180fb04f656b6c1581a420540cd8457b8e32ed4580db554e0842ad85e93b1c39

Sharing

Copy URL Twitter E-mail

General

Target
SETESTS.zip
Size 100.4MB
Sample260702-bsajfahs6q
SHA256 180fb04f656b6c1581a420540cd8457b8e32ed4580db554e0842ad85e93b1c39
MD5 4fd9f43c7dff348b84a306ded4b23f47
SHA1 40d731b23ad67b16b5fa9785c189d8729d1d088d
SHA512 d037c85f7f872da45eaab06029a2d936f1c71d4fafd77e59aae56aa38d868cf124977df9493932db8f677d35fb36910b818ced3deac274031c8b4db22a170399
SSDEEP 3145728:OqFoNDa74E31OvHAASNyJD6NjeNsTbOoN984F/RZ8VC3D0os3+7L:Oja74E31+APNyJOVeNsTr98M/CosY
TLSH
T1AB3833F67FF85FD552AC837306B0EB2D9B476A6A6E1C444505E817710CB478CB2BA4C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SETESTS/Astro-Win64-Shipping.exe
- Size 105.8MB
- SHA256 18cd05647d1a5d7c2a3855c4d5a28c51f2a5e3b981196e6286ca05929a798521
- MD5 28328f541f74beeabe328d893c04a626
- SHA1 b56f246990d9ffa9a6af16cc375bb6539237a0fe
- SHA512 bf1bad0621389b96e9a040af131f5a1ed8dfe73be8007617d57ef3a4f1661d2966d1b68226c62ac81ebd2fc55e1fa699be2f15cba00cfe4f0b62d9ba3e348fd5
- SSDEEP 786432:ZnWFBnnWFBM2xh7PuWJPzkyVQRv/6aOfz:ZnWFBnnWFBM2mWJQeQRvSHfz
- TLSH
  T1CA388D06A3F854E5E17AD034D62AA717EBB23865172047DB02F4059E6F3BBE05DB9F20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  SETESTS/Custom.dll
- Size 12.2MB
- SHA256 69a17e01a91622864ee2f814abf33c24295c8d11ca57f3ef2cc298dad8fddc55
- MD5 559e096c6712f6f507551a72aa3edeb6
- SHA1 62e2a146bc2d52cf47b11ef2eb7b9582a2b9218a
- SHA512 360550d3e48f6f099339495b818dd3a57270a94a4a6d1ebab4565928ec982f707ea1ce6c9313f3708a7ee366574efbeb35c017884ebf5214bd0d13fc99c87299
- SSDEEP 196608:Su+sW0rWlnLOmmF31IdwDPPfNJvsT7VhMoX5eEwq8sgfxnU2FkmEQ:e0yZjMrDPPfNevoEwq6ZB
- TLSH
  T179D623E9A0A113E4D4E34A80768A43CD72D0655D4EEC4C2D3AD62D02AF72D7F168DDBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  SETESTS/OnlineFix.ini
- Size 782B
- SHA256 43759a3e43feb38b7849eb5345e8263e89033686dde5081a4f84c9a671ee833f
- MD5 8cb7666648b2c91610bbebeaa435cb5c
- SHA1 1a98156b81c491fc3045b8d23908c36003e024d7
- SHA512 0f28e59239388ef74e042f9875edd388218afb628a5a2b08f092303695ad0cf6371e260ba7700d601247d2e554728afc05475b9051a6d839efc2937bb2bf60f3
- TLSH
  T17B0120E936AD31BC892171F91DD3758B98A92A09314F0964340E0FD9281F994E652987
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  SETESTS/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral7 behavioral8
- Target
  SETESTS/OnlineFix64.dll
- Size 11.8MB
- SHA256 cfd01ca6bce83d110365883be797ce22ab6ee436d8bc1cbfb4f91732a24b1e3d
- MD5 9ee80bf36a62e022de8ea7ed0e7f3ba6
- SHA1 1469e9cd8a260949b899981d57558c7da907026f
- SHA512 bfac7658f84fefe3c4c5b85f3f250f1c39a443c1587424278363013cd5d943c9948dfadd40f2790ecbec44aac4502be7faaa575d55997f2ce7fe8370f1e76959
- SSDEEP 196608:j+Q/IEsbemkpcKjV1uQ5hVd7YXgkiK1SFCupxPq+oJEIUEQ1PiA/8kxWC:oE8bgJV7D1YXwFV7iVDQ1PNEY
- TLSH
