98735ba025aa2bdce4fcb2ab1ad5b3d51645435c380e2de103e917cd2e7b59bb

Sharing

Copy URL Twitter E-mail

General

Target
MSS.zip
Size 60.7MB
Sample260701-ctpkescx4p
SHA256 98735ba025aa2bdce4fcb2ab1ad5b3d51645435c380e2de103e917cd2e7b59bb
MD5 e79ea5d42b37dfb1b8601bc3329a72f6
SHA1 ce9988b1a5f9085c87f22cace4e769fcc31c4a6b
SHA512 cec2854a8fdfa27968b04ac8f8738f8c74e0dd9de0a5fa82ce8136666a4a5a7d8e42389019c3bbdd01281d5bb0f47356075ca26164ea971dedf15ef90e579074
SSDEEP 1572864:K6zH9ulvl4SsGyWJx0pwSblnB4uYjOdxu7Pp:vzHE+7GnophX45Pp
TLSH
T18FD733DA3D313210E89F493F675681386142EB6152B99FF3D7AC8442C6929DB9B3DB03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MSS/Kernel Sideloader V10.bat
- Size 1.6MB
- SHA256 211f819f528ae9eafe53531766c4d8e2032cebe000b3799db6ecb53c1733e0f9
- MD5 e3ba87526be2ccd1fb502cff215995f1
- SHA1 0b0ca7beb33ac2b63362650d2d4c640cbf81207f
- SHA512 ef98ae73c1a77a36530d2d57626e094c8093430ea1c173773b30c803c4f5a00d7d0a5498917a9a7eb79c54d09deba59d1d12d3e9d60224d2c0ca0b734b5da436
- SSDEEP 24576:sI3UUap/eknS85wMcXUk3vI9GJ4X/0qIL5SR8gLx28GZMPu5:TK/ekSS0kWug2S5
- TLSH
  T11F75232F3B1D2CE9058016BB2391DAF59B918F24C187D09F40958FDB129EEAFD65AC70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  MSS/MSS Keygen.exe
- Size 64.1MB
- SHA256 663b3a05d54b89c4c0ad502d4ef9cd351adc4cb42cee4ed2baee9221f6cd4a0c
- MD5 1db25c6b0e7f76d7f03814f2c6ed4339
- SHA1 2671ed86b3736d1ba73836230e10fdef060e9d23
- SHA512 5d5867b46219c9634327791080f3c895b2eb3fcf03727b5c4e67554b259df956c552c425b824ea8bf175ddc9f7aa3d247daa5f5305713867b76f56bf446d1606
- SSDEEP 1572864:GmeqmvBQxkJA3wyMNAD8p6xGPo2Ei1LsQJ:GImpQxkJAD8p6oPBLsC
- TLSH
  T15BE72356E2F900E8D57BC0B8C6575517EBB2340517349BEB66A48A692F33FE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3 behavioral4
- Target
  MSS/MSS Keygen.zip
- Size 786KB
- SHA256 f1f79a3ef2860c51644c9f297b230fa810c3bb242a2a89c6214f00eceb175cb1
- MD5 13510da06107066dec26aab99e13fe2a
- SHA1 25c3f09b99d46b98406beffb28851cd661eb9467
- SHA512 679171d6837933cbef1ea409d249bc876ef72a38b7b760f151d76310ce496d9eefd18b0e3c0f390781c7b7ab906040e3c33c0f1222bd745862efca49367fecb4
- SSDEEP 24576:Z554wBi+vucdd2wDtFSEYKuXXjccyxWLWBYXCB:ZhBi+v56CtoTKuDccRLWMCB
- TLSH
  T1920523B002D74901DB1E74F6D9BA71CD73A4F36A06A09E9C6F8499C172C1E462E3F5B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  MSS Keygen\MSS Keygen.bat
- Size 1KB
- SHA256 da1de78ace766bda94dcce74c9ed49cd9d53c5aa6bd078cf4a8e6aa7a6214e01
- MD5 ecebf48927f3c91348399e0518e565dd
- SHA1 db758553d73bbbdf28b880baa8ba8e09de25acc4
- SHA512 ff6d4b5ce6f746a29d07274992ef300a5f3d84c7e5bd7167efdb36f65edda93cf90de8373af1312730c9f38bbcd59571944ffa6c9847af2d047b5c18f2c6faa1
- TLSH
  T1AC21FDA14DC14093E232FAF136480D43F35BC6AB99669E4D346844059BDD78FA2BF2E2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  MSS Keygen\app.js
- Size 10KB
- SHA256 9c7bb80dafefc046136dbd3c66520f0f136efa8ed6cf0b9ae26d4468a1d92e27
- MD5 9a5c51f6a0b3db2dc4ded14d7c819a2d
- SHA1 db898058b25ecbf0fd716809e386beb332e9d108
- SHA512 6b8f05f97e991fd10ddfbdacf363bf9b98ad7501b82622579346f20ddbc770876a1af643ff889af014634caf0dd12bd2deb815317c38afd0a59b9043ec2564f1
- SSDEEP 192:4YGB8lkSIj331Ivw+isuGYR4jjjc2VCJyC3PdF9HA5ZEQ:/sj6vwnsqRx2VCrdHqR
- TLSH
  T1F722A4E590BA103881F285725B961B4AFED681036742C5453BFC81C11F7EB24E97FAED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  MSS Keygen\assets\cosmic.png
- Size 15KB
- SHA256 a8cea6db774b7fb816629ff7f7901de5c6ce7ce758fe852bb23502d2003110ca
- MD5 c0428d273fb6959982393f9c17308bf4
- SHA1 82ca2ce7ea9c61c30a4d1f65c8894bbb00300886
- SHA512 730022e1c3d277d489f5fbdb66f4e45b2a0a7dbcaec838797f6227556a9454af82cb9696e1958df2ddc5ddd064c84ea8561832d03d67a627324c0881c52748ea
- SSDEEP 384:SU85SEhj8i9I8gW3Tum90ybSRshjD+a0sAQw+L:A5SeE839ZWR6+vsAQlL
- TLSH
  T1EC72C09A7278691FE972F23154878557CA516B3BF17C2E4932FEE06270D1CB07352E10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  MSS Keygen\assets\icon.png
- Size 17KB
- SHA256 277f0eed3190c829904be65198f68d9614d629b75c20079f3b16e95f9cac1efe
- MD5 0c95a0ff8b35e1955a8e4160d2863062
- SHA1 1520d5398155efde84b1d59458b9e52071dd5aba
- SHA512 3b4ae8c8be5634ddd17e82c2764ecc0551ec18e7d8768db57d1c8fdb8efc60bb07621313e00e260ba249521cf6d2fc813019287b37a12d953863dd63f55a341d
- SSDEEP 384:npXmnB4YSAiEITs7CKxfkJpQL+SmNLSevgZ/VT6uNKlvyXC9:npEmAiE4s7CY3YJzvglJ6uNKlvyO
- TLSH
  T14682E0A829395F2DF45E2C72CDC5A28A66A285915D30F24B417DF03BC7883AFF0D454D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  MSS Keygen\assets\matcha.png
- Size 18KB
- SHA256 d548ee048cd1fc4f1a37bf2679b47033980ab445666490c8babfc9fd83de5738
- MD5 f9cedfd9fd7a325508d933f123220f5d
- SHA1 e6ed9d85b4d79cacba533ca503127e01627c6744
- SHA512 755c7b0a14eae6798180bb53a5897dbbc7038de3efc59fc3df854d905ff103d00627466a19c481b36607aa833c39884db8bdbc182834a1bc034de9fb5c1a861a
- SSDEEP 384:jYBTu1PXjz9j9sR+OpzOnavMGdMT0WEl4XsVn9Ed3Hdc0A:ZPXjzp9sdOa5Jd2q9+92
- TLSH
  T11A82C0BF2869B60CFB772A7471E2A4FD2C35A49A60D2C54D5F00186F253BCBC2693592
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  MSS Keygen\assets\matrix.png
- Size 46KB
- SHA256 d04045ca5fba0335baf6b8a6448c7d8a910a085012a80894883b38016d3dc777
- MD5 e8b529ca7d936b25606025c84b982d7c
- SHA1 801cfb7d1dac3bf8cfeaa707bc5416c112afddfe
- SHA512 420204da7fbce297fed918cf0a7fe9e6f72ab9ecbfb4c49e6032e399b3e6b1b91a9fece0843d390bd1840ed3187bcd698ba8797546f18c1adc1ef68a44bb1341
- SSDEEP 768:9DXFOHj6fLeX5UzeDbkfeAwp3BZbv0aCEccb1503POOq+9JvJQg2JY:SHweXSiDWeAK30aC21q3P++9JvC8
- TLSH
  T16623F2479ADE7F81CC02B2781BE57C27A763CE42A5BE8D1C76309C20F6523499CD39A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  MSS Keygen\assets\potassium.png
- Size 660KB
- SHA256 7b8d3d5adab331beb73fae7a723c831569dd8846c4e10da18af549f9bf1e68ad
- MD5 e74435a1ab5164007b79c70096d812f2
- SHA1 cd5ae8245f12514377e5f78d813b14eefe0788d9
- SHA512 0773ab0fa4266709f1ac9e539eb3d5cafc0d46870a2c36f7664c7720d4181b7b33d40736af8f0b12df59c63e5b3f722b146af8bb04e7c0b220028b1c33d77290
- SSDEEP 12288:29wqgBTVox37IozqBopJj7Hyf5QKQf/OMD5AtzM7hcIL5Sxx2+:SwLTVY3UoZDjjm5OnDatahfew+
- TLSH
  T1C5E423B2DBA2A0D1C5DF83D2F8A5136EF67556ED19CA8B30450085B2E520F5C8D4FECA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  MSS Keygen\assets\synapse.png
- Size 9KB
- SHA256 621e757d36cb2b66d92593edca8ce6c36ae3f6f1122e6f179292132dc465fb8c
- MD5 a48d548c2ed525eea81296c66b394b55
- SHA1 1fc77ac7c679f2b709d1c2be42b59ad90d9e3840
- SHA512 856e441ba6b6aacca2885037a1852b3a736c305dc842ddc406be0d5f0b3177179133b9beaba393e8fcfd2b59dc7836e621523e099202255d533a0c9b092887fd
- SSDEEP 192:ia5W2JLN77qXhx8fcw6fOXz7eWhMZMKzrsaDJwgVbRgBnYCY4T:iAJR7OXhWcwgOXz7eW1cf3VunB
- TLSH
  T17F12BF62AA99D8EFE5CFF8745FCA454F1D502148C47090DBB42B2A3C7BCED8418A6B90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  MSS Keygen\assets\volt.png
- Size 15KB
- SHA256 235d21c31d8ed942b716356ea754d533a88a7c7f4cc978669980ec59b0d72163
- MD5 47bf6dc1e313cd0d57ab4fbf700913bd
- SHA1 253edf275d8a61c67f388d3c9badb9a8d97e11c4
- SHA512 0acd47999d8eaf2ae2b8bea1bbaf9dcbcaaa4ab79b327d4432f2e6e73fcf9fbb20ae48a21e492836bcae28194ff570a0faa11c23db99671fd584fdaa63951f39
- SSDEEP 384:9jwivpADFM5eSj+sJBvBVmjN6z8wiYUk2vC02X:eq9BvBVCrNpvCf
- TLSH
  T13172C0C046A5D5AD4B92B0709C1ECC0829DA67BBCA407B54DC0A61CBB3E8DB43B45ED6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  MSS Keygen\index.html
- Size 1KB
- SHA256 54b1d10a38a40adff646469d1cc6335a7a0b47818a929e4b995ae930583b3566
- MD5 c3926bd8458db7f6a09f5f4319d93453
- SHA1 6f4413b946124954e9a19eca6a5dd46f2bfdb58b
- SHA512 f149369f0213348615090254646898f70880e11eb16f27342ec31cb7d7cdbd07e28491a5006edf11c382e5fa67ae033e480000e37250113f1f33184494524e0c
- TLSH
  T1B941AB6594C9783742B390AEE652539AFBE68643C78E120034BD26A71FF3E85CC17459
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  MSS Keygen\styles.css
- Size 15KB
- SHA256 3fcd52003618f73f06a3ab62776b14830d1cddd904c16633b25945b93e76913b
- MD5 0f61d971ce89d8797f824224bc6f19e9
- SHA1 93bfde9fe2890befe85a410cd927c176ab8362cd
- SHA512 9520ef4fe5bf8552da3e78c9556bb70eebab89171e262e07af064206febaf590a48b56e1992673db82f23a54d7346e21d3e9f35466a27bc0c343c5b736194457
- SSDEEP 192:qtw8zGElmGaNeVgsLm5MtJw8LMV1WKP+71VMOFo9pnr+AYZH9jqVNBabbyoBRJKy:O3mqtJw8wV1WK2712OFohc2121x
- TLSH
  T13E626395AE1940087733DB60FBD6875AEBB99512DE130B6D7FE8200C17817BC425AFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral27 behavioral28
- Target
  MSS/README.txt
- Size 340B
- SHA256 ae5547d3766e6b74682c3f8d927efe2160e61353f7a6e19986da1de53db55aca
- MD5 1b08b1f28e91e66e80b6ad88171a0091
- SHA1 4d85f8a9110f9ab1b7102f4fa81babeb848f7a5b
- SHA512 c5266c09f8aabe4da15a782faebd1beae05e5aaac83cd188ff677ed4559b2938188fa3159f47e429e7a7718b6095161fb7f310989680ed77e703aa8de171020c
- TLSH
  T1A5E0260B7A87E32D04E705C543CF30CEE7291628615EC077391F802062CA5B18165EDA
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Loads dropped DLL

Checks whether UAC is enabled

Network Share Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30