004d425c8dd62c1220cbe269e265a73c359b05ba7dd525f0bc344759cd872c99

Sharing

Copy URL Twitter E-mail

General

Target
disco.rar
Size 94KB
Sample260602-h43spahs2j
SHA256 004d425c8dd62c1220cbe269e265a73c359b05ba7dd525f0bc344759cd872c99
MD5 68d1d4400565b83b6b3ab1ef1d612cc6
SHA1 c2bdd429967ed98da6a6f5277107169318aaa3cf
SHA512 ec83dae20941571b73960b715927126085264166d45803afdbea061a7fc91b3f8798796a6694160fc40bcf658807c724235f0feed9513be08849885c3b2b5c8f
SSDEEP 1536:PrWHk1SWfzV67PWkldjUenIqJpVEjVKBEa9rxxQ2H8qgoMYl4G1yo23aCU7hxC/o:PKtWfzuWkgUIJVKztQ+8qMGwo23av7qQ
TLSH
T1649312D1FE969D5BCA5D8423B05E0B3B1CDB10DE4CF34078E463DA6662806DE86B88F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  disco.rar
- Size 94KB
- SHA256 004d425c8dd62c1220cbe269e265a73c359b05ba7dd525f0bc344759cd872c99
- MD5 68d1d4400565b83b6b3ab1ef1d612cc6
- SHA1 c2bdd429967ed98da6a6f5277107169318aaa3cf
- SHA512 ec83dae20941571b73960b715927126085264166d45803afdbea061a7fc91b3f8798796a6694160fc40bcf658807c724235f0feed9513be08849885c3b2b5c8f
- SSDEEP 1536:PrWHk1SWfzV67PWkldjUenIqJpVEjVKBEa9rxxQ2H8qgoMYl4G1yo23aCU7hxC/o:PKtWfzuWkgUIJVKztQ+8qMGwo23av7qQ
- TLSH
  T1649312D1FE969D5BCA5D8423B05E0B3B1CDB10DE4CF34078E463DA6662806DE86B88F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  disco/readme.txt
- Size 22KB
- SHA256 c6b765a0fb48c90e55b634dce30618866dcc031d8a4e6df48b2f18d023d734d5
- MD5 8937685047369b432d85f16097e23648
- SHA1 4c3e1284461f60cd9d6dc9a3853e357aeeb5cfdd
- SHA512 202225fbad34d85a2c0c4019c612b4ac5f3dff268b06abc8986fd4367628363962d57568efcfad64c1b6fe059a7ac695621f9245282a196a038254785cf10660
- SSDEEP 384:lQJ9Chsbk1enA+8OdM+OBAiW/kl+P1utIoL0oG0ROTT01eoOOrXwNIP:wdk1UNbDOBA3a0F0q01br
- TLSH
  T1E2A2A60EA702133256731186228EB7D2F77D425A635706EA386CC25C372B3A9D3F75E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral3 behavioral4
- Target
  disco/readme2.md
- Size 41B
- SHA256 3b375f9c4c144f489ea9585970dc399f2ae942ccc70d7e0675fbf2f28b669a68
- MD5 17c3487ac61845bd0be55bec7e469468
- SHA1 3981aaf6cfb9383dd201bc656c22622ffb378138
- SHA512 4eb7e31ea021fe65531986e6ef5d52c4507ae4be10e644b15d614969b0ceaf3982bf486d3b53afe1d7948c8c0399f78ccfd0bab8c31993cd680cae84adc9feaa
- MD5 SHA1 SHA512
Score

