4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076

Sharing

Copy URL Twitter E-mail

General

Target
Velocity(1).zip
Size 12.5MB
Sample260507-sxt73sft8w
SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
MD5 69c1ec1744daf4c5dea14f428621dbce
SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
TLSH
T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Velocity/Bin/VMProtectSDK64.dll
- Size 124KB
- SHA256 d43329ee5af52665bc4afc3f7dcbe1d8aa13528f49d7580df15a9c9ced50c0ca
- MD5 3339229041a6aaedfc037afefe58813f
- SHA1 1121e690c877b23a623f57b8d339b494c20b209f
- SHA512 bff891e88d6b956bd75fee560fb6c38577322c4a61a288f6ab7baa8e0906d2fdc5b00a936359fc98f0b060940c3418d74412d97d7ab8abdd11603b6328051821
- SSDEEP 3072:1mcqYHq7Aiytzg2ScpvgJcG5sqYX6UOHNlBS:g0Hq7AiyegZgJZSXmtH
- TLSH
  T1A1C37C5773E540BBD1B6CA79C8638A56D7B178110B24DBAF03A402162F233D18F3AF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Velocity/Scripts/Favourites/Dark Dex,lua
- Size 769KB
- SHA256 514dfbb86b40ede6f3d0abd70b5d2935c807161d815138f23ecb0ffffe1eace1
- MD5 fd55d68a2c6b02eca802fd365359c1fc
- SHA1 6cfc853cecb82cc6458e7d9bf1e87336fdd637d6
- SHA512 41feb566b622b8eab94fa8ea53124359a12904f17cf70e240fd8f2dbca22ee9c3f219de22af573c36f1ca7962626819abbaacbb5a484c90ad50bc6d5ea744ee3
- SSDEEP 6144:8DS0p3l3XgRGS+J5sme4dGuRXPnJZXBoiZ0DbQwZNXsDSyGQE4SRJ48RgQxAaNS6:5VYTeCO
- TLSH
  T119F4830C22898EFE97636D64B0E3158DB2E86263D3D91540E1BD4E1CF24DE5B05B7A8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Velocity/Scripts/Fun Scripts/Infinite Yield FE.lua
- Size 472KB
- SHA256 1c071c31271791272a4d21bc2ca6b571b20020444a33883611c2b315247f8cb5
- MD5 aa40a2d10223dcc7eea00701a53cfae9
- SHA1 a5772eda1152fd8917c4de08814b7ac69b650c63
- SHA512 65f11aff17166f846ae0ec6e451cf4df0dbc3dbeb4da4a90e472e86db5c0769b0db9b05e1c75eb095c88201811a12e115b7ea5cae86187b69e3ce123c8435b72
- SSDEEP 6144:FGfBMi+jpIPxvuv6oZf8D3xzLdzFI8gOyT8NPle+niXX6rWagl8Wi7ZSnjPuO5HD:AojpIPxvqfyh1F9NniXDX+O
- TLSH
  T17CA4F79E319E16AD1A17A26DB46308463EBFE03510091A5DF8FC513C6BCD60F81F7AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Velocity/Scripts/Fun Scripts/Sirius.lua
- Size 182KB
- SHA256 52a0ca20e499400cd766bc9676ded35d0eb0a9bed6bb20bea5488f3054575fed
- MD5 b5704851fc56ef02c7450068c1c9bbc9
- SHA1 ba88206f41d9607057ef9bd3120e29972b5975bb
- SHA512 d3bc75dace3e36d61d1bd78a92bb31a6028e509326ca0c6d09dd0e1e2749e3cd5bf9e37e7cb49d68a21fa22200b3bb3d20f70c7cb57fd1e2015fc1ce5d948b4e
- SSDEEP 1536:SKsQCXCWXIaIi/f9YeUAaFEuDQTvbRVinAx+j:X9CXCwId7eUAaFEuDQTTKj
- TLSH
  T1A804C58C316E62FC44A3418EE56B0415BEACB220626D5045F9AFB4BDC8CCB4EC5D67F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Velocity/Velocity.exe
- Size 32.9MB
- SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
- MD5 83da367e14fe39262fcf57c39dc3180b
- SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
- SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
- SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
- TLSH
  T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  Velocity/VelocityAPI.dll
- Size 17KB
- SHA256 7f8b8d05d22c24e9444e8c5da63e5631c762971f4ba6e79ba823fe3880fa95df
- MD5 229bdd461d751c7b63e61c926f5ed6b7
- SHA1 d2569c72e9408de66c36780e5c48074dd605db3a
- SHA512 c416b319574fedc597bb34710b22348751c976606602453890718eef9effa99c8bfd845392c8ffa9dd6c954e778e5e6d5fb57752cf4dbd40821eec9dc49b015a
- SSDEEP 384:BVrr3r+K+ftBdZ0rCbv/YOJaPhLuo2O6xNEQEQrzdaRS:BVrr3r+K+fPh/Y2UyDVl
- TLSH
  T193721A0A7FE8C677E6EE0AB85871021043F3D7157823FF5D68C7A4992D63B4A4614B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Velocity/WebView2Loader.dll
- Size 118KB
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH
  T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  Velocity/runtimes/win-x86/native/WebView2Loader.dll
- Size 118KB
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH
  T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14