0d08190cfe649dbc53cc603dd08c2e7caafa98adaf30ad4184f9cf316252ab82

General

Target
SA_Study_Workshop_Guide_AW_3.3-beta.1.zip
Size 528KB
Sample260622-ryy2zsc19n
SHA256 0d08190cfe649dbc53cc603dd08c2e7caafa98adaf30ad4184f9cf316252ab82
MD5 079c80ef00773c4c7159c236b2593e26
SHA1 4e8fc70cde646f58922854dc699d860954119d3d
SHA512 333336692d1165a9028b38af6d2053801065156ff09d8fd74352dc9729a2c0fc204be98b91751f806be0850cdf2b993eb537e6129be2550275fda55d004cd720
SSDEEP 12288:Z4lhhLoVDI2FLmMJKoeqO3g/ALyYG0ZaDajTCXMO8xzDOeDBs:GxopIAmMJkA/f0Za6TCXKBxFs
TLSH
T1C5B4237B0A7F70D00C6A43BA8B468611A43D9D621628AFBD47DCE6CC8D0E51EBF14E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  App.bat
- Size 29B
- SHA256 a96ffc9f649333f9e84b7a7e1101cf85f7a5f143253db1d7853e6e48d46b3c72
- MD5 6763da0e8a0778b62bd2bc404bfa1e1b
- SHA1 0a9e04d5e85702f53301d0e424305a4e20e1ebd2
- SHA512 36bd96a17730f29e2e7cdfdc1a515e85dce94ccb10d4d7fe0d9502b1794da0c274aaee5bef185933ce1de57f9bcd5ef6c76af578fadd905b32df695cea8afe80
- MD5 SHA1 SHA512
Score

6^/10
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  icon16.txt
- Size 289KB
- SHA256 33250ded61c43128b6c29b01de7b1cc962b241b236933f54bc42b648afae2398
- MD5 8d818e3923c032d9bc233ef67be430fe
- SHA1 66b64a0313384c8c5d39f764183e60c0cc74ff49
- SHA512 794f252ac654c3dc181c603e2489d982847c48084e14fe09c0bf80f67b485901ca7674136db95eaebbd3c5992282b458b189333b2f7305870c5d135b6597bd70
- SSDEEP 6144:9zMxJhKjorjuFGnEPMTgy77tEcpvACCI6mgT4f2D:BehKjorjuFGEPMTL77trpAyZgU8
- TLSH
  T1E554D6F014480CDEFAAB96C1DC738EA61573E8F98A4B264B0F7CF4A13654591C6EEC16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  resolver.exe
- Size 753KB
- SHA256 3200b7d6a42fc8d2bf213cd17b1bd6f0fc76c4f626330ec6fb0a3f9a0ef9e00e
- MD5 a643386d4af0ce1d488dbcaaa393a2d4
- SHA1 6173c53637ae562e6a7ac0c449210767615512b4
- SHA512 53a7a1157bb1ae1864743b4c3e66fbf4786ee805ff111261b7cba7e042954797574df06f128340fcc6a57761f5bec08da5d3692d2edaeabc00c4460423d90f83
- SSDEEP 12288:zIxb6mgscIPv+xPBPx3ph7WfsnE6VTdUZ9nUt2ZvIX/19X7BroWkLwqG:olRcIOXrh7dEiTWZC8gXTFW
- TLSH
  T1C6F49F19FBB101FAD5B78135CD16A90BEBB2BC050624566F43E06AAB6F377210E1F325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6