jupyter | d07bdefcabeb6ef9fd8066d5fd79777225bc0725aef6e737f16c643ae9662559

Sharing

General

Target
Chapter 2.zip
Size 4.1MB
Sample260414-e7r9ksb18n
SHA256 d07bdefcabeb6ef9fd8066d5fd79777225bc0725aef6e737f16c643ae9662559
MD5 0f4a961ef5bfaaff6f1bfbcc55edad56
SHA1 8c601b0717fcf6b5275de0e29630d72821782397
SHA512 9da755d95d9cf6fd22927dcb2e683f8135f973beffd8c428b98a43eb6ac2ea2360de7f337ab1267900c7d4433d48baf52ffa1a5ebf22eb95b33b35f9658281f8
SSDEEP 98304:Glt3iHt3Bk5T0SU5cp6QyC9FlxWKLDXF5vCeGxzCO3jXoltnsWU:Gj3cBqT0rcpDyC2Kn3vCeK2O2tPU
TLSH
T12C1633F58161FAE4F2042EF54066C28BA5C77872FFEA5D368A8145EB4C84F7F9B80590
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

jupyter

Version

MX-2

http://5.254.118.242

Extracted

Family

qakbot

Version

324.142

Botnet

spx133

Campaign

1591267427

49.144.84.21:443
189.159.133.162:995
173.245.152.231:443
77.237.181.212:995
207.255.161.8:2078
76.187.8.160:443
207.255.161.8:2087
98.219.77.197:443
66.222.88.126:995
207.255.161.8:32102
108.58.9.238:995
47.152.210.233:443
1.40.42.4:443
188.27.71.163:443
82.127.193.151:2222
104.50.141.139:995
67.83.54.76:2222
86.126.97.183:2222
73.94.229.115:443
47.35.182.97:443
72.29.181.77:2078
98.114.185.3:443
24.226.137.154:443
5.12.114.96:443
78.97.145.242:443
64.121.114.87:443
62.121.123.57:443
151.73.126.205:443
69.40.17.142:443
197.165.178.49:443
80.240.26.178:443
79.115.128.221:443
49.191.4.245:443
71.187.170.235:443
108.51.73.186:443
134.0.196.46:995
75.81.25.223:443
96.56.237.174:993
72.240.245.253:443
67.131.59.17:443
216.163.4.91:443
72.204.242.138:443
72.190.101.70:443
47.201.1.210:443
24.43.22.220:995
76.170.77.99:443
71.163.225.75:443
69.92.54.95:995
108.31.92.113:443
185.246.9.69:995
79.119.67.149:443
47.205.231.60:443
66.26.160.37:443
65.131.83.170:995
47.40.244.237:443
71.77.231.251:443
50.244.112.106:443
96.41.93.96:443
47.153.115.154:995
62.38.111.70:2222
72.16.212.108:465
24.46.40.189:2222
24.10.42.174:443
85.121.42.12:995
188.192.75.8:443
174.34.67.106:2222
70.174.3.241:443
65.24.76.114:443
128.234.46.27:443
100.38.123.22:443
67.5.28.72:465
96.18.240.158:443
85.186.141.62:995
207.255.18.67:443
207.255.161.8:2222
79.113.219.121:443
203.33.139.134:443
72.209.191.27:443
64.19.74.29:995
24.201.79.208:2078
98.115.138.61:443
68.174.15.223:443
75.87.161.32:995
50.244.112.10:443
173.175.29.210:443
173.22.120.11:2222
74.215.201.122:443
76.15.41.32:443
176.193.41.32:2222
50.29.181.193:995
207.255.161.8:32103
24.152.219.253:995
72.204.242.138:2078
173.187.169.73:443
24.43.22.220:443
71.88.104.107:995
89.44.195.186:2222
93.113.90.128:443
5.13.99.38:995
72.183.129.56:443
86.123.106.54:443
5.14.251.226:443
69.245.144.167:443
82.76.239.193:443
81.103.144.77:443
70.183.127.6:995
24.99.180.247:443
175.111.128.234:443
50.247.230.33:995
2.88.183.192:443
24.42.14.241:443
98.118.156.172:443
216.201.162.158:995
81.133.234.36:2222
173.172.205.216:443
184.98.104.7:995
47.146.169.85:443
108.27.217.44:443
74.56.167.31:443
80.195.103.146:2222
67.209.195.198:3389
96.37.137.42:443
108.58.9.238:993
173.79.220.156:443
98.32.60.217:443
78.96.192.26:443
79.117.161.67:21
72.28.255.159:995
207.162.184.228:443
189.140.112.184:443
105.184.48.142:443
97.93.211.17:443
47.153.115.154:443
188.192.75.8:995
142.129.227.86:443
72.69.180.183:61202
75.183.171.155:3389
140.82.21.191:443
71.185.60.227:443
137.103.143.124:443
173.49.122.160:995
96.35.170.82:2222
71.80.66.107:443
59.124.10.133:443
69.28.222.54:443
47.136.224.60:443
184.180.157.203:2222
72.177.157.217:995
104.221.4.11:2222

