b1f93b2e9434d93c5321275c4a3d0a87f3b822c552eceabdbeb1610c879e1863

Sharing

Copy URL Twitter E-mail

General

Target
goodbyedpi-0.2.3rc3-turkey.zip
Size 301KB
Sample260701-yb75psft61
SHA256 b1f93b2e9434d93c5321275c4a3d0a87f3b822c552eceabdbeb1610c879e1863
MD5 78cb0650461d2194cecde1d92b8d15dd
SHA1 374bc8d83ae35cdd7db02265648e5379ecb7ac20
SHA512 6094a16569279f9e94dad62e4aa54a9a5348a20247a75c092c139b563d69832fa86d7dc30bf871a6e997f0c2928ccb20b3cd40b463767d8990c4935020fac189
SSDEEP 6144:AtScsXc4aVSZGIFH0Yev0fUIo4rhAN6v0Wh6ZguYbytxHKMKkcIo4rhs:PXEVaGIBO0v9rhAHWh6Zg1I+29rhs
TLSH
T13E6423FBF9E80D7FED1D9ABAB126484F93D034804030F55B6A5C700615A77CC8B56AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  service_install_dnsredir_turkey.cmd
- Size 804B
- SHA256 2b0d9f7d76a198b83f4f344dc0d9ffcdb09a7616af6b9ce41dfd74e417ce8ded
- MD5 ce60ef0ddef529d2685513afe1a90c95
- SHA1 66a1ca5771ba7f5bde41bf20046f2063625cb2bc
- SHA512 591eb0bcfda46849339bd27b55998ac0374d88c43be0987a738a5436b0e9e3ad2640f33d9d125d4db0f168f734cb432ae8f96c6197113ad641b97a29e9435402
- TLSH
  T12501AF7A739551749BCBC2C2FD3E5A8375498127251196DE5D216F2409106FF90C1126
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  service_install_dnsredir_turkey_alternative2_superonline.cmd
- Size 801B
- SHA256 9cb59b3139481f0981f08d55c56add61eb6c3a692db2894df7f19c1a403783d8
- MD5 cf87621900707b268783534851c5083e
- SHA1 81461ec7595e708532c7f474e1a04bc866ae0cd4
- SHA512 f746546c04a43e1c746a961b0325c57e7582aef7c38279764ccdfde3d506eaebb087ecd6351e7d30fe3ce3e88ad8b1da2da20a332fb6d49dd4211ea536270af2
- TLSH
  T1AF01ABAA73825064CAC7C2C6F93EAF47B1998127352096EA5D52AF680D212FF90C053A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  service_install_dnsredir_turkey_alternative3_superonline.cmd
- Size 749B
- SHA256 011830db2f2300de222d512221bdd58b3993bd7f69545a0eee170a45aeadf799
- MD5 23f3829f31416931920148a01c12359c
- SHA1 7a800b7a2a729831026ef6863599b539c9f9b7dc
- SHA512 68eeddfd853a5217e56a97868ea3fe7afbf43951cf260aec931c9a75e8f20999986d1aff483b0d44cf39b59a4825c50374a478840215f2a6bdfe6cc5132077ac
- TLSH
  T1F701BDBA7386527497CBC2C3BD3E5A43758AC217296192EA5D517F6508202FF80D0436
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  service_install_dnsredir_turkey_alternative4_superonline.cmd
- Size 740B
- SHA256 2c83fd943b335db8abc98feec22b990fc2bdc579dab7032c0a8fef5b2b80ec86
- MD5 8f06657ef041527bbeb40730469bd4d3
- SHA1 b41a824a5bb0bd4cbcb9b00110e9984ec8c14833
- SHA512 4c2b2eefea45c2e8842726b4f7fdfdb06e3ca5b582ec7909260a027decf7bc3dbc21bd03f222db45ae60bdfd934b9ae0a99c90a170fdea75170b4ca118250b6a
- TLSH
  T13A01D0BA7386517497CBC2C3FD3E5E43B58AC217292192EE5D517F6508202FF80D0436
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  service_install_dnsredir_turkey_alternative5_superonline.cmd
- Size 740B
- SHA256 f99701eeb815fe7fad228f68760cfc2de1e019592f97b63246e46d9d79a806a1
- MD5 b0df6fbdacf2ac453a2c54661af68b44
- SHA1 9146cc0abfa029b9ff63f881c1ad1b71210dace7
- SHA512 bd5d5720dcc2f86ff52a45d6510b65a65a49e2f7b80cb8720d6963a89dcc3590a55f08d774e390a3178343dd8c95595eace4f92b0a62d41526e84678971017de
- TLSH
  T13A01D0BA7386517497CBC1C3FD3E5E43B58AC217292192EE5D517F6508202FF80D0436
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution persistence
- Creates new service(s)
  persistence execution
- Stops running service(s)
  defense_evasion execution
behavioral10 behavioral9
- Target
  service_install_dnsredir_turkey_alternative6_superonline.cmd
- Size 653B
- SHA256 4285bb298018613fc5c2c6b8bc8533f2af0ed5986f85aa214ade5dba1c33ef9e
- MD5 8e86b2f818ae16f6fa407183ba9e0870
- SHA1 f238bd41eccb7dd2219dbd5d9d5673b86ba64524
- SHA512 8996e46f7af382c91475b27e7f51856d1ee2237d40d313f113ee2913cd32092f315fb9a240ffce942c3dc5bcfb3a46ac5cd0fdeeb29b7e891da2f2166ff3fcd0
- TLSH
  T175F09EAEB38251748BC7C2C2F93E9F53B189C257392086ED5D416F5908212FF90D0536
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  service_install_dnsredir_turkey_alternative_superonline.cmd
- Size 808B
- SHA256 b87532f816fc4c4fe49e0f1049e1fab46ed733434e490c65c9df75f5d98c5225
- MD5 a0429262eb7859768b86b540a6d4007b
- SHA1 d104810dafc586f6cd0b2fd6b1fc3336c9e1dc6e
- SHA512 6d46320f1d5682b649f6498462177ff2702d75777b7084e630c4c24d06a2a365253580b8f28b386196de91504ae8bbd0bf8b05d45145287aebc31ee2f45d2a5b
- TLSH
  T16001AFAA73825064CAC7C3C6F93E5F5775998127352096DA9D526F640D212FF90C0539
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  service_remove.cmd
- Size 355B
- SHA256 78d7910d79862da0b6707d90b0d494c3b3bf34ae733072c89b3da79bb4cc8852
- MD5 527f95833c7bb8fefb5e07f1cb365009
- SHA1 bc8af7d526a40b7837f4b37482dc76093411a394
- SHA512 23166a1ff60037fbb4014f9f9a5f8a3f67183b60c1bcd2423614ca366d7101e9f36fed27021966a88e8f051cdae1bbf76b48bb023a14bb9db9d9852538bddb07
- TLSH
  T130E0D8EBB7835E910EC7C3CBFC6B5D637A5942869040A2CA0D11BF56C4111BAA414423
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  turkey_dnsredir.cmd
- Size 303B
- SHA256 b1961df58e25db76e6d2c22b582a97a1cb135800a4878466e8d1fa6f10c63e22
- MD5 775a903331912fd9867a99b994e1b859
- SHA1 54c9e428e4a178b9ab1c720387703c204ff18245
- SHA512 c92a86261a6b6879061995b6e8b00ffb20307af9d7f6dac7434d4a159b388a1aad48ae984ecd80aa7a1b7ae5516dc80967822c6c43bdb8192c9cd30e14b22035
- TLSH
  T1E8E07D3E03CC517CF78ED10120282002F4D5D0176E31A6E6A4B8B5301B263DFC4C1159
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  turkey_dnsredir_alternative2_superonline.cmd
- Size 204B
- SHA256 8f432fb6710d0d2d36d89ab4125157766722928afe2e70077cd921f27579ad5a
- MD5 2e479250a2d20c6d2d5fc5171528694b
- SHA1 e72055aaabf6ae076d45bc6ade3a9aa8c8da33c3
- SHA512 7550871629ce9f72a72fb9e2b17093505c036737cfd0e21722ae9eaad4c8ed99916937c3e73637af63a1d24e392863fe79c6606dc29afc31129fcd6bfb71d67e
- TLSH
  T1F7D0A71D028C50BDE946D01000082002D4E8D0567D308AB46995E924175368E48C131A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  turkey_dnsredir_alternative3_superonline.cmd
- Size 300B
- SHA256 ebef2bf55c4bb7f1327bc62abdc1d90be993efe8e20078550ab63e27efc6b397
- MD5 e712f506d9c8c5e3d40f7bf540ffebcb
- SHA1 cf2eeb7ecfbb59efb8f8fdf5738623d9b8af50da
- SHA512 3d0ccde0b865bade9d75de7b46a968838ebfe03503e73d0ed630b09ee6ae935587b0a0ad1bc6c54b6e7ffc8e065f9b1141ed31e256120f9dc67711025b7b84fe
- TLSH
  T119E07D3E03CC61BCF78ED01120282002B4D4D0176E31A6E2A478B5302B263DF84C1159
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  turkey_dnsredir_alternative4_superonline.cmd
- Size 302B
- SHA256 9d6c768971be9db529ec35a55b599b8bc8ccce9f2778c8f521796fa6b0a318d7
- MD5 c67418e03096b645a2f28b5b44fd7ee5
- SHA1 5f40c0e9d24d7d37da6bd84114422bfb278d42b2
- SHA512 bea723feadfd8ca4a1535caa0df2ffba76133fd1a984911afa9135cc8323f8f4c16fbe31077c68c54df659120d1b752da55803a6d7c895761d8861035dbbeb85
- TLSH
  T16AE0CD3E124D513DB75ED4422098241AF4D9C053AE2549D7A138B57017756DFC5C21AE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  turkey_dnsredir_alternative5_superonline.cmd
- Size 302B
- SHA256 e962b1f65370f666f8d26dac23b97d6e603fbaf049b5789d834a22e50eeca96e
- MD5 42c1b40ec2532c1da85c95532b8f6418
- SHA1 0177dfad6da6965c5b208ace73ae8a31a076382e
- SHA512 3372943e609aea7aa4dce5151ba1b2e79273b18119d13e73c11af363d14c1c52d346785087ec6fdc72afcbaffabf95170e8699b1d395233b9e70ad6959de6640
- TLSH
  T113E0CD3E124D513DB75ED4422098241AF4D9C053AE2649E76139B97017756DFC5C21AE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  turkey_dnsredir_alternative6_superonline.cmd
- Size 215B
- SHA256 d763d761a89c1c7875bafda159e1e1b6f66854f658057922186a87fef778a1af
- MD5 ebcd9f9d4b9d90cebbe16a6b15bafb2c
- SHA1 7cc120e6d01503358195b9794891fbaacf71a89f
- SHA512 10582f29222d8e704dc41c3ed65ccec8bf9f6334ef5a8ed7e75479d53ccb5df95f75ff818ee3faa0ff844e181d69b21d5bf5b1060af56a6f4266bafecb5b28c3
- TLSH
  T11AD0A71D164D507EAD0294410008305BE4ECC097FD358DA57125D9640662ACA988229F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  turkey_dnsredir_alternative_superonline.cmd
- Size 213B
- SHA256 cac6119fb96c9870e1d6c36f13956a1d63a1abbf1569aa2e7cae269ce18f2106
- MD5 0180ec1cb44c76a9a026e04f681ef354
- SHA1 8d7d1cf4bf6a84e979bbba7ccdbd7ccf29506895
- SHA512 7e6d18f762da8ed30d48f71ecf7a8551a191f22c71a394c2b9738b10f14b4a6c0e7525bca6ccbee54deff4e916c3e69d69d3fbed438f47ef0b0cd6272b998afc
- TLSH
  T1B0D0A71E03CC60FDE946D11000183406E4E8E05A7D309AB4B9A5D92417536CE48C121A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  x86/WinDivert.dll
- Size 42KB
- SHA256 625ffdd95bfabff32d0e8a95beabcd303c01c8bba73b90402d4e84d6e15dd8e5
- MD5 1cb0efd60883b5637b31bf46c34ae199
- SHA1 b91de8d5f072f8c6aabd029d96568effdd5662d9
- SHA512 68c7c257b8cd28011f4b9af09b1e4c7b3d69c6f1457ca6f68fe114fcb382e470b87b9c12ca5d6d4aedd27a103a35fac9093c08b288867cceb9621a60ac70a6f7
- SSDEEP 768:/BD4bCa+EfZ9+EwleNwYLWKkR9c5s1R2wdRt7JtXwxwprTKkimOyd:/BD4bCofZ8VYwYyKkR9c542wdRQ0TKkV
- TLSH
  T14D133B8AE793C0B2C87E8AF0225FF7E619281570F945C6CBD7D41D6C7C569B30839A86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32