Overview

overview

10

Static

static

9

_#A-2/SSD-...-Z.exe

windows7-x64

6

_#A-2/SSD-...-Z.exe

windows10-2004-x64

6

_#A-2/SSD-...64.exe

windows7-x64

7

_#A-2/SSD-...64.exe

windows10-2004-x64

7

_#A-2/SSD-...le.exe

windows7-x64

6

_#A-2/SSD-...le.exe

windows10-2004-x64

6

_#A-2/SSD-...ow.bat

windows7-x64

9

_#A-2/SSD-...ow.bat

windows10-2004-x64

9

_#A-2/SSD-...al.bat

windows7-x64

9

_#A-2/SSD-...al.bat

windows10-2004-x64

9

_#A-2/SSD-...p.html

windows7-x64

3

_#A-2/SSD-...p.html

windows10-2004-x64

3

_#A-2/SSD-...al.exe

windows7-x64

7

_#A-2/SSD-...al.exe

windows10-2004-x64

7

_#A-2/SSD-...ll.bat

windows7-x64

10

_#A-2/SSD-...ll.bat

windows10-2004-x64

10

_#A-2/SSD-...up.bat

windows7-x64

9

_#A-2/SSD-...up.bat

windows10-2004-x64

9

_#A-2/SSD-...st.exe

windows7-x64

7

_#A-2/SSD-...st.exe

windows10-2004-x64

7

_#A-2/SSD-...xx.lnk

windows7-x64

3

_#A-2/SSD-...xx.lnk

windows10-2004-x64

3

_#A-2/Shad...64.exe

windows7-x64

3

_#A-2/Shad...64.exe

windows10-2004-x64

3

_#A-2/StegShadow.bat

windows7-x64

9

_#A-2/StegShadow.bat

windows10-2004-x64

9

_#A-2/_AxC...up.exe

windows7-x64

7

_#A-2/_AxC...up.exe

windows10-2004-x64

7

_#A-2/_EcMenu_x64.exe

windows7-x64

3

_#A-2/_EcMenu_x64.exe

windows10-2004-x64

3

_#A-2/_sbk2012int.exe

windows7-x64

7

_#A-2/_sbk2012int.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    tkm.zip

  • Size

    88.1MB

  • MD5

    68a6a713bedd3bbbabdd19dc3316f712

  • SHA1

    4a242528aa066abd7d792826ea8e463f72d9d441

  • SHA256

    b79d0d1f7559939f8d5adc2410ca971dfa5387ba1fa70658471a9835e0ed86a7

  • SHA512

    5f2baef02891322d4fd1bfb580fed87f424294ee17a2fb4951eba306e0037871bad15411578a9f4c6d2599da6c25421269bd923efe1f90c10327f31d5725c590

  • SSDEEP

    1572864:czvcVnv9Lz7UOv4XSV6+JIZxyNfYOd3brwrNBH1CR7mVfwkb8foaiBZdGU0Xk9jt:cgBz7orxyNfYwrrwfV4+4kFXTgkpt

Score
9/10
upx

Malware Config

Signatures

  • Detected Nirsoft tools 8 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • ACProtect 1.3x - 1.4x DLL software 6 IoCs

    Detects file using ACProtect software.

  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • tkm.zip
    .zip

    Password: booba

  • _#A-2/Add Take Ownership to Context menu.reg
  • _#A-2/Administrador de configuración de SQL Server 2014.lnk
    .lnk
  • _#A-2/Desktops.exe
    .exe windows:5 windows x86 arch:x86

    Password: booba

    c8681af63c4b3bc7041fe674efea6dd2


    Code Sign

    Headers

    Imports

    Sections

  • _#A-2/Eraser.dll
    .dll windows:5 windows x86 arch:x86

    Password: booba

    38ed2357d2803f7a77a5e1de88016c55


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A-2/Eraser.exe
    .exe windows:5 windows x86 arch:x86

