bedef4500cee52f28af82edc447e78ff14ad8920eaa3c346d2a571bfbc8fa9a7

Sharing

Copy URL Twitter E-mail

General

Target
Reserva.zip
Size 4.4MB
Sample260605-wbfpcacz8r
SHA256 bedef4500cee52f28af82edc447e78ff14ad8920eaa3c346d2a571bfbc8fa9a7
MD5 65a42324bc220fc3b594c55a3585aa84
SHA1 b61949d27509e0455e78dda5d18c6e7ca17fbb91
SHA512 a99fedfe24a4fcbca87986e912e8284635fdc7f4f5aff995d5551978db7d934c4436fe4f36d518bde48382e27758d8b4c817713276cfc21d26ac58d4de8799c4
SSDEEP 98304:h6K/cE3OMpv7ZlAwIxoSj9CY9+K6xqtRfTU0iOHpIzPO+Y:eE3tpjVIxv99rtRfT1JcPg
TLSH
T1662633ACC44B3819CF11F0BB461E8A9729D55F43E71227DF05769BA1F388DA61A33C4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Reserva.zip
- Size 4.4MB
- SHA256 bedef4500cee52f28af82edc447e78ff14ad8920eaa3c346d2a571bfbc8fa9a7
- MD5 65a42324bc220fc3b594c55a3585aa84
- SHA1 b61949d27509e0455e78dda5d18c6e7ca17fbb91
- SHA512 a99fedfe24a4fcbca87986e912e8284635fdc7f4f5aff995d5551978db7d934c4436fe4f36d518bde48382e27758d8b4c817713276cfc21d26ac58d4de8799c4
- SSDEEP 98304:h6K/cE3OMpv7ZlAwIxoSj9CY9+K6xqtRfTU0iOHpIzPO+Y:eE3tpjVIxv99rtRfT1JcPg
- TLSH
  T1662633ACC44B3819CF11F0BB461E8A9729D55F43E71227DF05769BA1F388DA61A33C4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Instalar_Cliente.cmd
- Size 2KB
- SHA256 cd40fc23c4882362e9898a265551f411824461ffaf552ba05b7c7c5af2f692a9
- MD5 3f569b57643f1d1848c5354c68dbc5fc
- SHA1 fc7acf4006d50ddc0d26507f52fc875d728a669a
- SHA512 d4a7aa9ece4ab2730454186aad66f3f8b042146f270afb1f9c93bf085219234c5f0afbde68623915081e73b7735b63d6100339a370d6e985c02f9e88551890ec
- TLSH
  T1BF515515E768ED0B589A7A04C1D59C1EA86F1EC94338DE9BEFE491CEF443A10CFB0449
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral2
- Target
  Reserva_Nuvem_160.exe
- Size 16.7MB
- SHA256 3ab54134459ab0cd4c61c5d3c3bfd71949310d5ac9cdb20532e5648bf9247f50
- MD5 096645bb6c298a126a963f84b5e99237
- SHA1 db285b0b0c0aeea4810a1be70e3caf5ec6b4d423
- SHA512 450cac35c8359f00974e0704ab89159e15ec65744906a4bff065b691bb536f8a65924e94a171834ae0fd90d4cfb6ac9aaffc47da59f0ab458aa1a02d084252ac
- SSDEEP 393216:x3QEYqNTD1QoNFFx5CAuK3m25kyORkXAwbmMnXBFuR:2E/4R
- TLSH
  T1320739163F49D813C06A4E74CE0BC6FC5666BE10FD6045ABF7E03F4EF675640A82A296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Testar_Conexao_Reserva.cmd
- Size 812B
- SHA256 dff34dba4bb36fbcb36adfa12cc4c86169a98b7d3f992bd24f1a84b745db3759
- MD5 ee28cde974b50f5c5d9e47f340d6f7f5
- SHA1 cc73bb4c30fd99185790bb8c4e00604ea8ad8491
- SHA512 ef7c2a1762e837b81cb7aa5536f2634548aa27c28cedbff6527bc950e3f5d116500fa3cde44860cfb88e59613099827f851b5fdef11d463ef5105f68d6c91b01
- TLSH
  T11E011EE2F7C670861DABB81BB991D1B97C3E228F1222480FE622C1366801544A771186
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral4
- Target
  UnzDll.dll
- Size 119KB
- SHA256 f3d82eb7c11292422341820f0c5872f0b96b3a7e0c4c6bcf32a94c237b0cf571
- MD5 df685519e6ad0897cd26b778172167b5
- SHA1 b826b4386a5929bc6f1fa2c7625c75d0743fdd78
- SHA512 66dd73d4ca2e9443c0d5b492f68d2240c3412850ce38d67b5d47a85d73c9254e4d293b13b93cda6df3b8b77594d61b75f738981af6f5e1f9bacd709f6809cb78
- SSDEEP 3072:Uobjs5y9wX0B+LjOKvSkGburX5KwPmhAorY6:h/2yw0B+LaKaLub+hA
- TLSH
  T11EC38D12FD50C031E8A345B12E392B36DE3DF6601716821763A585A6DEAD291FF063BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  ZipDll.dll
- Size 136KB
- SHA256 311ea1c4d1514cf082695392c6bbe597a7df1bbcd101eaaa0f664579d97b8c4d
- MD5 971290a523897e3be8ff51f7bce2e7f4
- SHA1 da5ecd369e186dccbcdf0bb4915c94d58604cf20