Extracted

Path

C:\ProgramData\hpsqjywbnv655\@[email protected]

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

- Target
  8888888.png
- Size 1.2MB
- SHA256 a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4
- MD5 136b9c85525ba66276b8c9f6b7014b0b
- SHA1 0cf5ba13d14c28c60586c7f4b9679925fa4d4172
- SHA512 0c02b116029a7d4f4c44988dc6220ed4050c94cab6e57f4aeb29d8edd0b8b59e74c89d6bd62e6e828826f44ebfb478280051ca289ea712c52d5fd113541e2590
- SSDEEP 6144:JanAo3boaSrTBRc6nWF84LvSkgNSjEtIovH6DgJG3uhRtSUgnSt9BYbC38g/T4J:JaAKoRrTBHWC4LINSjA/EMGU/SHomaI
- TLSH
  T14045C04073B05C0AF1F98FB4D8B656AA4430BE41BA34DD1B919068CEFDF529295F87A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker spx133 1591267427 cryptone discovery execution qakbot packer persistence stealer trojan defense_evasion
- Family: Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Turns off Windows Defender SpyNet reporting
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- CryptOne packer
  Detects CryptOne packer defined in NCC blogpost.
  cryptone packer
- Executes dropped EXE
behavioral1 behavioral2
- Target
  Challenge_1.dll
- Size 180KB
- SHA256 b6d7e579a24efc09c2dba13ca90622790866e017a3311c1809c5041e91b7a930
- MD5 ed629af9a127724d64185a26d00ae62d
- SHA1 3204c4352e4765ecf64b9bfa1b5e31c06b9577cc
- SHA512 ac989c584c067425ae2e67111b869239c0548baf085edcd9edb017056cfa3edb208d5fc5431ebb351c190fd4c9adffb673eaf5fc994d7833efcec6ff3511c55f
- SSDEEP 3072:C5OLkQW8JS0k0wcBalDIs3hlAp5+hQQE89X3Qo+PgaE3:CsWnGYlAp5+hR9sYaE
- TLSH
  T1C104411D29EB00D2CDED6EF68100693E9A30B802D7465F5C1EC54DEB2AA7D3AC9DD50B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Challenge_2.bin
- Size 3.6MB
- SHA256 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
- MD5 db349b97c37d22f5ea1d1841e3c89eb4
- SHA1 e889544aff85ffaf8b0d0da705105dee7c97fe26
- SHA512 d6c60b8f22f89cbd1262c0aa7ae240577a82002fb149e9127d4edf775a25abcda4e585b6113e79ab4a24bb65f4280532529c2f06f7ffe4d5db45c0caf74fea38
- SSDEEP 98304:wDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3R:wDqPe1Cxcxk3ZAEUadzR8yc4gB
- TLSH
  T1B70633A8962DA1BCF0050DB044928557EBFB3C57B7BA5A2FCF4045660D43B6F9BC0E61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution wannacry impact persistence ransomware spyware stealer worm
- Family: Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral5 behavioral6
- Target
  filetype.exe
- Size 44KB
- SHA256 0283ee684729fc204a985e358eea93ae4010894a0a662ffd1267e1e78e9de624
- MD5 1f2eab66674cd1820fcd06a20b0a7ab8
- SHA1 0dc9e1b02e72b3f2630e47e715568cfceea9ab35
- SHA512 066936f34d655ce6d6023dc08182e0d69686528460e003d885b1be0f386021ce8c607f16eb964ad8d3ff56e5a6dce65916abbd93b59c0ba83520574f6849c112
- SSDEEP 768:XPy45aRacSB9ivfCw7LjfYV4spkvlS63ul:XBEaHBsfCOLjfmNkvl+l
- TLSH
  T1AC138E267CE3C077C89546F406694B0AAB3F611143F595835B9C68ADEF632D06E3F34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  md5-1.exe
- Size 7KB
- SHA256 e16a3e7bea60ab2aa1e49e31199791648c58b14d1691935f25f3bd4e94f2f34b
- MD5 665ff1dd581f97b33af9b7fb9f695912
- SHA1 ec762b486a048e1ec88a04e07f107499cfac2c92
- SHA512 63ff81533b5089672e83ea740b77739bbd0594f3a6f98df30a6983f724d4bd4132db468457bb6368e629ed4083018e3860ddbdeed1708b45c425060fd4596b4f
- SSDEEP 24:eWpTD7ncAWq4Uz75TN4+8t1XDsc1+/qxB/qVsHBoGGmHBoG8:5TD7+mJNt8HXDsqrguBoMBoj
- TLSH
  T188E1214B5B054D32D44E2B358897264BFADB1B7017F34160E744A80F3B72A95A73DF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  md5-2.exe
- Size 7KB
- SHA256 84af18cfd067df107b790edde3dbd23a0379f8fbbd1913ab0cea74c4378f4569
- MD5 665ff1dd581f97b33af9b7fb9f695912
- SHA1 89755b503f7f45aa28ef5567c679bb9d0de20309
- SHA512 63e4f2f8a2dc1c835e44e54635dca68b4fb6321327a1e2bbacecbb31ba625957f0429bce58dfa303ea99aa18afd20a2eedcba1d3189f3963a46599287f381637
- SSDEEP 24:el9IJDrn9AWqQUz75TN4+8IDXDscR+/qxB/qVsHBoGGmHBoG8:sKJDrTOJNt8OXDs2rguBoMBoj
- TLSH
  T18AE1214B6A094D31D44E1B3589972A4AE9D71AB017F34160F744A80F2A73A95E73DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  ssdeep-2.14.1/fuzzy.dll
- Size 25KB
- SHA256 6139ec4ef02d56da92afdf5b124d206e73b418ffdb2cc1a0ad6224827a7baf58
- MD5 b98efa830dc2089287ca527675913004
- SHA1 3a2295f7a2f7feb3a0b061190284b21e2dcbca6e
- SHA512 96bb0d7a360008c833567d441db2b329632ca032bf4b17c7d79a38c59e4ed25e449577adf9f3ed4d7cb85521bb26c765dc5f682bf26d02314cd6b53f4b1b667d
- SSDEEP 384:7EX6kKD8aq3ZGrl4HjmpimeWW38gVm98ivFIEEaiyDHF2O0HKq3ln5DH:wVl3eOmpimkFZithbBb0qSb
- TLSH
  T1F9C229CFBE878DE6F40B30B4A167E5BF4EB9240784194A78C7B4C8D8E976644A705237
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  ssdeep-2.14.1/ssdeep.exe
- Size 836KB
- SHA256 6333bfd19c7d6ef5768a19bf8188d07ca5769313faba1836c1043ce2e11079f3
- MD5 5fe8e35203fc26b013e32749f241df89
- SHA1 48eefc1cac645cfdbbcb18043213ebfc6685bce6
- SHA512 9ab6739dee77f763352b5ba27b332c3199ddf4a08e577a9d28094fab3c2017fd7fad71ad263b16b436fd4fb64fc4d43f7cdd3c0086181d11057e182811eeb9f8
- SSDEEP 24576:fWmPxN/Kt592Yxl8hiJygbYn1e0XmRTkxr15mODK7hfPexmKm6EQch7sX:uu/C2WJygbC1tiODKiOrQch
- TLSH
  T10E053865EA4385F1DD5705F1050BFBBFAA309F0980218D6FE688DE94FBB3D53242A225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16