a4d56ceedcc7a24812e07ff15c34f72e1e402f9b90daaec575a878d3e04af2fa

Sharing

Copy URL Twitter E-mail

General

Target
azahar-windows-mxe-2126.2-installer.exe
Size 46.0MB
Sample261113-anmsjad13v
SHA256 a4d56ceedcc7a24812e07ff15c34f72e1e402f9b90daaec575a878d3e04af2fa
MD5 ce8d332dfba46b0f33d19d16d7204f19
SHA1 cb42aeec6ec97b3bc3f6ab0c4736e31eae1fea27
SHA512 0849e9d30387edfd1365d9649671fb2df857516d57e380b689652c3039347c185ad068989b50dc7ffd9cb20f0017a6cacbb7788503f37234d64815cb6e77f329
SSDEEP 786432:+PquHnb1QErJYCQzlZ4TKLC5ZiT+tpo94PEmoE39gXq/Ze0PrFqBxcWXY9cajzrO:9onb1ZKCw/4TK4G+g9GEmoRXuZe08Bxr
TLSH
T1BAB7336F8F51D2E5EE911B374165F23191B02D5A0E1A621C6BD23FE37B32B862532E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  azahar-windows-mxe-2126.2-installer.exe
- Size 46.0MB
- SHA256 a4d56ceedcc7a24812e07ff15c34f72e1e402f9b90daaec575a878d3e04af2fa
- MD5 ce8d332dfba46b0f33d19d16d7204f19
- SHA1 cb42aeec6ec97b3bc3f6ab0c4736e31eae1fea27
- SHA512 0849e9d30387edfd1365d9649671fb2df857516d57e380b689652c3039347c185ad068989b50dc7ffd9cb20f0017a6cacbb7788503f37234d64815cb6e77f329
- SSDEEP 786432:+PquHnb1QErJYCQzlZ4TKLC5ZiT+tpo94PEmoE39gXq/Ze0PrFqBxcWXY9cajzrO:9onb1ZKCw/4TK4G+g9GEmoRXuZe08Bxr
- TLSH
  T1BAB7336F8F51D2E5EE911B374165F23191B02D5A0E1A621C6BD23FE37B32B862532E07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  plugins/imageformats/qsvg.dll
- Size 90KB
- SHA256 6625a2f988da58340277f288b50ea71cc1816176e2248fd2b55680637b9283b7
- MD5 61bd0e5a6db37dd407be8032140dc32a
- SHA1 dc7188bc0d09479a7664fc18d59a4ba987245681
- SHA512 c21b03af25c2c2f389ad3ffb24d0b6e77a18c39f9b37882493798329568b29e56e0a9dd4a2bc4c3acc87f8534284e4abee42901270e2a44179cf6e470d3bd733
- SSDEEP 1536:eb36Y4AtjmEJhZhspQEUUPNqjhqWTHn3gfr4xoWbS7M:euZAtjmB0j/dFS
- TLSH
  T195930527A355EBABC9944B3895BB0319FA35E8022B074ADB7D1641390F737EC6E37640
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  plugins/multimedia/ffmpegmediaplugin.dll
- Size 987KB
- SHA256 0a8b026e49e8183c669bdb0b3c1ea2ff354572db8d9642412ecc28279a95cad0
- MD5 0b2f1a79de2066d6b6e26e21085d771d
- SHA1 ba06726c4f96b668bf6d67e29bba02573497a204
- SHA512 dd78aa441eb1735dada7efd538040e9eaf8e5cc9908ea82cb088b276b9369f41e62afc1287a827dc7162c667f1ff3e5a9978a7ba7e9bdce7c6cf2ee483f7b535
- SSDEEP 12288:6iedwL01MinwZYuPuip6opEpbWrCizxZkfifPNDxT:6ibL01MDeijpEQrr3fPNDJ
- TLSH
  T19F252A22A7419AEFCC5ED338D6D71732F6347844173BAAD7A540463A2FA6BE41B39700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  plugins/multimedia/windowsmediaplugin.dll
