0a1fdf8b57e9863628f9b204f991150cac800f926600a75fbe95313d5477a795

Sharing

Copy URL Twitter E-mail

General

Target
ec_menu.zip
Size 2.4MB
Sample260508-sfbdmsdy9p
SHA256 0a1fdf8b57e9863628f9b204f991150cac800f926600a75fbe95313d5477a795
MD5 1c196db27a7f1a88dbf798bf5c9b70ad
SHA1 9afea3bf1d62dbd3af16ec740ca6f6f700454277
SHA512 1dd66f4145e86480ed2a4e32a5a4ef21f775dcc8216430429e9ea19e99a0cb96384f834f9724856b8bbfcc8c17d503ec8cb715921c06db79ec77418b69cbcfb6
SSDEEP 49152:jJ6DxQiR6vqagqJs96ikkDRTNmrbw7BFJfYJGn1tQ7V9IIQq:gWiRadikYRTNmrU3JfYJu1tQ7VGI5
TLSH
T11EB53382C36A443EFC28F8FDFEFAA66216B62D0D98855D3DFB986D94E201804DD17447
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Targets

- Target
  ec_menu.zip
- Size 2.4MB
- SHA256 0a1fdf8b57e9863628f9b204f991150cac800f926600a75fbe95313d5477a795
- MD5 1c196db27a7f1a88dbf798bf5c9b70ad
- SHA1 9afea3bf1d62dbd3af16ec740ca6f6f700454277
- SHA512 1dd66f4145e86480ed2a4e32a5a4ef21f775dcc8216430429e9ea19e99a0cb96384f834f9724856b8bbfcc8c17d503ec8cb715921c06db79ec77418b69cbcfb6
- SSDEEP 49152:jJ6DxQiR6vqagqJs96ikkDRTNmrbw7BFJfYJGn1tQ7V9IIQq:gWiRadikYRTNmrU3JfYJu1tQ7VGI5
- TLSH
  T11EB53382C36A443EFC28F8FDFEFAA66216B62D0D98855D3DFB986D94E201804DD17447
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  EcMenu_v1.6/EcMenu.exe
- Size 1.0MB
- SHA256 27ce38eb64f3969d52ba8d52a37d98f6e129b7dd12a0622e57ef18deacf2ea8f
- MD5 fdea0366e834590a45a95bd697b4b1a3
- SHA1 0e1754ef45d6cb2c95c56522a6a9da915f875796
- SHA512 c331fc536cf272efa7aa278972a6a2c3bdda7d6959ab470a88aa31da5ef5b4002cdde8aa172a1067f213374751becc9a98c2046035a9ddb2ef372a02c5816deb
- SSDEEP 12288:QaWzgMg7v3qnCiXErQohh0F4fCJ8lnypQ82C5Mjva/FzkBgOE784x4PWUlcCqreo:XaHMv6CzrjbnypQ82C+jAn4eUHqrv
- TLSH
  T15625D012F7C680B6D9573870297BE7269B367D198332C587A7E03E76AF721005B36362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  EcMenu_v1.6/EcMenu_x64.exe
- Size 1.1MB
- SHA256 4fc2ccf80f1da2b3db3f1e03a343865e255a176637fbb39b4dfe790692c7e250
- MD5 d4cae9981946b6e2fb1cf52eedd10261
- SHA1 721e03a68539a11c72a0be3849dbb34a4989e3fa
- SHA512 9e87da78766b2f362961fd6218b453155fa8690c0640165752c5b7951767e7c24b0e4828799ffa44ac7fd1623290ef4c65e4c591b767e2f558d23c04046b65d8
- SSDEEP 24576:+2DW/xb2X2YIbpQsu3/PNLlQ7HyR12Cv7OubJmnFNmmFx:+2EiXoQsW/PNhQLJFjFNmW
- TLSH
  T1AA45AF55F6A444A8C43EE076CE46C22BE2B1BC09977597DF07A05E6A2F33BD06937321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  EcMenu_v1.6/Files/EcMenu.ini
- Size 314KB
- SHA256 731dfe5336f702af0ef4346f3e1db17f5f94901ff706119ffd2e9f9c62e1c885
- MD5 b1c570036eafd101417aa20404f62af3
- SHA1 cd3e49b1d16861d66d6dbea24e26a1172d2af0a3
