24c95c194451721f2d7f1353db641804231287e2d2f9620fb2a7221178c85fd6

Sharing

Copy URL Twitter E-mail

General

Target
Downloads.rar
Size 30.8MB
Sample260424-kyaaases7p
SHA256 24c95c194451721f2d7f1353db641804231287e2d2f9620fb2a7221178c85fd6
MD5 86a417e2563c29e7ecb2138493b246b6
SHA1 92f53b0e02208463d478c81e71d64d57f049e89f
SHA512 7b9af060dc021b4d61c1dbd6e47e928ed95bdf619d2a938672569f6699b1bc42e8516caf052d8e867928a30945f94ba8ed4ba38e42c2e9522490c1a0c0c69bc6
SSDEEP 786432:jMz2VFbi/3jfyLWgDEMP8iXW5Xl9fqk9CHRWqgnB4LQ:wcErKLWgQi8iXW5XlZ/4Wp40
TLSH
T1A56733FAD2876591E66F02F6D94ED78B02401B4B098FB610E4C3DE93C11BD6A045FB9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  Procmon.exe
- Size 3.9MB
- SHA256 3b7ea4318c3c1508701102cf966f650e04f28d29938f85d74ec0ec2528657b6e
- MD5 c3e77b6959cc68baee9825c84dc41d9c
- SHA1 bc18a67ad4057dd36f896a4d411b8fc5b06e5b2f
- SHA512 f825521149f4e771c9f51abaa4fa956258a5393754ec7422692dc0c24c120ed9f103dd3953b47b7bb331dd4095b3e97b95fb35c4dfe03ce39574ba4b39b76d7d
- SSDEEP 49152:C9TJDVmHMAlNXFJelNOBLVKcu6NvhM6qHJfTJb5lmzSzko22LGywmtG6tlp0NjCd:O4sA5JelIBs9JlmzSzko2zjCf9fP
- TLSH
  T1FB167E1333D440E5E26952308ABBC67AD6767C79077245DB26E84E4F3F32AD52A38732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Procmon64.exe
- Size 2.0MB
- SHA256 3e15995894f38b2eead95f7ff714585471f34f3af3d8f50a7f83344781502468
- MD5 223b222ce387a7f446d49a1ee9b572bb
- SHA1 8ed888a02861142e5eb576385568c2ba0ddd8589
- SHA512 037b4787af5fb129a3b1e0ac9565e59d5a55ef26ccf93bc9adf685c08422071ee0d0eb4667cd2ce0d725c7dea0209c1d7d48baf58cd18dfb58de35bf7feef1a2
- SSDEEP 49152:LNvhM6qHJfTJb5lmzSzko22LGywmtG6tlp0NjCw6IxKX:ElmzSzko2zjCf9
- TLSH
  T185A56D5723E800D8E16E927489B7CA3AE6B27C55037286EF16E84D4F3F33AD51939721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
behavioral3 behavioral4
- Target
  Procmon64a.exe
- Size 2.1MB
- SHA256 36085927ca98b9b7d630edead37671208e01978ca38974fb3fd435f42e709702
- MD5 03a3a7c0f0534d7f56fb50d486fe8cef
- SHA1 a53b165ac6ebf2bfeb66003346754fd1196bc620
- SHA512 b467ad6e2fbd05ae93a4e922c59182de763ac92e4c48a970a6118a78de5e575e5ce5c20e6ccb3454943ecd4020ff704a8293b82736648e03441d329c59f2b51c
- SSDEEP 12288:upJevV6JImsLobpqsLH6Yjg07x9fjBsXUW+KlzLfR+Kp4rufHbsTk5IIfDmSBhZ7:BvAKj1YbypKoPDrBhZmDvi0XTL1KLtgG
- TLSH
  T1B4A53B826B8D9484F2C6937CDDA2CA74712BBC648631815B75F60E4FFDF5AD88960332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Regshot-x64-ANSI.exe
- Size 129KB
- SHA256 d41b926d62c3a99fae12bb0116f2cdf5f382a883d508bb7feb7734c09682004c
- MD5 e92608fe80698293858002f6a7e9293b
- SHA1 a3b44f26a6902416d47b2128a1a919a3307e091a
- SHA512 4961f7724510e4c6edc0b757d02fdfd4e0b784f2242a8f3758c26136fafd74191e6f2c61848827050e4f8c4606f8e28795ad2b77876a03356cd7264eabf295a0
- SSDEEP 3072:ojsxDMph+uO+jmvuwcNEY5IQ+h9QNM4tmK9s3l5JovFA9:ow1raQXh94qOvFA
- TLSH
  T1E0D37D6AB2E450F8C843D2B9C9E5AA53E3B134290F3567CF172896995F336D0FD2A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Regshot-x64-Unicode.exe
