022e498fe973889e1c2ad0964f0a097a87feb14ceb314a5c19c7ff5d9c7ebb36

Sharing

Copy URL Twitter E-mail

General

Target
spoof_2.zip
Size 565KB
Sample240528-mexmlage85
SHA256 022e498fe973889e1c2ad0964f0a097a87feb14ceb314a5c19c7ff5d9c7ebb36
MD5 79aa575e7e2b033646f74f69e44c60d4
SHA1 6feff8cad2f9ae2b831343fa7bfcb408ffe23b92
SHA512 732e1ae4488765d0a4b5919900c548272ce932d97743a1c8adca26d437c9c4e38a78b45c5ccf15acd51d0042f33c6d132e98a6dfd92132d3bc97ff58984de006
SSDEEP 12288:Bq0wZ837dYoz2ko5wLJXOKfegCEkwg+al7+fzohptnT1cbyx1fR:Y0fLdYTyLJXN2gCEV2KfzAnBcbyxJR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  AMI/AMIDEWINx64.EXE
- Size 377KB
- SHA256 47c16703fa7df006f9559fca8b1482b4c59111017a0530c1edac3caf0bdaaf39
- MD5 6dea36ae7a414e376b00829e16da52e0
- SHA1 5ddb6b72867002a03f26aed612f320e82598464e
- SHA512 f61f6a661e816ff72a91849c8363dbbbadadc24d34c25072a3cbb3be16ce9a540c8f86ae2c031fc97e5484944d8957cd7a7e3104dee2a2091b2b344422e30487
- SSDEEP 6144:u0lLNvLmP/LgoYG5HViOlHH7qKPUcky2FpwhPa24UW3Plqr9hUURgr:lzmP/Lgk5HViOlHH7qKPfky2FpwhyV3X
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  AMI/amigendrv64.sys
- Size 35KB
- SHA256 b9e8de155fb9aabb4760034a65855130eb85aadc88963e40e2be87b049c025bf
- MD5 8d533ae1500f743a177b27c88a241163
- SHA1 52c25cf4c903714fa52870a16d143fb6aeb0fa99
- SHA512 546c9309b9b078ce4c49a3b56ec8d77b0fd4c0bd583f4bce53705f854fe2addba5c8029ed8b8da9e944b2c212d2ee0508095bf20c12632b760a5c271d19940de
- SSDEEP 384:mrzqfCQlZluZfnktrQsHGh1jEiI4IHith5kCN88ZGmGovy8ZpHcS8FRJvIsWAR9k:+dCluVG0zuiv1yiR89PL9zIf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  AMI/spoof.bat
- Size 57B
- SHA256 74975bffd064e9e27f44db7738b5f4c971ca1401b5e5d89f4aa50835801abb5c
- MD5 70c372a580ee13ad16ff67d3cc0ff0c6
- SHA1 7e92af45a827b70404573f9f8339b2c9297793ec
- SHA512 8dd0f5cbf1e66061f11d9129b6da90046ffc36742b2884e271399f17f096dbaf5c1db80d2b4c3e4594961021c96e04c623c684c5c6511cfe6e64b5527d1e50ed
- MD5 SHA1 SHA512
Score

1^/10
behavioral3
- Target
  Insyde/H2OSDE-Wx64.exe
- Size 918KB
- SHA256 412e058e92b2498a4dcc4bf70b9aeedc8361f97be0fc071662d5cc480fd965ae
- MD5 42aedfbe60926aac1464a62d8d1c4df6
- SHA1 89b2cdb05a7ee068b3601311331f057b0364eedf
- SHA512 ec8a1962c37f06a8ebab527a492d30ace1fb38cfa56d2dfed20fdb79a28693a555e8c74834703e97218575319433b95ccbbff6ca1c1f01adfeec79447844e7ea
- SSDEEP 24576:wtT0dc9f8XTEtvM6kvvJ+11u4CN5oHDsUBmT:PTovsc11sN5ojspT
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10
behavioral4
- Target
  Insyde/segwindrv.cat
- Size 10KB
- SHA256 e830efe7786b0fb9dd84eb647614fa1795ec5caa605d44d9a13f0fdbd0f4d6b5
- MD5 43d3603cf918445cbd1d7253b49bf527
- SHA1 fabfaee55f2c4e6ca508d735b297bdb738ab1c7d
- SHA512 183b8498e4c86966050be324a027fc0a7f8179bb77d032ec97cf64ab91dac72c8e7fcdda36c733c2815973b72c91cee19d3263376a7e3b955c616f548690186e
- SSDEEP 192:nPv5lU3j25JC5NFvE4uyK6iWPFWQFe8imCLqnajvdjA/2T:n35mFhiWPFRDKLljdjcM
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10
- Blocklisted process makes network request
behavioral5
- Target
  Insyde/segwindrv.inf
- Size 4KB
- SHA256 e1449864c7403b9cd3d828c6fc9710fe1fbb3f35c7b6522a5dcbcf97685f40d7
- MD5 843fb7475608ce359da7cbd48fa3ab1d
- SHA1 ae16643aa1756b34391e4c615958343ecb17b153
- SHA512 9db610ebff1ab1e24147abadf10f978eab95358f2b0806d17fb8df6e53723b0523dd26d0207430d029f5b6826a02c3a5d73ff01d8f6e28d53e82c230075f2b34
- SSDEEP 48:rRFH5oXHIYYzQS6QLOOLcqnXT+E6tE58HWi1LRfuwGRfuwpkHo7uFf:rCIYY0SzgLRfuwGRfuwi
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  Insyde/segwindrvx64.sys
- Size 103KB
- SHA256 b44f4384f95cc9d3f86f0c27fc0abba9a291a7cc24483f41e70c1234bc61edc6
- MD5 e46dfe45c1714f4920d3fd2546f2f630
- SHA1 28cdb0b48c1d88d71421ec9e40ce52836ab79956
- SHA512 97480d19e22ebef836e61f33d5540c41a08a9edc71af97a59fef71b3d60abd9ab78b32896ee0812cae1780da08f875e3cb32c048edf4fcae523fa04e23d2246c
- SSDEEP 1536:yALHKmz+6n3qOZhiIjyvxjSd0CG7wMLw6JSoe80/ttsw:bHKmz+C6ATjuxjSdq75w6JFstaw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  Insyde/spoof.bat
- Size 39B
- SHA256 9a33bcec16224a280916ee5362c09e5c4b9e23b578802824250710d8cb5e3bdf
- MD5 00b669e9102e6055f3ffb59c495f9590
- SHA1 33663eeb1eb9dbd1fb9d7d8da05ff682a0b77817
- SHA512 64564a7c15c35f2a8f2f0490b015461831ceb8db1d23481b2fed6b396333d931663f2fe3684b7d54dc3ca99ea89b8527d570ee19969561a23bf71dcfee93a5f6
- MD5 SHA1 SHA512
Score

