0f4f63adeba0cdbc7795332caf8ab5069aabb8beefa4c779d3e38fc5099e6118

Sharing

Copy URL Twitter E-mail

General

Target
MAS_Remake_GUI 1.0.zip
Size 11.4MB
Sample260702-e46mssbx7z
SHA256 0f4f63adeba0cdbc7795332caf8ab5069aabb8beefa4c779d3e38fc5099e6118
MD5 70e27df580d40d19ce43aaa8663a3fe5
SHA1 54472dda87b6a4e4206fc850589a61ded955c012
SHA512 e545b03d5ea2b6bead9ece47a242b0debcf757df8460f9da6b6556c286a89eccb2f9d153f9d40a11e78567f70103b78114a688eb5b1f2e3a6c338b5bcaaeaadb
SSDEEP 196608:0xpGPdbDU7k/qe3J0GSUDTkIifQARsIHbdYjlcwZcohjZyJPiwSCiXrItYA68cZm:03GPuUqQJ0dUHZNIsIH5YjlcwZcohjhy
TLSH
T1B1C63318FA6308CBB593CF80FCEAA5905CECEF170641D55CFD6780421DA32EA2E5EA55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MAS_Remake_GUI 1.0/MAS_Remake_GUI.exe
- Size 11.4MB
- SHA256 3392719bea3457b252dab1ba80fd68c0087a596b955731b551d6e374c76cc5ea
- MD5 2a6b9a3f4f94c146047afb792d936bdb
- SHA1 9b61b4b513ff3e71f3f880cd5492cf6a194d50f0
- SHA512 c49e0de43ce6e732fb921897c1c1300ec9578d9474eb10a11f7807d4e8b0bff5014953a7dae9e11266b91a861d80bbcc5553e5aad4265a0024bfbd327ae087c1
- SSDEEP 196608:/yStJUIfBUGi50W8UAbuM0jnGCxdGjP5Ui2bjKVPy2wE4/Fe8xvEQa+wWbFvCnAX:/jfjfBU7aW87H0jnGCnGjKi2bjRo4New
- TLSH
  T120C63388BBD208D9E8874339D8E29666E7E0BA320364D58F5BF18C411D731E5FE79720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral1
- Target
  MAS_Remake_GUI 1.0/MAS_Tools/Change_Office_Edition.cmd
- Size 56KB
- SHA256 d4b0229ea3a7fdb124962ed4bd0516aa9f019fe38dfd6d5d4217087bc55d5d4a
- MD5 ff31b0e6055d2e621e3c4b55d5c01ddc
- SHA1 7f1d144411a564972766f371e166ce32c07466a1
- SHA512 f52a184b304795eed80e2c83c4416c3374babb025d80e259ad4e1600ca0ee5a914237bbe73d95e0a680910a40315c8cd5b2e334af32c0ad2eae8dee0a16791d4
- SSDEEP 1536:A1/Da/O2y/t/k/g/I7p/S/LuXr7/N/0/D225:A1/+/k/t/k/g/I7p/S/LuXr7/N/0/D75
- TLSH
  T14943F857B94360A602A732B9D5A7914EF76DC2A3C32197DC386EC088B716354B0FDB6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral2
- Target
  MAS_Remake_GUI 1.0/MAS_Tools/Change_Windows_Edition.cmd
- Size 48KB
- SHA256 b15844902198d6ed5dd26b29043b2a131582dac9afa0fc14034491fd71bf00dc
- MD5 c9564c66946269e6d4277a407e27a40a
- SHA1 137e4729174dbd26fd21046a22c52610f2304b7e
- SHA512 6a07b2d9e713220f303e4d7d391021fb84c7c14a3f2f838f8a14c248a03a2ca02aabb6c266606394b6014be377713a6119d4e4e6911522df759e10f534acf25e
- SSDEEP 1536:4y/Da/fp21d1/BX/rA/cz0ykWk2a+Rnu341/H:4y/+/8d1/BX/rA/cz0ykHO5hH
- TLSH
  T1BE233C87750251A402F33275A56B828AF72EC1F3A720974C795DC0A4776B355F0BBEAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral3
- Target
  MAS_Remake_GUI 1.0/MAS_Tools/Check_Activation_Status.cmd
- Size 47KB
- SHA256 c9a1688c7ac1409483e279c418f7b8b12d2cc7b232c65b38f0656e2cd741b4db
- MD5 27a52fac266ce18ba89ec46fb811a5b3
- SHA1 81bdc69384058a3245629295d934ecf8f5821a80
- SHA512 0f36930728aa4e8a4c6af412f2fd7ef6caeb993098ac160efb75796cb8ea2405d554c6f71e2d567a01d803aaedf5549c57feda7f9de7a780f7faeb7223744edd
- SSDEEP 384:TM51DLGNV1caT1UwZoio081ReKVwlfaNodso0XTf9rcKbVKQKUKypLw8wcH3L+rg:TMO1c2o9eyPvpnga+BnJbYTf4Jxm
- TLSH
  T11923D905FD1B926B57C733926E72C68D6C7482EB06FE54A878CCC884F124F6893F9589
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  MAS_Remake_GUI 1.0/MAS_Tools/Extract_OEM_Folder.cmd
- Size 24KB
- SHA256 8149efb071552f848ff87429118e9ad0bb9ff7ce0aa4bb428a83fad852e6d539
- MD5 84a79cc9a3d8fe4fc15e5c4c38dfec9b
- SHA1 ccb04c232de8465796ebed6c916d57836bd73410