- SHA512 a9dc514f574dfe989f6be591a792a4a361a5b012064b83cf1ee7b9c90a1ae9dea5256456c0cbbb08c4bd3f9673efbbdf7ddfbd842c1122106450b05f1b03fba9
- SSDEEP 6144:vj4CF5qeHBeDs9x97E0zxnqWWNtNrS4pDLJqbcJ:SJLJq2
- TLSH
  T1AA64762716FA4125B2F3AB50EBB04EB64B7ABC51697C840D0EC25D4C14F4A50A963FFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral7 behavioral8
- Target
  EcMenu_v1.6/Files/EcMenuCmd_x64.exe
- Size 1.1MB
- SHA256 4d3311ef245d5425b0d066660b881c961f7bf708744e9789f7cae5f662d4d126
- MD5 ea7bb3b4aab029b6a7cbeb81124ed2bf
- SHA1 f27e1d5429e782404d20fd92d1d3feffae11b5d4
- SHA512 bebb45153e80bb60f1a2219bb253b3d628a0ade7da6b59f700c06e37f6888eecf3b35303aa015d5a736d6126b339a15975af60b76098a80a5a1c868ee8bb7586
- SSDEEP 24576:e2DW/xbkX2YIbsQsu3/PNLhQaHyzlICsh0M2eFV:e2EoXVQsW/PNlQS4lICshXdV
- TLSH
  T1BB358D56B69444E8D47BD4B6C957C53BE6F2BC08677147CB06A07B261E33BE0293B322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  EcMenu_v1.6/Files/EcMenuCmd_x86.exe
- Size 950KB
- SHA256 70718a53b3f61011724c02a79dc2a2667f59dc52ce94bf26bdb5c4617de99670
- MD5 452fe541273b99c0fef03dcd3a3af27d
- SHA1 c2b32a14b6429bd4c75b6017b660222ffb17d94a
- SHA512 69f769ba20b913364c7c7398686591123b7dfcd5d14c2fe6b349c83fb91b2790dfac45b9cd5b214d4be66bd2ad04b61b17eefbc9a655c653aebec43dc2e4a7f0
- SSDEEP 12288:KaWzgMg7v3qnCiFErQohh0F4DCJ8lnyRQyUg+hSNx9alICsh0M9Dmwmw:laHMv6CtrjLnyRQ5lICsh0M9Ew
- TLSH
  T13B25AF52B3C584F6E9937CB1587FE7366B377D1C1212848BA7E03B328D32251662B762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  EcMenu_v1.6/Files/Items.ini
- Size 37KB
- SHA256 e2a6a116f24e2a75db955c8eccc1dbaaaf51ba706209177127687b994155b37d
- MD5 83708d26f6beaa3d0b358ce286841e28
- SHA1 4c8794197423bcfd54b714049131a3c3bb4dd518
- SHA512 772705abee5a387388966cb6cc8327196f8ba0660c54d9a49848b854af002630104044d6b6fb20d744aa59d40a3d84c5e84fdecbd04ae5535d2244cc9e4a02d1
- SSDEEP 96:nk1HaH16Jkve/Ve3jH2JI1H2wvE5H2nOvOH2JI8H2wOE7H2nOvziZH2vH2mS4VTX:PMET7EQf5E6HA0PjDUqosx8UKQpNy
- TLSH
  T164036B02BBFD0114B7B38B91AFB9E1345A3BFC325D2AC59D91D09A8D14E1D109922BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral13 behavioral14
- Target
  EcMenu_v1.6/Files/Readme.txt
- Size 621B
- SHA256 061e96bfa9aa171ebfcb9d928f8c4b5d8e1dad5b1e09c06587d5d5bb8e63e685
- MD5 faa52e981ab875e7f7ce2941177f1614
- SHA1 21d8a91173cae0fe58b957e3cdb7096c6b8373c0
- SHA512 aec41f119d3fb70072406576a39a6507ada872b2bd99b8c918097573fe7bf8eb2861983a5ede0b90caee33f17e724d9f2b0ccf96fe2f674e1642a21f25f1bebb
- TLSH
  T1CFF02D965286177AF6E1B121364F0CD5C34ACACDB7654A2404A8D44D37D3BB143FE5F0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral15 behavioral16
