7704b3408ed7bf19091394071399fb3fac9410ce934a51d13c78b82dd38eaa1d

Sharing

Copy URL Twitter E-mail

General

Target
GoLink_v1.1.1.1.exe
Size 71.1MB
Sample260620-dfd27ses3y
SHA256 7704b3408ed7bf19091394071399fb3fac9410ce934a51d13c78b82dd38eaa1d
MD5 dd5710ff4ea3b7743abfee2711405476
SHA1 a39070f4ff4023a407d1bf13cfa4c2105b9c907c
SHA512 e1f59bdfffe4ef710c8d9fd3530701013c82aaa16cb341a227d4ee89a14bf1431147eb367f19b6f0d822ba61a80f2c07c70ab70a2faa765fca3fa4b37b07d8ef
SSDEEP 1572864:3SK+ak8Cz8xonyvKYOqJsfPNM7SeMkcSh2:3SB3z8ZvKbqJsOGeMkF8
TLSH
T114F73394F3908883DAB8F37D5D92B87693185A91B74D002DA9DBFC534B361B42D2E0ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  GoLink_v1.1.1.1.exe
- Size 71.1MB
- SHA256 7704b3408ed7bf19091394071399fb3fac9410ce934a51d13c78b82dd38eaa1d
- MD5 dd5710ff4ea3b7743abfee2711405476
- SHA1 a39070f4ff4023a407d1bf13cfa4c2105b9c907c
- SHA512 e1f59bdfffe4ef710c8d9fd3530701013c82aaa16cb341a227d4ee89a14bf1431147eb367f19b6f0d822ba61a80f2c07c70ab70a2faa765fca3fa4b37b07d8ef
- SSDEEP 1572864:3SK+ak8Cz8xonyvKYOqJsfPNM7SeMkcSh2:3SB3z8ZvKbqJsOGeMkF8
- TLSH
  T114F73394F3908883DAB8F37D5D92B87693185A91B74D002DA9DBFC534B361B42D2E0ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/setupdll.dll
- Size 1.7MB
- SHA256 42110c68f981c143f067f29e70e6aed549f12df1d0dcda65b0991a6e5186c451
- MD5 b050554e5516947ffcf04462ecc8d0df
- SHA1 7390fdc329ba6942fbb6c541699f4dcec3225076
- SHA512 1e3cabef3f0d8537dc0f0e44e1100929aea90efd837281b94e3f766001c92050696a96f8e400bd77c812a678979d90b9cbe5b62aa7feff486d3ff43581cef6b8
- SSDEEP 24576:80J2SsdV2DkHW8FRVqu1ctnCNrMia3R3iGTSOK7/KEdcKzNN+:dsdV2DkHW8FauinCESGTFmSaza
- TLSH
  T11E85BF5034918035E61E83705D39F2D8A5AEED216A74868BBFEDF52F4F329C5D622323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Auto.exe
- Size 355KB
- SHA256 185a9737f4fee754a5c9a970b46f8c46ade53f483ff6d4b807cf982aaf169b97
- MD5 ff9b595f8ad3a557f79e0d4b4540422a
- SHA1 7f479ba678f48327cc70d40e6aeb9ba366ab29d2
- SHA512 716efa497d5baa13380ded7d6fd12e23bdd3cb487a81b2cdb37d126498d3f38285d2d8761894b607110728dbb05a1d45868eb13896fe6d863acae440685955b8
- SSDEEP 6144:qnB3lpQ8ml7PGo15HQMQJ6rG8WyskmmsqHVIkieXpAOuXHXjo4:qnB3lRml7PGozHdAWG81mFG5XpQXXjp
- TLSH
  T1E4746B117682C036D6B246318EF49B6BA97DB9110F205DDB63D4076A8E313D2AA31F7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Channel.dll
- Size 798KB
- SHA256 27c8ca62782771f9888fdf5fe827afc500075ffbe32282f4477615ad926ee64e
- MD5 d8c37b50b89d5d00f6d54774bf6a6a85
- SHA1 d3e375fd802d916f1333830220825d50b468a33a
- SHA512 f69a22ef795b5692803cf30f15bae1f1bc3ef120c676def5d49de3ee5429b5bf7ec6c77904bf5fb72270dbe65929cc2c1dc3cfc962624cd933995de38a75e956
- SSDEEP 12288:IvNp/8pu7yZOvhgZ5PQe6Nk0QsFBe+uQAZXP6kTjTwHm9Z:IvM7YqMh/e3LfTwHyZ
- TLSH
  T142057C21B04BC073D55A03714069ABBA8169AEA01F72D4DF77D43F7DDB7A0C1AB31A26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  Engine.dll
