4a15e703a2bc1156d20724fa30bb4083903b727c997e4fe8d88a8d2b3672139d

Sharing

Copy URL Twitter E-mail

General

Target
c2ware.by.HunterDevops.v3.1.zip
Size 14.5MB
Sample260623-pd2ahacw3j
SHA256 4a15e703a2bc1156d20724fa30bb4083903b727c997e4fe8d88a8d2b3672139d
MD5 c5f943553ebff2064c9b5f5ffb2c2c7f
SHA1 37f2e24f6e28d3afaac7345fc96156aec892e3fe
SHA512 aaa7e16449bb2e4ad14f3d5bde512be36f135db6d7feef89b8068c093e9d78432cf5d06bfccd03753572789b91f551f7cfe6d3a81934652fea26059587db4132
SSDEEP 393216:SYs7cQM2nHo0KrKWBCaeVjgw+8uGF/u+TyQ1ZVNs:SYszM2I0KOjimTWyZ/s
TLSH
T110E611C78AC52D8ADED018387C3B4B704E21C9DAF912CB538F22A63E9FD73949D59449
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH
  T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  AEControllerImpl.dll
- Size 4.9MB
- SHA256 f15b0afd904825c8e653fb305bf5248571566a9d59aac9d3202aad549d746e1a
- MD5 2821718912293886e9b97f75497b91a1
- SHA1 00db15cfc8b947e43ffa9116abfd5552bcac8d69
- SHA512 f3fe52dae9adccedc989734ec834d84cb22154751cbe0d7d8f9f51b00fcab920b8030743b1f81b1b9655b956b1532a69a62272d3b33da7b9a1abe598fb2f9784
- SSDEEP 49152:89QcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbAL:y0XTnMmPsUXbPWNPvcYLUw
- TLSH
  T1E8368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Actions.dll
- Size 6.1MB
- SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
- MD5 923a9fe2404277f490bc959493f48e72
- SHA1 563c8dcc7adf7fcd2c706be7ac56ed79c52aacf9
- SHA512 5bdbe65ffd24380d423c3d2bef220e29c39622551edff942f643e79e50ea582439b9e7e91387ef020d44e2462721dda089a83566c76ba1287c2dd917e4fe4194
- SSDEEP 49152:v9x1737qVRJXwMb5WOXz2aXjAr0dcOyccpFZckK/xjDzBE+WjYFJWgP4FNJe5RRe:X97ELkwdchTNOAjYFsG4EGmzqZzhaa
- TLSH
  T196564B16A7E801A4E0B2C178EEF79103EAB27C255735CBDF0590525E0E73BE09A7BB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ActionsShim.dll
- Size 3.7MB
- SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
- MD5 33617cde11d2bfcef47faf0d5ce3cef9
- SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
- SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
- SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
- TLSH
  T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ArwControllerImpl.dll
- Size 5.5MB
- SHA256 ca1f915b6ebf65a1fbaf7b8f917424d9436aec03826830d8ef7867e01d2e9e03
- MD5 7eef30500d42605cbb86900ec94f851d
- SHA1 7ce762e54e014f2467971369cbeb44a11a4b5e1c
- SHA512 406738b664629e9092e0827dd6094a83ee46f70f397795fa56d684b2d3759971c689d9710bdfb29d5c551c611f50566dd47c3a795fe21b4779e97cbd3e3e59a3
- SSDEEP 49152:HjXqdt61P6e9RZe/nZTqOLCIJAq/trSw7BaPR4M0zJP3HNrtlBJ/QBPDY8150GhY:HTqdmPycqMwV7HlcDV5j0Xn5f+KH
- TLSH
  T16E468E1AB6E500A8D8B6C23CCA678513E7B2BC154731DBDF16A462691F73BE0473EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  arwlib.dll
- Size 7.2MB
- SHA256 3795590a2193fbe872403dabfd4adc73ae2a7b580d0ba65080e7b504912ad489
- MD5 c6205a1401283627f711453acd6fdb3d
- SHA1 b9aa422c283f18749fc704b223fe86089836d06d
- SHA512 4bc37eafc1553e9a989fb6a5b1b7ab2fa2c1173676c152e48970884a0e7fad38ca1ce8dd5f8358a126b7cb775295b9fe21b25a0646ff095e448d80d3ff157aef
- SSDEEP 98304:1dnJpHOsS9AkcfcanXdGzzP1t88ZhE8r0/z4NPawDD:9xOsSK5fcAGzb1t88TEB/zWzDD
- TLSH
  T113769E1AA2D801B9D8F6D238C9678513E7B2BC151332D7CF06A0966A1F73BE1573E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  c2ware by HunterDevops.exe
- Size 703.2MB
- SHA256 53cb8105eedc1aa56c45d301ab035e760deb8e93abee707aae5213db58b22a5d
- MD5 d09d7410d1fef7f76fffd60e06254725
- SHA1 d046c0dae8249249266e1d3e90f1b6136f57a3dc
- SHA512 101097d9783665d5ed84a47f34ee88e726e75b71a895555c1cceac6fbbfa28c89b969035c7c647e51a5489847f970ded1d78f6f2f5f620ee6f88f144842e5cd7
- SSDEEP 49152:hYro/q7hotYawEmfC6jWpM0WAa+PR8Mw:hx7aC6jWO0j7RA
- TLSH
  T1A1798C07FCA509EAD49A633289A751927734B8091B3237C32EA0B7383E77BD09D76754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13 behavioral14