da0a7ee9e10bb9ea5c2678d0b70caacd208db4199e10e53345baa49628f8431f

General

Target
Release.rar
Size 9.1MB
Sample260619-2m69bsc141
SHA256 da0a7ee9e10bb9ea5c2678d0b70caacd208db4199e10e53345baa49628f8431f
MD5 efaa8a10da46d169c3c203a8207ab9cf
SHA1 156b989cc4e1fa1aa28248f663045f044da7295d
SHA512 8e6ab3773fd9836b60989123c5ea049368c07b0627b134bf7d5f08d1d6407c664cd105dfbb11c69f1667b9f5a3794a296302be044e89f24b20fbc6dda970dac9
SSDEEP 196608:yo9WRS0zsvdNCTvet5NXKmNkid7jKvxswiF7elkW:ys2Si2dNOvyNamVjKximkW
TLSH
T1A2A633F6302788FACE54DF42C116CD5FEB4B4F6C41CB49BB76A33B694201094A27DAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Targets

- Target
  Release/DevilXIII.sys
- Size 25KB
- SHA256 35677b90f6e212bf3e953b7acf43b8f4696d940f2bc2713b75da228b8bef5fa8
- MD5 275ad0abae8300c4bcfeed9cf83e2b13
- SHA1 fbaac0ef36d27566554ec75102cba726a1e9b5d5
- SHA512 9217686b76b3e5f45608f15e0595dd8537b01dff991e288873211a051d980407ebd4782cafb7050a64b716f6c76bdd90bc7459fd369d0df230a01834f9bba597
- SSDEEP 384:wfhJqtCT9eOvwIM3hDeJDWsY/ouGQApg2xX/KA4IrNCWuAsuJVCMzwl0/g5rNocO:yMtCTnyxKC/oumxXyA4GCWu9eYSc6M2
- TLSH
  T117C22A2A6181A6FFFB67603A8373D2CFF9257041232698DF09B8DD1F234A9C52138D65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Release/Mapper.exe
- Size 1.3MB
- SHA256 ee521c972d5c91223efeecd4b04bbfff52832d0cee9d6c430e7a190d6af27bc7
- MD5 a3aae65d075c2185d5e7c98b9b6ccb7e
- SHA1 560f1e00deced0b05477c1362b9e1c5eedd00579
- SHA512 51bdb4df7fd550f9c393df332092651ff2d7feba7c6cc68b1484320efb2f71fa05394a25eb0e31c699f69561e9de3469af852015eb9d659c7ccea9cb2c489e6b
- SSDEEP 24576:YxczAUqCsmeKGIC0wmCCvBdkzIWxaiNJsDGqotqVQ3tKCxfhBIscRHSqzMVLksBa:tXCCo
- TLSH
  T179558CED526E147DE224C631D985650BBBF1FD8E2B51DFBA2BA14CC1683F840B631A70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion persistence
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
behavioral2
- Target
  Release/nogibogi.exe
- Size 2.5MB
- SHA256 f58472874c8fde269b9ee06df87dc73692d36a8c75e656ce95784c43a55a468d
- MD5 a5fdb6a36fb84a2addca7d7cd198b18b
- SHA1 9637340a34f3017a12ece3cf213fd21e9512e4ba
- SHA512 b30366d21146a38fd167beaf3ebe9505ab82c5242ced3467deb7f7a1ca0fa28b0069ab982db162bc73fe0ab143af158f0766d442b33d864d988a12de44daf5d5
- SSDEEP 49152:JRJB0AExbkYsP2xaEJcOJ3d9AUgdPI/GoLd/HM8x7CF9EncErUZ:BIu2xaacUviC/HL5HzCF
- TLSH
  T1E6C5D1D2F3E88845E027B53857416D0FE2327428031197E7BF99499E8BBE5E0CB7AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Downloads MZ/PE file
- Executes dropped EXE
behavioral3