17ac44b604ad3450348a5769a851c16abc3b256ea8c5c4e64bb64ac3657b403f

Sharing

Copy URL Twitter E-mail

General

Target
17ac44b604ad3450348a5769a851c16abc3b256ea8c5c4e64bb64ac3657b403f
Size 1.0MB
Sample241109-2vqljstja1
SHA256 17ac44b604ad3450348a5769a851c16abc3b256ea8c5c4e64bb64ac3657b403f
MD5 e037ceeb0aeaf43ab7e8bd56540f0ab9
SHA1 e16f059a82fe8dfe0e62c5acbf2bf5420e181a9d
SHA512 68a6ffc9080f0e5bb260a03bb6f14044b896117b91f74f0ebdda6fb89d47d773578517d29d1d2ff82452deddb4448a09cb73d9380fc073395827c94ef97164b6
SSDEEP 24576:8P61AuKDAmUqLd7WPBtq2UpO+FYgCiBeoSHNdBOvPAle0:K6myeLd7cLqi0YniBe1BOnAR
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery dropper

Malware Config

Targets

- Target
  0_russia_update_blacklist_file.cmd
- Size 130B
- SHA256 d9d7c57c7dedb3a4e6566ddd7623758f53986a2c34e0cd3784b84f7f881a01c4
- MD5 a6af4b081a4cbcd448759306b2366eac
- SHA1 0d1d887413e074b0991b5be0ca296f18053502c0
- SHA512 f406b865f4bbe08181f1c1f239f198bab03b5b681174323b78f0b3c1790a1e177473a89ee566dac906c08d044fb0eb9a48991cf773222d378f469bd4941af62f
- MD5 SHA1 SHA512
Score

8^/10

dropper
- Download via BitsAdmin
  dropper
behavioral1 behavioral2
- Target
  1_russia_blacklist.cmd
- Size 274B
- SHA256 69c8b67fafbca446ce5302e97f9947191ecb84d2a51eae61d4955dc3e2147da0
- MD5 76763259e528cd27e998fb4c665c2b78
- SHA1 f2b6e15dca04c54ace2aefc4bc72656dc7550cab
- SHA512 69d35fb64ab4cee901b7ecc9baac437cd4dd5e3feb5b006a0fa8c3d52fce8ac9eea5ee68a6dcea01f5386966ac135e85bfba8fc8eecec5d8c70212e795d0dd76
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  1_russia_blacklist_YOUTUBE.cmd
- Size 420B
- SHA256 2712d7700e2f3217e826412a5a773487f08a41451849722ffaa08841b8684496
- MD5 55e68f566514148bcf844524b4e99041
- SHA1 8b1d5715cf9a1513b6db9d74270b20266c047c9e
- SHA512 075cd6dbe158028bbc315591c69a9554c80dd50c510457f802e5f4f1b34104eefb1113f165061c21c07fecb70bd0d8e7170a97aa3e08107a98eead2b2f7473f0
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  1_russia_blacklist_YOUTUBE_ALT.cmd
- Size 427B
- SHA256 ffd2fc0fefca6cff2525c92ce5a7e6109a4a9e50756de275b85fbd86bec07760
- MD5 74a8e80f39adfd1ff8836a5c05254f37
- SHA1 eb6fdfce93b5d3c2bad5724c97584c0676803bae
- SHA512 1b74775be3d4d5f14874cf3bce0a45d937d972a7d5f7bd9f84b674baae592e3905ca1295461c723846b42c38e17c0dee2c17334d6f4261a8af1aab0077fa6a83
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  1_russia_blacklist_dnsredir.cmd
- Size 361B
- SHA256 472d9bd4f0366bb9478b6cd61302f12bf6cffbed038508a67087250bf610e355
- MD5 06018c5958cddd1d0cf3135762aeb2eb
- SHA1 42323a08fc5a9d9b600852cd587f0a7dd914858b
- SHA512 c49a4b90e08785401049dc374599404976d9a5e145ed0a034f18615d4b8a4c4cf8adc4b714ed7b68445e66546d9c59a5666846d71e70b7fba600659821f4a4f0
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  2_any_country.cmd
- Size 204B
- SHA256 17a3d7b8b1e1340f67d3687ce9162199c0a25025941d23954880808403487d07
- MD5 72103c58f2ed536ebc07e19fd00fa2f0
- SHA1 cd37e3bfdc4dbeecfd945561b8538e328dcfe2f9
- SHA512 4270dfb825f03d41d5911db8cef7de43c58a0401d84bd72e047da6b9fc6753789c070c9fd61bb0145f70b47026ba70d9d18612fefd1314436998adb354de815b
- MD5 SHA1 SHA512
Score

