8ac69265577a3690a39dc067f99583e17d3a226c565c423ac6734dab8a90ece2

Sharing

Copy URL Twitter E-mail

General

Target
Pac��ܵ绰�г��.zip
Size 1.8MB
Sample260506-gzmegaft6j
SHA256 8ac69265577a3690a39dc067f99583e17d3a226c565c423ac6734dab8a90ece2
MD5 7c13f821750d57ad07226033b3f87ad6
SHA1 3286edba9dd13e6b6fe06591f4f2eaaee2d22832
SHA512 db1f2ad4a95cd4921fde65610a0953ab17b6c07afe56aed7f20dddcc42c4f6e5a4bd2c1446c6ccfc5f25df4b9708d18e5feb0c394e932886ac7ef9a3e52ed243
SSDEEP 49152:ig3MjS06A0OaBF6ZkBPnVr7UmpZ15eXB2lD:ig6S03eBbVVr7UGZ15wID
TLSH
T1868533572A51FC65F324B9F868BEAA0FA201518158AF3D07D4E431F7E697FCA78470A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Pacܵ绰г/lib/autosetupdrv.bat
- Size 32B
- SHA256 9f156d3dc0e81141f1ac9edb310a0f999be998fc9333577f5db4690a392b5a5e
- MD5 2886fdfece5a4676be0ece49300f917c
- SHA1 67cd6cb65269f696f25cae2ff817994edb590dc2
- SHA512 94ad3f180d28ce6efa191af958cf593efe79f9cbee58b21859d0b5404bf4f01604f4897cac464ac4141065c3f5d3c768138a1fa22dfa8afa889daf2ecaf5bd37
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Pacܵ绰г/lib/bridge.dll
- Size 367KB
- SHA256 2b316ce83a12b8d0a7fd3b5c7c753e5137879d6deb6dc218df97703cc0b00233
- MD5 7cfbe9e46ebcd8ac531b3606eee86ab2
- SHA1 ee0da5402f64caff677522986d7cfe66ccedc9f8
- SHA512 4626d96868190856783f3a48297e2303355ec719cc2a4c023c5652a1b3383f7a18f84db509ce029aeca9a27553e413ffe30fe193ac981cec48f10305a046e46a
- SSDEEP 6144:qcf2vZ6v8pb1h3YkwNRFtNWBG6SHW6dWlnSRXdTK5Ak8g+0aW6G71i6:3+h3pbrok8/WtSHW6Wl1b8/bG7P
- TLSH
  T1B4847C42F5A640F1EA5D2634216FBF36563A9BC98B015EC3D3E8EC394A7A4D2913350F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Pacܵ绰г/lib/driverfile/TelMateW64.SYS
- Size 33KB
- SHA256 8ea98a0ceb41f505c43c82ec940fd0eef810f229ddd5d4804c000be4c1e4423a
- MD5 d1e92dd51f3fe13e7fa8d521c5f99730
- SHA1 bdc8d8205d238b5be5bbd32b983775ebc90ea247
- SHA512 cde7a5791e95ca50e7a704638d6fd0fcf223f0a89158641fedbf1316c9340befff7e6c9b07a029a04780d8a76c72b14e2c3f5239013bd462ac52e688f6d1bae1
- SSDEEP 768:7vE1ayIo8Xb2HQ1b7zxCiImX2+4IILFmyX:7v/z1b7zoD62+AoyX
- TLSH
  T1ADF23B73CA591068D55AC535C7878997BEB170C43B24ABEF009096422E67FF21F7D21A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Pacܵ绰г/lib/driverfile/TelMateWDM.sys
- Size 27KB
- SHA256 687616cf7cb4ee49f575876d8dce27d53a4a184b3a12ce12512922f6e4633ade
- MD5 d3fc1ca3844d10f45d6ab155bebf3e27
- SHA1 cc404706eea6aed09b9f13933380fdd06304e3e8
- SHA512 7776e10e47947adc887d8dcae310bed16b15a56c59189300bc941136a7277a3f2a43ecc3a77be5b19ab339cbeaaeb39cfdcbafc9e97f2bfa4edeeb03c7873198
- SSDEEP 384:CfHLp5CvygEqiuaNW+4dOOuFaghZsZFUNQQftarcPeFgzDIYmt3mirILca6jU0SJ:AeyqyoJTX/UoEb4Y3IILFmyNr
- TLSH
  T129C24B6257106876C8C64AF1856EBB2F283F7AE90F58B2D310B046D61D8A7E53F3811B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Pacܵ绰г/lib/driverfile/dpinstamd64.exe
- Size 1.0MB
- SHA256 181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab
- MD5 be3c79033fa8302002d9d3a6752f2263
- SHA1 a01147731f2e500282eca5ece149bcc5423b59d6
- SHA512 77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea
- SSDEEP 12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
- TLSH
  T1FE258104E7FA4225F9F3AB7DA9B152528A32BC815B34CA8F4240569D1DF3AD0D971B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral10 behavioral9
- Target
  Pacܵ绰г/lib/driverfile/dpinstia64.exe
- Size 1.4MB
- SHA256 54bdcdf491722899ec3b04ba12aafe1c0b989bd2444e6ae5bc82e78b18cd5b44
- MD5 f9d6c6f40dc8ad9d3fa526029b6066b3
- SHA1 ff542ef0bc96f7525c23758b04e40c65dda36ca9
- SHA512 3e8a39bbe4635217baef7c079e0c4234c43212ecec0769ff2308182726ee6955dc9269d6c73c1c8a8f62f04deb05aeee2328af88af43307343fc92a2e8298f57
- SSDEEP 12288:2wUQoJxgl86rfHbdLDfOnmU+5KlIPMaLiH:9UQWNgfSRiP2
- TLSH
