da9aa7f69696a7a84c6596e28cb1b1c926d12a3f69b983b26d62421d78eaf617

Sharing

Copy URL Twitter E-mail

General

Target
4.rar
Size 4.1MB
Sample260602-dc5ezscs8x
SHA256 da9aa7f69696a7a84c6596e28cb1b1c926d12a3f69b983b26d62421d78eaf617
MD5 95c644990661bd0b6dea9c9a110d1c9a
SHA1 c092144da34249c596f7871a93075117e93c0053
SHA512 ae5966826d3ea3328b5bccfda299e15475b4da7db3d704ef926ff6f7d99763001dc6173ca1ce375e1c3ed62a628991ba18f3733b3251b17b91727da8f725b171
SSDEEP 98304:bm3ecTI5r7Ty5u4xhcGEurYzon8uqp8CMTbmaUo:qucTar7Ty5BHPYzYHqplGmLo
TLSH
T1C216331211765450AD39B83269FAE9FE0F07F2C084AD97BF842F75027D626937F22693
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  1.bat
- Size 3.2MB
- SHA256 2fe645bcbe93398f67d06a80607a0bbe3f1441ecdb02b277fd62dd8e2ad99340
- MD5 e6ee619d82590355f8b9eccfab8cee9f
- SHA1 fe6929f638a394728fbde1b48d21c5a92e4b96d1
- SHA512 d8b7686a1815712ce1495ea1673ea0926c3fee693fd96089f78cf4874bf77796ce2ee8114aa994ce9054b7557040d62c3918b77332ea1571887df650ccea48d3
- SSDEEP 49152:yTOB4ynYygOvXsMruROZyUpWvWOLZkORes:Y
- TLSH
  T16FE5324162149172D46321CCD7DFA91D396CE08B35E03BE352E9AF4CD88B83C957AEE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware
- Server Software Component: Terminal Services DLL
  persistence
- Disables service(s)
  defense_evasion execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  2.bat
- Size 867KB
- SHA256 ce2c58f5eecbf209b2d33b4034c55d36c07da82a9094de99f757a0684f6e4efd
- MD5 0a324989986ed9b4dbf23026bdf2c8e5
- SHA1 b3ceb4e321215785da84f8c83b7792c43f934c04
- SHA512 29830e54265dfcd543f13b3e69354f5048f1055ff56801a494973db6efd383fc02a3aa712bd35c41b929d28eb3c94f2b8282db1657322d28f34f1b597f4057a1
- SSDEEP 3072:iYScHNYScTzg8gvRnvpWyhytyhy6LfgCWcUWgM+4oH9q4gH9/14/I:REwE6l14/I
- TLSH
  T19A15228163158131D863358DD3AFB9196A69E18B31E137D311FDBB0DD88B82CC276AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  3.bat
- Size 1.5MB
- SHA256 e106b60099faa77c101cb9cbc1cde7ec5b909ff995b3039ab0c42c0162fe4c6e
- MD5 7b641c7dc6d9594726ddfe900313fbcc
- SHA1 c66f280e8bc007a6dd88776549e12e215673e4be
- SHA512 d094f7c2abc30752d10ffe6386c8bc7a33671552f05b888a72e9c28ae6b1be336c15b6326ac4d30420066f348ff47de7f99d3ac6f6d7babfa665ddb88b8d8df8
- SSDEEP 49152:CTOB4ynYygOvXsMruROZyUpWvWOLZkORu:T
- TLSH
  T1857532006260D2B2D46711C8D7DF995C396CE08725E07BA343E6AE8CDDCA43C55BEEDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  4.bat
- Size 107KB
- SHA256 00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
- MD5 98f1a0eebcb5f4798662a40323b05a7e
- SHA1 068e288005c04b8d859c44d3767613a8036bdb11
- SHA512 6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
- SSDEEP 768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn
- TLSH
  T1ADB3D292621895B2D96704CC83EF964D3C7CE0C625F137A242F2BE48D94A83C567ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

