8c95efd9b5118535b84c8c4b24544cddd04d9d9c6e16fca0dd4b84baf8adf497

Sharing

Copy URL Twitter E-mail

General

Target
VueScan Pro 9.8.55 (x64) Multilingual [FileCR].zip
Size 59.6MB
Sample260627-29ykpsd15y
SHA256 8c95efd9b5118535b84c8c4b24544cddd04d9d9c6e16fca0dd4b84baf8adf497
MD5 2f9e0bad52a3e7d0bb56cda623e8ac49
SHA1 1ac92220974afa5d514f4c7bf7012c77b59420c3
SHA512 4184852f2b4b913f50476c37b42b0685fa346c23abc997dbc81d4d22cfead198d9aed06e285aae75980625de74fd77893c1d06b5efe0544be85161befc7d984b
SSDEEP 1572864:Kw4ixp46Nva39QjyeIhyAUsvhKdSuKxmNvJgOPTQE:Kw4c1va3EyVzUYRummNBgO7
TLSH
T158D73348225391CF84EFEBE31C061390ECDA58A7804FD76E9CB59D1CDD931C0AE6B666
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VueScan Pro 9.8.55 (x64) Multilingual/Patcher v1.0.zip
- Size 83KB
- SHA256 101820a75ca93a75a065900a5414eb8a08683dad73169249043d783fa098bc57
- MD5 392b45abb7b8d67c2c50e3c9e3ca9a0a
- SHA1 e1f8da3a1bfae7fc54d97cdf588625708baeb891
- SHA512 5d5fdc37d5538fc24727ca9b0f114900f84449e5b08452642a255a6c9c542c1adb67fbd5b8af65e87d7b8bf00c0a75af85bf00cc8e260f10480cd5c1e3db718b
- SSDEEP 1536:7laC2fwNXfiJTrYYVLm0sf5xOG+BnuugLiHablxXwo9yv2Hi5clm6g1C2YMx/:7laFwNPifYYVLgTUBuugLiHalxXzyUiP
- TLSH
  T125830296E6387E08D022A2B7701228E50CEC4A24CF8CF973597E39C1A5BF979359D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  VueScan KeyGen v1.1.exe
- Size 20KB
- SHA256 61196bc0fa83764e1faded3f63a5f36f4caf8d721695980f8f8057ba82a9437c
- MD5 6f043ad3e167edb6ac261374e1b8bfa8
- SHA1 8dccdbe627d70b3a56974dd3bbae58278f07b024
- SHA512 91dda6b0e2248c9c54ed9e55f36a736ea60c99b9333627a05c24c962543b1832fcd714394b13fc0ea84cb6511cc3b9e3171a1cd02cbdc21c200774f949d60934
- SSDEEP 384:uwTMhz9Mh8JmwYVwnrGcdz+xlnJaMWqGfPTO1eU5Bg:uxN9Mhmm0rbd6xbahht
- TLSH
  T1F7925B82ABE824D5E6B40537247BC1764D22BD654B35879F35CC3E0F3FB12D28A72A25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery defense_evasion persistence phishing privilege_escalation ransomware trojan
- Downloads MZ/PE file
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall
  defense_evasion
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  VueScan x64 v9.8.50.04 Patcher v1.0.exe
- Size 80KB
- SHA256 b48c24ac602e4adbba8533bbbce356320142202dcba05f6d5153e6fbde6e9c17
- MD5 5111ff0f448f1d2a866e0c29ba4c76ef
- SHA1 88852507749508b686800c6b5ec6b83c580b2213
- SHA512 6a628aa658b79f65e8f7ae19877d485b941cb72b7c4fb384d943af61d44726dc325da5ffa45a61a47806535b19f0d399355664465b0a8a220e7016be3f260e08
- SSDEEP 1536:WhN0rbd6++yal60VHJ5fa4A1vOTuugLiHablxXwo9yv2Hi5clm6g1C2YlYev:Who6ByMPVe51vOTuugLiHalxXzyUiUmd
- TLSH
  T1E783F143B9492CC5CA60643160DF04FA0E3C9C3686AD9A6B378E7DCBBFF191206B5675
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence phishing privilege_escalation trojan
- Downloads MZ/PE file
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall
  defense_evasion
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  VueScan Pro 9.8.55 (x64) Multilingual/vuex6498.exe
- Size 59.7MB
- SHA256 11a877fb9d1f21b846ca6b6e7d53bbe17c8f03ad341fcec415f0e360b09a62d1
- MD5 e0cff1f8001ad1a55bce50908ef21993
- SHA1 2577475b27e0f6ec455ccaf7f7214a0341f422a4
- SHA512 112c5422c6d14c7b22dab91e618a9c528ab89fa5944649089226edd6a4b80e36b06c88c894e5cd86f4c0d2a35eea069563bfdaf7d001ad649e9a477119fe1226
- SSDEEP 1572864:s7DS+TAPCUhi7j7YX0MP66/ZkEtbDCiv/tNaX076Uv:8DS++fk7+P66/ZtvCCtNak2G
- TLSH
  T1C8D733182D84CE96ED97413F96716003E0787C217A76E89F718A227CDA36B73ED34B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence phishing privilege_escalation
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral7 behavioral8