7024b41f9f67f035810664bdbbcf45c1d7e50a9967812ac8a2adf41732a00e58

Sharing

Copy URL Twitter E-mail

General

Target
durrud.rar
Size 8.4MB
Sample260621-zzbbbagt71
SHA256 7024b41f9f67f035810664bdbbcf45c1d7e50a9967812ac8a2adf41732a00e58
MD5 3de87ae3c143ab54168cbab59d77ac28
SHA1 96ddaaba43a878325fd9a542009c219e92d6c6ea
SHA512 bb095cff173ae7b3539c9c0be176831cdc16e08a59671b8e1e759fa15d5b3db246e751e3272db1baa404aefe12e1913c3ae92770c2fb9bc85b99bfcfd610655b
SSDEEP 196608:AY2Frf0IvMmLQq5R77N5nIe87iklzclA7CCITDxVX6C5LEWU7:upccMmt7R5If7noK2CIx4QEWU7
TLSH
T18A96337266442BCA6D0FCEDEA34F009E309A165A1D711F4987C31A9D3BDEF82754AB1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  durrud.rar
- Size 8.4MB
- SHA256 7024b41f9f67f035810664bdbbcf45c1d7e50a9967812ac8a2adf41732a00e58
- MD5 3de87ae3c143ab54168cbab59d77ac28
- SHA1 96ddaaba43a878325fd9a542009c219e92d6c6ea
- SHA512 bb095cff173ae7b3539c9c0be176831cdc16e08a59671b8e1e759fa15d5b3db246e751e3272db1baa404aefe12e1913c3ae92770c2fb9bc85b99bfcfd610655b
- SSDEEP 196608:AY2Frf0IvMmLQq5R77N5nIe87iklzclA7CCITDxVX6C5LEWU7:upccMmt7R5If7noK2CIx4QEWU7
- TLSH
  T18A96337266442BCA6D0FCEDEA34F009E309A165A1D711F4987C31A9D3BDEF82754AB1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

adware discovery ransomware spyware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  durrud/+1 317-460-2861 - Report (durrud family member number).pdf
- Size 1022KB
- SHA256 518381de74146a14680c7f791e0200a3f7573908300af4b5b897a64106770e16
- MD5 5bfb51eb0d0f88e5dbc578a3da27e9c5
- SHA1 f881b90afb13dfd64947a8002fef9ba7f02c2fd1
- SHA512 f75f6ad7113258cbb3b88402d5491ec97ccbb2bf5cd974d58741f273b69ac6a816ce4daeaafb235503d6fbd1e38d2d30b77e3928d809604a74510cdbcd59db7a
- SSDEEP 24576:zk2E5SoImBuUCLKrDUP8Cg+G1fMeDcfxdWYrL6Id:wNQPbrHWA6Id
- TLSH
  T1AF25E05A2097764257EB8EFCC4E0646B0937EE371E6589DA822225FC076433FD44E9B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  durrud/468844449_10162599475105479_8187891674161537411_n.jpg
- Size 104KB
- SHA256 17a5fd0ae1426eb8295f7cc6f36ef695ec68b5ba0d4c322bbe1595eb578ac07a
- MD5 7f94e7ea2fca160daf7d4aabcdf328de
- SHA1 e78cc9c043161b441bfd1d5140463ac3ff32c384
- SHA512 c0cd48ce4916f8e9a3f8125356c4152122b789c6005593eac691d6e22db9fbc5a91154b95f493872c87319438e3508629fba4f4e5cfcd23100fff2a6cf302a41
- SSDEEP 3072:w5VQYLr6toB3zUqKNA16H5eR4lKU52hVJKJ1:wbQgr6te4G94lGjJa
- TLSH
  T17FA3124CEDA043EBEF5F160B1202D7966D1FF89404E9968ED48119BE186C7E602F1BF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  durrud/480665061_10162807191800479_7764584616751198470_n.jpg
- Size 85KB