- SHA512 3954402b5b210a75d0a57ed7808fc655343e61b6ae08594d0f6a6375868572713a119268957ce030f0a8754b3aa00e419364f1beb26395d7f6f0a600ae12776d
- SSDEEP 384:cbJk0Z3PBFwnJcT/BFLGIk0SCHx3kbbxtUYgv1cwY:cJZfBFwnJcT/BFrk6zv1cwY
- TLSH
  T1AAB295D72906A06281B737BB4A37914EF72DC1A3D310FACDB49D4478B31A38DD4A91AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral5
- Target
  MAS_Remake_GUI 1.0/MAS_Tools/HWID_Activation.cmd
- Size 81KB
- SHA256 d26c015cd129f5b1a84abe9b846a0eeb7ed20f2a03e38129e46efcb526b6f298
- MD5 7aaf569550c8d0e767da30e007c52033
- SHA1 67c2ecce036f9cf914719bccdc7ae5d06cdc6f77
- SHA512 ff0468f8a961feb85298a34f7f2cc3fad326e2d94010d84a70aa810b161412effb2009dfc1c72a68115d28f8237bd25742db013d5c52c61362c619aa3346388d
- SSDEEP 1536:jD/Da/u3y/DaKPPQVhEE6Zt/flC2nq7Df+lirvGHIxGrS2ciUf6s:jD/+/X/P/g3m3HIpL
- TLSH
  T10C832B07B50260A602B333B86E675686E31EC6A39371A35C796DC088774A74DF1FB79C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral6
- Target
  MAS_Remake_GUI 1.0/MAS_Tools/Ohook_Activation_AIO.cmd
- Size 164KB
- SHA256 048402b1a27af2b08da22c800595502f019ba297a48e157ec0b987608191f59f
- MD5 7ce4bf0a57da78880586f2b2ca4241e1
- SHA1 cf6f2167505d20f1aed056def4323b6897085df8
- SHA512 e6b37d443099b9aed26b91b56ccaf4b24adad7566cb644bab4b15b1b04ee7f0fd54167b7eaefc29069584e7a4de4a1e96edd63e65dd01e9ec7147b03a08e4c79
- SSDEEP 3072:Rk/j/0ZU/QN5Gfew3HIpZv2xcG1MZgnnwT:RfNO3ICT5Q
- TLSH
  T105F32A476E42A1F602B3F379AA57958EE32DC693C330A29D396ED094774630670FE24D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral7
- Target
  MAS_Remake_GUI 1.0/MAS_Tools/Online_KMS_Activation.cmd
- Size 172KB
- SHA256 d60586cb7ee632117205d1735a90bb7116f6b7c649541754c8aa27251370df3e
- MD5 62dd3ff0aa686180844e6ee204c56907
- SHA1 53c5437f5039362f17d33abdbbefcbea445d16d7
- SHA512 c3293d3131aea6dc8722ac12799525d3bb9efcadd16cc49c9b33763d4b8d286c9864f587ae4b5c7b243872b5ac9061f1dfddc39d25d3a2f87e7c949dc4b83ec6
- SSDEEP 3072:mJe/j/q/Y/FmUGgDM20e3HIpvGGjYcnck:mmmW3ILnck
- TLSH
  T15B044A47A54260E602F323BDAA569187F72EC2A34331E2AC356EC484BB5631B71F775C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral8
- Target
  MAS_Remake_GUI 1.0/MAS_Tools/TSforge_Activation.cmd
- Size 359KB
- SHA256 67ef13f25ca36b5f366bc43c5b219cd69d90967e5c9e34182e3accf1d142fc76
- MD5 37ff5581828b14a6f39c2e876c9adbfd
- SHA1 7c1b3513ff9bf791d4f6db1965a9256f1a07c573
- SHA512 cd8b2b4bd9c85177b293cc01dbad15354ca2753bb9e49489a90c57d83e2670ec85e627b197208939680f332de349ca3ef98f76a0eb56cfc93923dfcda2408515
- SSDEEP 3072:vz/b/5/x/x/52env0yf3/nNq/Q/8/O/3/UGs3m3HIpJZl0FcExVTGX2THiwPr8ri:FF/J3I2cEvTGmaiE0
- TLSH
  T149741945A913A5A705B33379DF42804AFB27C33303755369BAADC104AF7A309A2B5F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral9
- Target
  MAS_Remake_GUI 1.0/MAS_Tools/Troubleshoot.cmd
- Size 58KB
- SHA256 a09a38473df2583c9fafc0bf17b8ed5ba98eafafb24d0316b97f7f8a9f7469ff
- MD5 b5ca3be590257bfbb68da669d3aa76b5
- SHA1 a769c27c0b1b575c549624e4687dc94f95cc0363
- SHA512 9b5e6cc9873bcc0b721c19d9e55e5dec01eb415d8879793a350c8da80579399c0dbf418410e0846932477b77dc5a8ced7be3ed0a8d72e128526e4a3d3afa2529
- SSDEEP 768:cJriBFcnNI/rBFXk6MOgXL9DlVhIQ++iW3AaPhPa01SAuXmPGnI1jzsWpjE50tnf:Au/ca/bMOgbHkQHiW3AC/te0v2G
- TLSH
  T13343E813B60190B182F233B9DE37964EB71EC157D324AA8C759EC158775538AE0BA3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10