b54a90b62b6e3cd3de5227707ad327455ac975c75a2fecd51343c58347c11183

Sharing

Copy URL Twitter E-mail

General

Target
DVREMU2 Manager.zip
Size 2.5MB
Sample260626-rd1ebabz5s
SHA256 b54a90b62b6e3cd3de5227707ad327455ac975c75a2fecd51343c58347c11183
MD5 9ff10934b9f693d97eddaede81c3f7c0
SHA1 772e63f70dd1988410e080a3f4e432173978ccae
SHA512 5d0d812ad25615100569163a352f1f6e1bf13773b8e4a226f5589f20bebf3959438f4b056e41efb85f3028ddf3931639cf8a6b085e3729ad60e2c1b3e6b5b81d
SSDEEP 49152:B3AQI6qrdPQKZBGHkX4Owp29irIB/Z9nsLrJ96VEG50PIkFO0+gLampn:B39yrdPQKvGEX4Owp29iMB/n8SVPWIkb
TLSH
T1D7C53315A24220DBF6DD48B06E733E2669217D77145844B000C7EEE183EB9E66ACFFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DVREMU2 Manager.zip
- Size 2.5MB
- SHA256 b54a90b62b6e3cd3de5227707ad327455ac975c75a2fecd51343c58347c11183
- MD5 9ff10934b9f693d97eddaede81c3f7c0
- SHA1 772e63f70dd1988410e080a3f4e432173978ccae
- SHA512 5d0d812ad25615100569163a352f1f6e1bf13773b8e4a226f5589f20bebf3959438f4b056e41efb85f3028ddf3931639cf8a6b085e3729ad60e2c1b3e6b5b81d
- SSDEEP 49152:B3AQI6qrdPQKZBGHkX4Owp29irIB/Z9nsLrJ96VEG50PIkFO0+gLampn:B39yrdPQKvGEX4Owp29iMB/n8SVPWIkb
- TLSH
  T1D7C53315A24220DBF6DD48B06E733E2669217D77145844B000C7EEE183EB9E66ACFFD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DVREMU2 Manager/DVREMU2MAN.exe
- Size 102KB
- SHA256 2083beb78b4ceba4a8fe819ed2307b4c0a22622f32caea60fcea7de0bcbd76b8
- MD5 2a052d9b7bdd115e24b7bc4b8475edce
- SHA1 2018370cf1cb6e8fdefab2444c086bc98a39e99a
- SHA512 85eab43585c93fcd2456593beca8664f74c22203baab67aac284cf34220be109aa4a7e71da795617d39d7f4a09c68e8452901be3f277a5f73f96661e64812348
- SSDEEP 1536:o4nrdWYUBkBxcnUcshYlRYE3wD06YUCfyJwH8Aa5vCWVpqTet2YVFfcMP0:LdWSBxcn+Yl3L6YcJwHpa8WXqE4
- TLSH
  T1F9A3F14B9F61CAF8F5B0817B55A2463FF165B0C246A15F0F3AF688480E39B41FB5A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s)
behavioral3 behavioral4
- Target
  DVREMU2 Manager/Readme.txt
- Size 2KB
- SHA256 632e2772f9536a30dda7e1f61f267ccec1aac7dd5f568260377c0573570a32a8
- MD5 0de76ea95b6ecf3866d834fa1b078018
- SHA1 69848f81de145ee8f2c5466aa87e6b7278018da7
- SHA512 1c10ae889dbdad83b9bc135d2c1adc6de988d502624c2a3cf3cc08639bc3f07959a5ccecf4c5dd1a8e1f1581457ebe11a03b06493bc59052d54d967c104e6f6f
- TLSH
  T12441219F6EB5D33A1E51F3CF644FA5A5E758E49983BE610278DB4008320A4A3036E1F9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DVREMU2 Manager/commands/DVREMU2 - Install Emulator.cmd
- Size 22B
- SHA256 9c5465254c6ecc96177657bc039f33eef1b8f99f6349187566e6e4d1f5cd0c89
- MD5 74d85c83cdbe109e9972b8db37e30492
- SHA1 ac1e0fc13472c74dc11f394e87ec71645fec849d
- SHA512 0ae790756f03e1cb2d66493f451fc7c4500f9fb181f30596b4c96a1ff2d9be44437c42ffc79d4709b6c7677e10813f55ec4b303eecd2b006abc0b4629c998cd8
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  DVREMU2 Manager/commands/DVREMU2 - Renew Emulator License.cmd
- Size 20B
- SHA256 d941aaf2e03be3eab4670f34e0de05bcdfbe622674779a093a91ca500e98ce71
- MD5 cd55db859b9c6f1811d72ac4dd793356
- SHA1 c45bd9d9319192f80a1975b21c4b974a5602d926
- SHA512 a55528c377d02c0959a2cc35a64d167318c9160ed2ed042d14ddc3990883bb73df4214f6f52aeb30418d5034aef4daaa3bbc54d5960cc237d70ca6636851e5a2
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  DVREMU2 Manager/commands/DVREMU2 - Test License and Emulator.cmd
- Size 19B
- SHA256 4514aa7e9b6114da0a3b0b985a9107f5184de99f9f822ff13d2204263c373b0e
- MD5 509354ede1a8e4dc9387f8f1d2cb874f
- SHA1 8dff15d78bb16741dcc873633ab19cd9f4ba6fd0
- SHA512 f68430b69d4f60c4e6125d60324438674051fdd75fd1c5b61edc0aab59df08f8ca261611d3939adf454267c6d829c9fe49b0e91a7e68eb6d23ba4739c9d628e3
- MD5 SHA1 SHA512
Score