- SHA256 5b525cbd31428f0449c68b0e1b8aa8e847505d9231b5c356a9e7f1d959e07cc7
- MD5 0161c29ed1fdb22cd3b91cc818e5aa1f
- SHA1 5afe0ff6a20c96239cb0db2fcad41b22e4a4e9c4
- SHA512 451ce80bf6655c2ca669c42759ef83f01b2ac2c221dde84ae362b41b560c36414d5b343c2bb377d920a22ffa578ce02b1b90de9930ede588939f502fccf3bbfc
- SSDEEP 1536:7XW0Np26GCQbtrYza72nWhd3a58K7M4Qm7i7NkkdOgaCoj0v2c+MT96:q0NqwWqWhpa5H44ZkdOZCoIEc96
- TLSH
  T18A8312DDDE683F4F93118132845E72F44D6C38F6B081B1EFB4BA10D66608B640EB989E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  durrud/489283732_10162992544765479_7328107038324951315_n.jpg
- Size 182KB
- SHA256 2912dd9943d1e2de76c197845ab6a1ea6e5b0f6996b8e5967e17c73cc0b16f15
- MD5 2938bf4275a72e913716a36416218857
- SHA1 cebf0f01eeeb69e565c662fa3dab143a05b51e12
- SHA512 e9c65080f9341c1d894f9c7961f8561ebf0e4d5999a1b6c5ae9db4440a77b564771d841edb2fc9f7143f562d724be12a24e3c68410a86efbd55ed8defce5d9c9
- SSDEEP 3072:e5GX+myrSS5duDU4gpexC5u50EB82mgi9JhDwc61Gq0LDmNoUv9G:e5GXDn+zQC5ude2Hi9J6GLLDYoUvs
- TLSH
  T12D041222F9B30146858E9AFE9741D03A3B687B554D42A2B157E6460FE1CF42036EBF1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  durrud/509356537_10163322010090479_6366012844761924788_n.jpg
- Size 377KB
- SHA256 e7fea054cd9089676d6591429f8324ce49504a06d14fbcecb1103e14e72b6e3c
- MD5 36b1b66f4fbaa71abc4a04351fdb1193
- SHA1 dcfdce60beb3eed618b0957c8b16cc77f6c5ebb9
- SHA512 0098b9efb947431f0093cb04fbb6b1f469b1ac33ba7006106b9897e05eb3173f417307bc486843654a4e7afe81f6bb75522c0f8b76213b28039bb49425acc6f6
- SSDEEP 6144:izSk+gXQPTp0+ltyW9fg8JZImzQti1SlEb0ciDIvGebkXxSOq/hPcrTw0T2I2lam:4S/g6nltyW9fg8HIOAvcbvJbkXsdErcl
- TLSH
  T1E8842350C59ACEDE721D49B7EE9502CD477A40978DB8720572009854EC3B2DAFB8EFD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  durrud/516519760_10163414213585479_7515487858549607760_n.jpg
- Size 534KB
- SHA256 ad161d5d40682b230f8a4214b018568eb4d9470870132e091a735d3adfe5391d
- MD5 5135ea17c99c4d8659f9778cdd5b67d2
- SHA1 694deac509c43ee83fd88e99f1b3b71a193858d0
- SHA512 10355024c98c2bf7343c95f49146fedd2c9e151a14f90a07484813faa5ef457ccbdc2eea739aee3c2fcf1cb9cb591fd54a9977dad875ce44c3d7306df3bafa37
- SSDEEP 12288:0obh5QubkTvbTcMB84xpQxgpxjfk/j6oh2Z4bnPkl/32U4PEF:0gjITbQgpZfk/j6b4TPkzZ
- TLSH
  T132C423F1BBA7FEB679758729BF40F588CA3C1221830A9D2C951C4E6B94D122C3717D4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  durrud/634368849_10164487043245479_3489372388277272004_n.jpg
- Size 282KB
- SHA256 d1ef12f157229034be934188a605efa724f0238929dab0f79742daf0874a1fbe
- MD5 5a8db2907e7b7a222546817bad16f2b7
- SHA1 4b8af420f443ce8ffc0703616ba781b6cf940ba0
