17f046a7da3e7c0e6d7686d3890b023de8f4fac722bb61a702af0d8ab29ff18a

Sharing

Copy URL

Twitter E-mail

General

Target

CrystalDiskInfo8_17_14.zip
Size

5.9MB
Sample

240725-tkxywazbkp
MD5

773f79174d2d64b0d2c7463251175357
SHA1

eecf3892a4928619295443330738fdc7e35a692e
SHA256

17f046a7da3e7c0e6d7686d3890b023de8f4fac722bb61a702af0d8ab29ff18a
SHA512

58c41d8c75e32dffa251fed8f10fd00d73a767f16411296e59db1ff2d89cc48d72169b77c491b59b85b563af4c0245c4465acd17d146258409887da7a3f75fcd
SSDEEP

98304:zwAFLpriyLyVE6JV5RjDhHjgvPiQNUJZI/p+gv5Or22J8ud6/GXVxm:EA3NuuS8NUw/p+K5OFJ6/GXHm

Score

6^/10

Malware Config

Targets

- Target
  
  CdiResource/AlertMail.exe
- Size
  
  81KB
- MD5
  
  b8369f93200cddfd93e46437a1b099e3
- SHA1
  
  3f7c589dcd36f733712a1e94611bd39ba7e11971
- SHA256
  
  abbb2bd38f8e5cfd1fca428e27de421b77beb09f7bb8fdb7d91018a6bce7b098
- SHA512
  
  7cde6064e5095fcde14128aada6c54168173b0b33b2f11783c6e2eab6b1735d5f834f38a9f034c584d9e781fd7bc8155a3fc1552b950131b3f011478c706457d
- SSDEEP
  
  768:yw4ni2c0YIz0eXU6tvZ2XWNG52mUBT0iw5dIAXdRCRn75c3ggNWhJ1aSoQuSthBI:GrM1eXTthgWNGhWboL7StvoL7S6
Score

1^/10
behavioral1 behavioral2
- Target
  
  CdiResource/AlertMail4.exe
- Size
  
  81KB
- MD5
  
  4ca37bcaa4e6d83e7d25be1dae022f41
- SHA1
  
  14625ad67ee56c166e329ca6e6fc992fef1a7fe5
- SHA256
  
  aaae342e4c84a3540a1220b9ed6d8ed215ab71c05df862349c1980bc044f7f77
- SHA512
  
  019762e0720158ae4b66fdb27541b4d5b6b00e6b1a6f6c0364677c37bd8f2e378dac6026239c66a5a7654612acd985e5a666f29739d28de9059fca6a2cfac757
- SSDEEP
  
  768:puwJJMLfzqBV+Ix0eY3nSvV2XWNeHOecV5keEt9IcPHBIpTnDCtgCcshT1aSoQu5:FpBAdeYXSNgWNSEspoL7Sks3oL7SRqZ
Score

1^/10
behavioral3 behavioral4
- Target
  
  CdiResource/AlertMail48.exe
- Size
  
  76KB
- MD5
  
  9faef5f8444867f67adc9efd1eea9b49
- SHA1
  
  467726511994e9431b57b56422df814aeede5b71
- SHA256
  
  9fee4af85da459119af4eb26d7cd6ec044db959d2be57af115a5b443ac416411
- SHA512
  
  77b05ff28864bbc19d5d90dc70bb89ee21560aebf996dd91dba63f5431908c1459966f52126d8c49f0feb6b34d12cdab2eb6595911d05df3cd38deae0cc381fe
- SSDEEP
  
  768:xwunkxcY5Sskim+evciHK5cxJFlHKriCFZthQFNu+nhXk8TyBmCbYcdNh0qh1aSe:RkxVR4+eTCc9C9N5oL7Sv1/CoL7S4u
Score

1^/10
behavioral5 behavioral6
- Target
  
  CdiResource/MailKit.dll
- Size
  
  837KB
- MD5
  
  c5cd71489d9c78d85d89a895bf463cc4
- SHA1
  
  ab017768139d5731756260a8f9674e089347d9b9
- SHA256
  
  75211b1b7c7af76c7cb09c8ee32f0cad82db86daad15633690ee3c6881a717cb
- SHA512
  
  8ca003cc5a7b9253320cd66b4dc57bd8ce8b81e7a72e8d30af528b13128cfaa32739f7253f9dbc7844b00ce8a49d00370b9822db7530f0ed916b2b8f32952665
- SSDEEP
  
  12288:Mz6bczVeI3nauKmSG1iFvbeu4N8OdJVRwwlBhu9hayNuw9K:MBzVrVjiFvbeug8eVRHhu6yNuw9K
Score

