0b33dba7aa02a615339de9d0c3090a0b39aec48ce20ffda0b8202de6104bd221

Sharing

Copy URL Twitter E-mail

General

Target
Zoom.zip
Size 6.2MB
Sample260702-ajftesgt5q
SHA256 0b33dba7aa02a615339de9d0c3090a0b39aec48ce20ffda0b8202de6104bd221
MD5 51142bd6896d7aaf06d8fccc3eb99003
SHA1 eb8649f9a4308ce5927b8da50d09bdfb31f01c9d
SHA512 b16b015acd4227b58d18391b275e9836bc88878f0f8480e1099a2d1fecea07302b2e4c8477655e5ecdc81b322b55a3d9e940f181b99df8cb437383a68f8e0b39
SSDEEP 98304:8kemufLCb7anf/pBergYtiRzuG46fTo3YJcEp6QNeKjdhGwpZdmsB1BES0N6ca0Z:NLz7wBBerjqSGztf9bGwpWs2SU
TLSH
T1076633F0CFCF7F56EBE385FB96C334106D85942907A53A24AE51ED711A12C4B1DB0AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Zoom/Android/invite.php
- Size 601B
- SHA256 c2267850c316a43711c44f30cf3acdc9ef5107c45b4eb830bde4e44a76c4779a
- MD5 19b220bd46d0623bf01d3c1e13d1fd42
- SHA1 43b435fedb8a003e5afbee2a94674be2a9ff4b9f
- SHA512 eb81da07bb60e1d3e202aaa3a9f171e05817109aab800c9219ec7fe6478c5cd19d5ffdc655f86cb24f2a3c17e1038f31278e0cf5e2500cc267955b23461765c9
- TLSH
  T15BF08B4A08F2180A487380B099E1B7161D818457A32E8D10BCDFB06C8F99B02C4F3788
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  Zoom/Device-error.php
- Size 182B
- SHA256 33097086e62ad550be4e58e0a12a1dda87943dfdf64bf2411a9691d2f6858803
- MD5 d894a9ddb9245b99af912bda694f6626
- SHA1 a17fbb3f2750551f03b5eadfd6b3a2bce186d77d
- SHA512 b1a7c3b68b3477d08764630b586f5ac0e5fd7e3505678b63e0b911e986a46d17704b3957e65fdcaef11353bc3ca41ef245525b79f2213e59cc68ea35261b8db2
- TLSH
  T176C08CCEA2F038320011D0580C9A3F5B4B20908F22168948304DC0212F0AA065AA7A68
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  Zoom/Windows/index.html
- Size 36KB
- SHA256 161ce5a6275992627cef0fd875938cb5c0674188614fbd175301412a3c2b49b2
- MD5 bd7fffe9ceed9b9f79003fe2745fb765
- SHA1 cfbad3bfbb357a04976e6ca4362f3dcff8793e4f
- SHA512 9cba936ddf23bd36e9b8eab4bf35b6cf4c5b3bc4c83dbcf5e0d2f77768b1aff9a81415508fd4b81bb0e61bdeba92a59db8b980e874a431eceb83b3eed162b62c
- SSDEEP 384:7P+wmD+8ZjWYMNuua94wSlsJErRhvBWC0q7zg/zjwCmEUIBlBJBYY9nRMGD:7P+wmDZjiuua9tSr7JWCmhPvbHb
- TLSH
  T1EBF2D6B247F4142E529782D5A7A27B2FBE629083B545840675FC4BA1DFC3E81D8630DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  Zoom/Windows/invite.php
- Size 138KB
- SHA256 5a1a863d0ff6e1778ca20249eaa56fe34077b188a31aa0549be5e4853b35dc79
- MD5 e46d8abc497d5c2a07b13b7cc6ea8325
- SHA1 c1c87ff5a9afdbf59af7282419f1ce07f09cb93d
- SHA512 5ad2f2be251071544c5b196bebe2fc891fa6c3750a66674a6c8b7c3058e85fdda3417e81381538298c94602ed4a3b726be653712bbc4665a22ea0071fb678795
- SSDEEP 768:5P+w3GGnq+az7A36cYqq9qq2zeDdX7vszNizSgc6Enz3zb818UiHoQthgD4kQAHg:5P+w3DWzOMvszJgs3zb818UyxgD4kQt
- TLSH
  T196D394AFB950230DE6E3D71996957A887421989FFD330DEDF54E6338CB883E20D1464A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  Zoom/Windows/zoom_logo.svg
- Size 4KB
- SHA256 ae4dbcc7c944827cd5be49e6360c40ca2ce26e7afba8a9263e099c960180e6ae
- MD5 3bba4f3bded944d8c3b90293a60551bd
- SHA1 51cac84301fb2ccd601c54fd491b4d9f8c293e23
- SHA512 f7ff35416b673d5d1e0415814767fad9386c43c6ec587f66410f9acc13077be32353faad72444895c9405e130e0a21cc8cbd0e84b314a3268051d97577dbdafd
- SSDEEP 96:VkoIanLX5VYfLnCwBbs5MyPRW57O5cQZzc0sXRaPAnpcCI/bV5z+ns:Vkoaxbsvw57OaQDGMW1I/jMs
- TLSH
  T167914364E22955EDD70E871848E13D26531F34E3F0361B61F9AD88A0DF022C0B6BFAD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  Zoom/ZOOM.bat
- Size 1KB
- SHA256 297fec7416dfc00b26ad93dbbefe8351cad5686af69a443563693d62d55c0d35
- MD5 d4b826c4bdf2e966c64501fd00b8445e
- SHA1 96437407c204b3f252c1924e2cabd20ddda7dadf
- SHA512 22876586d391f9d51447a0df4f3c6814248079221191b8499171a9c4f080037716a709ae97c9e067f3ec73c959cc5e34432f7b49195ca9b61537a9662a244f84
- TLSH
  T19D21FDD7205638299BF3E752868553A4DF5686438A0822DE34FCC042AF072E683CA58E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution adware persistence spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  Zoom/zoom.msi
- Size 6.8MB
- SHA256 188a8cebd55d1731041b4cc18efc7b02fbbd1fc3df3ef61c52b51d78b1cd2b02
- MD5 ebaed9ba059d9e28155aa1e0f8c1e5c1
- SHA1 968ee810e7b5e6aa11bf89424ff75129cec52a4f
- SHA512 0a858c36d32460735d66dcdb3e5ee9bd8b4e2c8e66ae2c95df624ab97b1482e022215fc3a4009eb0304b3aa99a81939bf93b0573f64048297cf6b261678b9215
- SSDEEP 98304:FkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:mlc4pkbLHLhObmXe/kdkmPDTs
- TLSH
  T168761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation ransomware adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral13 behavioral14