5b9659a4179141e6a74a07fcefcc13cef456acb3676837a478ff3d85247a8689

Sharing

Copy URL Twitter E-mail

General

Target
Setup.rar
Size 128.4MB
Sample260505-3z4jmsgw2t
SHA256 5b9659a4179141e6a74a07fcefcc13cef456acb3676837a478ff3d85247a8689
MD5 45cbd412423fe62969267824e86b7830
SHA1 ac69c74aa222fcc78ba8372a4096a1cc136882b9
SHA512 e0c4c8f5c21f848dd5617c42cb98d818c54b7c5e0ea8b51439513f5982b81dbe0c1efd438ceeea47ea7e5c739051b55de05d83d85bc6320226d8cd7fa13865d0
SSDEEP 3145728:txGLVegAFGMHEKGuUlX+WB7kwfbS5s23giBdngjx9Bm+Fri67lY:tx2VCgyEKGuUZhFbSZBdg1dfy
TLSH
T1E258335AC13B78078DA9C81975072B5E958E9E31F17EFB6C9743D0C125F4BE2E20839A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Add-On/backup_40.dll
- Size 768KB
- SHA256 dcd173950845ad73a91573b1ecc61bafb598f83bb74352b229d9369a4aeb0fc2
- MD5 191d2960ea3c843b33194fc86b060cf5
- SHA1 b5d3a3e4cd20a227a5a73c0176baf16749852942
- SHA512 9402e2812669b515bb8928ad258b6743c3a2da9425314644e1fc4ab1a83cd66efc266d89625b4be88b3402dee4efc0f877a0fb2bbb46fdccfeb5d81c59c72410
- SSDEEP 24576:Oglo6JAv4VdrMoYKHlq1iBkuqJyYgThEcALzThUbEI6Z:9d2v4VNMoYKFq5uTKXdURs
- TLSH
  T167F433A0D3673906BD1ABD04D70917BA62E43581E43E3BE4CDC60C66F1A7AC24F5ABD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Add-On/cache_122.dll
- Size 786KB
- SHA256 962b2cc8bb38261914043211779cd13cc63fc876f2149b41cf0bf46d00c27a14
- MD5 45329f081036ed60d01ab9a47b321bde
- SHA1 a100e2d7d3b804bd70d9e2fe06ce7344be640278
- SHA512 a205bb81d49225e8d4c90d68da9c974717deb124396125e45be4d01eb5b6f3b20476746e330a923d63b9c355337708f47494b90786cf31a5a6faca56fc8ab967
- SSDEEP 12288:yjyYWYCDZKtHPIturnCUIeRh32/nKnj1WA7LumW1z8ww/sy4kAN4a2dcUyPW:yjQAPICCUIeRGnKpPmt1AnANz26XW
- TLSH
  T1750523EC0608E31C65A497AB7A9F574D4A1E0036952CBC74CEECBEE7A719083E4467CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Add-On/info_107.dll
- Size 794KB
- SHA256 da4e9c4023eea9dacee6edaff589585d1b123172ff13796a84a2510a9ac323f6
- MD5 6def9c252ff90ef17d6f28caa53281bd
- SHA1 7d2d8a32b0f5596cc8e96f07751d821a04cafdcd
- SHA512 8d3aeed813b4587ba5f6acee74194fecd53c8732d8609c036d5dc28f0fc083b20bcce2012ba67f7d470936218c43e3de947b0ed7c68a047c14ee349b5ec76655
- SSDEEP 24576:TiM740HjIe+4RRv5fbUj+Gg9ayUE3qFjJPoLs:mb0HMenRRv5oj+d94EaFEs
- TLSH
  T1DF05232A87FB95A21D91450BDAF60DE78A4B5CF4A3C1C8648778C935F0106FE25C3AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Add-On/proj_23.dll
- Size 964KB
- SHA256 a21698661eceeb04f8a571b120857d0c58da07a521260e31ac887992d129485d
- MD5 ee07d09e4a3c7c6635ac44c7d1026cbb
- SHA1 42e6e7cd3d3733d377087b733e948b1a231b91d4
- SHA512 5ae13693bb6439e12f94ca36552d4af8e0f2814b6cb0a6dec4d8eade65ca54b0303dd8c360823ae0fc148eb0c3fe8b13197532b578cb687d08324d9c9f1e013c
- SSDEEP 24576:95BmgpKYUAmNL8jT8LNHwG2NILOhdF173BWQhw:95BmgpK8mNMmNQG2SLOnF173AQhw
- TLSH
  T14D25238CFC4E2C9504DB4272EA5500914ECC8FDEE0AD6714ABC79DCABECFDA56263641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Add-On/proj_88.dll
- Size 794KB
- SHA256 5f4cb1344651a4bd1d669e9262e57eda12ce7052514f16672556e52b1369ad45
- MD5 185b1289909d8cc5c9cad31a457ff759
- SHA1 a691dfc988f449403daee553b16ac01b149ab076