    Password: booba

    ba326d2341b4e46a8716e14a4aae269c


    Headers

    Imports

    Sections

  • _#A-2/SSD-ZPortable/App/AppInfo/Launcher/SSD-ZPortable.ini
  • _#A-2/SSD-ZPortable/App/AppInfo/appicon.ico
  • _#A-2/SSD-ZPortable/App/AppInfo/appicon_128.png
    .png

    Password: booba

  • _#A-2/SSD-ZPortable/App/AppInfo/appicon_16.png
    .png

    Password: booba

  • _#A-2/SSD-ZPortable/App/AppInfo/appicon_32.png
    .png

    Password: booba

  • _#A-2/SSD-ZPortable/App/AppInfo/appicon_75.png
    .png

    Password: booba

  • _#A-2/SSD-ZPortable/App/AppInfo/appinfo.ini
  • _#A-2/SSD-ZPortable/App/SSD-Z/SSD-Z.exe
    .exe windows:1 windows x86 arch:x86

    Password: booba


    Headers

    Sections

  • _#A-2/SSD-ZPortable/App/SSD-Z/changelog.txt
  • _#A-2/SSD-ZPortable/App/SSD-Z/readme.txt
  • _#A-2/SSD-ZPortable/App/readme.txt
  • _#A-2/SSD-ZPortable/CCleaner64.exe
    .exe windows:6 windows x64 arch:x64

    d86693ce643afb92041ce5b57cca682d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A-2/SSD-ZPortable/Data/## BENI OKU ##.txt
  • _#A-2/SSD-ZPortable/Data/#### IMPORTANT NOTE ####.txt
  • _#A-2/SSD-ZPortable/Other/Help/Images/Donation_Button.png
    .png
  • _#A-2/SSD-ZPortable/Other/Help/Images/Favicon.ico
  • _#A-2/SSD-ZPortable/Other/Help/Images/Help_Background_Footer.png
    .png
  • _#A-2/SSD-ZPortable/Other/Help/Images/Help_Background_Header.png
    .png
  • _#A-2/SSD-ZPortable/Other/Help/Images/Help_Logo_Top.png
    .png
  • _#A-2/SSD-ZPortable/Other/Source/AppNamePortable.ini
  • _#A-2/SSD-ZPortable/Other/Source/License.txt
  • _#A-2/SSD-ZPortable/Other/Source/Readme.txt
  • _#A-2/SSD-ZPortable/Remove_Recent_Files_from_Quick_access.reg
  • _#A-2/SSD-ZPortable/SSD-ZPortable.exe
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Code Sign

    Headers

    Imports

    Sections

  • _#A-2/SSD-ZPortable/StegShadow.bat
  • _#A-2/SSD-ZPortable/_final.bat
  • _#A-2/SSD-ZPortable/ccleaner.ini
  • _#A-2/SSD-ZPortable/help.html
    .html
  • _#A-2/SSD-ZPortable/iShredder Professional.exe
    .exe windows:5 windows x64 arch:x64

    b45408465410e69c955a96d2259342cc


    Headers

    Imports

    Sections

  • _#A-2/SSD-ZPortable/kill.bat
  • _#A-2/SSD-ZPortable/startup.bat
  • _#A-2/SSD-ZPortable/svchost.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • _#A-2/SSD-ZPortable/xxx.lnk
    .lnk
  • _#A-2/ShadowCopyView-x64.exe
    .exe windows:4 windows x64 arch:x64

    dd0db5f567f60cd2b289d068bec8b49c


    Code Sign

    Headers

    Imports

    Sections

  • _#A-2/StegShadow.bat
  • _#A-2/_AxCrypt-1.7.2931.0-Setup.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • _#A-2/_EcMenu_x64.exe
    .exe windows:5 windows x64 arch:x64