1^/10
behavioral7 behavioral8
- Target
  
  CdiResource/MimeKit.dll
- Size
  
  1.1MB
- MD5
  
  007c665a952587526f08fab9c84b0973
- SHA1
  
  e98a30dbd4421a0b06224eac66e5db3db052de49
- SHA256
  
  4bde60d1eb8f31844097e609db2874d138ba896d530a195572c19b7ae3014f95
- SHA512
  
  3ac4d8c322bb0b601e60c9068ad0a83e80543cc0233d16c277d430b015f74a685715dd37a62e13b69505935ab39f204d443615f372329b030bf98a4c89ebc1df
- SSDEEP
  
  12288:2ojHuG7qgJZ3W4vlnTZ6/hsHH6c/l6gSttAd7b52lD3qWh21UyKCzrZGG5uqgoz:2OzqAZG47lHH6c/l6gQ21XK+rAGE3oz
Score

1^/10
behavioral10 behavioral9
- Target
  
  CdiResource/System.Buffers.dll
- Size
  
  20KB
- MD5
  
  ecdfe8ede869d2ccc6bf99981ea96400
- SHA1
  
  2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA256
  
  accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- SHA512
  
  5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP
  
  384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
Score

1^/10
behavioral11 behavioral12
- Target
  
  CdiResource/dialog/Graph.html
- Size
  
  8KB
- MD5
  
  1f2f281f50cdefb6794c9c87133b89fb
- SHA1
  
  6aaf495b5eba156f3b6d69395a022251f54e8460
- SHA256
  
  00ceba3cca57b7ae140f077d6aebb88e172f69b4cc0c8879c5be7f2734a989f8
- SHA512
  
  c1d8d99104f0dfc0f3417c6c0a2519ab9508aadecc573b6c338614237d6d91ce03825b4b978a3a9a03272759d7d566d1bc7c60b7742b4f83a8ad1b9d943e906b
- SSDEEP
  
  96:7KkOs1PJEpKltJtAZ29wi7/3j/Rj5LNscioCIq9Xr9MDoevklwew+K:7CMEpKltJw29wi7t1LNsBojvklwew+K
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  CdiResource/dialog/Graph8.html
- Size
  
  8KB
- MD5
  
  95e946a56eaa284e0167d5669861315e
- SHA1
  
  80c69fb76714856274183d72da863b65f63dcede
- SHA256
  
  715663ab9ac4f2b0de86ea36c90436550b648e8d79f35b2099b904071ff3608c
- SHA512
  
  75fa148c3a38ab07751100d23e574d94ab9073a4a6611f3262a6ebe9e33e509a6e0152c44f87d73448c751c31047fce7f8fbef1bd3eb2c99e340866bbdd8b066
- SSDEEP
  
  96:7fkOs1PJEpKltJtAZ29Ni7/3j/Rj5LNscioCIq9Xr9MDoevklwew+K:7BMEpKltJw29Ni7t1LNsBojvklwew+K
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  CdiResource/dialog/Option.html
- Size
  
  17KB
- MD5
  
  1639dc3afebcb77a24f2b76c060681be
- SHA1
  
  4d5be3e3eab978f344602c9e7f8a5cf981ae7fb2
- SHA256
  
  1c33000a9201ab7f6fb76a35adecd1a3b4a0ab7e21d4adca9b7ce47eb0438eb9
- SHA512
  
  badeefa30d01331fc8a0ccbd1478ffb265c602737c341ccb3acd33484bf4e622c27cf4d0896550e3077313b19abe4c127002b30cd8ab57c30cd1d84fd9cb798e
- SSDEEP
  
  192:u6/T7J+jh5BOfalBZOlVSY7SM+UJBRyHyl:uw7J+jhfOfXp+u
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  CdiResource/dialog/flot/excanvas.min.js
- Size
  
  10KB
- MD5
  
  08182065d2093c978a9bfa16b0829173
- SHA1
  
  b72f4f5b78513de55e61ae0f8804757b7be97d9f
- SHA256
  
  5f94b032a110504b7b261eaf71392fa3e8d82cdc6455c0cba5c9f03cd34ed122
- SHA512
  
  73edb75f889493c40765f8c34ae02746afab14f98585639279ead7f87232c98122adf9eaeb8d4e585ca45fda9a9b272f126c239a9acf50cf02a77c3e889e6112
- SSDEEP
  
  192:f0nOGBoKSDDfL8SZy/RJVfGPSfJq2sq2iq23UdFm2lx0fRun7faSpWM35Rfz5wyC:snOhT8Sk/RPePeJq2sq2iq2b2lx0fRu+
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  CdiResource/dialog/flot/jquery.flot.min.js
- Size
  