defense_evasion
behavioral7 behavioral8
- Target
  AppleCleaner.exe
- Size 3.6MB
- SHA256 027d32bf28bf27f41e1a4a883cedf922d0ea1928f5c8024b2702eb70cee6710a
- MD5 5d55189c4f5b49069859724f34597158
- SHA1 c79a67cc70d2a8994d1c1480114c1890ae550f15
- SHA512 bae030f2075d6cdef0ba02533dbd0f5a5ea05a75634af7a7e231c836978e7512e8b237fb6197634b39278383927eec7410b437c52e926623164c3a17b643d00e
- SSDEEP 98304:dB92kxJ9+xRXCoSJB56et0JsX+40Kollv09V/9T:dj2KJ9+xRyXJFt0yX+40xNWZN
- TLSH
  T1A906337E6C92CD27C4D8423A4E7665ACEA252F2D9DD28FA1CC035F06306B16C7CED5A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  Cleaner1.bat
- Size 4KB
- SHA256 ca7dfbc65c1fde66413b5dd06f763cbe6b8be78c2a3b88030ccd5dfac23c07df
- MD5 ccf667986586fc0ee3a0898629a36ede
- SHA1 6ffaec4689d257344f8edd02d44d8388280fb162
- SHA512 3e7f9b8df4c455595b57c18917ab9092f5cbd08545116788bcfa709e9edc79c36dae51493da7dc19ba04f69067a420755379a5b11a73205bd05b569f3c0c7ff3
- SSDEEP 48:5eB5uGLW8FktI/JHeUsY200qfDTfbi5t2Qzt2Nt2QVt2ttUFt2AAt2Aop+RAULJY:oHeZY2ELTTqMQPdwYrOPT
- TLSH
  T10D91BF8323974021691230B6EBDF860F6DA8E04F27D9365125F1763AEF468389176FDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
behavioral11 behavioral12
- Target
  Cleaner2.bat
- Size 22KB
- SHA256 6d8474b60f28ee629a8b0eae25cc8c214d2e45c23e64445105389b530b535819
- MD5 691a8da53eac534e67dd0a1afd8d7829
- SHA1 fe9754ea0817ab1c3b43c3541ec0b8b5fb551aea
- SHA512 667193eee3fceb28c9fdce6017938d87d0666948cee6abe46f36e92055781e30d8e39d3835fcf7d8350f560873065c958e7e0c58aee242f770beade3be27d6f6
- SSDEEP 96:tVeN1ZifiB1ifIXi4C4AySST5bWV7oJnJdwTK4hS9X4V4j4V4z5Rg51fH84f/vWo:OZifinifILh9aswTthIIhU0
- TLSH
  T1EAA27FA1BFD1E237AD5B421E037EDF1A45AC8C89128511702772BE49E28E43C65F1EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Cleaner3.bat
- Size 111KB
- SHA256 317142fae707cbac948083d56b1163aa5a6a1b9270031d9e49ea79214ebe99ef
- MD5 7d29dc3ace16b45ae3b437cf8aa7d65f
- SHA1 fbcfde13c5522d808c321c58291cfa962f104655
- SHA512 333d36985afdbe68fbe455d3f59cbe6fc77b0669de44194e07ca28dece06505a1bd5c354ef132df70b936f7ba2740241046b75ab86afbd4728c0da5371e576d9
- SSDEEP 768:zo9R/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLg3:E9xg8gUDRnvplQL5LvLpLjLnC
- TLSH
  T137B3E292631895B2D96704CC83EF964D3C7CE0CA21F537A242F2BA48D94A83C557ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
behavioral15 behavioral16
- Target
  Cleaner4.bat
- Size 162KB
- SHA256 11699f90d4533162a3b7ad620b61a9745a9a06989c3b93b217cd10dec64fb0ad
- MD5 8c3967f9be32e3f7d07ee878e1794c13
- SHA1 4b0d632fd8f3d30147f4a5721e6fdfb0b0b470b7
- SHA512 55519fabada9285bd96d043f3128a6ed4dffad624359c47b27342fe63e0e6f24d9cd35f1a7488da627f68146d4d803ee1e4e946384f62f5a1c32c4599d2ff9d4
- SSDEEP 768:xlkTPz5U3/D35lU14IYIXZBMjmgPBpszWQP54Iq5Knz5U3/D35lU14IYIXZBMjmB:Azhzp
- TLSH
  T120F344045B218001D6F23B4FF52ABD654F6EB24FB5D05AC721AEB70ADCABA4DC3503A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery
behavioral17 behavioral18
- Target
  FortniteCleaner.bat
- Size 1.5MB
- SHA256 365685c1e71944bc955c6be46cc33a44099bcb0f8c625228e89445f18866b778
- MD5 2429db21a224c48fa6b17e55a6762328
- SHA1 f86eb0c2de25e8970add83b66253d3f18b0994e1
- SHA512 0487e79a9b2b427f8c0e5bb860e78039bcf29626bd58ad8190df858fcfa130d15add3fcd350cdadaccbc1d2e13f822dab76e418029d692d2ccd972594b4c0e23
- SSDEEP 49152:9TOB4ynYygOvXsMruROZyUpWvWOLZkORn:b
- TLSH
  T1A37532006260D2B2D46711C8D7DF995C396CE08725E07BA343E6AE8CDDCA43C55BEEDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