- Size 1.2MB
- SHA256 b11eb33efb889a2f752a7079a5bbad7508f6baba9d3089bebc6352adbb62b064
- MD5 4bb3744ca9d284fe3063e359a50269bc
- SHA1 8b1edef55e1c1daf0e37d65d06423ca39cabbe22
- SHA512 d525587e34ac6ce499d9aba87a52560ebe5471382f768b58c8d983c4c8c39d6b3768903e0e4a91c93b9e931267e472317bb17c214527ae06b9c7c9f553d0fa7b
- SSDEEP 24576:Vb7wTFMI3xGS62kIu0BtkXMl9q1QlvSCc0h1:8sS2akXMl9q1AvSCc0h1
- TLSH
  T1A1551919A200EB57D42FCB3D69EB6902F77078402727DB9776400E781E77FCA6A39648
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  plugins/networkinformation/qnetworklistmanager.dll
- Size 509KB
- SHA256 09667a8e9b560a15e5d162b1929bb794b07a35b5f5c67fcadf9a60155d2d1ea8
- MD5 bc97426befdf650843eb0f5b913ed5ba
- SHA1 5c9531e1e4b26391ae665c7ec3dbdd092d87b95e
- SHA512 8559fee746c6f8e2830c209e4f164e8482028eee89a80ca83a0351d66ebace9cb2f2bfff89b7fc0d7b70cf42c646be587f5dcb2e5ac07de3c1af485185168931
- SSDEEP 6144:UHzUo5Utptc+Wa305P2AMIBeq8PFCCVI2hFEOc:MUtKF5+2KNCeIIFEZ
- TLSH
  T12AB4E70E5211E7A3C56FCB3B29D7A502B770A0406327DF5726000D7D6E77BC72EAA94A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  plugins/platforms/qdirect2d.dll
- Size 2.1MB
- SHA256 875e7a8fcbab9ab492398dba4fc6ef1658d567a0b40e6c7f4e04327f918c6246
- MD5 37e81507b776783cf4fe82f6a6fd943b
- SHA1 0345ef63018d0b447a01399e5811c762eee0932c
- SHA512 21cd7ecd27d5f377fbd300a6f2bc73e1a0188061cc97d9c9215867bd574b14f7112ba43ea94da56b1a45913be8f3a720b7f138749f6d9ebbe66bffb510e8a419
- SSDEEP 49152:49X25dDyMmtFjbE5adJBzaiqrJYWt2PpWebM0cgN:q+yHZzQJ1ipWhq
- TLSH
  T151A52816E300D6ABD46EC73969CB1622F57038414B77DAE746800B39BEA3BD2273D749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  plugins/platforms/qminimal.dll
- Size 102KB
- SHA256 32ad63c1cbc3866684cb1035a6d28ae4cd12b62a9ed9152160f867310d4e733b
- MD5 e0b9ce13f38250df567cf1db19a9d553
- SHA1 32a2722e422144966ab9c80571a2c9e3c9873c18
- SHA512 06334590e8cf6afdbfdd490f1f6d4f411a864d869ad307bd971846a718ae247d835b05a9f57f4a3e109af6b5f774a6517005af6e59487306e13ed659bd6bcdbd
- SSDEEP 1536:MvdtlCJhZhspQEUUhNJEJVWFytwKinr4xoWYuJ:Mvdtl57E7vH
- TLSH
  T12BA3E6226715DAAFC9598F3A80E70219FA38F9011B439ADB7817413A0FB77D82B77750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  plugins/platforms/qoffscreen.dll
- Size 201KB
- SHA256 a1a6b0cb6afe19c79546599c74be95bd4b969bc3213b1211ff6298f683570d42
- MD5 098ebc8faf845caa206935d4d5aa312b
- SHA1 df5d900b5039371dd29ff3545485ef49ad95c121