1^/10
behavioral11 behavioral12
- Target
  DVREMU2 Manager/commands/DVREMU2 - Use Shared VCRuntime.cmd
- Size 26B
- SHA256 4cac1bfb65a43e2fa9c95d7431dc20a4e204f3d407200be04929684ba9d8f0c0
- MD5 ad5d2c4dd94af587a27fe87fdaee24cf
- SHA1 6f94942c4576fc187031964565610a880a14083b
- SHA512 29fd0a87f6ec110ff75035837438d73d18007d1176528dcbf9688f979c2429d206e99f4709c7205807228fdffe4864d5ff737ca9e32eb1565c25d2bfc8d0a91a
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14
- Target
  DVREMU2 Manager/libbz2.dll
- Size 69KB
- SHA256 57d9cb6e10ba90a3b8e9c2b2eab2b80937b088123adb482eab71ef550cce7794
- MD5 b6c39ab833a3bc29183d0633bb9421ab
- SHA1 304a8ae9e4668625571301acfa9e14c7a89a469c
- SHA512 f5fcc0e9a92499b316ce8b65e583a9329e519a61c87d482283305ce1db88d6a109197c427e431bf39dfcba8e30181937300da15b287f5e663e7807d999a6fdc8
- SSDEEP 768:YOK4+beCw4Iuc9QfwE/JE16O2RQg/Nr0t9PdFmphy5rn2g6///////5iHFN23AGI:g4+yCNIuT7SN2RhCtrouBHX82p
- TLSH
  T184634C82D7A26FAFC45342B9A206D90FE3727CA803717ACB4260F63D1741BF52579786
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  DVREMU2 Manager/libcrypto-3-x64.dll
- Size 6.1MB
- SHA256 2249476a14dea73ae271d661483bdc6c15e45b931f8dbfd0bd1b84193cf420ea
- MD5 e7463d58d7aff43c7d71a3847ba8201e
- SHA1 1a030443545820af4edea017c64da1233a6177a8
- SHA512 2155a8fda32b9cb0f9029ce9fd6b418322b392523bf641b67eb885afc219a9b4942bc37292f32d190f128864b3f5830a8eee44dfc29623689bf0d5b259d0859a
- SSDEEP 98304:dP+C5HnwdCqOB1rpZtC78tPq1CPwDvt3uFGCCN:x1HnwNOLpZtC78tC1CPwDvt3uFGCC
- TLSH
  T117567BBDA67C0109E4AA91BDC3874237D271BA1953B013CF696186F90F27FD92B7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  DVREMU2 Manager/unins000.dat
- Size 11KB
- SHA256 2297553a19f3502b601456905c225701a7dac16dfa25bb8e0acfb09a10a0f41a
- MD5 b7ba273fe90b3f5227f1e6f6c010a7cd
- SHA1 cc4984d852febf1f4fe91a0910fd15d442080a54
- SHA512 b449dbc08fb938000d5212ecb9ec3ca2087296d1d33f3335a9ffca5c57763170f98d382dddfc390d79261074195008de00f998be61acfc2092780fbf5c14ec2f
- SSDEEP 192:CP0+h9jNV5PNNhsB9GJB9RA3bP4DSmLNDyFYHO:CP0QGEHA3bPILNDyFYHO
- TLSH
  T19442640C6BEC9A24F3BBE775EFB709187727BC411961C70F12D5428A0467E89DDA5322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

persistence
behavioral19 behavioral20
- Target
  DVREMU2 Manager/unins000.exe
- Size 1.2MB
- SHA256 6bdc1c8f0a1bd5951e94f575e6b693d0150d25f3b62bc7314567b2c4c3a8f009
- MD5 908f64b344bce85c344e88db0c4c334f
- SHA1 b917238e7bd8176a6bc34664fad61f95bc9b6cb0
- SHA512 9e1a4ff4a92f939f9f0ae65b3e23ebfdb1fd2d6d567fc555579abe4ba67221a91585459e017c4565b562ce85f611ff1f2cceec70bb4b74697ed1c06d26e70a0c
- SSDEEP 24576:3nbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtdqxytq:XHeKh4nqzF3PYdSto1
- TLSH
  T1E5451822A3E24437D5732E759D7BD2946C367E202EB4E44A7EF89E0C0E75B40AD35392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops desktop.ini file(s)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22