- SHA512 7ad26bd746eaccfcc87f20aee9a7068fad268fee86c22996ca53e5dd6b0f93b23100df01ecdd0d070b187c8f7824432f56b0a021ae4c03693ac6b5748c5e16c5
- SSDEEP 24576:h745xFkKJtLps48kZfMaXLBapF33MDVG+:h7ERtLps6EaXlapeJG+
- TLSH
  T14505234A03FFC66D4CE3097C4596228029848661F7BE7B3D7E2A5AD505FB690743BBE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Add-On/record_59.dll
- Size 571KB
- SHA256 7e266b45070f149ad19a1f3a0f0a6d958f1d3d99fd49da178a5e5015a416e397
- MD5 6e41b54da93a95c7e3a6da9c61e75224
- SHA1 38f26e436cd6fb94548123134aa0ffb4089dde44
- SHA512 6b016f16de3e4bd22c447188002fa0655cc3219774cd1b15898adcb97f89a354a3ed51b79ab8e9c6ceddd7b4c41b2a160287f6e0a810dd4887f8b7216dc73612
- SSDEEP 12288:1I7//gALKuOFcKd79A7pTbIhJhz/OeMn3zlDSO8xrtBrVgdS0D:i71LKtcKTuehJh7jazlIxrbVV2
- TLSH
  T105C423A290D13841A3729193FD70442F043F9777B027728A22EFAD9BB773606955DBCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Add-On/settings_50.dll
- Size 530KB
- SHA256 d399031c27c407ca6d6f02a05e79fd0af39e9b7be368962c9c1d282b7f5660fb
- MD5 c444c1fb83b19f749f455417b01765ee
- SHA1 0ed3709fc2f136b45d7e1a8860fa78ed9929a6e9
- SHA512 8ec97c25aeb9b996d1eef2eaa31c3af527b7b6293b2d5f4dd21fa295199aba0a47f880f937c31ac0779a4452745ca4b82d2689d28b2eaaffd7c227219fa355dc
- SSDEEP 12288:j1jmkjCaiNhIcb6sSqwlCaFz/ChbCIbmvDH3:j1VjgycusSqwBtemvj
- TLSH
  T108C433AF38BA6ED01C83AA0F84F5181C9244A678EE7FFEA3FD761524C68815474651EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Add-On/struct_33.dll
- Size 990KB
- SHA256 3632dbce4e729cc604441834cb3b96395da029883f5442ec2ddb1ee07fb2564e
- MD5 4a88c39b655de59447d9816cfce6d93d
- SHA1 9135affc2c6c9ca48fbddc2a91b502d4e8506e1a
- SHA512 8669b73e890052e17fe354c5472aa0935bf1c6f37f466a588549c7bb43977bd7b52a9fdd658d3c3d4155db537b5c0b59679fea2192581eea9da70a6793787af8
- SSDEEP 24576:4u5Rf9PPzgXt5cxPOgU41oSZVueW+zvXA0yr4L307jehh:4AJVsX0OsySbue/jw0yr4TQjA
- TLSH
  T179253382F20D33638C2E8F65C6E3F57DA252D3E69AD7A8C6EB19515E0C3250101DE67B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Add-On/test_0.dll
- Size 1.0MB
- SHA256 fd3adc07836a06f5f111c491c89b209f72795c062948d41298ff310b9b698112
- MD5 008ba94432afd8dbfb43af95be1df641
- SHA1 e8f71814e298e1b2054a729b20f45821955766c7
- SHA512 3f5e7180178a5cfbd5f2e840afe3b133b72bf2dfc6a05d3fb58c7e530d556be86dd1b814edeb93e8d688d4025d6e300f07af47f5859b3b9fe15164c40837d99f
- SSDEEP 24576:IRpD1iadrmAvyAj8sQawZwjEkfC6vJCHU6NTA9MN:zdZPZ+Ekf7vJENQMN
- TLSH
  T1C5353361045FF0941EFC437F361AE86AF440BDC24E366425819892EF2D2ACBD6B79367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Setup.msi
- Size 28.3MB
- SHA256 e23db89eec03254725586501b1ae7e0c45e66cb630a4658294aab855662ef811
- MD5 077d9a6eb51679d25d492a1aab1ecb0e
- SHA1 bca1bb41885a8f11dc36c41f60e17f718cdaee15
- SHA512 aa35d65dbccb7cf3e0db57f1d551832df6dedd5cebcdabd91292b4d1431120a234148bc83475b9f474e5d9a0bb1eae4d23087165200542affda836fc68323ec4
- SSDEEP 786432:7QkXKW+nKwUfAXLWkuUilTFz6io6512Lb0X7YvASyC:7vKW+nFUoXsUilTB6izaLb0LYISy
- TLSH
  T1155733DE99A5038FE93BE976FC71899E8193FC498D41522F5607B14A10F3FA0617A08B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20