    42b8d4fa3bc2c4336a20de1bdf1422d8


    Headers

    Imports

    Sections

  • _#A-2/_sbk2012int.exe
    .exe windows:5 windows x86 arch:x86

    b729b61eb1515fcf7b3e511e4e66258b


    Code Sign

    Headers

    Imports

    Sections

  • _#A-2/desktop.ini
  • _#A-2/eraser.ini
  • _#A-2/kill.bat
  • _#A-2/lockhuntersetup_3-4-3.exe
    .exe windows:5 windows x86 arch:x86

    20dd26497880c05caed9305b3c8b9109


    Code Sign

    Headers

    Imports

    Sections

  • _#A/AdvancedRun.exe
    .exe windows:4 windows x64 arch:x64

    65f94fee8f6fa846b2b29bdd0721c096


    Code Sign

    Headers

    Imports

    Sections

  • _#A/AnyDesk - Kısayol.lnk
    .lnk
  • _#A/Command.exe
    .exe windows:5 windows x64 arch:x64

    8c41d052bb4ef0b19ba03cd224b77a0a


    Code Sign

    Headers

    Imports

    Sections

  • _#A/Computer Managment.lnk
    .lnk
  • _#A/DontSleep.exe
    .exe windows:4 windows x86 arch:x86

    6f9719ab7a64ff0c9b1011c53836b56e


    Headers

    Imports

    Sections

  • _#A/ER/Eraser.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • _#A/ER/Eraser.exe
    .exe windows:5 windows x86 arch:x86

    ba326d2341b4e46a8716e14a4aae269c


    Headers

    Imports

    Sections

  • _#A/ER/EraserDrop.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • _#A/ER/Readme.txt
  • _#A/ER/config.ini
  • _#A/ER/default.ers
  • _#A/ER/eraser.ini
  • _#A/ER/eraser.png
    .png
  • _#A/ER/gdiplus.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • _#A/ER/grepwin.ini
  • _#A/ER/schedlog.txt
  • _#A/EveryThing filter.txt
  • _#A/Everything.exe
    .exe windows:4 windows x64 arch:x64

    e396317e0c41e0f27509668e8b94edb7


    Code Sign

    Headers

    Imports

    Sections

  • _#A/Everything.ini
  • _#A/FRST64.exe
    .exe windows:5 windows x64 arch:x64

    8e94250c88a6c0e478828f96bcbb1662


    Headers

    Imports

    Sections

  • _#A/LostMyPassword64.zip
    .zip
  • _#A/Port Scanner/Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    c6663fc96ad3fbeab8e2a6dfb0fa9a63


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    88e6c29ceb3e14e1a3870a3772a52774


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/Qt5Network.dll
    .dll windows:6 windows x86 arch:x86

    f9364da2e01420d9f33ccb9f7544a43c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/Qt5PrintSupport.dll
    .dll windows:6 windows x86 arch:x86

    528a5435962e9a6d7f7e87d704b9e414


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    e14f533ef0c9c7d6c75b9bfa739cd0e6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/Qt5WinExtras.dll
    .dll windows:6 windows x86 arch:x86

    7047c255cd4e6e991ea11f62f1aef8e5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/Qt5Xml.dll
    .dll windows:6 windows x86 arch:x86

    7513f1b0a4843d81802c03ff0ef88229


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/advanced_port_scanner.exe
    .exe windows:5 windows x86 arch:x86

    31e3e9d3dde3c0c0f2c167b89b8e269c


    Code Sign

    Headers

    Imports

    Sections

  • _#A/Port Scanner/advanced_port_scanner_Aliases.bin
  • _#A/Port Scanner/advanced_port_scanner_Comments.bin
  • _#A/Port Scanner/advanced_port_scanner_MAC.bin
  • _#A/Port Scanner/advanced_port_scanner_en_us.qm
  • _#A/Port Scanner/cports.cfg
  • _#A/Port Scanner/cports.exe
    .exe windows:4 windows x64 arch:x64