  T18965A505DBE6E127E877177C59B3072917B2FA961BB2CB2D1220472C2CEB7509731B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Pacܵ绰г/lib/driverfile/dpinstx86.exe
- Size 900KB
- SHA256 d84149976bc94a21b21aa0bc99fcbdee9d1ad4f3387d8b62b90f805ac300ba05
- MD5 30a0afee4aea59772db6434f1c0511ab
- SHA1 5d5c2d9b7736e018d2b36963e834d1aa0e32af09
- SHA512 5e8a85e2d028ad351be255ae2c39bb518a10a4a467fd656e2472286fee504eed87afe7d4a728d7f8bc4261245c1db8577deeee2388f39eb7ee48298e37949f53
- SSDEEP 6144:EZtaKSpwmx5ATm/LC3fwf3OoU9xkYSr/mdBTRhKWIjsRP/1HHm/hHAM8i6r+LyIU:EZxSpwmxvL/f3vCN1PMaLi6rAyIQjF
- TLSH
  T151159311E7FB8139F9F36F7C697952620A7ABCA19E38D64E1740055D08F4A90DA70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  Pacܵ绰г/lib/driverfile/html/index.html
- Size 1KB
- SHA256 3b92ef48614237f0295d791206590e200ec21b993c4f96ef955dc84bb4fa05b1
- MD5 f92d3522ec085ba15fdcb9acf5961b1a
- SHA1 e96ace2056d954388b4da9f0137222a1e93b4395
- SHA512 f6f7f5d8d05bbc16d8ae2807341f0475a1275954ec1063ea13bd9b071e3189cb3eec0ce423bbac583ec66dd59e8aea13a426ddc2ae82c2374ce186252a1bd52a
- TLSH
  T17721ADBA75CBFB0966D5B7E1E2726640E01AAC01D35E4415B080707F6206668CDE7F68
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  Pacܵ绰г/lib/driverfile/spc/bcdedit.exe
- Size 352KB
- SHA256 8e867d807a4e24b2ff8d40116b171d021dd2f2c7cbbc8d3ff4e6db70e9697d31
- MD5 2c4030b42488e8560a7a09eb582746ae
- SHA1 37e0a91d0eb93b1c336e93797902a9b7df07c212
- SHA512 271907319995081cf34cbfd7731856e0161c5fabf62989e6e658746bdd95de22a333c570ff8566fd1486f7f3e7bd360913db4e5965bd85c6df30e594ef00846e
- SSDEEP 3072:sew5yXrzPNwotc9qyhZXiMqnm8YB0umyJ4nFdD+YVIU7Fc8HDHTRhdNV/ysXo34u:aKrrNwotQrhZX5qnbdVyORznIk6
- TLSH
  T19974FA02A3E90205F0F77A759AB556718A77BC85AA39D68E129C004E0FF3F909D74B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Pacܵ绰г/lib/driverfile/spc/certmgr.exe
- Size 73KB
- SHA256 38fe38349068c264ff653c2d1d273f2a8154f0da485364d962b83f2a75bddb45
- MD5 d56b22e2495e4cb73aefe3faef046c93
- SHA1 383e9460d2426a98abfaad0e8dfca7dd436733c9
- SHA512 6d6213d6122d85171b910c392c717cd1a19d14f0b483accaf33f8677c841f92ccae4092fc47740a8a2a57098b68208416197c84b62ea41bd5790cf3c1b905dfa
- SSDEEP 1536:ZI4kDjGubbXp3aGePmImYw+WXsA9iYzv7AA18Cy/S:u4Ybbb5qxPmImt+WXsoD8Cy/S
- TLSH
  T11A73D80163FA4D26F9F726F1563A9A924F77BE911A30C64F06EC468D0E73B94C931326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Pacܵ绰г/lib/driverfile/spc/import.bat
- Size 55B
- SHA256 5c883568110c2ae4a4d4be437bad08d5b09c9dfabd81e5f3199ae2fac51aba4c
- MD5 236b3c8474160ef901623ffc48909057
- SHA1 72157dd376afa135b585a70758ad2251073b2790
- SHA512 5302d915c53cebc0f18efd1cb8082e64ef3653d14316d422b05ff2d5b78fea664ac7fd733a777e403cddcc602f64c5fa68f6b908a0565a88f924f88eceeb135a
- TLSH
  T1E8900200A53E6151830201609E54D34D2196A42B1505DF7149544C94365529121518AE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral21 behavioral22
- Target
  Pacܵ绰г/lib/driverfile/spc/install.bat
- Size 394B
- SHA256 ee014ff43e946542cfc447a283440e7e37f38c7d249a3618adbc11d1daa85704
- MD5 479b7e74065b1884260c81458c2c2b29
- SHA1 cc41aa15a795b723dc8b862bce671e2fffd81540
- SHA512 30129592757b69e505dd7670c7399a9515634964f38084acfcf258bb6fe0e43ce1f7e3aa73234f4c6e6c345a955fcb66aacda6f999459406dfe27d03982f103d
- TLSH
  T1ACE06151816D067AE3B30DEBC300310E690ECE8F3A55D5D9B37405B8358719459428FD
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Pacܵ绰г/lib/driverfile/spc/installex.bat
- Size 140B
- SHA256 0597483486ad2692fc49e5ec386e557f15ba9ca41e1be19214130a47fc6faf87
- MD5 08452c90d65fd3791f99c07550b09196
- SHA1 09f1e90f70243cb297b46e17e2f795a1e0f6e981
- SHA512 d184a13f36a6a118388a709c9d502e15d380edeb08261368b01306f39eef6d21544f57cf096557092f152824d71528d3dd7d83835bbec988982c6f2ecec83b77
- TLSH
  T1A4C02B4145374FB0C347CCFA1100700C000ECE0F22B2C1C9D0260071786464EC533030
- MD5 SHA1 SHA512 TLSH
Score

