dd1fb0275bc606c98b845651cc50e5bfd0ddd5e6b5dbf3280404f04510dc1593

General

Target
Canvas.X.Geo.20.1009.x64.rar
Size 309.5MB
Sample260625-lf2ghaay7j
SHA256 dd1fb0275bc606c98b845651cc50e5bfd0ddd5e6b5dbf3280404f04510dc1593
MD5 c68ad284de0e8a4ee410680bf9b78d28
SHA1 6082d7aad21876cd0385f6ad8b6b38a51c99970c
SHA512 830ce9a36793369091e9ce5c18b9bc0be83a05c9fa98a206f8a7b5c64bcfd0f7631b6d280bacdd841cbe5147171fecd3c0fd184431d542210aad0ce5454c054b
SSDEEP 6291456:RYmeFIwUBZcJPt46heyIkB7BQw2wNQgIIZKSrK/7ljpndrrthaf9:RYHFIwU+SImsQw2wNdPrKjlFVrtY
TLSH
T1DCF833525A785E12D7AD3AFC0524364CCB6AF7B4CDCC19527209A8640F1AC7FA4AF873
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Canvas.X.Geo.20.1009.x64/CanvasXGeo.exe
- Size 290.6MB
- SHA256 8bc2c448b77ec9aced5779d4ba12d9d198a941bd1483587e6a377857ed8f8c85
- MD5 c7c0d5e490314266786cb872bc841fac
- SHA1 eeac5ec167803faaff67cc7f60715b06068508de
- SHA512 32a0f52f1b61730d200d571d0e2b0166fca191236774f74aae605f4ae595839a8d150a3ea5c5b673e1ac33afe04fa57792ba632b8dbc370041f2571847f1c899
- SSDEEP 6291456:WWkiRRfKGCPMGHlb1t3dF2y4mQAkriIZj7N4XFOAv8g7LbIT0wo5mH5PkKo/M:wiRR/MMGHlb1FPeAkrTj7c8gHKo5m5ok
- TLSH
  T1CCE8336312A6127FE12016351D2F8C2055AABD278DBE844AF254FF786FF4450B827BDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence ransomware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Canvas.X.Geo.20.1009.x64/Crack/CanvasXGIS2020.exe
- Size 11.8MB
- SHA256 cd71ffb61dbc1e3ce2af2817d781494eff8347d633ce8ddac96f0c8ce1823247
- MD5 00aac4d9e6d1bf50dc1797fc0047bc88
- SHA1 656543936f0b43410998d0d180b1933b9df7d07f
- SHA512 f9361abcc10443a49ee59e59859e4c783b68c3d48dfbd50564ea584928d00e45364b158d1bab1d54c3ae93e3875c85da795b59651d189c781060ab9a125f09ec
- SSDEEP 196608:XfJhGX5re77cHBiVMtruEK+pMf5LkN7twsYeclO4Lmg/iLeheyTp9OAq:XhY08HUVMRunj5LkTwVM4ag/oY9u
- TLSH
  T1D3C6125B294866D8D014A4F501B3ABC923F75C99C67893573BCBB9E273FDD48E818B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery ransomware spyware
behavioral3 behavioral4
- Target
  Canvas.X.Geo.20.1009.x64/Soft98.iR.url
- Size 202B
- SHA256 cd49c8c8a991a045e07e301c17735760a6c0c4ef533882c48a7f1d9af6fc8582
- MD5 3ddf222b0633a83ecd9f4dd34f1d3fd3
- SHA1 66cd0d6b22af41cc99a87e7dda2605857f17cb37
- SHA512 ddc1d3cd6f07bc913b0907188ec03f35f4e4f7ba67072317d4c9597e90fa29843b28bb12ff95495b1e4cde4112100dff417dce8e49ea82e0fc4d9b3e3171c010
- TLSH
  T1D5D022584F08C0F4C2A3B80A50F8FC1CE80D708016EAE65862C0DECA0CA9090CC0AF72
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral5 behavioral6