- Size 133KB
- SHA256 299702f56210ab1860ad4b6ad7611e22abcb048114a52f15a04c896bd33cd2d9
- MD5 c48a906a47d7e66366435b6d9d3d0be1
- SHA1 a9ead0de5d5648695932f2f415b82076d16189b7
- SHA512 944a32204577f447dd8d21e4b3e444c3500ba45e326ee5249caa7be97faa1f585a79fb3204acf6e168d91bec7e91f40da3612f310faa2512b1c3fc81a9808c76
- SSDEEP 3072:ao9jbiWCo52DOI3Jnr0Nd07GbYmdCsXmfwNTfuocbtmm2S5TovFAX:NMYdkstmkTdm2vFA
- TLSH
  T192D38D1A73D850F8D463E2B8C9F55912E37274251F35A38F0A28866A5F337A4FE3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Regshot-x86-ANSI.exe
- Size 116KB
- SHA256 28408f9f79c5f9fd8c7d6101fc30073ec5a0378bdcd76f680328113a2920fe0a
- MD5 aee0d0bc1a728f52b5c7a96087cb50b4
- SHA1 1a8254af73ff1fe4b334e6339ed08f00b1398380
- SHA512 02cad25b66a2d5eb4b9a6da66b158205965efb4cabb6cd7c6be4794b37f8bf05337882903704e14fcffd58c46270a05e8741e6884e4065f587cf79dd4d87f3b2
- SSDEEP 1536:IfYz90xb97Us+tTiqPPZQL//k4npn4qlue4ojQTFVBD18vQLYpudZ3q9:IfYGjUs+t/BG9jQTovFAZU
- TLSH
  T1EFC38D50B2C1C036D051333911E5EFB2D73BE93647A995CB776816EA8E112E19E3A38B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Regshot-x86-Unicode.exe
- Size 120KB
- SHA256 d4cba517118ff995bcafa3538fbdaee99212fe1fbc2147c0c6dc440e991b6ec9
- MD5 b663e3ff65fff422545278a1dd17ebc5
- SHA1 add2ee66037798f5f1ac03b1831f8f65064f3f4e
- SHA512 fe8e8170b3a52b0fb6c1c58990896bf02a20c9a82ce58d156f711ec3c95a2edd4ed54230c73e5b53f403ab7bfc2772efb1c34bd48ebd067e0b78acad6b0d133c
- SSDEEP 3072:9fqJFPiHqQwkdyrY80cLBoEuMbtJhQV1ovFATUx:hqJFqqrkdS0cLqEiSvFA
- TLSH
  T150C38D10B2D8C532D062613E09F1EB76873FFC35173995C77268269E4E216E29E7638B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  npp.8.9.3.Installer.x64.exe
- Size 6.6MB
- SHA256 8db87a458551371e911bea5243840c783b5e7d41b7f867a2a6f74971881fb1e4
- MD5 3419ce845525534cda48cf6959bc41c5
- SHA1 32d5f6f3ae0354dbd44afbaf99bfd1d3977668d2
- SHA512 f0016b08ff63855e12ff3418909086041e456271fa3e0883c52088f48aa9be13bd0d028c35abc994ce8816009594ca875bfd349757b83f160969cb7c41070440
- SSDEEP 98304:CQvozTSOU7wEDKJ1acuNX/PjhJ4LWuBr88glx2tDvDBPWMfUqx0sOUE:CQDx73DKycWrhDuBrBglct7VLfpxTE
- TLSH
  T1D36633112A6DC957DA498D35431BE3AA70E6FDC52E52C3033B40BB65BC96B53F8ADB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral15 behavioral16
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  systeminformer-3.2.25011-release-setup.exe
- Size 22.6MB
- SHA256 7612d5e44a5a392ab9f0d1b5b8a79bda3cdbe19848e8ee9ec23909aaf3daad45
- MD5 979b20755ddf86eddb3e2892003a2ca6
- SHA1 3a0b6f9ee4ee12872e733948465be5ece5b25629
- SHA512 3238f77f7810460cb7cdfe7692892879c28e14ccd95969e80cf83d1dff320c8354173a87503b893b7095b99ee81c61e195004ad5f5e6a28e09e3e9c1fc080d44
- SSDEEP 393216:Cg+SqZ3hd0y0HNQvVun6kljEGVHXQYGSE1fggY6Q1Gv0ZOfBKy48/ZtwnvmFO4lL:CB/Z3hd0heVu8GyYGSE19eGv0Zvyd/31
- TLSH
  T1F5373390F6B242E4E9F1177069A3EB19907C28D01F2489FF0BE95C845FB16D1973AF29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24