c4812e37aaf60bb0c03ba37a5de10cdf37171202c1fd1396e692916377556447

General

Target
Script-WareV2.zip
Size 19.9MB
Sample240916-qv7dhszhkj
SHA256 c4812e37aaf60bb0c03ba37a5de10cdf37171202c1fd1396e692916377556447
MD5 df33376b6ec3248b62dd96d57f2afc9f
SHA1 f39cdee7d9e7a9b70f21261cacd566d161484a3e
SHA512 c53bdb4a19cc430e8f6b0b437f7f05fc6b3732ab97ad1d7b5fb806a532f98509d0d37e20a3cffefc3fc5675c827cd3ab59430bedcfbd8fe8aa8b9e77d39d7009
SSDEEP 393216:4d/QGhhDiUBhJu9ssqrwW1t3fHe8apZclR8fAEpjI8r59VwBdRWlU/q7mkDcwEt7:k/ZhDJBhJFsqkqfXEGdX1r9pdH
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  Script-ware/Installer.exe
- Size 1.3MB
- SHA256 acf96978c04d6be7089811792c24d2084fbcd41fa966e3c33f16af3cb7148d68
- MD5 efe97f3890d47071a9d38ccf2da54aae
- SHA1 54a9e215628828dbf8048aeb5ece90d39b133d38
- SHA512 ef733be9a892ef8241d7cde0014d051528e647f14517cf20e313bd9022a9919c72f8054f81fe13d57184bc288706e8eaf55c96e20109a9f46e84986ecb948500
- SSDEEP 24576:1f3DOoUWhdoNLLJpTmJG/Olrvn++Sib5h5N4bSRaCUsvp1uEBzyN3DedwlYvN47:hSoU2siG/Ai+S+v4GR5jBzkyClY147
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

agilenet discovery evasion themida trojan vmprotect
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Script-ware/ScriptWare.exe
- Size 14.1MB
- SHA256 218f51111d95aff9ac48cdf3a0a9a2095acea67957d96bfb631de75a7a059ef8
- MD5 b788cb6e8e50414193103a6f52833e45
- SHA1 fcc02d922a2fb94d90f8b617e1b2b8e878af382b
- SHA512 f693640db3f61d0583f7ac2a7a79956bfb0e22127e3a9659adabdf3bce1615b56361eff02c61b1e490d1a026f4748f48cb6997aba5c1fbac307f30b99b957855
- SSDEEP 393216:ycFJi0bdAuKGFrHJ4W9pp/+vMogAuKGFrHJkRAPADY11kSc/zmjx:ti0bAWH1m6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral2
- Target
  Script-ware/WebView2Loader.dll
- Size 107KB
- SHA256 77a2a3097c0af6e884d2f7643dfe38094453309dd2433c33730fca10a0477411
- MD5 0fc6f5b0b3babdf352024844d2a756d5
- SHA1 1b58e7c0ff1d1cd83d9aed80c8d75d8bc2b163e8
- SHA512 81942fe24fdb0977ffc4e19046af49cdb3cfd4660d75a4e8f5a5db399275c9641a2615bf01c94b74fed044730144b0969160a2eaccf274ee4aae6c595e5abe15
- SSDEEP 3072:ulzhJmad5M+ekPfJFVwKrSDnuP7HCt+/NyIDfEtPsn/j481+y:ulzqaHM+eCTrSDuP7ZbEtUnr51n
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3
- Target
  Script-ware/bin/SciLexer.dll
- Size 988KB
- SHA256 de68811a33d29346d302c5b430f55fc7b65d63c30f18df23553f50e1b82aec55
- MD5 66a03d991de4ff53deef5ee623e109a5
- SHA1 956131edebd64d5f5a209f338e6ee2d498b92115
- SHA512 6761d027b020c721f294ab476a4c2786edecc59373df940e08ab755cb536e2b12d5758a8177c1887fe6914641c3c59112869d27cbc8b018f5000bb9265e7c177
- SSDEEP 24576:7tdy0r6l95db3kH+PVa5ScfjhU/zT1oGOwea9:pd/r6tdhNvTLJobweK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral4
- Target
  Script-ware/bin/ScriptWareAuth.dll
- Size 4.7MB
- SHA256 ee142545331511cc6bb93a95463e8bedcdff76f46520255c4faa2b2f6508f41b
- MD5 16317ae9fb3dc86da0afb7fedb41eb8f
- SHA1 4ddbe2e7277c326e4e4f5fdf9f82c12a8c61de1c
- SHA512 fa8c2bad6519d476a2e49f64f4c2e361e942eb615585cf42cda8ceb0c438b92f2cbdced90c3a40d9b048dd6580ae7c36bffbde31376fd406fb8c0d129ae91f96
- SSDEEP 98304:nZbNZzspoweCon3xRVx6HFXJ60MNayHY3X:nZbNmKwnon3xRfzHYH
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

discovery evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
behavioral5
- Target
  Script-ware/bin/ScriptWareInjector.dll
- Size 45KB
- SHA256 70147049f81f7afc41905a8aa193a4b58351d19ea385e7ddcd7655ceb31d50c3
- MD5 4ec169708a86a5baa627d8272906a3e1
- SHA1 698e814410f3871a18b42987fc92f752af1e4fe4
- SHA512 3afffe64cb2f9a63b8b38a1808c2d29ac76d3b50ead9928db71c648286f47e93fce14d4e3ddeedc9aafe5918f76a9971abe81dbf315b7d690d34fe18ee03a8ee
- SSDEEP 768:xCLJd0YGADrBrvr11rQlMeavQrUBjPIq7pC5Yu4pbyZaYebeWf8tu6lLTtyK3:xCLJd0lAPo+NQQc514fYe6WYu6lVyK3
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral6