26db5db99d37c14d9158f4205b5f1f0021e9563c8b74b548feae295b897ef019

General

Target
Software_2.5-beta.5.zip
Size 535KB
Sample260622-rrd38sc17v
SHA256 26db5db99d37c14d9158f4205b5f1f0021e9563c8b74b548feae295b897ef019
MD5 8345f9acbb704e020f33f67a84962f75
SHA1 c1a703ecb64d23cc67ef7c6f57d39948de9096f5
SHA512 08f3e2f1f8007812862f6b7e7366e563aba1cd2c85d2c1ed6fac3e9f49fc9ad5003e4560c7dc5375d0bd17e29df7f8a69e45ea7804e30202344148505b3c102a
SSDEEP 12288:KM+Lkjyqu1SXyFf7onLGbQUsANy2cFhG57yuiZ:Utqu1BFf7miQUrNegyuG
TLSH
T18DC42359B2B7498EF221A0E5A8CFBFB8A2E7DD55EE4BDCC477C052D41221701389075B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  launcher.cmd
- Size 27B
- SHA256 ccd107dc7de92cc112f656d433f95db249d6ab04a72622a4d4528863b56939d1
- MD5 9a683b6e391c64dfeef8f2a526bca3e9
- SHA1 3065d4a04c8d38e18811f6a04ad6aa33cb61f72a
- SHA512 cd1a363e7b6895c8e96a90efede923886e7b1a28a13d973660dc9f028c0865cab43077a5a508701626cd2235c006a0358aade053e9747e4daef1968e47fc9d26
- MD5 SHA1 SHA512
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  luajit.exe
- Size 720KB
- SHA256 1a970a1e390ce3ecd02d531d94e76fd2b33db14f2869f4b9e4b3385f31d6d952
- MD5 42fd849177a3dad16e4f680de2710480
- SHA1 bb7ebc3224f576148b9934a14b8a5ce082ccb31e
- SHA512 64003624e58e2251385d7e7dc28bd20756e89fe31102e7534cf4fb74a139f900bcae29b9e6d6f9cc564339553293c5a9a023e14b624889b13b60a4d93080ca9a
- SSDEEP 12288:+WMNv9nDNEcqs0KThReU46upzipe74Q6WI20BTEhfY4:+WoNEJs0KThR6/74Q/hSZ
- TLSH
  T149F4CF41B9D280F3D4A210714579AB7A0D3DBD2007159DEB97D43EBA8E346D0AF372AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  opcode.txt
- Size 350KB
- SHA256 862fe8cfdadb00fb307d0ac51515ed23145fb2ecd7e9d4c85a6586b6fc398b87
- MD5 05f3083e17d535f22d440675f4306295
- SHA1 5d81e0b6826d9c78ec2a18c4a009851d86e0c997
- SHA512 7b90d08730d9e25884f49300d6725012fc47b9b211cf789124d74c99c4573b3c3131686accbcb5c62421f5e879835c1fe133e117dae3dcea2bf9eb8a1af41707
- SSDEEP 6144:+49rdDV0GJsxf5nE0dnTHEkP1w+LFUTQQA:rJz30pdnlWE
- TLSH
  T16F74D8B0944C0CF956EFC664CC6B6D87A1FAD5E4034B668B8F3CE7A531A4261D7CE806
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6