- SHA512 2ebd516043947d75fbc29fae51fcf20cbd4877737c12a4727914a157cece747b8e8b1057ffab8e57ec850ea8cc8fffadbe086045e308b5fa97228a122ec2085d
- SSDEEP 6144:sw3CvcAZ+DR2E4IPPzEeU7iMR5P3uxzNQa:56cAgDRlzEeUrRQnQa
- TLSH
  T1B154232176F702D7FA8D2A5438C0FC6F2315734771A79FEA00D5BCF2EA50B94606A299
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  durrud/649873049_10164423747823162_6049444889732639062_n.jpg
- Size 34KB
- SHA256 4ce15c0b755a05e6636e78eec96c6211e2a55a52f594b68223e8d4c4f698e336
- MD5 fc8df3697169ae6b8ec38217c5da0289
- SHA1 86bd182d91f032dc92cc6a0f065e48f98562dc6a
- SHA512 e350a1768c2ec5d17c71c94811e0c552c238477fb975829655cce4c83b8af524f920fd533f0f3cc418f492ab0f22077eb4be46518c7d2cd32d6c2899a0c6b2c4
- SSDEEP 768:fXtdNTBgKshijTEB+LAIMiv//9A75U9fCJroD6FmP:P9BvsU3EB+LAyH/67i68wq
- TLSH
  T1BDF2E117C6C3872EB3315B5E5EF96C6C9514FA109087E32BDA8736144AA21B3F9C3CA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  durrud/655488600_10164690986910479_4590366938245414761_n.jpg
- Size 341KB
- SHA256 c6c1c678db0ca89230567104175a258a18466e49c4a02b78ac3efd4d8cf0d6c4
- MD5 56a175f0bb6ac21469cb5878b4fd0778
- SHA1 dc5583151c13eeecabb46e557bc1de06120f7b7f
- SHA512 68f47b1a0da4ae668755e24d7fcf3a42cfaddccd283da73977b4a0e9b82a89000e1058e27d47d2eaf8eff9eec164d45b36040563038d7b16a43fe2f24bb75594
- SSDEEP 6144:TOA6N1739u41iW8znjzK3Ylue4d5IV5ro/TkEcxVye99r+NPIlgfPn6qcvN4ncfk:TOn1B3tczKIUd5kro/Txcx1mNPIcnXGU
- TLSH
  T1AD742385C7AB628F8D37E4B85EBFD20CC7A2E7C8AB279052FC8617521712DDE1309461
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  durrud/658360205_10164684696100479_1561915328764918109_n.jpg
- Size 180KB
- SHA256 31f8586983c2e492b122fdad9ae11dc01bd4912411012c06f9544da3cd8b8285
- MD5 8ee6f43923680ac416874b567b5be35c
- SHA1 260a0d85214d2fc7dd83160b18a381c7e27afda4
- SHA512 3f51161b1e081d3f33d2fe2c87763efb804d61992ae17b550dba065ec7c5007dcee9e6a947594437684276ebb3ddf50b5d04e132412c517d9d84788e2e67fd0c
- SSDEEP 3072:71bLf2LAfaYr0CDvBn5yVOm34jg+ISJhPQj/yhMqtrSxQ3i/8SdhDxVfDCFX+AAi:MLq0CDvFYVd3fE1O/ygxLUSbxVfDMX4i
- TLSH
  T1630422F606F637D3385741AE4665A0C32A7D312922F89CCA34459ABBF48D878E9F4D13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  durrud/670276008_10164778825840479_7434143053661119157_n.jpg
- Size 545KB
- SHA256 15ae4f812421d0189f6848f35e3470395e15d086273223da889f8da02e60327d
- MD5 dc0e23cc7c597b569fbd15fb74f66f99
- SHA1 de7baa4fba6f84d4b1ad3db3799418a188a65af3
- SHA512 b23dd5b3854130338486d8ff81983888f921db1188cc38366da239835ed951467e1b77c5f112b81175028c5e72b7bcdad91d22918f58a78ce9056cafd9974d10
- SSDEEP 12288:H/Nq21uCbCftwCMMegT31MwV8V8mAgrpi3jn0I:fkXEYrM7gTlMDV3o3bz