- SHA512 98d8d14a175a60f4dda5aa68d1cd2bd714660e9d91d70bf543743853a5ffa9d2c554f01a9f766cb5ca8422ffd2823ff132fde602658eb0d4f23c26a968716215
- SSDEEP 6144:BQE8KFAAtRxTyC12u5BiORmHuZqPNXv7X:9sKTyUuf
- TLSH
  T1AC1429226711899FD4A58F3AC1D70226F336F8010B17AADF7A4602365FA7BE41F36794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  plugins/platforms/qwindows.dll
- Size 1.9MB
- SHA256 249546edd0eb8152e46f8d7ad8046578cfaf347605074fcaa30fe4e6ca580e21
- MD5 375b69b004554b42ce458e5ff1eee9d5
- SHA1 8da8d5e029f796407d652f95098a8d2d61324525
- SHA512 bcc6251a2e88f660fb632be1fa845c3f8d8194d63878c0606540da2b54e3e0cffc1f767efa346b11871edaeae5094552f0315bd1dabe0e4831b82ca6dd20b596
- SSDEEP 49152:C8gbEuWB1uHHbuxEx2H1p6ilykklXDMLpHR:C9AD/HyilWlXWx
- TLSH
  T19F952916E300D29BD86ECB3969DB1622F67038414B77DBD752800B39BEA3BD61738749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  plugins/qmltooling/qmldbg_debugger.dll
- Size 335KB
- SHA256 5ae806fe7131b57dc758833084e447f24ef8e5a6ef9d2d20ec5bb328eb6295c0
- MD5 53b11aabb4d810bdb1cedfc8cf5511f3
- SHA1 ee8897c8a1331966bcb58071401a479f46c0f462
- SHA512 c945af856a7fb7f054ab1f7f952a426db5d5079f7cd0facec61237069ce2bc3dc6a6afa2d4d42cb578e821cce8b88380c7f955704a9f95826d8670887794cd78
- SSDEEP 6144:DPsoHfK+P8a6ZI6MADqHOwG3p/tcE0ENPXNbNlYrMh:DEQoZI0SUjNNOrM
- TLSH
  T151742A22B38585EAF89AC738C6974321F932BC411B76F5EB968042317F57BE86739740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  plugins/qmltooling/qmldbg_inspector.dll
- Size 195KB
- SHA256 462ea59d74f34f04153082b6a0a11ca746b1b5a773d729c7a83e469e35c00a3f
- MD5 2a3b6df7c0ed4690210578b94fe1be1c
- SHA1 1c6f940091a4f14434d039b4362933ce22ed123f
- SHA512 9bbca7701415eae16c0b6d7013499cb783be58bec89a7a594c0edf5b637820cf50281da41bfd72b390ec9ee1fd2e0a6c7aad9a583d4a57a6b33cce9c43c0c0a4
- SSDEEP 3072:H0gPyaTxDtg8lymyP21utcEUdwjEn+SCNQrY:U+JTZviPftcrkRSCarY
- TLSH
  T1C9143916638886DFDC9A8638C9D70215FB38F8821B13ABDB559141386F63BF84F36785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  plugins/qmltooling/qmldbg_local.dll
- Size 89KB
- SHA256 702b5ebba0ec5449eeea5bda53ab1b65f3fe30d44b73c169294932fa9fb05245
- MD5 eeb86ffdbb0ac6abda7a2eecc74b7590
- SHA1 304a14b5bf62407cf695fa8a90a02c22c6e010ab
- SHA512 b32c8cb4b369a5d2a02099e33ae1e191307bb4b0268c70cba2cc460b12cee909843652dd8b004cc8858a3cce2d6d6f858f5f4429ace244a314995d4496bd16df
- SSDEEP 1536:rpXWtjQmFJhZhspQEUUfNQFhDWvtItdl2r4xoWdpVYkseYF4eH:rpmtjHAuFyIFbYksPe