  43KB
- MD5
  
  f1843acdb53f2c88903f89e4e175cd32
- SHA1
  
  6fe88ea552177f7117dc4cffecc5cdd53a250234
- SHA256
  
  8a0f1dd79995a9308cffdcae12445d9f727d66a450ef5158280e0724de55c32f
- SHA512
  
  1a0c7e84d6edd2678624c1b9bf4b4cf3bf2c897ae3c5d75a08199f96dd2c9d03b77a43851f033f2ae9cca197f6cba1d996730ceffbdbf5a78aa31ab7d2c5bf48
- SSDEEP
  
  768:HyGrgyZo3Rf+fHfb0cQ+LObGcMMr6GQbDtvjQa+1w30007ASG:HyGrgymmDXL+Z2GQ/tvjQaWw30007ASG
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  CdiResource/dialog/flot/jquery.min.js
- Size
  
  54KB
- MD5
  
  a9331828c517ac5d97f93b3cfdbcc9bc
- SHA1
  
  1be9c3684054001f53fa7ff6d85ec3cb573a9cd2
- SHA256
  
  d548530775a6286f49ba66e0715876b4ec5985966b0291c21568fecfc4178e8d
- SHA512
  
  403b7c0dc179ee12b85b76885ecb9a16e1e538572ad866a943f404f674dd3ca8c626b1cb2729fb720a6db3eba4e6ac1ac1de875a4d598f1b76337366d33bdba5
- SSDEEP
  
  768:NcBsS2y/PUrTsLK88E1o2z33cThrtz00lU3+pSk+f1:NcBsyyT1R2T3Ahrt00lG+ck+t
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  CdiResource/opus/opusdec.exe
- Size
  
  174KB
- MD5
  
  1f3cf9f2eda491e461a44d956033d7ff
- SHA1
  
  9b5db2d3b252d9f4c434ecb05306b3f6a05f186f
- SHA256
  
  d8d8d30847b200f2ce1059726d3874469887e452af3133518eafdf2b2692f260
- SHA512
  
  eb5e6baeb6385fb1889bff131aa78f71a1235cf7468466bde3344e6b035c65e5d8dfdd18f0f75aa970758132d540009c7f5ba67cfe61a69061702144e7233b54
- SSDEEP
  
  3072:74UvcpDZ6BNNglpMg4Ewjw60B8EDh7lR84YijJkPxZUOV3:7Cp1A+l8ElZX89P3UO
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  DiskInfo32.exe
- Size
  
  2.5MB
- MD5
  
  c5d0557fb26679b38851dbecae8dedbb
- SHA1
  
  2b924a911fa36ec34963f66a108cf790a8cb4796
- SHA256
  
  4cbc4be268d1913f1e566ecb36cbe06f7c0326874ab1b5546df3b3d943304bdd
- SHA512
  
  2c65c076dca18ece9ab328ed70895b4fb6675935dfc9821f4cf54eaaa358d9c32ccd967787c93c3aaba528200e086927cc73c588dea18b86301763f49ae266d4
- SSDEEP
  
  49152:C1ADeQ8INvYkgx/+nmnM4atqZdd1v+0Krb:kADelqYkwWnmnM4aqTPKrb
Score

6^/10

bootkit discovery persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral27 behavioral28
- Target
  
  DiskInfo64.exe
- Size
  
  2.7MB
- MD5
  
  290b9d139ca0057e5970d02bab50ee1e
- SHA1
  
  19416e9b9e66b29bfbcd2be8d4051025e1370904
- SHA256
  
  d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9
- SHA512
  
  eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4
- SSDEEP
  
  49152:HgZ3iZKjw0IehynmnM4atqZdd1v+0Krb:wIewnmnM4aqTPKrb
Score

6^/10

bootkit persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral29 behavioral30
- Target
  
  DiskInfoA64.exe
- Size
  
  2.8MB
- MD5
  
  d9c87a3caa71be03866b4947c731ff06
- SHA1
  
  e5be99a71c113706332e8b29ef64fcc797c12cb5
- SHA256
  
  a5ae982672b06b9260e06c19c2bc1f4fa3bef3c8c3e337c0d6f2b1de3463a575
- SHA512
  
  3e8ae5d5b70766b9079009377ce56b4867849b45ccd344e9906b81cff8e893d67fd9e0011cce64b95410de45539f203a04e7974e6362c7c916bbb869ec851baa
- SSDEEP
  
  24576:Yrn4tBqX0BDSLvjDDWZ6blqpG22oKULunmnMIlL2Yc4abIZdWFzE1v0R0vSxFRZ8:HBg+GiXynmnM4atqZdd1v+0Krb8
Score

1^/10
behavioral31 behavioral32