5ad442ab9bb75a04e4d178b7a44ea4963345c52574f32b63e14aab4b5e237326

General

Target
OmesFree.zip
Size 5.2MB
Sample260620-rdbe7agx6x
SHA256 5ad442ab9bb75a04e4d178b7a44ea4963345c52574f32b63e14aab4b5e237326
MD5 739a92d06c1c505f49186dc0e229810d
SHA1 cbe3484733da250f7320e0e22bc33f149f4f922b
SHA512 a8c93db1b9b45f130daf78319dde6955f92203ac4a1f4bd90aa7c898e46a255e2cd62eaa2ab27868cae670aec05745f856308ac2e54c6fbf1e1f8fb2a26ec526
SSDEEP 98304:sFZM1qZnpPVfcO72/yEC8poRUlRmyquMPLoScdgH6DgaVbHRPqe1qu5irjLx9:oZ67w2/yEC83lRhq6ScdgOgQbxbFYjLn
TLSH
T1DE46339894B471279BE48C769A13E2657AF3C15C73A70E82BD510049B3DA9B047CFCEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  OmesFree/config.ini
- Size 615B
- SHA256 2fd79742d2fc4685dc2e088efc0606355b329e77e3fdeb3d85d43266d1af6486
- MD5 15a01c8f55f2a609545d74dd868d850c
- SHA1 c7cd0b30b44403363535431dc0ccf2569fa19c19
- SHA512 4f736e22c2131834c40db4876017496c895d333698e0f6184c43c450d77f679311185e5f35e71d754311182f8f1de16d30c646abea4aa03d7f34d024acc98aba
- TLSH
  T1C0F0283D7AC9BA39CAB78511A9C161A221755400350B35B1B1AD41AC1B23F7824BCE0A
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral1 behavioral2
- Target
  OmesFree/omesfn.exe
- Size 9.4MB
- SHA256 83221a62561d6ffe4b5ae1fcd4bfee3b37dcb05e77a21a19720609555cbb3b90
- MD5 83d33bd5b34294d35b2dcce13b33fab7
- SHA1 2e11fb2a514f9b9d2812737a8baecfd907937267
- SHA512 d9ec887d322ea3b3c391b88184a525fd2b8c536d06ecb7db153150b90ca348b8a928925a389668af413e68aa38a9271a7febf90d117f3ec229c0a8005564d92f
- SSDEEP 98304:kHa2VN6/Pd4yB7kGsFHU3yEO92HJIVRiEDr2yG+aVFGEih0HUlc+0dbdnXcoGbr:k1VU/uwOdRvDrRGMEih0ocNdTwr
- TLSH
  T19CA67B12F98B94FBE5031A3144A7B27F67345D064B3ACBD7EB407A6AEC772914836306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  OmesFree/skinslist.omes
- Size 180KB
- SHA256 0d158b7c6a06f362229fa818cb23d101c02957aeb977518443670f6a6452b2c4
- MD5 5c6acbb4e8a3f620e13901785f3eb733
- SHA1 9404bf71ceaac2073789ec30505cfaef82f78fdb
- SHA512 20e0c6a252aca496d9c79d55c44241b848d4a82f8bd7bc876df32799916f392416195109afe1ab518fd582a1457d68d5b725124799f040067a17340b86eba6b7
- SSDEEP 3072:K8F/l7kHbAnNcEASwRk8ts+whnCFpSlOcp8oXXL7dwRrCI9bDqXbas4TwkMdFvo:5lOclbk+7Ro
- TLSH
  T10604BCA745FE50C3C00293EBB803828DC6D96744B107194FA6B8FD6A234758EF766D6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6