- TLSH
  T13693F6166316FBABDA5A4B3094A70319F631E40267030AD7BE2280391F737ED6F77685
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  plugins/qmltooling/qmldbg_messages.dll
- Size 88KB
- SHA256 ed6b0ad354b4cffd0818f721f5bb0244a40d7f1ca7feb0243b89d723014680e9
- MD5 389880b57b1231254c02e60010361043
- SHA1 f879f03e6d895fdc60c78e8f7763f24d640be1c4
- SHA512 b7dd7b59275e1be006d887bf413d8a761d9c11c2b6f834fbc00d25e7a68d1b1c5a0355eea8a8479336d8f0ed03f1864596150ed2892db8c3b7cec6ce6fc8e4bd
- SSDEEP 1536:wFrUhwTt/JJhZhspQEUU/N3pRbWVg3SvVr4xoWHm5:wahkt/EBpRbA
- TLSH
  T13B931A16A385EBBBC9954B30A4B70219F634E40227076ADBBD5240391F73BEC6F77A44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  plugins/qmltooling/qmldbg_native.dll
- Size 104KB
- SHA256 b90bf95359d24e05fcec49cbdda34ecd2289e4e00a83b84ad35d724c955fe398
- MD5 b6ab410b20205b01021ce96335d75896
- SHA1 ee5b8bdf523aba5735f75a1bc69a0920eb21bcc8
- SHA512 35b3fad72777b843b0757cc1c90457580374b315acc134835c5396cbc087879215d0c4f089f8f2c1e5c8bdfa45a62c6a6b8f133e73620af6536c447c252169c9
- SSDEEP 1536:8aMLP030Ar66ZtD1oJhZhspQEUUPNDD81Wvu2qkZ2r4xoWCfZoI:HMAEArNZthlJD42ROo
- TLSH
  T156A32912A354DBEBE9468A3485B74225FA35F40227025EDBB85301385F73BEC6F37686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  plugins/qmltooling/qmldbg_nativedebugger.dll
- Size 128KB
- SHA256 d12d459f6dabb643406c749db6a7738373b634c05bd67c1a1a661da75b475f2d
- MD5 7e861ce9345f3c83c63cab98651c3d1b
- SHA1 6b59e3ebe324d838b086876a6bde03976e3c4e71
- SHA512 5776bd1e9ec4928a55656b6a1e932f493d3aac796585e3c054136e5af41555cb05af83cd890082fbe3ce10698a288f3aa0de317aaa2a744bfa83346da8b463cb
- SSDEEP 1536:JDCgeTFnmhxKaJufoG/nFxOstVfJhZhspQEUUiN6B4z7Wt59+q0Sr4xoWiZzht32:JnYuQfxXOstVfYBu2qKkR
- TLSH
  T11BD30C12E345C7ABE459CB34D6BB0226F631F8011B5669DB6A8142342F63BFC6F3A744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  plugins/qmltooling/qmldbg_preview.dll
- Size 345KB
- SHA256 e163acaf5f304601499a86fd0bbc37a8350528f3a7c47bfaf9bf2a22c550d7af
- MD5 802179ddc17c8594fdc73b7ad2b28911
- SHA1 b2818dd82491261b3a68bbe179dfe9757dc2beb4
- SHA512 7458b2843e5f260810adeae3d855a8b6c1d92319dbac4340c28ae3ac4223e92b65c78612eeda700f3240e92c3fa6cfdc9d64ffcc7f6d70b80cb63a4ec89f3089
- SSDEEP 6144:m4skyzfWy0p5bToXxnsNtGI/SGCs8tJavKn:m5jfz03bTohnslWs8tJavKn
- TLSH
  T195742B52A35585DEE84AC7388BC74221F931BC421737E9E7968142356FA3FE86B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32