ``None``, the ciphertext is returned. Returns: The tuple ``(ciphertext, tag)``, both ``bytes``. The ciphertext is ``None`` when the ``output`` parameter specified a location for the result. z@encrypt() can only be called after initialization or an update()r��rN��N) r ��r'��r+��r ��r)��hasattrr#��r6��r��r?��r"��r4��r;��)r,��r7��rN��cipherr-��r-��r.��rL��s�� mac_tagc��C��rJ��rK��r-��)r,��r=��rW��r-��r-��r.��decrypt_and_verify��rM��zSivMode.decrypt_and_verifyc��C��rJ��rK��r-��)r,��r=��rW��rN��r-��r-��r.��rX��rQ��Optional[bytes]c��C��sx��t�j|�jvr td��t�jg|�_|��|�|�_|�jj||d�}t|�d�r)|�j � |�j��|�j � |du�r2|n|��|��|��|S�)a��Perform decryption and verification in one step. A cipher object is stateful: once you have decrypted a message you cannot decrypt (or encrypt) another message with the same object. You cannot reuse an object for encrypting or decrypting other data with the same key. This function does not remove any padding from the plaintext. Args: ciphertext (bytes/bytearray/memoryview): The piece of data to decrypt. It can be of any length. mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Keyword Args: output (bytearray/memoryview): The location where the plaintext must be written to. If ``None``, the plaintext is returned. Returns: the plaintext as ``bytes`` or ``None`` when the ``output`` parameter specified a location for the result. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z@decrypt() can only be called after initialization or an update()rT��r��N) r ��r(��r+��r ��r*��r4��Z_cipherr>��rU��r#��r6��r��rF��)r,��r=��rW��rN��r7��r-��r-��r.��rX��s��! ) r��r��r��r��r��r��r��r��r��r��)r5��r��r��r��)r7��r��r��r!��)r=��r��r��r!��)r��r!��)r��rB��)rE��r��r��r��)rG��rB��r��r��)r7��r��r��rI��)r7��r��rN��rO��r��rP��rK��)r7��r��rN��rR��r��rS��)r=��r��rW��r��r��r!��)r=��r��rW��r��rN��rO��r��r��)r=��r��rW��r��rN��rR��r��rY��)�__name__� __module__�__qualname__�__doc__r/��r4��r6��r;��r>��rA��rD��rF��rH��r��rL��rX��r-��r-��r-��r.��r��s.�� '" " �!�c�� K��sR��z|��d�}W�n�ty�}�ztdt|��d}~ww�|��dd�}t|�|||�S�)a^��Create a new block cipher, configured in Synthetic Initializaton Vector (SIV) mode. Args: factory (object): A symmetric cipher module from `Crypto.Cipher` (like `Crypto.Cipher.AES`). Keyword Args: key (bytes/bytearray/memoryview): The secret key to use in the symmetric cipher. It must be 32, 48 or 64 bytes long. If AES is the chosen cipher, the variants *AES-128*, *AES-192* and or *AES-256* will be used internally. nonce (bytes/bytearray/memoryview): For deterministic encryption, it is not present. Otherwise, it is a value that must never be reused for encrypting message under this key. There are no restrictions on its length, but it is recommended to use at least 16 bytes. r��zMissing parameter: Nr��)�pop�KeyErrorr ��rB��r��)r��r��r��er��r-��r-��r.��_create_siv_cipherQ��s��ra��N)r]�� __future__r��hmacr��typingr��r��r��r��__all__�binasciir ��ZCrypto.Cipher._state_machiner ��ZCrypto.Protocol.KDFr��ZCrypto.Util._raw_apir��ZCrypto.Util.numberr ��typesr��r!�� bytearray� memoryviewr��r��ra��r-��r-��r-��r.��<module>��s"��7

Emails

+[email protected]&�Ze

Targets

- Target
  Ashenova_Setup.exe
- Size 51.8MB
- SHA256 bd6bcd1220804966cde6656f3b6153f7a452b07fdf0ed109c152dbbe71698978
- MD5 b3519993c86dcae3f9bacbce44c09c06
- SHA1 2dedff930f104ff5f50b0261f3038cad4b39ce35
- SHA512 eb60d9780577571f2a69e7f35c659002e99ace7c92751d0b35b00707a9b7b8aa24c2597804c6b593074701774c192257109a4c390d66cf0e1f72b44a31cabe66
- SSDEEP 1572864:tLUb0UGfBQyFGVzhm5DtZBGyKA9C6Lla6a1Dbp:1Ub4fBORc5JZMyv86Lw6aVN
- TLSH
  T12DC7339E1CCC4C32EAC6CFBFAD4E09B26588B63480E4F7944AB1356768B855B1DF019D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security bypass
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  Ashenova.exe
- Size 72KB
- SHA256 78cfe04abeafb6a1f2131fc179d766f14112ee6c6b7262d464d0612c42bcb844
- MD5 dbf35bacb95d350ec1133f2a029aef98
- SHA1 b6a226ab8e8b21749c152a6aa8b925a50e47babe
- SHA512 b7f733d8bfe3806851f8b73ffdc96845c3a8f800407e37b9816d2a6819da72a9a82b781dd97e4b089d704ed5bb744abe369096a87e916461bbd2b1e74a157311
- SSDEEP 1536:J+nQc1w4vuFv0hEe2+bO0DEtauqDCrGRdm6hF/Z2qGqxF96YppNqw:Un77v00hEoDEtauqDDRBbhLGqxFJpNqw
- TLSH
  T18273DF029BB0C51BDAF29B711D3C2E2BCFFA931825A4479303548A5C7B636D1E94E7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security bypass
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2