5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75

Sharing

Copy URL

Twitter E-mail

General

Target

Rainmeter-4.5.18.exe
Size

2.4MB
Sample

240611-mwywzstgqa
MD5

e2d2743839d187982e9c602575efc48c
SHA1

e5b6808770e6bca105c1616e31015160725f855e
SHA256

5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75
SHA512

941936885ee61bcda2d0623a660d5532adecd66d7ee506650d33c5236e15f01dd0689ebab2ebf4f1935bf48f88d0c2579af800602602542521fe349b291d9878
SSDEEP

49152:mQ5YRSuP59wVHUY1jLjTwtuXUaLEikcepufsJvHtgomcyC5eieKalFvv+Xg8V:m7Ss9wVHUCY8TIPC34eieKa/8NV

Score

10^/10

Malware Config

Targets

- Target
  
  Rainmeter-4.5.18.exe
- Size
  
  2.4MB
- MD5
  
  e2d2743839d187982e9c602575efc48c
- SHA1
  
  e5b6808770e6bca105c1616e31015160725f855e
- SHA256
  
  5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75
- SHA512
  
  941936885ee61bcda2d0623a660d5532adecd66d7ee506650d33c5236e15f01dd0689ebab2ebf4f1935bf48f88d0c2579af800602602542521fe349b291d9878
- SSDEEP
  
  49152:mQ5YRSuP59wVHUY1jLjTwtuXUaLEikcepufsJvHtgomcyC5eieKalFvv+Xg8V:m7Ss9wVHUCY8TIPC34eieKa/8NV
Score

4^/10
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  68b287f4067ba013e34a1339afdb1ea8
- SHA1
  
  45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA256
  
  18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- SHA512
  
  06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP
  
  48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/MoreInfo.dll
- Size
  
  7KB
- MD5
  
  bd393029cc49b415b6c9aeb8a4936516
- SHA1
  
  c67fd92fffd18941bed41bfd6ac4f3b04fd123df
- SHA256
  
  227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
- SHA512
  
  3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
- SSDEEP
  
  96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  14KB
- MD5
  
  adb29e6b186daa765dc750128649b63d
- SHA1
  
  160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA256
  
  2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- SHA512
  
  b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP
  
  192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/UserInfo.dll
- Size
  
  4KB
- MD5
  
  2f69afa9d17a5245ec9b5bb03d56f63c
- SHA1
  
  e0a133222136b3d4783e965513a690c23826aec9
- SHA256
  
  e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
- SHA512
  
  bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
Score

3^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  6c3f8c94d0727894d706940a8a980543
- SHA1
  
  0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA256
  
  56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- SHA512
  
  2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP
  
  96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
Score

10^/10

evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Downloads MZ/PE file
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
- Sets desktop wallpaper using registry
  ransomware
behavioral13 behavioral14
- Target
  
  Plugins/ActionTimer.dll
- Size
  
  111KB
- MD5
  
  e88ac8138e253c9ef0c068438d3e5586
- SHA1
  
  d68f2b9f3041af6c8e36175e822c79bf3e4e995c
- SHA256
  
  6630a385acb7f88c70f964fc08b411003801ee1575d23de7838ffaff9531b92f
- SHA512
  
  0f144f8a3b739b1d89fa5ddac5c97ee51e15e735cde4acea91a84a443f667b361c12a3d8591932da16fd6fe279450c8cd5a38f7582ca0cd30c07d110f2fdfe65
- SSDEEP
  
  1536:jkRlfSe/sWmcd+xvu98p+3m2cIlbyjzRDAfuEGVv3wE+tZPNqKSPgqU:ylfhZ+xm9R22cIlwzRDe/GV+SPgqU
Score

1^/10
behavioral15 behavioral16
- Target
  
  Plugins/AdvancedCPU.dll
- Size
  
  92KB
- MD5
  
  9479b71abccc8b4baf28f18ae1b62829
- SHA1
  
  ab375c0992ff752e2b2338793eb11165dd07da24
- SHA256
  
  588ffaf985166e119c9ac8dc37d190c9f6f4e71ccad83f17e2972b60ff233454
- SHA512
  
  3f886239965334204c510e779db05f8ac07af9185a2c62f71e8c25f5f2ff46d8891f42c05ddbe35ea7a12858e06d3868713a19187ed19cff163678ae3b8184c0
- SSDEEP
  
  1536:6kSlfsWoAYcdvaf2aNOiNb4OQZZVieo21AfhfDq6zWjuNL7AHtW8OZUMWE8Gk:6kVWvaeaNTb4OQ3omAfNGuNnAaUMWE8f
Score

1^/10
behavioral17 behavioral18
- Target
  
  Plugins/AudioLevel.dll
- Size
  
  166KB
- MD5
  
  9b81a346383d152c2dbd7df6778596f4
- SHA1
  
  e6bd3a9d390b8f0d33ecc42e735e512aad5df77d
- SHA256
  
  37d3094cf0dd66efdb239752cf2b62ba53dc3d6408fb738f9ee403524f5c1f55
- SHA512
  
  5cb5a8147434b4ed87d24f574c4f65ec10432d078b41cb06d835c3a3163eabf68b59d9c78e2c535b16528f6027a0300d493d12f176193218ea1221c4c679a4c0
- SSDEEP
  
