0e6367229b8dd73641b067e69012831ff02a972bfecd96d9f19ae2db04c6b4c5

General

Target
Tools_Unlock.zip
Size 138.9MB
Sample260626-resqvscy5p
SHA256 0e6367229b8dd73641b067e69012831ff02a972bfecd96d9f19ae2db04c6b4c5
MD5 c0e23edf26af39f93df735180e76976f
SHA1 a989d47fa650bb3881b314bb8a605a5a1251a92f
SHA512 94d1ab2b2d01aef085a318a40f1321a3d220dc1d47af26483d2ce2c40d6e585adac9d108230910be1d8ab0fe896dceae2b043b6d384613d84bfb17433615cac1
SSDEEP 3145728:79nZDw5o3/w0+vUNdRnOcMyBtfGu+7ZGQPkTYA:7dZDw5ovw0+vUNvnhTTanPkX
TLSH
T15968332B6F96A8BC01D53EB070949F168732D1FA6128C1A0C23F98DED75D577AF67820
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Tools_Unlock.zip
- Size 138.9MB
- SHA256 0e6367229b8dd73641b067e69012831ff02a972bfecd96d9f19ae2db04c6b4c5
- MD5 c0e23edf26af39f93df735180e76976f
- SHA1 a989d47fa650bb3881b314bb8a605a5a1251a92f
- SHA512 94d1ab2b2d01aef085a318a40f1321a3d220dc1d47af26483d2ce2c40d6e585adac9d108230910be1d8ab0fe896dceae2b043b6d384613d84bfb17433615cac1
- SSDEEP 3145728:79nZDw5o3/w0+vUNdRnOcMyBtfGu+7ZGQPkTYA:7dZDw5ovw0+vUNvnhTTanPkX
- TLSH
  T15968332B6F96A8BC01D53EB070949F168732D1FA6128C1A0C23F98DED75D577AF67820
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware credential_access discovery ransomware spyware stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Manual.txt
- Size 552B
- SHA256 90daf98a85adb6bfd5959c6fdf60dee72396a4d7e5feb0d4eeaa87a274043cc9
- MD5 67e9cd0ad82186ab52b95f4db1ca4ca0
- SHA1 d29ae327692e3cc6e89d0719b0dd510d267427a6
- SHA512 8939d8a29d21df05d65a5ed08785d5746fef4544fcd2e543e32f870e2cbe8b7cb67741d9af6ee48c6d3360951fe6a68d6a37a850b94d15fcbc4422cefe5a7d37
- TLSH
  T1D4F0819D0AC3023734B50977365A9AC1D110983955B7C1401FAD4114B27DED38BC14AE
- MD5 SHA1 SHA512 TLSH
Score

6^/10

ransomware discovery persistence
- Drops desktop.ini file(s)
behavioral3 behavioral4
- Target
  Tools_UnlockPro.rar
- Size 138.9MB
- SHA256 0db38213d13cb670d5679ea98ffd87a6d5cd52712490f18a3b428f23bd7f4977
- MD5 6b110b0256e7c4ce5880711ffead53c5
- SHA1 cfd1ec4639594de37eb23bf2cc478bd39360951b
- SHA512 4faa1ac3b57a92f696463f6b719f66dcdbd66aecf35380f4acd5609a2936e814fd778baede9608431fcca0eff50c3c03344ec4765215f222f7713c75a85046be
- SSDEEP 3145728:H9nZDw5o3/w0+vUNdRnOcMyBtfGu+7ZGQPkTYg:HdZDw5ovw0+vUNvnhTTanPkR
- TLSH
  T1C068332B6F96A8BC01D53EB070949F168732D1FA6128C1A0C23F98DED75D577AF67820
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery ransomware spyware stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6