8f446760e86d7fdab04f07fdeaa3e90a53a0b77baae56b25b01063d8a1aa5a12

Sharing

Copy URL Twitter E-mail

General

Target
Crack-17.1 @GsmTubee.rar
Size 105.6MB
Sample260626-ncejnsbw2n
SHA256 8f446760e86d7fdab04f07fdeaa3e90a53a0b77baae56b25b01063d8a1aa5a12
MD5 719c027bdb324388389a4fab308073a2
SHA1 855fa8b0ccf50d949c19b94d35f413b3bf65ef22
SHA512 8d880fe3f95deecdf49489e178110d9eabcc7fb51bec1b68ab8e6d10ff8acc3fdea2b45f707b07723b2b700cc9cc76c0bd895fde3dde545b260c284d94582b10
SSDEEP 1572864:i2EYEEIxE4G13PXu4SVZQWmNYoQmOBXte7M2dTyKnYrG/y1Fasxuzu7suaNQvkn5:AyI24s7SfQDZ+tUdTzUlaUuzPuaC4
TLSH
T19238336970F99D2DD748A02B47A3C780B3F83777A9D4E76273C8C9A4E183696484CDD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Crack-17.1 @GsmTubee.rar
- Size 105.6MB
- SHA256 8f446760e86d7fdab04f07fdeaa3e90a53a0b77baae56b25b01063d8a1aa5a12
- MD5 719c027bdb324388389a4fab308073a2
- SHA1 855fa8b0ccf50d949c19b94d35f413b3bf65ef22
- SHA512 8d880fe3f95deecdf49489e178110d9eabcc7fb51bec1b68ab8e6d10ff8acc3fdea2b45f707b07723b2b700cc9cc76c0bd895fde3dde545b260c284d94582b10
- SSDEEP 1572864:i2EYEEIxE4G13PXu4SVZQWmNYoQmOBXte7M2dTyKnYrG/y1Fasxuzu7suaNQvkn5:AyI24s7SfQDZ+tUdTzUlaUuzPuaC4
- TLSH
  T19238336970F99D2DD748A02B47A3C780B3F83777A9D4E76273C8C9A4E183696484CDD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Crack-17.1 @GsmTubee/CKEngine.dll
- Size 14.9MB
- SHA256 2104d5c346d178109b8041a757e4e0f1bb68daeab28d1a6a0a313358933af76a
- MD5 1b35ddb74dd3fecdd1e7cf8d56f0f66c
- SHA1 f2fac92dbd1a8f44553ed315873dc5744e5daf07
- SHA512 ddb28f41a6a2c84773fa35517c37f0aac82d89a67a66da8ca013ff2ed2f2c2dbfacb1eea551ed0458342eddeeb717c2e1b93c8740f01d5f470d13de8d565e8cf
- SSDEEP 393216:OK4sPV4WDtdjR2XhrwQc3VjxVsMeFsvZ6uWj0FBgkPc9LVpZ:OKPiWDbj4X23VVspWguWon+9RH
- TLSH
  T16AF633D17ECAA298C093CF3173878359B2E7B7CD03BD4B1D3ACA6C157620E064B6556A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  Crack-17.1 @GsmTubee/CKEngine_.dll
- Size 6.0MB
- SHA256 e7d49d0f0a74a0a734afc419290015a2c2229bb7adc13fd40ce0eb79644e6055
- MD5 83b0aa718fc8d2d6f20185747c7efd03
- SHA1 0d8818539773e857bd65a0c2586c4f11443394af
- SHA512 48f7850f0a4cd3006d769cfb10365ffe3b13581aabe4cadaa0f69a7b50d87f557e237d6043fe47b81bd55056568a5ca92d4fac963ec7c6bea5b6e24e9322ceb6
- SSDEEP 98304:mF+4wYNeVVsbRkApkczQA/kBUcXYZiGGE2T1AKJSo94RSqpuXuRClrSlQPqbHht3:rRP9DIN/cXO2T9JSoak0BYbYHhtCyb
- TLSH
  T10C5633A244E0BED2D66673F1AD5328488A35BD311E865635F07F4BA04F5B30DCFB22A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6
- Target
  Crack-17.1 @GsmTubee/DeviceExtractor/libcrypto-1_1-x64.dll
- Size 3.3MB
- SHA256 712b577da41b68c5669d107f077a776d4cb30ed7b49bddc3cf5ed5dead78895f
- MD5 351e132b8252645b2b1ae2736c0db4eb
- SHA1 f18a4bcd8b1340cb1afd0482ca8514daf60bea86
- SHA512 9fb03f00988df783ef15e9c6a1bb60491b9be50d09de0ee2141f0565ee58d8cad995724118d8e5164fdacf98410742a2d681125cbcb1c055f101ade63025584e