1^/10
behavioral11 behavioral12
- Target
  2_any_country_dnsredir - Kısayol.lnk
- Size 1KB
- SHA256 185859dffba1810ec01e37eac64fd29e8b0720fd15a760c09ac7d16bf6185803
- MD5 65643b2e8d809f54028f59ec9ad7f9d4
- SHA1 f2442a41ee6b646037b34379aa100f0001ee810d
- SHA512 295c90b1616776d7235838fcd6585015af8514ef6078cd24c8b9daad3e2c6b77a7efcd99e1a9843510e695ea067307a96921d5cb1ada81eba2f38787b5f7a58f
- MD5 SHA1 SHA512
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  2_any_country_dnsredir.cmd
- Size 291B
- SHA256 a7762f252e434134245adee7398eabc7b96e4e83ee408ce63cc3f92b942c4b6b
- MD5 48de91946fd423515b182a622842adc5
- SHA1 4519a0bc87a0e0838f003d3e4e4904d5721abad7
- SHA512 43ef99d5f0ed8725cfad206d6d3bd0d393258872882f3c2fd8f974703dfb418652f9f1adae5b6e9ab769cf9a46192655c795c4ebc0adf4cd6a1b4e7cd20db745
- MD5 SHA1 SHA512
Score

1^/10
behavioral15 behavioral16
- Target
  service_install_russia_blacklist.cmd
- Size 660B
- SHA256 4d2068f04436998bdf003c430f7bc28f0d0fc7d48031b8a37983f84bad6374bb
- MD5 af6dac6686b77dc51203800737f41b75
- SHA1 385568a96d92ca8206e45b6cf945b2fa11b29f80
- SHA512 ae54f13ec18a71983b598f9f2d38231168b9f7de3238f6f742128331f2957e0a770b9502f2bf1997c8f6a6cb0c4bb90e9f4a8156ac807744141c51f4b0c4c49c
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18
- Target
  service_install_russia_blacklist_YOUTUBE.cmd
- Size 806B
- SHA256 1b50fb46b29a8b43cf5df5d34dfa4dc4148ff0c9c695392a8cfce9e360b5ab69
- MD5 ab8e1d24adbba8444d9a1970b594f18f
- SHA1 615475706fb8b2bac8e9dbb24ec1048b6c5a71b0
- SHA512 e49cdc4babb30e6c3369b1baa713fa4c4b6f9e391ab25d95992583515cdbcc4f5ba3444998060359813bb2a490737518895c4d8a55411eb44614da5734c53232
- MD5 SHA1 SHA512
Score

1^/10
behavioral19 behavioral20
- Target
  service_install_russia_blacklist_YOUTUBE_ALT.cmd
- Size 813B
- SHA256 98191c999493a3aa6018550c3dded3b6aa4f2b7c071f8acbf00d3f06c8df13bb
- MD5 e9b8f24c9624866d1607c05b6a79a6ec
- SHA1 b7dc28788112d3dbdf489418d609a13f9fcf95cc
- SHA512 35027fff139e666fd53e1f0272ebf9ea0e445f7595a8e5a978e3d76a29a67da9a22b890aa85512ef1df8cdd75a5e365284c22dc6de2cff4471bb40114eb5973d
- MD5 SHA1 SHA512
Score