    512a3007fef727fff6306757b46e434a


    Code Sign

    Headers

    Imports

    Sections

  • _#A/Port Scanner/details_panel_en_us.tpl
  • _#A/Port Scanner/libeay32.dll
    .dll windows:6 windows x86 arch:x86

    96792dd86e77abd54e56f99be6e9b1b9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/mac_interval_tree.txt
  • _#A/Port Scanner/msvcp120.dll
    .dll windows:6 windows x86 arch:x86

    6ccda270a497a2c5a36a7f385cc9910d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/pcre.dll
    .dll windows:6 windows x86 arch:x86

    fa4e8d8941822294b368a0215ca88fa4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/platforms/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    061c37ae3197a09e4d6766ffa6fa82f2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/printsupport/windowsprintersupport.dll
    .dll windows:6 windows x86 arch:x86

    d0ce5da85915b22c2370fe824da2c649


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    061c37ae3197a09e4d6766ffa6fa82f2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/range.txt
  • _#A/Port Scanner/rdp.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • _#A/Port Scanner/scan.bat
  • _#A/Port Scanner/scanrange.bat
  • _#A/Port Scanner/service_probes
  • _#A/Port Scanner/ssleay32.dll
    .dll windows:6 windows x86 arch:x86

    424359274c5f83c7008c38ebd2508fee


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/Port Scanner/windowsprintersupport.dll
    .dll windows:6 windows x86 arch:x86

    d0ce5da85915b22c2370fe824da2c649


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#A/PortCheck.ps1
    .ps1
  • _#A/Remove_Recent_Files_from_Quick_access.reg
  • _#A/SSD-ZPortable.exe
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Code Sign

    Headers

    Imports

    Sections

  • _#A/ShadowCopyView-x64.exe
    .exe windows:4 windows x64 arch:x64

    dd0db5f567f60cd2b289d068bec8b49c


    Code Sign

    Headers

    Imports

    Sections

  • _#A/ShowPass.exe
    .exe windows:4 windows x86 arch:x86

    c9e3b779e7a1e02be069819ad476574a


    Headers

    Imports

    Sections

  • _#A/SpaceMonger.exe
    .exe windows:4 windows x86 arch:x86

    dabc5019c94f3e88d51d12734e01b9a0


    Headers

    Imports

    Sections

  • _#A/Start Anydesk.bat
  • _#A/StegShadow.bat
  • _#A/U.bat
  • _#A/USBDeview.exe
    .exe windows:4 windows x64 arch:x64

    7f6d6c22698845fce190590da793f13b


    Code Sign

    Headers

    Imports

    Sections

  • _#A/USBHistory.exe
    .exe windows:5 windows x86 arch:x86

    a094c8d1cc7d80714ff0ad15ba4b4865


    Code Sign

    Headers

    Imports

    Sections

  • _#A/User ID= - SAPWD= uid=.txt
  • _#A/desktop.ini
  • _#A/extgmode.exe
    .exe windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • _#A/grepWin-x64-2.0.9_portable.exe
    .exe windows:6 windows x64 arch:x64

    a952e66796ffad64d4a69a8bcfd11157


    Code Sign

    Headers

    Imports

    Sections

  • _#A/grepwin.ini
  • _#A/mimidrv.zip
    .zip
  • _#A/svchost.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • _#A/user dedector good.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • _#A/whoerOto.bat
  • _#A/xxx.lnk
    .lnk
  • _#B/Bookmarks.csv
  • _#B/DirLister.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • _#B/Disk Managment.lnk
    .lnk
  • _#B/ER/AdvancedRun.exe
    .exe windows:4 windows x64 arch:x64