- SSDEEP 98304:G1+5pViOCso4G5D48T1CPwDv3uFfJcWX:mmpViOCshG5tT1CPwDv3uFfJvX
- TLSH
  T1BCF57C5AA7AC1194E5BAC17CC9574737E3B1B81A87B05BCF08A6C1780F27BD6263DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  Crack-17.1 @GsmTubee/DeviceExtractor/winspool.drv
- Size 11.7MB
- SHA256 44a33e74d957d033f66837be7887ad07850e1906eabe0850d171cab03f426dae
- MD5 550b60ad31b19eb8ffac8e5b9d584d09
- SHA1 7a11afd43e98e2602407df5196bfa85979e8c6ab
- SHA512 24f38a473f94cc8d543a689163838c80ffb2da26299a44269bd9a281a12597dc54e174ee864e7d309cda7d8663eccc65df6cbd1ef7dc4c71589c2f7a6e19767a
- SSDEEP 196608:7dloYrf6Bt7eAg6IE5BoracxeXiVonPLZqEVYkVvh5ZUlTxW/KJDT+AJ+V/kn:7dl1WBt7e4BgFaiEVv/VpcUGY
- TLSH
  T1B9C623DD46A982B0D0D30210B54B438A7885E68D82FD5C293DD62C467B1CDBF658EFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  Crack-17.1 @GsmTubee/Maps/libcrypto-1_1-x64.dll
- Size 3.3MB
- SHA256 712b577da41b68c5669d107f077a776d4cb30ed7b49bddc3cf5ed5dead78895f
- MD5 351e132b8252645b2b1ae2736c0db4eb
- SHA1 f18a4bcd8b1340cb1afd0482ca8514daf60bea86
- SHA512 9fb03f00988df783ef15e9c6a1bb60491b9be50d09de0ee2141f0565ee58d8cad995724118d8e5164fdacf98410742a2d681125cbcb1c055f101ade63025584e
- SSDEEP 98304:G1+5pViOCso4G5D48T1CPwDv3uFfJcWX:mmpViOCshG5tT1CPwDv3uFfJvX
- TLSH
  T1BCF57C5AA7AC1194E5BAC17CC9574737E3B1B81A87B05BCF08A6C1780F27BD6263DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12
- Target
  Crack-17.1 @GsmTubee/Maps/winspool.drv
- Size 11.7MB
- SHA256 44a33e74d957d033f66837be7887ad07850e1906eabe0850d171cab03f426dae
- MD5 550b60ad31b19eb8ffac8e5b9d584d09
- SHA1 7a11afd43e98e2602407df5196bfa85979e8c6ab
- SHA512 24f38a473f94cc8d543a689163838c80ffb2da26299a44269bd9a281a12597dc54e174ee864e7d309cda7d8663eccc65df6cbd1ef7dc4c71589c2f7a6e19767a
- SSDEEP 196608:7dloYrf6Bt7eAg6IE5BoracxeXiVonPLZqEVYkVvh5ZUlTxW/KJDT+AJ+V/kn:7dl1WBt7e4BgFaiEVv/VpcUGY
- TLSH
  T1B9C623DD46A982B0D0D30210B54B438A7885E68D82FD5C293DD62C467B1CDBF658EFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13 behavioral14
- Target
  Crack-17.1 @GsmTubee/OFEC/CKEngine.dll
- Size 14.9MB
- SHA256 2104d5c346d178109b8041a757e4e0f1bb68daeab28d1a6a0a313358933af76a
- MD5 1b35ddb74dd3fecdd1e7cf8d56f0f66c
- SHA1 f2fac92dbd1a8f44553ed315873dc5744e5daf07
- SHA512 ddb28f41a6a2c84773fa35517c37f0aac82d89a67a66da8ca013ff2ed2f2c2dbfacb1eea551ed0458342eddeeb717c2e1b93c8740f01d5f470d13de8d565e8cf
- SSDEEP 393216:OK4sPV4WDtdjR2XhrwQc3VjxVsMeFsvZ6uWj0FBgkPc9LVpZ:OKPiWDbj4X23VVspWguWon+9RH
- TLSH
  T16AF633D17ECAA298C093CF3173878359B2E7B7CD03BD4B1D3ACA6C157620E064B6556A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral15 behavioral16
- Target
  Crack-17.1 @GsmTubee/OFEC/CKEngine_.dll
- Size 6.0MB
- SHA256 e7d49d0f0a74a0a734afc419290015a2c2229bb7adc13fd40ce0eb79644e6055
- MD5 83b0aa718fc8d2d6f20185747c7efd03
- SHA1 0d8818539773e857bd65a0c2586c4f11443394af
