a5b2e6b0f8255ab3723a04b4e5e81885ebaaa6a3f65e6895a8288be8fbac3e6f

Sharing

Copy URL Twitter E-mail

General

Target
fiestanet.zip
Size 93.7MB
Sample260625-1pd5wsfv31
SHA256 a5b2e6b0f8255ab3723a04b4e5e81885ebaaa6a3f65e6895a8288be8fbac3e6f
MD5 6f8aca79a6757e5b837b9ca2bf304f34
SHA1 5bf08d93f750c57df7df3c32cde3288b8c02594c
SHA512 e4626f5e82d33aab6b7e96528220a6b45656028db3ab88e465f5787ea84240375dd5237d42f63295331e19ee6a8a071bfdc0075aa24a6bd5a211b657009dda50
SSDEEP 1572864:Pvb+nl1Ekp/WAbDT62KxsvLH0phVvs7mYyZJLdkvaXBNiGebA95ifIPZCtC8n34k:Xb+nHd6r+jUpfs7mYsBbBNiGes3iwsDd
TLSH
T14628338A4636DA1EEB75613933F602DD2772D210ECF1F4EDF28C7549BD11BA926C8242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DirectX9.0c/dxwebsetup.exe
- Size 285KB
- SHA256 34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4
- MD5 bcbb7c0cd9696068988953990ec5bd11
- SHA1 3c8243734cf43dd7bb2332ba05b58ccacfa4377c
- SHA512 551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786
- SSDEEP 6144:3WK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQ43:mcvgLARDI1KIOzOR3
- TLSH
  T13454F15197E4817BE4FA1B351DF2025327797DA8ACB9E33E938618881D70380BE75B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  DotNetFX451/NDP451-KB2858728-x86-x64-AllOS-ENU.exe
- Size 66.8MB
- SHA256 5ded8628ce233a5afa8e0efc19ad34690f05e9bb492f2ed0413508546af890fe
- MD5 607d3c9b399e3d303a1b14eb4326bd1e
- SHA1 5934dd101414bbc0b7f1ee2780d2fc8b9bec5c4d
- SHA512 7643de709ad69f2e3c92c08955e89775a92b27830e3fa153d1f8e3550acc66c6b20e472f6af13cd663bcc10470db723efce5b78ca434ff166e4d27816c5aa25f
- SSDEEP 1572864:K1taRdXCi9PO4jBpCGsbglzNoVpXTWxowYNr5d2hlD3ZE+L:ytaR9VCpsJKVlWxow43I3ZE+L
- TLSH
  T1CFE7338B8331841BDA71203533F409FD1676D910DEF1D89BB35C6B8E69227E93BE8A51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  installPackage.msi
- Size 27.2MB
- SHA256 f8a459549095931caad44198db70b4cd0ec8d5d2221c4db5542b779de0cf25eb
- MD5 a86faa2468f9b4a25955445c243efd2e
- SHA1 e6abf3ea811091bbc9c3a418abcaf2ce3c781341
- SHA512 8d286aeebe6aca0a00a05bb4e70cbf3f4a2150bf8a853546942f77f5b8f426dc4df25b7081ed7c7d27eb676426ca3a64616979df1a01f0292b4198e452149003
- SSDEEP 786432:ZrZRTw4bSBrTIapkyOasxf2IzIHskuT8bgfEp:NM4bStVdypzQskupfEp
- TLSH
  T1345733123899A935E58C1A3B45EFABFC46B67F34A4B0909576D83C0F7C326E1D268347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  setup.exe
- Size 417KB
- SHA256 57585ebf9a3508c9b72ceb366804608db884587ec5d2df549ca1dfe7598edd98
- MD5 31f09451bd8666d042066764b570a844
- SHA1 15400cb32e47b80ae1004f0a1b5de0a4011fe31d
- SHA512 8c0604144fdb74b7f37da1bbaa771e71c3bcbb56f7b4f32832fe6ac8b1c96caa809040ec86b7ede5559711dc56fe5eabc35b7649ddc59a59d91d091703a5ea91
- SSDEEP 6144:ODI8JDRdozHIjc1eBEhHE52AlOpK4sL5nEHFVeu22ZXL//3Vpb4FWaVgJp488mfo:ODzJDR6qlSKlLVr2ZXhV2
- TLSH
  T1BA94381267E89035F2B30770AB76A7A04BBEBC715D35CA1F23C4491E59B4A81FD21B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral7 behavioral8