64d4e6fb6685e5138cd4d38287432ee6a15abd7a225a01119342fad1559a9337

Sharing

Copy URL Twitter E-mail

General

Target
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition.rar
Size 30.7MB
Sample260511-b2bg4acy3m
SHA256 64d4e6fb6685e5138cd4d38287432ee6a15abd7a225a01119342fad1559a9337
MD5 dfd6339dac9532cc0dc3c653714b88e8
SHA1 33f976df781ca43355aa12219db6b82dd00a47e7
SHA512 122eafdc2d32743a0557074ada58532ba0c23d6eaf8a8b82f36e50d6b7a7eea9faa7133498f5ccf376b69a76f45ed47634e4a7430cce632e2d008859ea95814f
SSDEEP 786432:/n1yL+cdtbnEmnTTRVEz7Sc6jr472FA4efavRp6:/G++zpVEvZ6jr4qFRKU6
TLSH
T1866733F486E78B486FE1D3EEDB705924508F4D353F92B0986462E9B33C43BB6215A853
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition.rar
- Size 30.7MB
- SHA256 64d4e6fb6685e5138cd4d38287432ee6a15abd7a225a01119342fad1559a9337
- MD5 dfd6339dac9532cc0dc3c653714b88e8
- SHA1 33f976df781ca43355aa12219db6b82dd00a47e7
- SHA512 122eafdc2d32743a0557074ada58532ba0c23d6eaf8a8b82f36e50d6b7a7eea9faa7133498f5ccf376b69a76f45ed47634e4a7430cce632e2d008859ea95814f
- SSDEEP 786432:/n1yL+cdtbnEmnTTRVEz7Sc6jr472FA4efavRp6:/G++zpVEvZ6jr4qFRKU6
- TLSH
  T1866733F486E78B486FE1D3EEDB705924508F4D353F92B0986462E9B33C43BB6215A853
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/ReadMe.txt
- Size 3KB
- SHA256 71d4466e01ef765a860cc778f6321050200fcf0e7cfaf3bdc630987d2a2755f2
- MD5 150ef2b9b0439be0925fc73ef1c725e0
- SHA1 ac7b5a0832abd5d32852d9b5dd7346b50b322f87
- SHA512 434acf67618a543e4fcb5b8661e000460da362a4ff436f6d8b3ffb35664bae73cbdf02a22ae13eb5f353d4e8d50675184bc752087aed62165df10c2113ef3a87
- TLSH
  T1B3816D153EEC211278F2BD401E7C40B69E237A9190394F995DBE114587DBFB0AFC8BA6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/Registration_Modules/elcom_xml.dll
- Size 156KB
- SHA256 942d4a71a29c6fb673e233f6032e37f4c00baa4b647a85bf531639003becc204
- MD5 b5a0694276957ec6ef097fe0541a034d
- SHA1 8ec2e6c530d9c516aef8de468f10acc6c4c031ce
- SHA512 90009e8fbb78f82a9dd6df286bfdbfb4113e77019a9afc259215a5ca2eb7cca8c17f3db659bf6dd5c15b385cda11b6268a1c0dd96b1788c92ac96e715205bb1b
- SSDEEP 3072:P1vanArnJqMb4Qx0VWIAuBVExXpUMMftOVb62QfIIIIDtV5TQYJ9:NvRI84Q6AUV2ZbOtGsfIIIIxT9
- TLSH
  T14FF39E007390C173C55F25395569C7B26B7EF2316BB5C9C3BB994E7A5F202C0AA3638A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/Registration_Modules/onlyone.dll
- Size 4KB
- SHA256 6714a609444abc566124fc8e3ede53a7a973d919c43844650e21b000c85c0b2f
- MD5 f1236c3c0ef40c913403342501781378
- SHA1 93de3d63ba93d13c2e82e49668ce7f58a91450f5
- SHA512 0a4165c7b64c04383c9afd741028618ddee66386e08e4fbb313fb64e64ed03e05a1179850fd33a182affc838a4ee31bf12b720062f0d187393397f9eda97dfd5
- TLSH
  T156816246F26109F3D6DC037E02C7C6DA28FD7A252FE942462E863E3C29D58895C36982
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/archpr_setup_en.msi
- Size 36.7MB
- SHA256 2c221ef570ef4dd2741a5ceba1d61ee8624f772130db9bfe600872b452a2f157
- MD5 f414795976e22fa3214eb2ddcff1b13e
- SHA1 420bf07b1c69b759cc574e8d172a35390a8e83e7
- SHA512 be224c80e8f10cd2c1dd08b38ff42a44daa6c0af05b2cf8d79651876e5fd872792e2dc27eab12ffc107094d245c0956ac57a97f2d365e88cd23cc11fdf9e2fa2
- SSDEEP 786432:oigB3zNmbGJQ4ExcGBuIq0y/zCquOnuxXuTqftQYKajXPiQoN+SfaZc2VJ:QBjNmaEeGBuInyWBJXuOFrmQoNHfaZc
- TLSH
  T1D1873353A651C274E9920934C627EEF063BAAD35C79054BB2A40FDC43E366D0A737B87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10