d781a95ac46900499228e16a545e1acd386988edc8b30e203cb14e6a7d6734be

Sharing

Copy URL Twitter E-mail

General

Target
XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com.zip
Size 154.7MB
Sample260624-bmpfeahw9t
SHA256 d781a95ac46900499228e16a545e1acd386988edc8b30e203cb14e6a7d6734be
MD5 3de8dd409cfad9bd55add30dadee89b4
SHA1 9d889680d87e68d33182ad59fcfa2eaa86ec1fbc
SHA512 2d9188a2f81823962f95bdb4885ff4703ae82a6ae8a7ffca5a3b687b50a255cac13025fa73ae153ae51b7ee63dcdc43c21f72b4420aa466d62a7f5a9427569fb
SSDEEP 3145728:idgnwlANS5Frf3fzoCqsXfaHqnuoXFFRTMEjbFs/8apTk5kkQnpI3fhV5:kg6ANS5d3bJXfayu4FRb/likQnps5V5
TLSH
T1D0783321452429367A5E32271AEDD3AFF94E33984ED44CB93B5E73F474E089BE0242D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com.zip
- Size 154.7MB
- SHA256 d781a95ac46900499228e16a545e1acd386988edc8b30e203cb14e6a7d6734be
- MD5 3de8dd409cfad9bd55add30dadee89b4
- SHA1 9d889680d87e68d33182ad59fcfa2eaa86ec1fbc
- SHA512 2d9188a2f81823962f95bdb4885ff4703ae82a6ae8a7ffca5a3b687b50a255cac13025fa73ae153ae51b7ee63dcdc43c21f72b4420aa466d62a7f5a9427569fb
- SSDEEP 3145728:idgnwlANS5Frf3fzoCqsXfaHqnuoXFFRTMEjbFs/8apTk5kkQnpI3fhV5:kg6ANS5d3bJXfayu4FRb/likQnps5V5
- TLSH
  T1D0783321452429367A5E32271AEDD3AFF94E33984ED44CB93B5E73F474E089BE0242D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/Downloaded from Crackingpatching.com.URL
- Size 206B
- SHA256 cfc498a8252f56ee4e409309b3ca4df29a94bdefae4858f48e0b05ee800c7e2c
- MD5 e124bdb2389d49c83c628142d57c4d80
- SHA1 7126c17c77df499bfdc7d48d91997ef0521a128c
- SHA512 2aee16432066f2a3fe13f410589c4ff466b9f63f3ab108db8d60629989d161e587489863faac08829c36d09bbb338ef64f71a7e82d9bc29bbc832fff0c302559
- TLSH
  T16AD022294B5880ECC202490BA0B8FC5CA80E301548EBC289B2E8CD9A5C490A2CC48E71
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral2
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/Fix & Read Info/RCE/XMindCrack.jar
- Size 249KB
- SHA256 f8b22866a83ebab848cc1789e28cdd339946f0af43cfca13d64747a5a69c8bc6
- MD5 552eacd417102b7f1b49d8f7b693169c
- SHA1 3efd22f7b1844694c73dd39002da61a8d6395d9e
- SHA512 244bf32e69a050c5c9fce764f6fa8cc066a5524425ee69de32496d62ba6bc811925d2b5d4dd3ba10cd1ce0b0981d3178508c3a582d966df150b51e54b5276b2e
- SSDEEP 3072:v9UZs1jx26NKoMN+uhuDM8Q+nITC79NRZJB5lqs1q+nDXI4C9XNh2Hof/yjrlasA:v9UoNta+uh1cfZJLkSvDXID9XEoyvi13
- TLSH
  T1CA44C005FE87D023E517B63820A2841BF9356AB9D688B4370EE5C7CBD47584B1B877CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/Fix & Read Info/Serial/Serial.txt
- Size 331B
- SHA256 66dc222783706d2a74673b76078dd2d81237cc3df0915b1b99a1e75437fb58f9
- MD5 c13cee66f3893b89577c4c0d0b105184
- SHA1 94d109db361977bda6eda92700345317fad5609b
- SHA512 04cce10d8fef0409223a6bcde6a980485f66797d668b8fcc4a24fba7d0d0decec61baed40fb9c13dbbccae8371a73acc9763a8446fe53cb090050be8dc2ea034
- TLSH
  T111E02D3F8389E4731700328B51806415B0E72681AE48438CA404E4FB89B84B0CE1B27F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral4
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/Fix & Read Info/XMind.ini/XMind.ini
- Size 537B
- SHA256 4d06dc2d029748ac9b7ee07a41e97576557bf8b6b9ccb6c876d69b3dd1a336e2
- MD5 28f3deadcfff50fc4c31f3a627218484
- SHA1 47ce4e7b9adcd1d1ded19fec3bdbad0740ff6969
- SHA512 3d438ec6e6824e84458e78f63993fb2431ca9123678175568e3cb6113fc3d3421a3ff9698fed37d2cd2a816a5c89f7e1175166bcb0062dd70b19fe0bf9fc7192
- TLSH
  T1B2F09582520DC5F00D672792C44D415D4DFB359F45E7A5C4B1732C5B9D2E0EDAB47405
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/How to Install.txt
- Size 2KB
- SHA256 493c39eb4d91c23d5f5ebab7e44d88e51ef4da2a2aa5da7962ac88ddf8aeaf95
- MD5 b0ad1cc4d04949cb8702268a84c6b613
- SHA1 ff45cc4ee0c5d3a2efb58cfc2154d3a37b1c32f7
- SHA512 d7de7a7c9e281118e6d90a26812a1a7506b37e3909e879cd95a3fafef35289b54b264f5027d54de65ee7ca674a1aa60dd98effe77bbea8791ffcedf74034d562
- TLSH
  T1BB4174DF018A65773FB68515E25B8C84F21BC49D639B4494224FC19C0303F6296E569F
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral6
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/MrCracks.com visit for Latest cracks.URL
- Size 206B
- SHA256 cfc498a8252f56ee4e409309b3ca4df29a94bdefae4858f48e0b05ee800c7e2c
- MD5 e124bdb2389d49c83c628142d57c4d80
- SHA1 7126c17c77df499bfdc7d48d91997ef0521a128c
- SHA512 2aee16432066f2a3fe13f410589c4ff466b9f63f3ab108db8d60629989d161e587489863faac08829c36d09bbb338ef64f71a7e82d9bc29bbc832fff0c302559
- TLSH
  T16AD022294B5880ECC202490BA0B8FC5CA80E301548EBC289B2E8CD9A5C490A2CC48E71
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/Releaseload - Windows MAC Full version Software.URL
- Size 206B
- SHA256 cfc498a8252f56ee4e409309b3ca4df29a94bdefae4858f48e0b05ee800c7e2c
- MD5 e124bdb2389d49c83c628142d57c4d80
- SHA1 7126c17c77df499bfdc7d48d91997ef0521a128c
- SHA512 2aee16432066f2a3fe13f410589c4ff466b9f63f3ab108db8d60629989d161e587489863faac08829c36d09bbb338ef64f71a7e82d9bc29bbc832fff0c302559
- TLSH
  T16AD022294B5880ECC202490BA0B8FC5CA80E301548EBC289B2E8CD9A5C490A2CC48E71
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral8
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/Screens & Proofs/Export Proof.xmind
- Size 9KB
- SHA256 bfd077ffcbe7bf0151218a8bbdd5b70a7328c950a91de6fe9a39e3bbad1a4e67
- MD5 bec6b93634cd0c9f4252236bd2b9a649
- SHA1 fe0a9912a150f78e9ec7ce0b2e7807abb4348ac0
- SHA512 998d77d6073606a8ed71c945a225966d62a80bc1dd103fe12e9f3d739a1ffccb3fbd87ee1750a0e0fc6a72efcf1631d9809af83bde087285a62aa816c38ffe7b
- SSDEEP 192:OrB1EgiV9vujNUxJVatp+6ak/Ibt/q0URWLFI3:OrB1EgpAbt/Zu
- TLSH
  T1EC12B600E527BAD9F11B89B9D3FD3917ADB266ED03110728A1738339ABCC997494125E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  META-INF/manifest.xml
- Size 549B
- SHA256 4ecbe77a4edc9b4c49bafd9582212911c84e9788d5483b2b08bc227e086bccd2
- MD5 996f17c8648072015c10f4c0caa2a0e6
- SHA1 9bd8b0b1214f6d52bd6627b8a8fbd778fb977f63
- SHA512 5965fec044cc29aa204e8790d5398e676f5e70d321c55372b67d03508b86ad61aa344dc3a7d690b2ff6df88e90b52c4630982806f32b4f271718458e96230760
- TLSH
  T1CCF0F6708FC2EDC5B44F1FD0831C00AF722EA28D5202879C69983A9E718742219F1FB8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10
- Target
  Thumbnails/thumbnail.png
- Size 2KB
- SHA256 7e681ef4c13c83a9d620aea044e7af89ef0a2b5cda920edb36e3d4ee39639e5d
- MD5 689324081a1c0081f8de2560b0ea6bd2
- SHA1 45699a9fbe0dae0965f824a6345caef1e2351783
- SHA512 8acd2f63f2bae43e903e6d88067b36eb2e9681fd54736878d64fb29512c5864602e91f16abd27790e524e16d44883ffd02c70545b4583cca1c5bc90a33de332b
- TLSH
  T1FE51EA513897A0E13E1FB56FE51F2D128EE1737CB6678900407B83A58BC536B2F9906A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11
- Target
  content.xml
- Size 666B
- SHA256 3f784a68c831536d993b1e1248650031b41f3177481c882343ced4e9103d1624
- MD5 854cbfafb3639e9009e1b84ac90b9cdb
