ae587301c9569c95509fc0d43c9ed7d050c2e4d9257fc6ccc58622befa229717

General

Target
Gemalto_Minidriver_v129.zip
Size 4.3MB
Sample260422-pp46jae18j
SHA256 ae587301c9569c95509fc0d43c9ed7d050c2e4d9257fc6ccc58622befa229717
MD5 2da7202b72b590490fba4f11f2f7071a
SHA1 fe1c35b8ca637e810c78fa9ce4529146addaebac
SHA512 16366ceaaf9a731785afe34ae87262af2d2593d17365c91f1e28f6269aeafe3976541fde983f002c2903bb42338617011fc1553a8fa054e3318fd7fbd415fe93
SSDEEP 98304:q7Fa+zoilUHx1nL4rp38Q8Wp42XsQ1SMXaq966V8v3SY1v9rLkLnPq:DXTH88Qn4riSMX59BVGULnPq
TLSH
T1C926331D87E50197482B2B63C971A4EBB4A0CD92CA7F98B4D4F9FA3C860F4F7524E944
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  IDGo800_Minidriver_v129/IDGo800_Minidriver_32.msi
- Size 2.6MB
- SHA256 aa8e23e6d0c01612756a148417f7fe1d344ab07f0106aedebe9ac776e61f043e
- MD5 043abaacbcde9065399cfd9ba085b6d6
- SHA1 45d72174e52ef9a756e4edee80bb273264b4716f
- SHA512 75a23fca283d53a40474bf5b50e3807700adbe60957c369fc36a44db4c57a843b04f3cef2ba2dfe9a5da9ce46792fc5f0439698a705760711e4cb8d546bc5e4d
- SSDEEP 49152:RTqHeX22PStNqf3gSoZJlR8YyCzP8Kr5hkczq2lKVG5P5wVVwsx33ijLXLYUvEJJ:4g2vFS8JlR8YyCzP8Kr5hkczq2lKVG5I
- TLSH
  T135D5D02273C5C37AD4A60E76986E41B11B76BC316B3546CF7358F23E08725A0867AF27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  IDGo800_Minidriver_v129/IDGo800_Minidriver_64.msi
- Size 4.5MB
- SHA256 9774a7d35b93219216067172fa3741ade7df2adbbee19dbc391013f52ebd00b5
- MD5 431eefd1b99b2f4d6f5c1e61a82aa7cd
- SHA1 78bbde10ad06f75bf0d730c6398ba43cc6629ee5
- SHA512 be73ca70a5979122b635171c309c4f27c115ae61df5eeb5186591f425e78509871e13222c02786d9703ba83e5756e65adfa05576722800adb399d43e47f31c4b
- SSDEEP 98304:JvXC2LSFllRCYyOzP8Kr5hkczq27KVG5P5wVVwsx33ijLXLYEUENuyB1+82P4Wmm:Ri9Pfz2P4Wof6b/M3UOVE5
- TLSH
  T12D26DF11F6A4023AD0528A7FD5939A69D6B23C5627318BCF1302F7BA0D375D68636F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral3 behavioral4