    65f94fee8f6fa846b2b29bdd0721c096


    Code Sign

    Headers

    Imports

    Sections

  • _#B/ER/Eraser.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • _#B/ER/Eraser.exe
    .exe windows:5 windows x86 arch:x86

    ba326d2341b4e46a8716e14a4aae269c


    Headers

    Imports

    Sections

  • _#B/ER/EraserDrop.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • _#B/ER/Readme.txt
  • _#B/ER/config.ini
  • _#B/ER/default.ers
  • _#B/ER/eraser.ini
  • _#B/ER/eraser.png
    .png
  • _#B/ER/gdiplus.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • _#B/ER/grepwin.ini
  • _#B/ER/schedlog.txt
  • _#B/EveryThing filter.txt
  • _#B/Everything.exe
    .exe windows:4 windows x64 arch:x64

    e396317e0c41e0f27509668e8b94edb7


    Code Sign

    Headers

    Imports

    Sections

  • _#B/Everything.ini
  • _#B/PortMaster.ps1
    .ps1
  • _#B/Registry Backup.ps1
    .ps1
  • _#B/Remove_Recent_Files_from_Quick_access.reg
  • _#B/ScanFS.Session.ini
  • _#B/ScanFS.exe
    .exe windows:5 windows x86 arch:x86

    2732d297471a97ac5ba6566e8a9a3ff5


    Headers

    Imports

    Sections

  • _#B/ScanFS.ini
  • _#B/ScanFsParam.scanfs
  • _#B/SearchMyFiles.cfg
  • _#B/SearchMyFiles.exe
    .exe windows:4 windows x64 arch:x64

    12de78188d45a2e7d5fd27ea942b7ca2


    Headers

    Imports

    Sections

  • _#B/ShowPass.exe
    .exe windows:4 windows x86 arch:x86

    c9e3b779e7a1e02be069819ad476574a


    Headers

    Imports

    Sections

  • _#B/SpaceMonger.exe
    .exe windows:4 windows x86 arch:x86

    dabc5019c94f3e88d51d12734e01b9a0


    Headers

    Imports

    Sections

  • _#B/Task Manager.lnk
    .lnk
  • _#B/U.bat
  • _#B/bookmarks
  • _#B/desktop.ini
  • _#B/filetype.txt
  • _#B/grep keyw.txt
  • _#B/grepWin-x64-2.0.9_portable.exe
    .exe windows:6 windows x64 arch:x64

    a952e66796ffad64d4a69a8bcfd11157


    Code Sign

    Headers

    Imports

    Sections

  • _#B/grepwin.ini
  • _#B/whoerOto.bat
  • _#C/AdvancedRun.exe
    .exe windows:4 windows x64 arch:x64

    65f94fee8f6fa846b2b29bdd0721c096


    Code Sign

    Headers

    Imports

    Sections

  • _#C/Boot Deleter.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • _#C/Eraser.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • _#C/Eraser.exe
    .exe windows:5 windows x86 arch:x86

    ba326d2341b4e46a8716e14a4aae269c


    Headers

    Imports

    Sections

  • _#C/EraserDrop.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • _#C/PortCheck.ps1
    .ps1
  • _#C/Readme.txt
  • _#C/WinSCPAll/Everything.exe
    .exe windows:4 windows x64 arch:x64

    e396317e0c41e0f27509668e8b94edb7


    Code Sign

    Headers

    Imports

    Sections

  • _#C/WinSCPAll/Everything.ini
  • _#C/WinSCPAll/SpaceMonger.exe
    .exe windows:4 windows x86 arch:x86

    dabc5019c94f3e88d51d12734e01b9a0


    Headers

    Imports

    Sections

  • _#C/WinSCPAll/WinSCP.com
    .exe windows:4 windows x86 arch:x86

    4930629d52bba909dc99b790c62376e0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#C/WinSCPAll/WinSCP.exe
    .exe windows:4 windows x86 arch:x86

    a2b5e84e1302109cec143108247d2492


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _#C/WinSCPAll/WinSCP.ini
  • _#C/config.ini
  • _#C/default.ers
  • _#C/desktop.ini
  • _#C/eraser.ini
  • _#C/eraser.png
    .png
  • _#C/gdiplus.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • _#C/grepwin.ini
  • _#C/schedlog.txt