defense_evasion
behavioral19 behavioral20
- Target
  Ghost_cleaner1.bat
- Size 581KB
- SHA256 d1ef552d446eb507fe476872efe18e76e0890198a8deb563e78b22b4c411c439
- MD5 8b337ed377138886726892733a624e24
- SHA1 8a1c8b34fe7c38cf5d72ed9106defd71778e1495
- SHA512 f5498c58ded38991fb3da53dea11c9e796e27943d9fe5ad17cfc448300b78eaeb190e876347517e5c79769e548a1a68c1aaee89438534c0ca810629ca027aa23
- SSDEEP 1536:LkYLmcHjAkpYLmcTzg8gxDRnvplQL5LvLpLjLwazhztzhzo:LkYScHNYScTzg8glRnvpWzhztzhzo
- TLSH
  T1A2C4654027248011D5B3364DE66FB8296F6DF18F71E06AC711EEBB0DD89B91CC2752EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  Ghost_cleaner2.bat
- Size 265KB
- SHA256 a3c1a9061c4caddfa5023640eb8c33c3c99859320a8c3164e88facba9166bf35
- MD5 ce55c0703b6be160771e927ba9de028f
- SHA1 144d8889c6d21de0121e189ff3a3d9f607875faf
- SHA512 a71678d1aa93a98c82721b351bb52aa339d374070aa85bb2a5782ee499823234d9bfdca1736c14dcba3626365059798275a6e55864cb7253a1895c91e4b82fdf
- SSDEEP 1536:gwNoZxBOz2oofaCWfr3PwUWgM8361L5LvLpLjL5Gzf4oH9Gzf4gH9c:gLfaCWcUWgM+4oH9q4gH9c
- TLSH
  T1F744B0926219A632E867108CC3EF855E38B8D08615E137B251F5EE0CD98B83C557BEF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Stops running service(s)
  defense_evasion execution
behavioral23 behavioral24
- Target
  Ghost_cleaner3.bat
- Size 23KB
- SHA256 6a0a081e956bb8570b273e6d88206f047ba415e633d54199ff1f23346f201d9e
- MD5 8dd0170e85ff789296ea34d4cb82ae36
- SHA1 8667b2bce43ad66a6e2daca9bcb5e2289cc33682
- SHA512 18354d46ef22315b56c9c4e6c8620406892a358730c7d7278c5cc53d4d97b055dec6a57878d978aa1ac25aee4cd24cd769b06030121d644f731486269cdcd8e0
- SSDEEP 96:IVeRHI8UeBVeN1ZifiB1ifIXi4C4AySST5bWV7oJnJdwTK4hS9X4V4j4V4z5Rg5l:IVeRHIKeZifinifILh9aswTthIIhU0
- TLSH
  T124B290A1BFD1E237AD5B411E037EDF0A85ACC849168412702772BE49E28E43C65F5EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Stops running service(s)
  defense_evasion execution
behavioral25 behavioral26
- Target
  Ghost_cleaner4.bat
- Size 106KB
- SHA256 3a146cc094d610615883fbcd72097bdf86b48e9c2bc190ae33458f02b0589b8a
- MD5 599c81c06b0f5e86b220d15a4775b4d3
- SHA1 ba21681af9669e77e27186a23dd1176d866cef1e
- SHA512 ae58c6e1bd10f3e3d4b96dca60d5de6dc4efa912af5702d939685c6b9cfa50c52d51114b1bf2a9b62a6e35ab602d33d87eeec37cc19e20ecab2f396d191e2de7
- SSDEEP 768:XX/KZzmezl/svUsfg8gVhCBL1oPY8xC01n5xpoL8oPlRPOpL5LvLpLjLgzJuP:Xvg8gU61nvplxL5LvLpLjLwc
- TLSH
  T103B3D49263189572D96704CC83EF864D3C7CE0CA25F5376242F2BA48D94A83C967ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Stops running service(s)
  defense_evasion execution
behavioral27 behavioral28
- Target
  Ghost_cleaner5.bat
- Size 23KB
- SHA256 f70f71900d00f4e3fecf0bb8ba9af0670455a07420893f3f5c3e07a961023aa1
- MD5 582d19556759663a6f10f1cbcdb8c7b3
- SHA1 381638fe09bf6e445183a053f0de584c43f64ad8
- SHA512 b37c5b18c112a38ecee4d9f5f9d1231ccf82c848430d408dc49c4f99534a9c63d8f0ef14426a4e2e58a5d5fb0765ce629c7bec438b7b565b3f3cc7d110a7e275
- SSDEEP 96:NVeRHI8UehgRVejIXO4C4AyCT5bWV7oJnJddsK4hSQX4V4j4V4z5ig51fH84f/vy:NVeRHIK6oI3m9asdsth6IhU0M
- TLSH
  T1E3B2B0A1BFE1E233D96B411A037EDF0A95ACC84A1584117027737A59E28E43C61F5EDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution ransomware
- Clears Windows event logs
  defense_evasion ransomware
- Stops running service(s)
  defense_evasion execution
behavioral29 behavioral30
- Target
  Ghosts_FortniteCleaner.bat
- Size 1.5MB
- SHA256 fc5a6bbfcbc91ba982f27afcf525eb516515690ed249b5b6a4be861a1411ec5f
- MD5 413fb52303987394bf98beb4f5499d03
- SHA1 cc0fb83104bb19312ef459a721aa094a2818ec73
- SHA512 c4d0df0ff3473f16317e78422f21d5ef42ed083738c7ff35543dd254529573dc2f0f03f1984f16f5f51d89803465cd226ee32b965938f98d6be0bf6046df618d
- SSDEEP 49152:YTOB4ynYygOvXsMruROZyUpWvWOLZkORn:E
- TLSH
  T1BD7532006260D2B2D46711C8D7DF995C396CE08725E07BA343E6AE8CDDCA43C55BEEDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Stops running service(s)
  defense_evasion execution
behavioral31 behavioral32