- SHA512 cd0754ba4dc9f19f8a1a48b579f5bc7d01fafd01e7a05e67b264ec35eb63574c76063bcef30154f1d90bd3be58390f2d515934a9b2deffb134a0049b794e9ef0
- SSDEEP 3072:FBw10bC6mjvYT01bt64emBomLgWBF6qW+faUr/aDz2:FEjYTw64eH5W6uaf
- TLSH
  T1F0D38C22E590C235F08140B46DBD7B33AD7DDD44634891A793E0A0B59FE9650FA1A3AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  config.exe
- Size 397KB
- SHA256 40adb5ce6646d8ff09e243a635d7974b9f9db0846cf9a3a5db07afa93b592e13
- MD5 be4265d5e5b0d133ccfedef8a48e64ca
- SHA1 855807810bfda67504a7a5defffa9ce8b6e72ff4
- SHA512 d87cd669ee116ff0b4743f2e3b7b5bebef3cb41f43ab0e61d92f3728717bd8064d533cb3156c2ab4f03144b7c1ad543fdfa1454a644750affd58c964cbd94754
- SSDEEP 6144:DlRLq1F8RiQYxqS0Z+8x2MeNS5dK6lyBprdJQ2wmTDEtHgo2VNXPal:hRLq1FV5omS5QpdJQl4Dp1w
- TLSH
  T1A2846E36F2E08837D1732A7D9C5B97A49829BE913D3868466BF82D4C4F3D78135292D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  dbexpint.dll
- Size 120KB
- SHA256 603a15f62647bb39e8bab3508f2a3fef25417185c4fc1281001cfb4f0a3ff5e8
- MD5 d32d73583ec44fbabbce9466ab3dbbca
- SHA1 17c8945b8499375c9e77cb18c025b851d3987753
- SHA512 6176a51183af0e7f8b1e8bce25d6b190b8ca3731ed58fe317ca8461d4eff973436557fdb7f7c0f2903ed53b1507885157388bbcde327b3a3b6c1e2b23c3fe2aa
- SSDEEP 3072:hqJFfEx0HmP3Ix/YBQCYmiWplq/o02mkM7N5buR:hZIpYBjYmix/UmTN5
- TLSH
  T1FBC37C12FAC0C178E55141724D783776667EFE860B1A63EB23C9B8B91DF1260BF06297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  gds32.dll
- Size 380KB
- SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
- MD5 1abd772ece0cc871696a867d1f2076d8
- SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
- SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
- SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
- TLSH
  T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  midas.dll
- Size 289KB
- SHA256 0b0edf7067ecb7a9554ffe5743fb65ba6e25c6407c137cb3657f7b8dd046138e
- MD5 a82285dda6f4778e5504fdf463f263e8
- SHA1 7d49097c362234e0bd991a8ab216733e98c70414
- SHA512 fcd6fa22906974ba0c87ae1dc8a04f29fa96cd8fd61d8d65029305c654dbbd67d553b0dca73bbaa816ca2bd36dec607d9a8f60f8c7aaae29fdac2a10f4fdd77f
- SSDEEP 6144:BeIZ5FcoGNQM4+hmwRtheDV2dyYjD9hYkn95myuj:BeKcofM4kAEx2
- TLSH
  T137546D11FC90C271C05101F05D39FB31797EAE656B2DA2873399B9AC9FB2360AB4275B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Drops file in Drivers directory
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral10
- Target
  msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- TLSH
  T10374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  reserva_com_dois_pontos.ini
- Size 534B
- SHA256 d82e79308a4ab94b27d56ae01c97abf055a2293c329e6f682f6361f1877ff69e
- MD5 f121b4cd4fa59faaf65f6d5618a64950
- SHA1 54fece65bed93625bb4b04b0ea5ee72a0071e31a
- SHA512 3e2e25b982e516461378fd36e864d21634a6a5bc14e5227bb395d5d224785027037328fb2cc0276f791eed45c78f2f8bf2a0945f09e2a586808dc81c3130e522
- TLSH
  T1C2F062A0D843A0410F17B927466476DA234B198EF4E1011291E68C7B694F9014BDAB23
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral12
- Target
  reserva_sem_dois_pontos.ini
- Size 528B
- SHA256 cc2dbd65d4f471a8a8471a5db58bcf89d0204f7acc9c6548b6f836cb4d8801ad
- MD5 b576bbcc601664b25cb58c7d16c85c31
- SHA1 2943d375ca4aea3cc49e08d6c861051b851529e1
- SHA512 fc194ccb27c27c8112081d9e2205d923a2e103acfcc138d3ac4dfb59bddc4638db43b995ff0ab770631a53485c88b564150bca9bce3518b564a45e6bed5297c7
- TLSH
  T1A8F096E0D843A0490F27F927462477D8234B298EF4B10111D1A78C2B594F9014BDEF53
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13