86bf6d54909d56b0e7034cd2f5fcd40cfe47bbecf264cdd466d56e3ddfae0dd2

Sharing

Copy URL Twitter E-mail

General

Target
Reserva.zip
Size 4.0MB
Sample260605-vhsrtacy3l
SHA256 86bf6d54909d56b0e7034cd2f5fcd40cfe47bbecf264cdd466d56e3ddfae0dd2
MD5 f7f46e231713a4381a0f521b92d9537c
SHA1 721c1c0546ed065b766179f5a3e1681ef51cc3d7
SHA512 601cda7bde5f4769cd1fa0a3d7c5ca984b1d9f1bf5f0967e503b6aa7a2c15b8a5fb940f09b64225001e4c18be956260071f271a7aa91383d43928e9ff010a7d5
SSDEEP 98304:4pv7ZlAwIxoSj9CY9+K6xqtRfTU0iOHpIzPG6K6cE3Ab:4pjVIxv99rtRfT1JcPcE30
TLSH
T13D16335CC40B3858CF11F0BB425B86562AD55F87A71226DF0A769BB1F3C8CB61633D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Reserva.zip
- Size 4.0MB
- SHA256 86bf6d54909d56b0e7034cd2f5fcd40cfe47bbecf264cdd466d56e3ddfae0dd2
- MD5 f7f46e231713a4381a0f521b92d9537c
- SHA1 721c1c0546ed065b766179f5a3e1681ef51cc3d7
- SHA512 601cda7bde5f4769cd1fa0a3d7c5ca984b1d9f1bf5f0967e503b6aa7a2c15b8a5fb940f09b64225001e4c18be956260071f271a7aa91383d43928e9ff010a7d5
- SSDEEP 98304:4pv7ZlAwIxoSj9CY9+K6xqtRfTU0iOHpIzPG6K6cE3Ab:4pjVIxv99rtRfT1JcPcE30
- TLSH
  T13D16335CC40B3858CF11F0BB425B86562AD55F87A71226DF0A769BB1F3C8CB61633D8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Drops file in Drivers directory
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Abrir_Reserva_Nuvem.cmd
- Size 95B
- SHA256 0ab2126fb2f006baffe843cd84e4d900ec46c6d3e2c0da6c52f8dfd3b6ae15b3
- MD5 ebb7e13bc38a914ea6b68cc502394f08
- SHA1 50081634017bbac9a234421d50e7fe0243107ef8
- SHA512 8483b6a6786e9748184455dd90033d16e6542761f1a4fc93f6fcfd7788d04f6184c5697155e01f18a1f756fa007cebaa9b90d21b4d72260c590caa27402ed3b2
- TLSH
  T1BFB01240CDC3304326761C010C4353433F0ED04753059E1C3544941D584F5DE58940D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Instalar_Cliente.cmd
- Size 2KB
- SHA256 39ec84ecc9a8010d57bfffe683c3d02b86b08cf9bacc40a0da551e66ce0e32a9
- MD5 48c9d9ae0fa545deb7e7beae9ad8ca32
- SHA1 81f5067704219582b011eb7011abfe966f7cea02
- SHA512 a336b22185aacbdaeaa1c023258c6c86d4cf5550cb440fd435082acc691c38fca98fd0038755a01e0b72f8e7594528e45ecc212dbcbb917bf8c845d2e389231a
- TLSH
  T1E0415745E758F50A59D5BA04C1C5A809B83F19C90378D96BFFD8A18AF493E10CFB1446
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  Reserva_Nuvem_160.exe
- Size 16.7MB
- SHA256 3ab54134459ab0cd4c61c5d3c3bfd71949310d5ac9cdb20532e5648bf9247f50
- MD5 096645bb6c298a126a963f84b5e99237
- SHA1 db285b0b0c0aeea4810a1be70e3caf5ec6b4d423
- SHA512 450cac35c8359f00974e0704ab89159e15ec65744906a4bff065b691bb536f8a65924e94a171834ae0fd90d4cfb6ac9aaffc47da59f0ab458aa1a02d084252ac
- SSDEEP 393216:x3QEYqNTD1QoNFFx5CAuK3m25kyORkXAwbmMnXBFuR:2E/4R
- TLSH