- SHA1 d7f39cf0b95f85a7e02d3cb8d89f6354074641df
- SHA512 d5fbfa1532466850cb9c86f39e36a69d795155d791c485cb3b436058913044a76be4003443422128fbe0262b79ac1134ec12f5843e20b278193428341ea02a0c
- TLSH
  T15F01DD0CC23A2854A33BCF8123F8E84ABB93D29E04CD1DDEA6D1041D95325C25282788
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral12
- Target
  meta.xml
- Size 397B
- SHA256 b21057056954e312a7337ac40418a3bb2c6897583e17949d8f57aa5c5f879f27
- MD5 a7629e08491281e62ba17b87aaa2f3df
- SHA1 588dc7ffb1e7db0b3c69d4d23950315840349b19
- SHA512 84f08149179b0c31df2f685554aa0822d253a5416d98a5b0cb3b9e70de78cf0cecadd6f16667e2b0722060e9edf6b92204a116e3b8333603d106fd1d2c066951
- TLSH
  T16FE061681055D1A131532EFC5759444D43FEA3FCC4004C8C6C7BAB78E7134CE0957427
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13
- Target
  styles.xml
- Size 4KB
- SHA256 55d67622e0beb67f77f652d31746360025284202ba0a7f522664ad30d4c39ff7
- MD5 27a73bb806b21ae9270ab765cd0ab84c
- SHA1 26a6a5c51a45e6daa273cac742148a351e338997
- SHA512 004e2cc21b45199fe653b63c2da7eb69139d1f13d2058d0797ca90ae6aca634708c9a61e72008613362ca8df3fb7731f01aaa5db47b56c4fac75534d2682e824
- SSDEEP 96:5iVQClfYp4Nt40YjsAY5GIwYvAY9vsNUosEYWT8OwJVDWtp+s:5iV9vujNUxJVatp+s
- TLSH
  T1EE912F04E135AF5EA01388ADA3F87767AC725DEA07242738F2B1D736B91CD96840135F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral14
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/Screens & Proofs/Thumbs.db
- Size 55KB
- SHA256 4b1d3cc3fc64cb9c030f75c660193508141258f390c9f1539d23476adf573c45
- MD5 cf97d73542a03e67626bdcc3707aa030
- SHA1 c4b3251519b2baf531c99a59d2d803f83cf54e57
- SHA512 8a509dbaf1f07c6150f90bf0ae15a89a168da32952c4dcae090ab08f1c910cf47f30c38b5de66867c39c6de98d07631cd1c69a410d8fa039df560de14c615e13
- SSDEEP 768:1x3Li6vpsfiSnDTxGag4aPnNmtDM4rCxqGfdmrxehl5ZVKa9aurSq/2Z5m:1NLi6vqffnvxGaSPNmtAACwGVmdeJdeq
- TLSH
  T12F43F2B25FD45EB8F609EA329DF9CC0CAB15BD8AAE42834ACCE43F558834452561251F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/Setup.exe
- Size 155.1MB
- SHA256 15cf7975bfdb990298d97e50cc597472748528dce76a7d7e0336e0666671eaf8
- MD5 b6510f58e5fb69e515fa7d72718e0ec1
- SHA1 430c81316259ccf3030452282a79436ccaded1b0
- SHA512 60cd1b29553746a42479a04bf5621f7cbbab4e29c52779923d260dc7716b64351bdece70c88a161b55877350e0ebe4f76c6c516a70bc65d124ad3acbbe641693
- SSDEEP 3145728:Yvw76K57e6V3Xe774HWeJhtluzgnpQ3RVL7x3uQhZgZ6IA6zdbZhuq5o:Ow157e6VneoTJhtGgO3R58ZDA6zdlUOo
- TLSH
  T14F7833A297681AF2E2CD513B0999E1A5BD8F375C46E4085D2FAEF2FC647087390701DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery installer persistence privilege_escalation ransomware
- Modifies firewall policy service
  defense_evasion
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral16
- Target
  XMind Pro 8 Pro 3.7.4 Build 201709040350 + serial - Crackingpatching.com/Share Files, Pictures & Videos- No Wait, High Speed Download.URL
- Size 206B
- SHA256 cfc498a8252f56ee4e409309b3ca4df29a94bdefae4858f48e0b05ee800c7e2c
- MD5 e124bdb2389d49c83c628142d57c4d80
- SHA1 7126c17c77df499bfdc7d48d91997ef0521a128c
- SHA512 2aee16432066f2a3fe13f410589c4ff466b9f63f3ab108db8d60629989d161e587489863faac08829c36d09bbb338ef64f71a7e82d9bc29bbc832fff0c302559
- TLSH
  T16AD022294B5880ECC202490BA0B8FC5CA80E301548EBC289B2E8CD9A5C490A2CC48E71
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17