- TLSH
  T16EC42351E19D9496640BC7BF0AF1718264A981BBF81DBAF4B9552F0E69FCE020E3053E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  durrud/681348552_10164840563875479_5845214137963982194_n.jpg
- Size 44KB
- SHA256 f0de9a17ac88f2665994b69962dbf7503169a341e53046ed87c9dee81d839c36
- MD5 5433019d391c7e42118ec82282be7fbf
- SHA1 22ca8dc195fffcc2f41b99c71f812c6a0b290093
- SHA512 d5257e46d076da7a52dbec6c98b6b285778f3b0cf6999e848caab830094d597e1c3a151c9ae437ab1a468404a6d31e712d38d8f1b608878db8f50e15be37aeec
- SSDEEP 768:BoCS8OCRNnAPedDWzW6RxzMGOOspnbrFs+zPxRgYA9I2Mv0m0ym9Ml81C0R:BE859ZREW6RxANnFsgJ2sv4yye8FR
- TLSH
  T10A23F1B50C742D5BF1EF1C90A900ACC7A5CE7772290B362068E353EBC66CDC507616DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  durrud/689222739_10164884321070479_2363002540439826886_n.jpg
- Size 642KB
- SHA256 19e0b83f4168e0358c600e33d94610a726a9845c66b617aa576f922ba3e64694
- MD5 3baaa3407d8f8590b6be5f11e51d0ab0
- SHA1 51c5b58bc5871a6215d745e808df95f9f344c774
- SHA512 c735e2a378140d7e45b1d6817dd3c48e04cfa7afae9c32da8ccc4bce637487796aa60960377809a66f3d5740a7a5e1fd77162b99963ada8924a2cc387d74a66e
- SSDEEP 12288:GknTpeFanI87SJs17IBVijOpFiw/KxtXvbahBxEU8Ygy5NRtNUK/CFk+RmKj5P:3nN0uu3WMiwuVbahBxF8Ygy5NjNUK/IV
- TLSH
  T167E4235A2AE27017E819709C369AF700FB655AD817C14F2B3EE32C233366548B772F15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  durrud/690613858_10164878737075479_6043124133187579184_n.jpg
- Size 504KB
- SHA256 ee867c39ae9e17835b97d1b200cd427665f165cd01bf91111de96ddbdfa45c09
- MD5 2f4b9f432c6876fc378e8daa36cacc7f
- SHA1 60f322c9150ce0587afcd4399b3760a2f3481f56
- SHA512 91003d28689b058dd45485b3922c3b849231661e81229c4061a9890c1c0ee154f7d01c240cdc40eb5525f326cfa80c3292e0a5b8a9801466ab4b9a196ae938f7
- SSDEEP 12288:QT5RRihDmhoerPEPpavDKS1TtZIG6ZokZ9RswS2QBd8pnHNvQ5uu1z4:QT8qoYapavOiTIG67g2qknHa5R10
- TLSH
  T154B423D529C2C71F4AFCBBD9F980773CB000C97E2145B36A5491B5AADAC3529FCB8940
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  durrud/710391565_10164999519615479_1173959317649277053_n.jpg
- Size 140KB
- SHA256 01103e4a38c5f7bd13bebc9e3db98097957d4a278a6906cc6c9e8c671b7a3b22
- MD5 974efd26b95e3ce4a606ebb58aa5c5ad
- SHA1 d82a3fadbae700807e4dbf263c67de4aba7cb50a
- SHA512 ae9f745915757eb3d25030ba2f7a1dbcdda1eda1bfc3346a15feb68a494879d301b5a8131f4644f46c898495dbf7bee3f9e800deda58014fefce9502bc416c4b
- SSDEEP 3072:jniZ9O8ppdr7LO0EDdSsjZABaqBTsaw38yx+qMHFTxQ:jniZppdrPcXiBDBTsf8y4VxQ
- TLSH
  T1D7E313277E13AAE8641FDBE1F3970CEF7C12A8E29251BCE55DC4800613924E2D4DA763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32