  T143C6128568D4D2BCC4808274E64155FDF1DA3C898CF9982AFFC758217E71D68C8B9BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  SETESTS/OpenImageDenoise.dll
- Size 47.5MB
- SHA256 11213c268e6c67262d48e7351e1f6c196acbb91a9a1cf059d4d758c34368f08a
- MD5 43b8ae36fb551bb0226bb59cf21431ce
- SHA1 a18980353bce3abb27d40ec1e17b4d25f155c30d
- SHA512 26e3a28976ad880bafb12eba9d2fd7cf86cb21dcde465094a78ccb6aad4e33b0465dd8fad7df7c36a2787cb94010768e2e4c403ef24e4de2cefa7eb77e3d55ba
- SSDEEP 786432:hnytAKo2dZOplxaeiF9Oz6CJk9w5ksfQYOSCIAnrxeMMNKo6LnZyj4fm2YkLuyp0:MW3pqPFUzJgw5hfXOXHnrbMZOnC4fmtN
- TLSH
  T16AB723A3B1B6D4D5C17AC07E820F5363AB7278E9023766B7A2D1E6753CB1E502938770
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  SETESTS/StubDRM64.dll
- Size 99KB
- SHA256 c44ce43eafddf6981ddfb7060eb01d70b0a0b7498a5a114e9fd0a240e6a97e9e
- MD5 ea4f734941abc5c64633e83b2eaa6db1
- SHA1 c89bb08fd717c846f0c6d44d38f647d68cd7c30c
- SHA512 3cd14d3c170521eeaf81cc8f82d7e2202d2ab74d17b98de930de3961444c9f3ed3595b57c01f09b62a056b76657217c7179c3165a8006c1c6d5d8bf0ed3148a0
- SSDEEP 1536:8renqwn4nLCWS9pqSoLDuODBEaiclO0J9dsWaRd09dlAH1tq:Qenqwn4nLhqqhLtDBEaicDj6LMWH1t
- TLSH
  T1E3A35C4776E501BBE5664238C5A30E05E776F8214721EFAF03A4426E2F277D24E3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  SETESTS/dlllist.txt
- Size 122B
- SHA256 c6c0dcb6bd4f331e228807acab54f066ee2254dc4764d9ad5bf3b99d55e4d182
- MD5 621d8cedc41bf4f714ae0274ed827b5d
- SHA1 c9a5f0fc6f318764144f05362d70ffa1e1804919
- SHA512 5118da25938ff8f54ce889ddcb90f7de794e31cb51892da710051cc0fae6b0d827cd4eae596f904ae44610b2e60690784d76d8e181fc6f00687c90672b85b108
- TLSH
  T1A2B09B1ED2E120ADD51515504615991F94475D177B008FC9559541C1535539E74E14B8
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  SETESTS/tbb12.dll
- Size 374KB
- SHA256 061f3b283b3e5b24c5ac45772ee19e2f4b24cdacb3ff8ae4f815fe62836e5a45
- MD5 123404fa3ab377e006e8bb777dc58b36
- SHA1 f716b9bc1dd30bd903c377de8ba08d1dee2827c0
- SHA512 4762511c8f75f0ee88e0b0c030fc4ded3681bd95f57b44d858a5f97bfb918d8f51df7fbed2fd473e3bd491ffec4dc1a290c3894a985cd2d7a959de140659782e
- SSDEEP 3072:LMz+pybccWv9lxKs66IYtmm17NakuCzbLModItR4KzdyHohj6bdJ9qDyh6tm4MBS:LMqpyOlxKOmm17NfLPSwKL8ItmhxpLO
- TLSH
  T144843B5EB7A868D7E13B827CCAA78754E37131540B6187CB14A4439E3E23FE9683D361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  SETESTS/winmm.dll
- Size 494KB
- SHA256 cb8baaa2054a11628b96e474e1428a430c95321f8ac3b89764255cbd6628a9d6
- MD5 67c049e74d242975ffd0dcab9bc3b041
- SHA1 1f5b8e6dfa8e2132264a7dd1f66948a0948fe4c4
- SHA512 f98d04258d3f77362a023278713a30c3cd4f8013adfcea5a26a548a6f95d0786da080a8fbffde40579bd783d818fd9c4f4714decbdc34f84bb1b10e5fbd0fe28
- SSDEEP 6144:0lHx0Al1TCgUfptsdNqB9G03mKt/SI+vnYvvooI7IreqdDp8:0hx0AlYsOdKJYvvooI7uzdt8
- TLSH
  T1BEB48E19E66842B9F56BE138C9530A07E7B17849536097CF03E09BBA2F27BE0573E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20