- Size 4.3MB
- SHA256 acac3c253fdf1e1feaac67b74b4b4b940cb6e17e1ddd6029dbc70494d15dd8b6
- MD5 6cb76aee4ff4d200044657c9ee5d9cd3
- SHA1 bc90489fddb46d5af36750e2be3116bded56bdb0
- SHA512 6286f2b893541d65c535a44ebacad28de1c94f752f0609f12d24486358449888c26141eeab1d4fe8fe205b8aa4598ef1c847a3961a48f8d89281abf1c09fa618
- SSDEEP 98304:DGzi8HrAgb249zjoZ+/8MJtskMqBs6qHZ4:aHDq+Dw6wO
- TLSH
  T1E726AF22FB43C072C9DE027521BA5B7A49398E648B3085DB9BD03DB9D9310D26B3B75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  GoLink.exe
- Size 17.4MB
- SHA256 dfa7bb06c4ba2feadb45bb7d5916b14d57673baa2dfceeb74e0da700ce4a55ce
- MD5 e53991ee79bc98975cb3aae637279239
- SHA1 6e4d374e4a095a9386db9b3c54e9eec94bd57e23
- SHA512 8220b5208a6b22b47244d8941c151cb382ba3de56ed38bd223f0bf2509b1ccedb5e8f5640c93f60cc31e5a1b156063b10c32c6226d52779e2ab4e4c5baa87cdb
- SSDEEP 196608:Z6fz8W1Z0KaKH4hm99FAdxTSNsH/58cmjWqcNWJcBCkTfNn:Zuz8WQKvH4hmQxEWh8hilNWjSfNn
- TLSH
  T1D307BF21F980C831E652427169A8B7AB857E9D614B61C8CBF6CC391F1F305E25F3BA53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Launcher.exe
- Size 329KB
- SHA256 de4d05ba7cad6228758b8e0b9ede942c83992e311a0b4dd746b8ebeebeacbeaf
- MD5 09cde834bf7f6133ff24d959880f70cb
- SHA1 fa7fc9b8e4b7154cce5ec22e2f51a9571c8f3d5e
- SHA512 1c2e097a9917a10cb7d028e674782ec4ace09a4a2f9bb20e33b25a0c655f52e7f4b67961ae0076e77697bda0a65399139c16c88588a86aa5e7974abb17489061
- SSDEEP 3072:eeFEYKvOTizJaphb4Jh2cRBjthao+yfhonjknSrQnDhNUrjAZXPcfrkG5qEPqtke:tFNRizVJhDwAneVAZXP6kI9t+mhUaM
- TLSH
  T13774F872648F8063D24603318055AB728666EFD53E73E59F2B943F2CCB7F5C0AA15A36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  LauncherSdk.exe
- Size 316KB
- SHA256 3509112f974bf80215567bc1babd15549cb2aaf8bd4fcbdf4328c837577db4ab
- MD5 bbdd70928890df4fed3224ab822bd22a
- SHA1 7d943d5fbb72b8b1abd4ae6d76b7b3581b729b4d
- SHA512 ab4d67205d63673f285ca44dda0f17c09730f3585c271576e45da5d280275799db87632893b7b7c10b42061d9a24489a2ed2e0a4a432651b4d84a349cb4472c4
- SSDEEP 3072:MGeH4O0jC6H5RModZ0nXC77zXXdloaEjhzktgTSrQnDhNUrjAZXPcfrkG5qEPqtP:M5f6IXCTd2WKTeVAZXP6kI9t++6hCg
- TLSH
  T1EB64F772A08F8063D64603319065A7628652EFD53D73E5AF2A943F2CCF7F5C0EB15A26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Replay.exe
- Size 2.1MB
- SHA256 ace23d9b32808dab344a789974e47484c4b171911f0946b05073c2cb6ae9e376
- MD5 20b4cd4260a0e367decf6aadf1a8738f
- SHA1 603863c926b5d23319af7c341cb7fd697ef7b2e1
- SHA512 0b9ef37ff4c02e864b6c7d648b0faef150b2c45827798f5d2d22096274d01fa130eaa61fea8d1d7c76ede9de089aa8600f441b5d7cf537bc4b80fe2c8555da45
- SSDEEP 49152:AeBXMLjIBP5VQXfvQ/qpyr0k3ixzubPHJjXSnkuTYfRZ:AeBXMLjIBPEPvQ/qpyr0k3KuJjXT
- TLSH
  T18AA5BE22FB8280B3D4820274516BA77B8936AF505735D5EF97D03D69CE321C1AB3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Savitar.exe
- Size 793KB
