59c7606130cfdab8c637430f6d90a9208112870bd5150d0637b5c8a56edc71e5

Sharing

Copy URL Twitter E-mail

General

Target
CSI.SAFE.zip
Size 823.9MB
Sample260703-brl6vaev8k
SHA256 59c7606130cfdab8c637430f6d90a9208112870bd5150d0637b5c8a56edc71e5
MD5 90325cb7e1f69da3c3f6cc50970ce7c5
SHA1 d0388e5a7974710367d50182bab4ca345c02c9c2
SHA512 b96d0d3f513ab61cf6f84110024e62c344f8d346d9e41c125863e6031cbbdf7b44bcf5d633d7ab229a3ea3f45323d48aa03bafb2509de3c0a5997036ea601f95
SSDEEP 12582912:/DwN5yozPBpXAVlbBV8Cp8zAtkGHwj8WXYTWBqsclmGXwe9kQlvPTYrIT4YZy:yyoDBmVlv8CEufWoTHhl993YCi
TLSH
T1A49933C3B6D776E3DCAFE364228DF43A6148DA7E62140492ACBD571F446C80F6113AAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CSI.SAFE/ReleaseNotesSAFEv2270.pdf
- Size 134KB
- SHA256 85954f2a08a7139728a99411c856718b3dd26e54878c51e87f7d396b59da3f0a
- MD5 a492fa49a81484191a1c700d1c06257f
- SHA1 9a209f5070fdac93f54cc4edeb09d9292affaea5
- SHA512 572b1d71ebacafa5754e37d27ce9ff5fd6b0edcc5f1668f350e8ba617c959f123e11ee7002c151450979d8209a7b1e320679bd882f30e8d8b7cc74eca2bb9869
- SSDEEP 3072:rNMYrxXz3BWeMz0TBFQ6Af/viQdHT7E89geixZ8lTJ:rNMYrxX1tMzKFQ6Af/vfHT7EmLAZ8v
- TLSH
  T12AD312B9C46CA9DCE8E5F5487A6C3D415416B21F61D8283254E82AC4C7ADE0C6FE27E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  CSI.SAFE/install/SAFEv2270Build3220Setup.exe
- Size 819.0MB
- SHA256 e3aaf54691d8429b85ae132121b379599ce8eb0685bfa4288ba0347f764aaadc
- MD5 32ae0c080d24d93b780fd65b77f5635d
- SHA1 f7592a784f2c7e44b110a5d789602f0ed0bc9362
- SHA512 0972044f733bde13fb041dd70b5951b9538df49f8b24203cddde4722a3d5fcf427d887361643192a826f14e9fa01bea7587d54449d521b800b308286f2eabc44
- SSDEEP 25165824:pdrHLdgEd1ORGCrpFah8+03alebAlcrUUB+g6t:pdrHJgEdIGCFFV+cagLXB0t
- TLSH
  T1EE99332F5539C07CCBD053702C2F2DA9EEA9A83713AD0066B620FA2C5DF2A655773647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  patch/SentinelRMSCore.dll
- Size 102KB
- SHA256 d9dbf4d6f0250571dc4155f1c6a94a123e692d006109f0b922c45daf74c98864
- MD5 bcc5b36599e95ac56d4efce4c8021876
- SHA1 4a2d89333bd3a23fc73a1c6f926bb929d78667fa
- SHA512 4c2bf2be0a2d6ece8c57de531f838f3798fef2f03119910bfb70de4d672c706cd9db19d4a97f911567f61e646503a91f04683521c45e3eed54b1832c8649208f
- SSDEEP 1536:on1QvCItHlow7nPOmaQoDrVZ2Np92+0GTc7nYc3diOsSKecvPKOKMEGcdE9cU3c4:oCwwzpaQArVZy09xtM1
- TLSH
  T147A3C62966F9CF5CE6EB1D7399F1614A5F98F4C10D63EFBF0D67242A38A12004A853E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  patch/csi_safe_v22_kg_lavteam.exe
- Size 4.7MB
- SHA256 beca3c02baf441233027d088f932349c4c2ec127e036bfe27270cb580d2f4426
- MD5 22689c4bf23ba57f5c0a3d0afd185f1c
- SHA1 a6f244953f58545607675f70da249531c3d52dda
- SHA512 cc269d795f0e60fa2407732617daffce1738f7e1d41f9c08a51e7c22bd04f0e18d0a5da95e33bfee966f6205587924da4c69303b852b9235e16ffbd9c1c07cbf
- SSDEEP 98304:8cLlWSLXR3dJyv3SbkyBN5IWZKpx8rkElsy8PwqBBGnblDqgD:8c/23SYyBN5IUktV6nLD
- TLSH
  T1CA363384721704BED095B6BA0329B7BC4C35AB4B47F29D83AF13AB046D793D746F2681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8