9ebbfb0305d0850624c4c0569867b12f0147c0a832218b6574984d977d73b3d4

Sharing

Copy URL Twitter E-mail

General

Target
Reserva.zip
Size 3.8MB
Sample260605-t4vmvsbs41
SHA256 9ebbfb0305d0850624c4c0569867b12f0147c0a832218b6574984d977d73b3d4
MD5 ddcb63f893e291fa1437ac3390501182
SHA1 a02d252ec4c775583907e6e1db589bb591463849
SHA512 b151eb173196c0d2b7ef7b920905f44db3e044770b67927eb6eae3d1d7bb61025f146ac0b2587989d90890c2b3909043b424c5b2860a10c6d353ffb221b5567a
SSDEEP 98304:kcE3Vpv7ZlAwIxoSj9CY9+K6xqtRfTU0iOHpIzPO6KK:zE3VpjVIxv99rtRfT1JcPB
TLSH
T12516335CC44B3C54DB11F0BB425E89532AC54F87AB562ADF1A769BB1E3C8CB11633C8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Reserva.zip
- Size 3.8MB
- SHA256 9ebbfb0305d0850624c4c0569867b12f0147c0a832218b6574984d977d73b3d4
- MD5 ddcb63f893e291fa1437ac3390501182
- SHA1 a02d252ec4c775583907e6e1db589bb591463849
- SHA512 b151eb173196c0d2b7ef7b920905f44db3e044770b67927eb6eae3d1d7bb61025f146ac0b2587989d90890c2b3909043b424c5b2860a10c6d353ffb221b5567a
- SSDEEP 98304:kcE3Vpv7ZlAwIxoSj9CY9+K6xqtRfTU0iOHpIzPO6KK:zE3VpjVIxv99rtRfT1JcPB
- TLSH
  T12516335CC44B3C54DB11F0BB425E89532AC54F87AB562ADF1A769BB1E3C8CB11633C8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Instalar_Cliente.cmd
- Size 1KB
- SHA256 acc605c29cb56de7597ae6483a317b924512cf158cc4f38cbcdd24387f9beba7
- MD5 7fe92e496598d7b8210d19befcca803a
- SHA1 029252599587625cd38641e101ef27ec77bed523
- SHA512 356d37e5109e92374290e0645d0ae57d292085e8c1b5d54bec54838d35eda9b5f3307b4cde08c4fbb32fb31a3f3cfd7308a547f8dd2248c4c2ec677307369d81
- TLSH
  T139412559F708F50A58D57A04C1856909B82F19C90378DE6FFFE9618AF893E208EB1445
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  Reserva_Nuvem_160.exe
- Size 16.7MB
- SHA256 3ab54134459ab0cd4c61c5d3c3bfd71949310d5ac9cdb20532e5648bf9247f50
- MD5 096645bb6c298a126a963f84b5e99237
- SHA1 db285b0b0c0aeea4810a1be70e3caf5ec6b4d423
- SHA512 450cac35c8359f00974e0704ab89159e15ec65744906a4bff065b691bb536f8a65924e94a171834ae0fd90d4cfb6ac9aaffc47da59f0ab458aa1a02d084252ac
- SSDEEP 393216:x3QEYqNTD1QoNFFx5CAuK3m25kyORkXAwbmMnXBFuR:2E/4R
- TLSH
  T1320739163F49D813C06A4E74CE0BC6FC5666BE10FD6045ABF7E03F4EF675640A82A296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  dbexpint.dll
- Size 120KB
- SHA256 603a15f62647bb39e8bab3508f2a3fef25417185c4fc1281001cfb4f0a3ff5e8
- MD5 d32d73583ec44fbabbce9466ab3dbbca
- SHA1 17c8945b8499375c9e77cb18c025b851d3987753
- SHA512 6176a51183af0e7f8b1e8bce25d6b190b8ca3731ed58fe317ca8461d4eff973436557fdb7f7c0f2903ed53b1507885157388bbcde327b3a3b6c1e2b23c3fe2aa
- SSDEEP 3072:hqJFfEx0HmP3Ix/YBQCYmiWplq/o02mkM7N5buR:hZIpYBjYmix/UmTN5
- TLSH
  T1FBC37C12FAC0C178E55141724D783776667EFE860B1A63EB23C9B8B91DF1260BF06297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  gds32.dll
- Size 380KB
- SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
- MD5 1abd772ece0cc871696a867d1f2076d8
- SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
- SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
- SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
- TLSH
  T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  midas.dll
- Size 289KB
- SHA256 0b0edf7067ecb7a9554ffe5743fb65ba6e25c6407c137cb3657f7b8dd046138e
- MD5 a82285dda6f4778e5504fdf463f263e8
- SHA1 7d49097c362234e0bd991a8ab216733e98c70414
- SHA512 fcd6fa22906974ba0c87ae1dc8a04f29fa96cd8fd61d8d65029305c654dbbd67d553b0dca73bbaa816ca2bd36dec607d9a8f60f8c7aaae29fdac2a10f4fdd77f
- SSDEEP 6144:BeIZ5FcoGNQM4+hmwRtheDV2dyYjD9hYkn95myuj:BeKcofM4kAEx2
- TLSH
  T137546D11FC90C271C05101F05D39FB31797EAE656B2DA2873399B9AC9FB2360AB4275B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  reserva.ini
- Size 498B
- SHA256 24a51aab453ffd1f9b8aa339a09e5782a67ba2cc084e9c926c0edabba04b6e75
- MD5 7f26e0cf391fde7c777b39c6f9238e99
- SHA1 eee2368387a9bb0b0382745b7e0b7a9c2de91796
- SHA512 1ec7880d70ff898a57a877bf7901f297ae0912394fc9ee3f42641a76af0179649bdd7f6e5608e0a4285816d1cf424a812a091d2ac195c62ca37bc9b1ca984221
- TLSH
  T1C2F0E090D843A0410F07B56706243799634B158EF4F6021195D59C2B9E4E5015BD7FD3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Drops file in System32 directory

Drops file in Drivers directory

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14