- SHA256 943a1228dde21803f8236ceb5a2cbd9768f61a1b646ede4b98f2d5fffe6bc59e
- MD5 746c674193643227d2c82df90f2f0c9e
- SHA1 f3343e0444104fc3316b914f01f0d07321edfcc1
- SHA512 a909db9bb525c439f5dfdbfcc9dc4f264001478e68eb9f00082da2ca4b8d026ca4c76d993c0e1ef318ddd28b71f6e99aa5cb821889120938ca2d3e9324ed7632
- SSDEEP 12288:UTQRz6FzQnLZTkz5kA0wQUTwgQt03FWGYiZL5sIQAZXP6kTt+2:UDakzWDNt0z7ZdjLhX
- TLSH
  T15B057C317447C023D59243B14469AB76806AAEA42F36D5DF67C03F7DCB3A1D26B32A36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  crashreport.exe
- Size 496KB
- SHA256 8362b3c6e8b117eca3541940d10bdb0e2ffb0dfece65e38e6ffbc36c45239822
- MD5 ca4b3a9e872a03fb4a1ab064213e0cff
- SHA1 8b23c265949992abb4f39cd18c9c10aaa7b6f03c
- SHA512 827a2a7021085d3c9017c7879dca3afcc80d5f749911f4fc6a65c9f8215627d89d7286cdc8f20d0bc9deb24fe53e7c0bf0c0dfaf26bc66445d7841458edeae42
- SSDEEP 12288:SopGFmGiEdr2j2ljCMqVSc19Zs6uT8Hp/EdZbEPH:So0FZiEdrHljwVSMZs6uT81EdZeH
- TLSH
  T1EDB48C11FA82D033D69101759D75DFB69A2DBE710BA064CB73D02FAB6B302C16E35A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  driver/ndis/windows10/amd64/miobles.sys
- Size 59KB
- SHA256 c218516cfe6ec8cce7559505a6a91274a2049d40611fb8af3b373f6d6f8a2cdd
- MD5 b400f1469ecc91f3fe5a11ae79418c10
- SHA1 806cbb4243756a4c88cfd384a6edf623d6feb804
- SHA512 8eb5d19095adfc3f7ab46cef8774757297810a5da0ed7831cbdba7aa6f92c4f961b6128bcf7d482a78993e701d3302bf8ddbcd9cfdcd3c513987a0bc886fd0cb
- SSDEEP 1536:5tEj2ZUkvEBNimUfcdFXZRiRLW8yTCfMXMvzAJ:5tEj2vMBNim2cd9iW8ICf7cJ
- TLSH
  T1B6539D9656B018C3FA1ACC74D2E1D607FDB1BA875B5882DF1364D1221F6B7D06B3A328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  driver/ndis/windows10/i386/miobles.sys
- Size 53KB
- SHA256 18c255902cfd9a0e91c13b21a7ea0eaa9ccf9eccbe67c6ac965e87e2b9b609c0
- MD5 86b01788366c5ca3140748de5bff6e76
- SHA1 6127b3d0ee5e20358ffdba36243d4e68573937c6
- SHA512 d0513b9ac53ded24707ba49442039f6a82f9078a203e78d5befafdcb246c9b648f5326a50da4a7827882ea4d7aeb42f5b3c095450d3c271bec484a218e2bf25b
- SSDEEP 768:ib6H5X8nXkC/6xYQQFPRpSr2OkV85ALDn3pa9zkF:H180EvvCMVLnZGzm
- TLSH
  T15D439E5395C4D843F8579C30A5D9E3976C39A3931F80E0E76375ED5869623C2EB3822E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  driver/ndis/windows7/amd64/miobles.sys
- Size 57KB
- SHA256 3fb2ad12603cc04603f0da55fb7b0c53d4d00346dc58116b7616d27eb77d983b
- MD5 09966eacb7c5ffa3b749e6b200246a45
- SHA1 5a3f7fd0a057938d7910da30330e34a469d72a93
- SHA512 74d39a6d520ad4ce801e0b6c949c5eac791d90fa9e21710d9ee4b8b0e9cc336779e2c26de144c952d22ec7fcd438eef019e19d632db28523b5ec040a8bd89cdd
- SSDEEP 1536:l1RUzqz4IxT0mN9bfGlZj+1ywmbXjPxd/zT:l1RUOcGT0mN9fYsywmbbxF/
- TLSH
  T195438DA2967418C6FA56CD78D6E5E657FEB1BA870B5891CF0324C1220F677D0AB3C318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  driver/ndis/windows7/i386/miobles.sys
- Size 53KB