9^/10

defense_evasion discovery evasion ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Enables test signing to bypass driver trust controls
  Allows any signed driver to load without validation against a trusted certificate authority.
  defense_evasion
behavioral25 behavioral26
- Target
  Pacܵ绰г/lib/driverfile/spc/installspc.bat
- Size 55B
- SHA256 b96a492f653d2b23811403ee10fc05d43d30ec3ffd492bd874449b13fb3f37a7
- MD5 14f95a843ee983588e5e9476095b5a9c
- SHA1 4d80c96bd1ad5bb5a9fa06ebad32bab7f5ccc73d
- SHA512 5f405a09527f0600d17f21941b65f6cb71cdea791633adfef742e357200216f29665d5bd9dbb245149630c4a8f925ca5aceee33d228508825488dd307422a548
- TLSH
  T162900240113217A19003CBD50D4961441188D44B404675472166043866343AE40150D5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Pacܵ绰г/lib/driverfile/spc/win7 64λǩ.bat
- Size 398B
- SHA256 fc8c075b000a9ffeb8c6074d39f8d5cbb004f73d00705f9cd411aaacefd50db9
- MD5 80e98be75b72905f42944e81dab1d717
- SHA1 fdb9491de532769147291664f0a2a6ecda333ba5
- SHA512 4e5538d2363355503259f25c7fe0ef3cbd1a49bb5fcf4e929e2807df5ac5bb26e935d756b119e47aff379b144b3bae7e3da0fa2738f7cbda7c0acc3a8db5cba0
- TLSH
  T19FE02B51816D0A6AE3A30DEBC300310E690ECE8F3A55D599B37405B8798619459428F9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Pacܵ绰г/lib/installdrv.exe
- Size 44KB
- SHA256 bd1cd51355457050bd8d55938e972b476b0417555d9d6cc9d5b1e8615d267082
- MD5 37f61f93a417a73e750825ec70e04e48
- SHA1 35df434bf4f0f6a77a0581ee2bc0afaf0295e75a
- SHA512 35add7812c0a7fdcca50aa7f77cf706b3624ee200db15e4a24495ef3ffc51cbd5937a5e36933206c5f1af19d3b0be728875d8c51453106669db3fc07cd3c6fe9
- SSDEEP 768:Gb1fdz+WnLqOdZq58NECealALL+LLg0nqquPo/FBB4:c1fdzD2OJNq2Ac7qquQ/FBB4
- TLSH
  T1A11329139A9341B0EEA4C130489F6BB99A77BC6A4B10A7BF13A0DE1D0D335D1EC7619D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Code Signing Policy Modification

T1553.006

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Modifies boot configuration data using bcdedit

Enables test signing to bypass driver trust controls

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32