2fb6889bed512601cc1576fcc0462f8a0597da01cac8f44f7812fdcb9f86e017

Sharing

Copy URL Twitter E-mail

General

Target
2fb6889bed512601cc1576fcc0462f8a0597da01cac8f44f7812fdcb9f86e017.zip
Size 11.8MB
Sample260702-1p2k7act4j
SHA256 2fb6889bed512601cc1576fcc0462f8a0597da01cac8f44f7812fdcb9f86e017
MD5 823526b50d746c43b3884fe0664f64bb
SHA1 8b4b43f25f717f4d994784cc147dab2f71b81e4c
SHA512 305bd260e5c052192a75e79c61fdd908af324a2504540d667869c30e3373be814828a73003a105bf12e6527a46094b5d3c89fe9a485d78f99dc6c25a5c8fa593
SSDEEP 196608:sEUCk5yvHVGRzHgNj3l9SA90+NoFtWkT5lwb9lbFGwIksD0v+EZqoiWV:sEUlWAzoJ9TX3k1lwBlbF+3OZqoiWV
TLSH
T12AC633CEB9E3BDBE56A564B3879DCA55AF68DA12353C64B840F020C6931FC3C6C956C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Assets/lib/VMProtect.SDK.dll
- Size 10KB
- SHA256 b8ff4bb2b247b67d707c77d32f4541c4de99ac8213aebc411fd36ab0dbd201da
- MD5 6e177b6a7e784ada4226d1bb5bea56d2
- SHA1 dbede14faecd8ccd413f5c583d0c80f99b0b39fd
- SHA512 9d8781da98c0e1c01701f7ac5e0701af72a99a10d64d560272987b72ae5fb5da1fa29be24d6a5d17222510eb1420d9dcb37211e28c0e3b6d908c0dc31b759a09
- SSDEEP 96:4jKLWlYY8hV5ln3KXkhk6EIIIII/Kg5y0bNVOz7RpSxr9+PXCr3c77dOHKMHm3je:jY8TTvOIIIII/J0z/SxrU3MHAjA
- TLSH
  T1C822A712B3E85216E4FBA736A97252240B73B9594973CF3F244C010F1B376446AB1BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Assets/lib/VMProtectSDK64.dll
- Size 116KB
- SHA256 af82c309ace1ce81c23aa190c65f4eaa4e2e668e227175e66b0637b56f546796
- MD5 724d8234d574846b6ee2262a2977650d
- SHA1 b3fb659ddb3306e23342a0232b9b85e924ae36d5
- SHA512 3ea5ed4fb38986098d19221e5dbf4f48a0ccf5c912235bfdc160bb949721c298e904bbaa1070beb67cb9cfdabb0163a7a51e593f37e2bc03c69b7200c3967e83
- SSDEEP 3072:xmcqYHq7Aiytzg2ScpvgJcG5sqYX6UmHRlBS:80Hq7AiyegZgJZSX+xH
- TLSH
  T1F6C36C57B3E540BBE1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  HyGuardCore.dll
- Size 430KB
- SHA256 89b4f42e6bc41f4bb3445184b175787566e681456f479a3573350924a79367bf
- MD5 d64249b6ff95cb7f4f35096bcd9758cb
- SHA1 6b164785abe374e91b4ecd4e322bafad4489cffb
- SHA512 10dd516c880802d79f49bcdc351c2a8f4a84d7dc5f720cde6c71291a9cef2d9a267734a8e07bcd3bfba01b9ed09f4273742fe08f7620aee253c9ba525adfc29b
- SSDEEP 6144:1R/2RlziKowdOzftYcKvtLdH1d9Q+yLRCMBO0diXjM0bi7:1R/2Rl4tZYcKvtvd++QRNBbdizM
- TLSH
  T19C94CF297FDC9D43CB89837CD4E105E182B0AAA4B543E797381A36F1BB5E3D0D91221B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Nya火影世界.dll
- Size 11.1MB
- SHA256 5660c74dbd230db837bc119bc06533a12dc231c316216408a9328dee6b7eb8bf
- MD5 26f1f4f227cc50b0fa6771dbf35b23c1
- SHA1 26ab2fbfec85050426a9897309dbf742a7e5400e
- SHA512 d61463b839fdf98cf4467c21906625405c7afc6e4c89fdcfa1c8dcbef89f2b5b833c4d91a93a49718f2ae0ffe4aee7537d743e269d12c984a8248a670407f97d
- SSDEEP 196608:gDgxsXNNIxHpSZj3NMOYJichqDhoyzdzn4D+RBR2kKio/6LyGzas0:j0yHwBMzP1yln4aRBRu3yzaN
- TLSH
  T1DDC633982BB19E5BD27B7B7A8AE4E334ABB497933909E74C44B074C7790BB446C405C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Nya火影世界.exe
- Size 492KB
- SHA256 c990212c1072dcdfb0b553bfa44ac8a9dde4ae4d9c6c3ef6e77d01512015613d
- MD5 0bb64a24be8bb23e3ef3f623e18aa7f4
- SHA1 136775d0ff4b6724612c2b7b6885806540a88701
- SHA512 74c5e94ca4b3714d942acbde78b69c3f9cf1834d2a8aca030cb92b328cd9448f9278d9775657f097acabb6642bab655a4b91ca26d0b9f9c2839b33f365121e87
- SSDEEP 6144:364k83TlEvh9IgSqB0DIKeQq/jqYuRPGho98r+EJh2qV1f4HLzMLHGuFk4lryCQd:3/TloLCxQr4tG20Sw1fSzMbRkfWOt
- TLSH
  T199B4BE1A5768915FD252B33989E1F731E2753BD06B21E3CB47B07DA33E22A846E74381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  System.Management.dll
- Size 399KB
- SHA256 2a8b7fcad6d6c18c7ea8b61c32c5ef3106e082382733b065cfd58bb8bec386d8
- MD5 08ea5b786bd1420eb760cdb64f4d677e
- SHA1 be32925583d6e21b714c8336becc6efe7354ed3b
- SHA512 f83e9efeccca9d993a11d6af963a9311645fbf8fc72c1bdfe38fb5e31245d1587ff69e6e79098aa710140957ed7d768099a442eaffd5a8148cab39e288c81c0e
- SSDEEP 6144:5oWtNab9Dks/PTUGLiYAivhaxWIk10i1lW4T2:53NabRFY4wxh80ElWa2
- TLSH
  T11394172173F84609F9FA1BB499B48552CFB67693663ED70D0CD52AAE0AB2F408513373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12