- SHA256 0b9dfcd9ee17fa3b9926d96fc0b84eaba670cb468f674081735ee31a6fdb31cb
- MD5 b9dcfe33f0cd43961ae37beee583f9be
- SHA1 b21bcdeaef8dd292d825cc171db1962ee7311220
- SHA512 cb553791a2fd532e46bd4035c3f61c9321c02529b1cb409b8c0ec1d0903583f472a0793fa5bb33b0b22f8ede6b2207b1348c7c2b65a2c659c25b2cddac4f8353
- SSDEEP 768:VkwohV/0JX8F4XahQzXt/qr27iNPxWEXz1H+L9zjBLl:pa4XYeJKXNPxf+hz9p
- TLSH
  T1EC338E6356D4D843E8A79C30A6C8E3A72D3993531B8090F7A375DD5469663C2E73432F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  driver/tdi/windows10/amd64/miobles.sys
- Size 85KB
- SHA256 2c555ad340892c70367dc887962f3732c847da2e9e12c587e1fd72dcdfbf0457
- MD5 dcfac457f024badedddf585838f624a7
- SHA1 a19c7a0344895e9ac82c52472c0d133585994c1d
- SHA512 3d6dabafa8227ff28f30bc6e94bf6e858ff917852ea4597a0ad112f59498df7ca555b664b8383eb94a0f6076c05baf6cb2bcafc84231ac25714ee07dd8721d52
- SSDEEP 1536:unZQAZJIVJJBoJI+f/ID96PuciYZM3F1z1:unJZJIhWC+fgD96Pu3YZup
- TLSH
  T15D836C5B977914E9DE5AD8B8C6B9950BEBF070422B7183CF06E4C6851F237D1AA3C324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  driver/tdi/windows10/i386/miobles.sys
- Size 79KB
- SHA256 4c5582cf5dce98b71c37f284856e218f088f5049b436f8306dc9debfa0a39d35
- MD5 f07e8785bcf30176bb9a57aa99a2cf03
- SHA1 95b1438892fb10d916bbc24f96e0f60e57a0eac0
- SHA512 4afa3af3df475e460c2ec582e45590eca5e31303f7cdcef8a1809c5e3485ae64e7ee483dad773cba3cd2c6d65a12c37e7d76a669f207cca3d01672e2b046921e
- SSDEEP 1536:C64PiNLTfuMYj+7JLNOdBzRXHzS6p8RCMskPPPzo:C64Dtj+jOdnzS6pgCnwPP8
- TLSH
  T1D2837C1BA4040163D5D60AF2AEBDB71B197DCF1247A4E0F36A079A4D4A113D2BE783DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  driver/tdi/windows7/amd64/miobles.sys
- Size 95KB
- SHA256 b55acca5b740e0147cdc072c0b1be6624ef62deb1224a68aa352b0c10f680c52
- MD5 2127322064079b540bab89cd773bfc09
- SHA1 4a194a858ee0f88d2c5754af29caa29d8127361f
- SHA512 c4bed073ed4467ab7c1195073f8e41e216e88e2e18d4061f35c9552a5a77e2f5251449ed9e8f3d7d52c92e576a999a2efdc5b0483d5794b3893430271b12c358
- SSDEEP 1536:oO/uPT/9b8Sw/+2mvFNzQsAal21BtrqxN9K1GMArJyczx:xaD96qv3zQsAaako1GPF
- TLSH
  T1EBA36C97D7A514DAD949C1B8C6B9960BEBB470052B21A7DF46E4CE102F23BC29E3D234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  driver/tdi/windows7/i386/miobles.sys
- Size 79KB
- SHA256 5618163cefd3a53c298571e0176d0cf7a189747bc0eacdd816f9015d80d0fea4
- MD5 2eecc6b68ab6f7300a9998fe97990e1c
- SHA1 62a286cfa1065cc6a5a3b0edbf0b13f0d27728c9
- SHA512 c00872224771c8a75c20ba8d2ca002ca33204b2e937c3f551ab9a3f298030f3050341da32f7da09b7430da5cfb94512670addc3ecdb001f00a96eeaf429c7178
- SSDEEP 1536:5Gn8CtN+IfGa8L+clL6OBzU0SDJarjs5MSft2Pzt8:5GnXWLL+hOBuarQ5bUPJ8
- TLSH
  T15B837C1BA4040163D5D70AF2AEBDB71B197DCF1247A4E0F36A075A494A523D27E783CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops file in System32 directory

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32