1^/10
behavioral21 behavioral22
- Target
  service_install_russia_blacklist_dnsredir.cmd
- Size 747B
- SHA256 450f2b003fb579f897eded1131c9e893afde7b2ebf07b86110449e57ed9a0da8
- MD5 77b1d63472e67c4368961c463cc1d92c
- SHA1 7653fa303944e6f2436ef72ad8a6d11eb6f8b95e
- SHA512 67763f15836d456bd8713533599f2bc6d97d16887fc4078f5c5c36ec0b42beffc267e5eb9396f16aa350ce39a61c57ecc1c82e32068495a74489af68dacc3a31
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  service_remove.cmd
- Size 309B
- SHA256 63915b4b09658cdfec4c74923650398d9fc497ae3ce9e68c5592337051d2fb64
- MD5 204b35d000d6b29c1102b1d8b6a63dc7
- SHA1 94a92cb8ea948b5ebac3b3eea2cb9bcf31f85e20
- SHA512 bb9dfa323938700c562bd68e5c1bb500e39b9f7ece58a3c7284ee0a895b4bd4b2337f693e9593d190a4461d66694ea7ec135e7b83824edce9ff73b7e4d413db7
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  x86/WinDivert.dll
- Size 42KB
- SHA256 625ffdd95bfabff32d0e8a95beabcd303c01c8bba73b90402d4e84d6e15dd8e5
- MD5 1cb0efd60883b5637b31bf46c34ae199
- SHA1 b91de8d5f072f8c6aabd029d96568effdd5662d9
- SHA512 68c7c257b8cd28011f4b9af09b1e4c7b3d69c6f1457ca6f68fe114fcb382e470b87b9c12ca5d6d4aedd27a103a35fac9093c08b288867cceb9621a60ac70a6f7
- SSDEEP 768:/BD4bCa+EfZ9+EwleNwYLWKkR9c5s1R2wdRt7JtXwxwprTKkimOyd:/BD4bCofZ8VYwYyKkR9c542wdRQ0TKkV
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  x86/WinDivert32.sys
- Size 75KB
- SHA256 29ca5ceb59c9c6993a349e82b1fd46078e6f8a302764153ab84fa22e382fcdca
- MD5 cd477ee96ff05cacda8ac3c0e9316d7a
- SHA1 68da0c17728aa672f140477b3822aefb5810c8b5
- SHA512 27e13504eb291a5324d824360532ca6d19c409022c72f5609ca55f92558388e3f25f1e8d657afd3d1e4f9ea9c082483c954d6f4e89df049e4f732383a04adcad
- SSDEEP 1536:tVYIJtdRHzb+uzucD5GYLKYaU6s8BLcHWXizv65Q4:tmidRHzMcDQY/aC8B8gevL4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29
- Target
  x86/WinDivert64.sys
- Size 89KB
- SHA256 e69b5ba3f0cd6cfb2983e442636e7f0b342b61b15264b0328317d4559c82cf50
- MD5 6a33620de63bccaf5e5314ee49cd58fb
- SHA1 ac728b339681b2e27099fecc1419821f01d04b34
- SHA512 638d1b8aa4dc0e4ac504f51aaa3ec8375ccc3d69a4d36821f6bb98060b58586007f47966b9d58d222b9f067e12e80755f56559286cbabec8746146acaf24f945
- SSDEEP 1536:8ovgCRgYL/h//oJJw5AdPtey2AyWpdsihch9WXi2v6MuO2:84jmJJsKle9A5pdsiqg/vsO2
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30
- Target
  x86/goodbyedpi.exe
- Size 98KB
- SHA256 66e202c9fce9e769e2bc791b7fd6f56f21eab59f607f4ed0724e0c68c430dd1f
- MD5 9c3f16d5a0aff180f9d04ae6c0fe1f28
- SHA1 c0febd0e54c2a335ee348233e9555eef4816663e
- SHA512 746ccd373f025d95ca4f55cb212ba6b259a6f17d7e2c5807940cc0d1d31ea61c943a6aa4fc91b2ec432ed1d04ffee4b4c3b78db2cdbb474399313bf26f56a4ac
- SSDEEP 3072:wjnafjFO9vbnTrjP7HzfLXDvnTr3jP7HzfLXDvbnT/rjI3XLS84mUgIDJO:46RO9vbnTrjP7HzfLXDvnTr3jP7HzfL2
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Download via BitsAdmin

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32