5^/10
- Drops file in System32 directory
behavioral8
- Target
  VHD/1.txt
- Size 51B
- SHA256 7c6672c0a37a5e9aa5f7216c4ede8fb29bbb01021553fd822e7a9b408242fc98
- MD5 ac20e2b5870fbe495b2e4d5450cf2915
- SHA1 b905055099236cf8fa841ed6277b97d1af4fbfaf
- SHA512 e659ffaf078f31c759eaf391dc0f08595be86ceed9ec4d16a140f3b80c847cf8db006942d12b5740448dc6a0c5cb8379fcd896ddefd9079a38b96cedc95da189
- MD5 SHA1 SHA512
Score

1^/10
behavioral9
- Target
  VHD/VHD.bat
- Size 82B
- SHA256 569a3ea35752c5f848269f90cc8fd72f3e587e44c987e9986af242ba3cbc93d8
- MD5 945e0ff83a6f23cf0568ba1444af9384
- SHA1 184d295e43c244bb4891b79927e45049f9a1b8fe
- SHA512 00991d10ec9fb366288b1a025eac20e2986ed31a09853dacc47dca21b420213d251c72c6006b32c02f77611284496d4ce2e4511e818de67d82e87342fd9b7789
- MD5 SHA1 SHA512
Score

1^/10
behavioral10
- Target
  check.bat
- Size 274B
- SHA256 3c36f73644642fa71c86fe48d24cc47f5293cedcec8bd0981d111e5823bda3ea
- MD5 e8db7ba2184c7b20e20182d01522e6c6
- SHA1 877be10ebd8d6281da715d96b4741dddbbd258c3
- SHA512 1024d79d1b3f6208c577b7c45ac8e3a985887736af0712fbec2e54c837c4d6de14afa7dfbe58266d157490952c9a857a402ec3ec393d560d6611273aac55d529
- MD5 SHA1 SHA512
Score

5^/10
- Drops file in System32 directory
behavioral11
- Target
  tweaks/1.bat
- Size 253B
- SHA256 9ee833b3b341ab2fbbc1b215c2613a3cb947aa5174122f69c87068c54d3b6f8a
- MD5 ce17bbdf67566edb48a72c10dc53aa19
- SHA1 5463f627871b844a098871aa5dbe43ef9f39d09e
- SHA512 6c76ccb6b1bf9c40c62c50ab04fe053f7358496eafa0345f14dc0a5f2e29cf58a3f87e301efe876ba9d2ac9f3ca5471d7af991d3f4c7097fd1f55dc9976360da
- MD5 SHA1 SHA512
Score

10^/10

discovery evasion exploit ransomware trojan
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Possible privilege escalation attempt
  exploit
- Modifies file permissions
  discovery
- Sets desktop wallpaper using registry
  ransomware
behavioral12
- Target
  tweaks/1.reg
- Size 1KB
- SHA256 648d42f046201351a60f1ecb107edab0a8ec7db8512886fd87296717df435369
- MD5 5f39bbc46845d5d3633aaa1ee20a1c44
- SHA1 b7454d19b11d3af833a45608f3631933cd29e4a8
- SHA512 273ad7eb69bea6f1faf5c6d73ad14dbfca01232d6cabba1e208e4c8dd36551c5c3c9059d6474638de635bcfea195a2977566a415c1495f0d16bd9ced4b890703
- MD5 SHA1 SHA512
Score

10^/10

evasion ransomware trojan
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Sets desktop wallpaper using registry
  ransomware
behavioral13