  T1320739163F49D813C06A4E74CE0BC6FC5666BE10FD6045ABF7E03F4EF675640A82A296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Verificar_GDS32.cmd
- Size 1KB
- SHA256 9d6cfb7bf32e45e2367c4677004089f0a0a88878e60b35a6deb77541f5c3c314
- MD5 e9e8e2799231d02fd2443780e8e6a225
- SHA1 54a488902a912172b01a7726c87cdc880eac1673
- SHA512 8e57681ab21b966bffb1af2bf5898cd04e7874bf44ad211f876e6a7a94391ec2860cca0adafa49ce004bcb769eee39f4823feb641c223dda2e869cb52d2f31a5
- TLSH
  T1C12102597F09FD51AC6F530D09B5A3163E1B010F3528DCA1D69333307485CC8D6AD235
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral10 behavioral9
- Target
  dbexpint.dll
- Size 120KB
- SHA256 603a15f62647bb39e8bab3508f2a3fef25417185c4fc1281001cfb4f0a3ff5e8
- MD5 d32d73583ec44fbabbce9466ab3dbbca
- SHA1 17c8945b8499375c9e77cb18c025b851d3987753
- SHA512 6176a51183af0e7f8b1e8bce25d6b190b8ca3731ed58fe317ca8461d4eff973436557fdb7f7c0f2903ed53b1507885157388bbcde327b3a3b6c1e2b23c3fe2aa
- SSDEEP 3072:hqJFfEx0HmP3Ix/YBQCYmiWplq/o02mkM7N5buR:hZIpYBjYmix/UmTN5
- TLSH
  T1FBC37C12FAC0C178E55141724D783776667EFE860B1A63EB23C9B8B91DF1260BF06297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  gds32.dll
- Size 380KB
- SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
- MD5 1abd772ece0cc871696a867d1f2076d8
- SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
- SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
- SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
- TLSH
  T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  midas.dll
- Size 289KB
- SHA256 0b0edf7067ecb7a9554ffe5743fb65ba6e25c6407c137cb3657f7b8dd046138e
- MD5 a82285dda6f4778e5504fdf463f263e8
- SHA1 7d49097c362234e0bd991a8ab216733e98c70414
- SHA512 fcd6fa22906974ba0c87ae1dc8a04f29fa96cd8fd61d8d65029305c654dbbd67d553b0dca73bbaa816ca2bd36dec607d9a8f60f8c7aaae29fdac2a10f4fdd77f
- SSDEEP 6144:BeIZ5FcoGNQM4+hmwRtheDV2dyYjD9hYkn95myuj:BeKcofM4kAEx2
- TLSH
  T137546D11FC90C271C05101F05D39FB31797EAE656B2DA2873399B9AC9FB2360AB4275B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- TLSH
  T10374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  reserva.ini
- Size 498B
- SHA256 24a51aab453ffd1f9b8aa339a09e5782a67ba2cc084e9c926c0edabba04b6e75
- MD5 7f26e0cf391fde7c777b39c6f9238e99
- SHA1 eee2368387a9bb0b0382745b7e0b7a9c2de91796
- SHA512 1ec7880d70ff898a57a877bf7901f297ae0912394fc9ee3f42641a76af0179649bdd7f6e5608e0a4285816d1cf424a812a091d2ac195c62ca37bc9b1ca984221
- TLSH
  T1C2F0E090D843A0410F07B56706243799634B158EF4F6021195D59C2B9E4E5015BD7FD3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Contacts third-party web service commonly abused for C2

Drops file in System32 directory

Drops file in Drivers directory

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20