- Target
  EcMenu_v1.6/Files/SnippingTool/SnippingTool.ico
- Size 1KB
- SHA256 08efd54155921539e1ef66ec2d621224e0aeefd35ffc1d71e2e51bf9cc86f9e7
- MD5 dbcf83361a0c5f09fa8b3014bbaae632
- SHA1 f85b76fb3038a15fddda8d638f648d4948faeec0
- SHA512 993c8695ac4bf7a857568aceffff7032efa6936cd911c774deff66e9a9314ce57246e838085fd1979eb0250bbbbdc0de49df829228d5c4b322f29a57da21ffb7
- TLSH
  T10921F14DE7057CC6E0145231373B7EE93F0C927B5924257E29F4554A1ED32499707946
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  EcMenu_v1.6/Files/SnippingTool/SnippingTool.vbs
- Size 721B
- SHA256 5922d78fa3e417e7c6287e88a2a50d2cb5f51c3cb22c5deabf854f2a8b90867d
- MD5 198e2203276744b37ed3327009580034
- SHA1 c71bc0697d73bfb68bdefec640be4b26a004f491
- SHA512 65622e0be3f99678c34db5b98886d2569ad0534f4263c3aaa80dd103e446b48650a0f2cfa741418832483874a2da35bc104ba7c1931953ed101097eaca0de58f
- TLSH
  T1EF01F4109E05C3DB107EA79217F6F45E42B14614D9A0E80D7BC9C5ACF043C08437057D
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20
- Target
  EcMenu_v1.6/Files/StickyNotes/StickyNotes.ico
- Size 1KB
- SHA256 08533f5cc9fbc267f212f0619411f67bb4c2960042bcd2ec869ed7cd7663c0f9
- MD5 0b1299c03d6105c6cea70e1ea9856825
- SHA1 0fa3afd52c3668b289da55617b9161d240752709
- SHA512 5f3275fa97d52061d363f05db368ce0ad5aa2e97fb5e367739eae017a78be959ab1bf875b353745f1cce16d357f5363bffb01809fd0761575e55ca2641763caa
- TLSH
  T1302178E0902A18FAC87237B7F1034D2999495FAC12B1361B549BB7466F10BD34CFEB85
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  EcMenu_v1.6/Files/StickyNotes/StickyNotes.vbs
- Size 778B
- SHA256 8266312e9c7249e8d840f8b4e587de90bcfd433b00e08ca81ebf092bd8fd5c57
- MD5 6036af57c7a434a72c39d0e35be4c02c
- SHA1 8eb40c2cb785f87817ea0a4e914a753fbabebbdf
- SHA512 9b02fa83713d7921e8e6fbcb21ef4337f7bacc2ca6b9dd69bc577eaf65c89cbae638613ec1648e79f3e026224302072004f46c90b9bab14515ff659dfe33f35d
- TLSH
  T11E01DC109E06C39B107EAB521BF2F49A82B24A15D8A0DC0CBAD9D5ACF483C0993718BD
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24
- Target
  EcMenu_v1.6/Read_me.html
- Size 10KB
- SHA256 5f3584bf162a79cd588cc8c86ad17bcd0e8b117e238af23780f2f58c13d42dcd
- MD5 833fe298f0a553a12e9bbb609937635f
- SHA1 e2f2fe3f543e6b5cb685399623d011d005be18af
- SHA512 7ff1fc339a912c8e433ec3c84f09fe323311a90bfc1e45633e82539d49830e4e9fed480ae308b97a5826b09af32edf3676a1f807f1b24185d959eb0e4c526c63
- SSDEEP 192:0N2va2MpEsU+CdbMGbm+Gv2PTncpWLjQINugVNl6pppYApSR2DG9HFEfppsPSpUd:0C5zfPT/x
- TLSH
  T1B1220E653E0E2C378603E25F76B26D40EA4EFD497342A46E249791BBE0C5DB8070D3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26