03c978f224dc60982149808dde2a50377611eccc5ce6bc1a15fe99fe5cc320fd

Sharing

Copy URL Twitter E-mail

General

Target
Lossless-Scaling-SteamRIP.com.rar
Size 98.1MB
Sample260626-emkc8shw3m
SHA256 03c978f224dc60982149808dde2a50377611eccc5ce6bc1a15fe99fe5cc320fd
MD5 479ee4e06e8a1fac87c21a08e7fea8c0
SHA1 a5647680793b9609fa54e6ded97277e6a2955d9a
SHA512 b884174f7a7c7eb2492257ebf3b328085577aff0d7b23c78034daa395850c20f23d551745ffa5ac3fea882b37b23c73568f96024186d56277f6cc018c73cd21a
SSDEEP 3145728:zSUZa8FjTzsaHjmx7Oa9MmV7OZ5tDHaFOuHk:zSUZaOvzp69OIqftQOuE
TLSH
T16438337BA395A8329DA336330E9DE4DDACF644429D62208DD062B4746ED15E4CE3CED3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lossless-Scaling-SteamRIP.com.rar
- Size 98.1MB
- SHA256 03c978f224dc60982149808dde2a50377611eccc5ce6bc1a15fe99fe5cc320fd
- MD5 479ee4e06e8a1fac87c21a08e7fea8c0
- SHA1 a5647680793b9609fa54e6ded97277e6a2955d9a
- SHA512 b884174f7a7c7eb2492257ebf3b328085577aff0d7b23c78034daa395850c20f23d551745ffa5ac3fea882b37b23c73568f96024186d56277f6cc018c73cd21a
- SSDEEP 3145728:zSUZa8FjTzsaHjmx7Oa9MmV7OZ5tDHaFOuHk:zSUZaOvzp69OIqftQOuE
- TLSH
  T16438337BA395A8329DA336330E9DE4DDACF644429D62208DD062B4746ED15E4CE3CED3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Lossless Scaling/LosslessScaling.dll
- Size 163KB
- SHA256 c5b6ca75d1eb4c67eba44a4acb7446b47239f4617d26ec3df5c85d482e2dc4ec
- MD5 0d4b7344b95a95ea5aa4bda38f376a85
- SHA1 e0c670638637be238148d176acb41d10e8bd7fcf
- SHA512 08d697d753f25383894a44450f62e5f113dd46c82249532b0b9761c36cce8e5f73926e5b0e5a55fc4edb056b755049713c3cb564fb3b9d7663013ce892f05700
- SSDEEP 3072:jJJx4keNySamqF7sk0L+VLNRYU0rVJmqXJ/+1NrD+caMNTYG693:jJJx4keNyLF7sk2U0rVEqXJ/KD+yTq
- TLSH
  T1B5F36D1677BC093FE5B74BB6241022150BBB7B8B1211EA8E6C6A74CFAD877414362773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Lossless Scaling/LosslessScaling.exe
- Size 154KB
- SHA256 f63e7106e27b40c69d1474adc48967608622611eb15cab515c6ce6feecc037d1
- MD5 ac3ac2955a8c7df0c98cc6dc32b226ef
- SHA1 1ca3f9a4d7d01c9ce2dc239363c7c39334d926c5
- SHA512 c4273f502b629ff5908bccca1bd0e49dd30268a9007d6666a371e2759f9ad5f35f8d3bcf51bd96f781eb011ac52134d6bbb00da56a099d67178cc18bc26e6149
- SSDEEP 3072:i9rMW83f4Mai9dMzhj0Whrnd6eiO5Qsd35NpejAJx3hp5JmmgrjFC693:yAWSf4M9lurnd35qAJxRp5JmNf7
- TLSH
  T1EFF32A43B2A811FDE1B7A37889625A01F7B7B829077193CF1350897A1F67BD09E7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Lossless Scaling/_Lossless Scaling - Registry Fix (Run this first).reg
- Size 120B
- SHA256 61df13bae98f10c330a751875146dd81bca223036d6470ebb9fffdc0b47f0fe2
- MD5 a95106d7c9fc3fb18a2fbe1885de09dd
- SHA1 3debdeee76208de099b80eff33949371f02bf575
- SHA512 d81d70466f4ff81111d2a9d0a63cc7371d75568b1a1c5fe0aef638742cef30c92cddc20b22683d3fb32331d328dba57005a3698569e9edb10d1fc63ff29718b2
- TLSH
  T179B092A4281295A2D2C43B415A0379A326D533AA7CDA09D0569950D03AC288A032A0AE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Lossless Scaling/createdump.exe
- Size 60KB
- SHA256 3dae14e357539fd731c0db1e6b0370f38c53b94a34af38ee8337db9585737aa5
- MD5 2ec36cd5acfc48fa57665fb1d8c2dad7
- SHA1 2e65c11e4cebf74dca9c7eb318bd8ba708727702
- SHA512 5a7ec1432fe5485a38f5135adbfd673307ac4736d9a366d0a8c87a63d391c34fa6616fc0373914356a8d277d14bac5ee347b5051d56385cb544086c908130fa5
- SSDEEP 768:KSuJ4LzaUVGwT/ENgdaLnlS8u13PWG01Ekks33HDXljQtax6dR7in9zkp:KSuJ8VINRLnl73HDX5Qcx6u9zC
- TLSH
  T1D6538D8422EA00EEE16B41F8C1F35607F979F81217E096DF0BA482191F637D19E3EB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  _CommonRedist/VisualCppRedist_AIO_x86_x64.exe
- Size 30.1MB
- SHA256 3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23
- MD5 1a7523d92b573859df4cbe8e75509b9e
- SHA1 65b0ccf1fe1f23c4a0557b8a30251cc7e70a1f73
- SHA512 f7c684c00265402876a4159869774096090c7482358fa1882a50468c89483c9a30066667418d510dcc5b9780fbdfd1bcc6672f92ec53cb933c0b36292c6ec40b
- SSDEEP 786432:4JVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCa:gjOLXelIMjJwi0wMVW6n7ShYWCa
- TLSH
  T10E6733B51858C4B8E7E0B1F00807F5E1769AF9BCE9C5CC46B1F4BC99A19E4618FE612C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  _CommonRedist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  _CommonRedist/dxwebsetup.exe
- Size 288KB
- SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- MD5 2cbd6ad183914a0c554f0739069e77d7
- SHA1 7bf35f2afca666078db35ca95130beb2e3782212
- SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
- TLSH
  T19654F15197E4817BE4FA1B311DF2025327797DE86CB9E32E838658881D71780BE35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence adware ransomware spyware
- Adds Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral17 behavioral18
- Target
  _CommonRedist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 47260420773a20443fb1e38a89b7f39c5237a80a842de598e6c8f7f90a3bbd6d
- MD5 ff1c0202ab7147c9dfd34b582f1da13f
- SHA1 5fc95a9ad87a38e71a953af116fd1f1cbe46a3e7
- SHA512 9a233fd33fa535d0783ac4a97108166b860d7647998ce184e6e5103200a6c8522a5e4d035b85e02280f5176c092e0d3e61a60f228d7ca17f09fcf2fc5cdf5253
- SSDEEP 98304:synfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:sYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1D06622A2751AFF41DDB406FCD970CA490925CF3B82274C686929356A7BF7E0202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral19 behavioral20