ac15a0eb8c6a0d3d7e0be6fbe0a04644c062ccb75a94bf8834fd408ddaf28cfd

General

Target

Conker Free V6.zip
Size

302KB
Sample

250327-yfzzwsxshx
MD5

97daacf94fa20d17e2f5ec2fd4b04ebc
SHA1

766d96bd8c7d160f35d50ed15fdfe7ff5b92ed08
SHA256

ac15a0eb8c6a0d3d7e0be6fbe0a04644c062ccb75a94bf8834fd408ddaf28cfd
SHA512

8f1b0ef3fa49d7775f6eec3944bfcb681cade115a336ef5e3d2bfa5bb0fc29583aabc574307a1eb90c452ae406bdaa969a3cc57b703dbc7b7f0780f44b9104a4
SSDEEP

6144:sTLLCisfjzJ/ePzOVYJb+WT1btNlT7gTC5onRIPFYdNd3frNFcxQ1PF8t:sIjVWPq++GbtsTCGnqPFYxfX+QJ6t

Score

10^/10

Malware Config

Targets

- Target
  
  Conker Free V6/1-Turn_On_Wifi.bat
- Size
  
  6KB
- MD5
  
  963af8140bdf1e6dc3fabc8932f02855
- SHA1
  
  72ac4aef3904e301a3eca8f2b8ef8b945d55eba0
- SHA256
  
  ff5464b00f5dc4c943fb8c7dfa86cbbf0c98ad5ecf731b9b598aec000da7781f
- SHA512
  
  adfa632ac2cdc1bfd63f2231bfdf63e68b89d6eff7f97eff37e8acf83204e1b04dc64151c8c1881642fb75bb40515324d8eff25e325173def63592b0d9e88a80
- SSDEEP
  
  192:Gwhpi2MqJMr2198Li59n2MqJMr2198Li59i:5i2MqJMr2198Li59n2MqJMr2198Li59i
Score

1^/10
behavioral1
- Target
  
  Conker Free V6/Conker Free V6.bat
- Size
  
  52KB
- MD5
  
  a537c8161217658e89e33e65b10013c3
- SHA1
  
  4db5ff98a4dd5e204e62c931abe4d6e93216056d
- SHA256
  
  81f573be0965af9805a28f8058e3f97585dde42243dd86516a124feba33ab0fe
- SHA512
  
  076172cf30a61b7277c931a720138aafb5f7fa765b4df8bd5e0fccb40b0ce83e69626dbfac7334ee0e002bce7a27727a80fe68d7cb075573fb3e6cbdc803e539
- SSDEEP
  
  1536:etgaG0N4EpmYqIkYQMTkQdb0MQwikweKQThSuVG:etgaG0N4imYqIkYQMTkQd0MQwikweKQu
Score

10^/10

defense_evasion discovery execution exploit
- Disables service(s)
  defense_evasion execution
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  defense_evasion execution
- Modifies file permissions
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
behavioral2
- Target
  
  Conker Free V6/Memreduct/memreduct-3.4-setup.exe
- Size
  
  309KB
- MD5
  
  0f74e88d113f46798dc0f5d69c26da2f
- SHA1
  
  ace6920cd953bca45cb798672592ae7089d6d01d
- SHA256
  
  a7ba8b9da0a1fdf7a886fe86b2ca55b4afe05d69b2c9c4d33b27d65986d6a033
- SHA512
  
  6434786151677e3cfef57b2d7069dc37a4b4d08c8c7eb7e817d7a956517a9d298bc08b38f8342d91234a65979ade1898dfe79ae9cb218332d5496c1517c124ae
- SSDEEP
  
  6144:4Ya6eFisfjzl/eP3OD8Jb+Wh1btdxlrgTM5onRIR7YdH3zfbv7cxQ1/C8z:4YgzjJWPe0+ybt+TMGnqR7YFfH+QFpz
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral3
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral4
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  6c3f8c94d0727894d706940a8a980543
- SHA1
  
  0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA256
  
  56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- SHA512
  
  2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP
  
  96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
Score

3^/10

discovery
behavioral5
- Target
  
  memreduct.exe
- Size
  
  290KB
- MD5
  
  bfbe78d329b87dd1d5ae51707fdf928b
- SHA1
  
  015c758391b620dee72625ed59b522c06f6457d7
- SHA256
  
  31689824dd984bd9c0f07c20f05bc253f6d107581aec4609044fddcdd50f655d
- SHA512
  
  e950551d53e50a0296a60730c0cc2ee029ef9026159e159bee9bb29a0f19756f5167f77c4024854fd58bede7ff8051ac4a2f5acf55443ed29c381e909fd04e5a
- SSDEEP
  
  3072:KV+VDeAxsOc8WdE7KEgD3fN/FZgTMJNa22IR9Lp3FhMd08Xevd0pG46tBHa/FgFj:WQitu7K3rfnh2IRNxfTv69
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral6