cd7ded509d92414f7b3ec8d59d2e0cbe9a43d076c444036bbc29ee916e7d9762

General

Target
auto-creamapi-2.2.0.7z
Size 1.8MB
Sample260702-11c2zafw4w
SHA256 cd7ded509d92414f7b3ec8d59d2e0cbe9a43d076c444036bbc29ee916e7d9762
MD5 baca1ae3982511e58ac947942d576d83
SHA1 8b8a48bea306092646faacbfef12592fead54413
SHA512 df24885aaaea7d0b96848a6dd212233a033baea3419896243b603fe8cc752aa4ce95bd2180792bda26f2b34c8df19cf9c35a113869ee32a404177d9a1779862e
SSDEEP 49152:/T5qQQIb2ZWfkCq/jUKEwEETSM1OtIUG1zYecPzMvRMii93i8SdL8D2xivof:bA8KZWHq0wkTt9P4vRdipzSNivk
TLSH
T1E1953382C57A40FA8E20B4D0EE7224611DB6523C1FEBB1ABA1CC05E757DF697725C0DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  auto-creamapi.exe
- Size 4.9MB
- SHA256 7f6e8ac3c2747443f91c0c2c7c7e3ca7335ba9090275b70619b5903316d537e0
- MD5 2b4c2827a5e0afa08d55014d5d9f3976
- SHA1 6b182cda0dcb1511d0cf426eaa0126de2066af92
- SHA512 f168c3123f1bc7a5d11b09332be13c8371ad2ad3fa9a8811727505212123d73d0d150924a7aa1386475048e69516b1b266633760c5403417d572858bb09a87f7
- SSDEEP 98304:siR6LPHMssoiHhKbWiVbMqhVvu8o9pcLFwiS:siUzM0iHhWWiVbMOVvu8ovcLFwiS
- TLSH
  T120369D0273E88A76D1EF4635E8714645C3F6F6566A22D74F3B8C95AA1F63B80CC12363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  resources/7z.dll
- Size 1.6MB
- SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
- MD5 72491c7b87a7c2dd350b727444f13bb4
- SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
- SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
- SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
- TLSH
  T148754B6BF6748260D0B7C075C5D2AB96EEB134868B3096C752859B3D2F17BF6C939320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  resources/CourierPrime-Regular.ttf
- Size 66KB
- SHA256 16c3b24e173a21f23bdab9d50b5a49dc138e2b80789e010c7f29272b23e0634b
- MD5 03ef685b34f3356631c3f60c91917002
- SHA1 1e0bb9c2375bc4910829abe58a950b999dd67a5d
- SHA512 18e909175128a4f5bc32e024aea9db3c3f03818c05baf1d4744e84e6189ede9ea701daa938010a065a3e68f209b777fcc16434a671b59f4e152fea7c9bd783be
- SSDEEP 768:dMMoMrT344bhlTTlIBVnszQzpRp2T6Sw2LGMkUMSxwETH45G2FNcnGFGN8wkI3zx:H40jT2ubwFktm8Q/lyZDfLek
- TLSH
  T1DA634C0ED367CA5DFF2A8E38C065D38643F9F4412A3A5647844A3A7DE8EA4F1CC192D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6