  3072:O6A6K1Xc0sAg0FuROHNMNt5FSvjMKq7npgKxCkaszl+L27vDHCdHPs2:WO0sAO0HNMr5FSYd7BCkDzgLyved02
Score

1^/10
behavioral19 behavioral20
- Target
  
  Plugins/CoreTemp.dll
- Size
  
  116KB
- MD5
  
  7ee5008e90570c5ffa8afe9ec0693070
- SHA1
  
  720117e3a3a4a0562e76dd5e91cecf1bc07846ac
- SHA256
  
  8aa49a2fe7cc2419d53f0fb68fe9c549e4b746e6919bcbb90f07842e3e7c2c8a
- SHA512
  
  bc9e7ff2de8fe38a32a77bcdccb2ab02b1986c4f07c20877e5f03a35d7323f87a6616f6dbe72b0413921defc4823968b4967b6361b289ad149058d531e7df040
- SSDEEP
  
  3072:3sHQOgc/AnrAm7ObimiRBLjhdMOWTKkI3t:VO6hw3irjjDWett
Score

1^/10
behavioral21 behavioral22
- Target
  
  Plugins/FileView.dll
- Size
  
  168KB
- MD5
  
  57553f9302b159abc002cbc0f6d64163
- SHA1
  
  a295fc11c0ef0f35992412fd10b02c93d77a92b9
- SHA256
  
  c922ee6dd39574e64eed027cba93d0a2edbc29cfd1993d9b6ce84de27324cb54
- SHA512
  
  5b05d0c48b5429cd5b77905798b1031376c41745113b0bb954a4b92b371b12e4125bca04f74086a686bb2abf74d06685001654d5afc23b680ae6da395e14ceda
- SSDEEP
  
  3072:45Ob10FBT4TOsPxO9Rj3rwKPWUwI1SFlFnbWubPJi20HQwT2qelY4PoLalzip1Ie:4QW4TNxORjbwljE20/2pY4EpfbI
Score

1^/10
behavioral23 behavioral24
- Target
  
  Plugins/FolderInfo.dll
- Size
  
  113KB
- MD5
  
  fdd62b0490e0b6e9e53378c3797eedcc
- SHA1
  
  28daaacfbb1d1a6f19831b1e902dcb6e2aedc206
- SHA256
  
  9f533dd0123cb8f5744a5f8407d91ce80fbbec02e41f305b09eced8f9651dc35
- SHA512
  
  bedceef149e13bd7375890a5e72ad706d22bfc97be09034192231ca9b1f4ca39648956bfd3e6e351059d4e6e56cdc019de53e85112c782e697cbff9a8474aa00
- SSDEEP
  
  3072:2CggYfOQoFugz7IfV7Zhnx4TngNoYO6LmIDsWF:md4s73x4bg1ZLTsW
Score

1^/10
behavioral25 behavioral26
- Target
  
  Plugins/InputText.dll
- Size
  
  23KB
- MD5
  
  d4a3ccfa86889eca3b7cb333e33257ac
- SHA1
  
  2a0b39115b1d20457c67e082ff32d84e61ebb26b
- SHA256
  
  f35770dde8d01b7e10f969aa1202155b8b0bed9c29c4f8b40d7e683ebe73d0ab
- SHA512
  
  65ed0b36cb181b75478b50d5880e7301dd32c8933fc43d95a346a49b9fe69d8efd7bb67719e030ea79079034b7d04737fa12ebd4ba08299169a44ee03769ca1e
- SSDEEP
  
  384:ALTJ6I2BatWSdduVbdJjgaseXPG69d4NjU7J:AvJ6/atWSdYM+esjl
Score

3^/10
behavioral27 behavioral28
- Target
  
  Plugins/PerfMon.dll
- Size
  
  88KB
- MD5
  
  77c1bb511ba882dd1f6b68a8fa6a3e16
- SHA1
  
  308c7edd447932f3e62e444cb1b7a16351d826fb
- SHA256
  
  8f3f7bf9f290190ded0ccacf21e5027eea14e31ef2eba59a7bc0cfccd8701325
- SHA512
  
  2a1350b8103c770142b078d915e3e979bf3fe52a93d42ada3fd47ee014a1eb9b1075ab068c44f6449312b3b02300714beb3fb8396917e3817c8ae5d29fb57919
- SSDEEP
  
  1536:770aS0fsW1AYcdO/L3a+XRIArIPb2YvJAeMfrw1X+pB17S/sk2O+xWU0G:770aHWOxRIAgSYxAeKHpBNSOxWU0G
Score

1^/10
behavioral29 behavioral30
- Target
  
  Plugins/PingPlugin.dll
- Size
  
  86KB
- MD5
  
  9bfda79c3aee286817e1579b15579b9c
- SHA1
  
  07fb8d727ec0af97b684d51bf053239321a38c9e
- SHA256
  
  9558ecfd0df85b4865baf26cd984e29d53840307c00331638533ef4f2a184534
- SHA512
  
  e6cd7a2d8ab78b6c23655af07d3f0b283a0cfc572dbc415c2d9b0adc5f9f2baa1e56575c2ed50b08e90bcaf1d6dbecda5eac057eaaf9578d8d7e73e45194a9a1
- SSDEEP
  
  1536:6QStrsWVHcdhgFM6eI7Az4FzqRHM7JnNbtEVe0DjSoikQ9VWqToN:6QQ32hgCXI7ZulMtnEVeuc9VWqTo
Score

1^/10
behavioral31 behavioral32