3^/10
behavioral5 behavioral6
- Target
  disco/smsniff.cfg
- Size 1KB
- SHA256 3b004f9cf33e97b638db4fbaee73bdaba325f497b6838047d6fef6b0e83e6734
- MD5 10e6b08d49f6072ace17f7e52de7e57d
- SHA1 36d47be49547b28125c739b60a1504c95379e7e9
- SHA512 81b05047de5c11889d84f79c28c758e145f030c55044abc91459a8fe0184189e258617a8428aca4250e852c117b6faef5aa850227f1a43bfec2355d69bf4dbd5
- TLSH
  T1BC2186510A0B1D5DE052BA8C306E3A6249F86E333CD92DE1AB4D271CDEAB9E94B49210
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  disco/smsniff.chm
- Size 19KB
- SHA256 ce71d65f73c5185f85f8cfe42984cc0b3f6cb1c711da846b1de8e1587a684cb1
- MD5 662f90bec361d17f61e851a5364f714c
- SHA1 82d9420e8500e36b06973ead366bb503c8126036
- SHA512 ceadbebe99ceb597d8abd99b8d1b9d5a636679db534f2a58c38a9feb15caf3525c5a95edee42ad72db8ec4d4194218e78196e74b563defb0aed47d6238965d09
- SSDEEP 192:rXNv5gaLswP3vNWdtlAmMB/fvGxlBJXS6p0KZcrn/42ZR6iWkF288C:rXNv5ganPEdnaslBJXSIKnX6AF28v
- TLSH
  T1DF92BF559BD6060BC8299337BFC66C5B3E203E259EEAACC401A613E211F0E0B57B1CA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  disco/smsniff.exe
- Size 79KB
- SHA256 326f3c55a978216a140d20516fc2008353ea92380fde373f9c381d902d4c9fd6
- MD5 a1e45561b188022e69c33479bb8370a7
- SHA1 febf8aa857bbc9bf279228b22d6dc89c570b18e2
- SHA512 6669b3cab1cd059a853e42a0c68f03f7ae68563168d6961ca524efdb090a35791956b117949b4a46edc3c7d4437c473023aec29a1a9fcf621e5c13ecce9c8397
- SSDEEP 1536:D8TEXwcKLS2SiDOiXzCqN/lxpF5kQ/YEncXUx8yktm9ZnahOm:ITvcKLS2c0Ndvnb/YAWSY2ns
- TLSH
  T18A83F10BDB18DE1AD61A0AB0119B8D361D55F09673258FDB6B59ED9FFCD03823E10278
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  out.upx
- Size 143KB
- SHA256 3c1a14db2e3b14d6407595f31864422999e733163a82bb8a61d5bc2cb5727504
- MD5 31a5597342bdc3cd61b47d620d05f9ee
- SHA1 180a2f18592cbff80f07b21fc31e006de966003c
- SHA512 4a8a00ec3c5720b6d857a371319e6d9146ee99b80db10775f6a49a2c90bd0bfcf0d520676041514f9e884cf6a784cd1bf686184a4ac866f1cbd4d41a58076534
- SSDEEP 3072:/WhNw+DJXegRF5ILvXNdfye+Tor8HRDDrHlnxNX+Md9:/WhpzjKLD0oy/
- TLSH
  T16AE36B03B2D48431E4FB1A305DF29B729EB6BD705938DA4B47986E0E2C71690DE2735B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  disco/smsniff_lng.ini
- Size 5KB
- SHA256 610551b1c63bc7277bb47b15418debc4d6326e3194d48ece41f67fc44799da24
- MD5 e4075d62ad8dc0e421e439a7cdf82bac
- SHA1 5d5632ca4f53c68e6a1263e79c6132d5fb4c7e27
- SHA512 1ca3c9c11459f7b328b032abda199d2d1e0fa70d72104a1c44f7430cb06d79850479a34f885dbf4782c4a25a6e7aa41477d1f70897b0d4223b7a3f2651e6b26c
- SSDEEP 96:OzRZVhmVqM/eCmd1rc7awrmTmUFJABEMXqk4MfOHghe6MaeFKmONE:SZVhm/awrm7JAyexWHgh/MRKmf
- TLSH
  T1C9C1D6531C4DA45AA15C9B7C34124E20807DAE48FD0BE2BC62B3EB8D2F4526EB85711F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detected Nirsoft tools

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16