- SHA512 48f7850f0a4cd3006d769cfb10365ffe3b13581aabe4cadaa0f69a7b50d87f557e237d6043fe47b81bd55056568a5ca92d4fac963ec7c6bea5b6e24e9322ceb6
- SSDEEP 98304:mF+4wYNeVVsbRkApkczQA/kBUcXYZiGGE2T1AKJSo94RSqpuXuRClrSlQPqbHht3:rRP9DIN/cXO2T9JSoak0BYbYHhtCyb
- TLSH
  T10C5633A244E0BED2D66673F1AD5328488A35BD311E865635F07F4BA04F5B30DCFB22A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral17 behavioral18
- Target
  Crack-17.1 @GsmTubee/OFEC/winspool.drv
- Size 11.7MB
- SHA256 44a33e74d957d033f66837be7887ad07850e1906eabe0850d171cab03f426dae
- MD5 550b60ad31b19eb8ffac8e5b9d584d09
- SHA1 7a11afd43e98e2602407df5196bfa85979e8c6ab
- SHA512 24f38a473f94cc8d543a689163838c80ffb2da26299a44269bd9a281a12597dc54e174ee864e7d309cda7d8663eccc65df6cbd1ef7dc4c71589c2f7a6e19767a
- SSDEEP 196608:7dloYrf6Bt7eAg6IE5BoracxeXiVonPLZqEVYkVvh5ZUlTxW/KJDT+AJ+V/kn:7dl1WBt7e4BgFaiEVv/VpcUGY
- TLSH
  T1B9C623DD46A982B0D0D30210B54B438A7885E68D82FD5C293DD62C467B1CDBF658EFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral19 behavioral20
- Target
  Crack-17.1 @GsmTubee/OxyCheck64.dll
- Size 14.9MB
- SHA256 de704a58e6eab40bb7bf3431714508c1eed4ee8ebf67016f859cac9eaab6da35
- MD5 7954441996c881b5c898044eccc5816f
- SHA1 9238f78f5f234ee235f4fcd1eeb505017da4549d
- SHA512 b3d14ccb2c8343e09cfa23999b1f9c1ed173fa09584da6ce0a164a4563259886c47d8ab45ff84e20bd410caa831bf45aeeb05a0b0810c55cd3eea145c8154fb8
- SSDEEP 393216:EdgwtGGhNaV0GeM/guUBRJZ4Ccitbnam/DXE:EdgwtVhSzxgZ4Cbamw
- TLSH
  T169F633D13FC79398C0D7DF3132C6526AB2E277CC43BD8D0A36C6AC46B661D170A5A52A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral21 behavioral22
- Target
  Crack-17.1 @GsmTubee/OxyCheck64_.dll
- Size 8.5MB
- SHA256 ce89510ae5399abde81bf330a10ee2e03488797c23a6404fef2240ce709c9da8
- MD5 edd8d6bb5983dad09b1234b71a8a02b6
- SHA1 c26b08609164793b8f81648a9be63069a9b85b93
- SHA512 a5105ca62469329d4183aba0773dbd540d8c919ab599c504635206c197d2662ff79b5f403cdf768a9f0c9627cf5d5833f8b01f78300c881fff2bd2278ebf8df1
- SSDEEP 196608:S0a/hI14Q8ounOyCSyGewjyrPXRDN775LugUt1fji6DkrY:SxJIqQnunJjyLr78Pf+prY
- TLSH
  T1BB9633A311D0BED2E572A7F2FD1228848562B9760D811264F03F0BE64EC775DDBF2A85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion adware persistence ransomware spyware
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral23 behavioral24
- Target
  Crack-17.1 @GsmTubee/winspool.drv
- Size 11.7MB
- SHA256 44a33e74d957d033f66837be7887ad07850e1906eabe0850d171cab03f426dae
- MD5 550b60ad31b19eb8ffac8e5b9d584d09
- SHA1 7a11afd43e98e2602407df5196bfa85979e8c6ab
- SHA512 24f38a473f94cc8d543a689163838c80ffb2da26299a44269bd9a281a12597dc54e174ee864e7d309cda7d8663eccc65df6cbd1ef7dc4c71589c2f7a6e19767a
- SSDEEP 196608:7dloYrf6Bt7eAg6IE5BoracxeXiVonPLZqEVYkVvh5ZUlTxW/KJDT+AJ+V/kn:7dl1WBt7e4BgFaiEVv/VpcUGY
- TLSH
  T1B9C623DD46A982B0D0D30210B54B438A7885E68D82FD5C293DD62C467B1CDBF658EFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26