8f0575a8d726aa8e5025c32e2bce3db0a434ec5695a231896982c77b79ecdd5a

Sharing

Copy URL Twitter E-mail

General

Target
DSAgentSetup.zip
Size 35.0MB
Sample260703-pf835ady9j
SHA256 8f0575a8d726aa8e5025c32e2bce3db0a434ec5695a231896982c77b79ecdd5a
MD5 582d71386a23f9fd889a4d4f0ace0b23
SHA1 a759efa6ad9614131ba73d7560d32826306d33d8
SHA512 722888b11574ef3cd6e0e44c6df19b2536ca0658a4231bbcb6419e98b3beb5b0e442fbb40054b40c5efa919690e5733db53ec1615d69290f2a9175d09e0b592d
SSDEEP 786432:E7jK0l1g4e4BJOgskSZvKsiMHsndRbHKK0Z8ydA9k6lvc72Wa16xce:E7jK0feGRSlpkbbHKK06yduZRcfa1ace
TLSH
T1C38733CDA37177C269A1F93E9CD6C2278B0A670655F14D7A3B9FBB402CC92E315B9810
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DSAgentSetup.msi
- Size 9.8MB
- SHA256 59b4cc911c25c93a9d955093ec177cdf1f62b746f38ad1032c9dd91fc57447de
- MD5 cc5d3dcdcaef743c71dec9ffe26496b2
- SHA1 91c1c118f17bc477b41f36e498d9c2bcc421a4fb
- SHA512 9ca4b58900fc2c168bb4eab71ff95daab2bd7ed6b4b22bba6d7bdbf442711c1d5471649dbd19b8f857ee191caed8b57c1d26ce3c2c30a10d9464c5be4194a54e
- SSDEEP 196608:MumJl8O+/FBIJ9ERLfRFEsBOVbTOn55KHi4Cl7A:w+//UKFLP55KHit7A
- TLSH
  T102A612A774886330C291237A5C66F9BD1E3E4D08B5B8420BF27DB29F5B3DD609365B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  DSAgentSetup_Net4.msi
- Size 9.7MB
- SHA256 8f2989073baf735b3c6efd39e7098edb74fcf81082eb5d840ea28fce3c95d443
- MD5 67561cf71885403b40c66af8b567abc9
- SHA1 de2bfc28b9c1cc0442166e979460a5a2830e2b2f
- SHA512 90f5dee1c5ea557e7dd8d608303c88fe7ac00a272661cad900286a32f5641d0ea881b612a8eff3fb59399558eb7e428c778d8bdb8ad556137367ca6d79b7bf66
- SSDEEP 196608:du+dl8LWPDsSzypd6CBiAywEn4HSw6ZbTOn55KHi4+ZA+:lLNynXauWE55KHi1A
- TLSH
  T165A612A768819230C191337D4C62F6BD5F3A5C09F6B18617B23EB19F5B7ED608366B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  DSAgentSetup_x64.msi
- Size 9.8MB
- SHA256 efb519df373548ecd0b3e826b0571f3759aa3591bfcacef8872c205c8f695435
- MD5 d9dac1f95a5d5e75672282912795123b
- SHA1 198038eabb9a01a940de2af5136bf1ee5350903f
- SHA512 2a610e1726dc178971e0fa1e714f26934f564b2e6e7c0f8d667a252f426819fbb844cad6c1a9b369bf66a52ffdcd2354f6983d91a934bcf67868b08832a304f6
- SSDEEP 196608:2uLjLerzFDiVS9Bvkd3DjCeJRU4mQ4iy/m5CgsRF3OywRXB6lV3YpSULQ1Ed/TTX:PWrhazjCe44mliydXOywRXMvYUHE5X
- TLSH
  T1B8A612A374446270C280237A9966F9BD5E7E1C08F5B5430BF27CB29F5B3ED6093A5B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  DSAgentSetup_x64_Net4.msi
- Size 9.7MB
- SHA256 b3689fe876c64e2bbf06ac223824e945b9bd95e566aff7fa42a90ffe7146a1d9
- MD5 eadd8d0d0fd984cf0e4f45b8816783e1
- SHA1 a1705a0d27823348cb6a2d31d1b832ae8af1ef29
- SHA512 dffe48e2114586042ee1bb7e48f09a9d9c9c927bcc260aa9c3dc58de4c0e6589782f5adce9bbebe7e9b0883ea9bf285dc26f58e0bf687f44096acc0c90ad3e14
- SSDEEP 196608:DuJcz2YMYIyWU4q708fouYb7rtOywRXB6lV3YpSULQ1Ed1zzHaRF:YkSApQuYBOywRXMvYUHEbW
- TLSH
  T1E3A612A764459231C180237D5822F5FD6F3A2C09F6B18617F63DB19F5B3ED6093AAB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Setup.exe
- Size 159KB
- SHA256 dd49c2de7232cbc6f78166c4d3947f581a44a6f44fe0640caa911237d2884307
- MD5 1c20222f6d0c09e811e857b6c53fa972
- SHA1 1526aab97a86126f62a97406ae36b91899a1b821
- SHA512 63f6d9cce82cbb41beda9a277b0a23b2435064586a45242fa210eb891244d8988fad0f5dcf00587a9faf7806ab1f100cb4889f94ca01e9100fa944ba9ef86663
- SSDEEP 1536:Tdr8areQ5ukIk0LX+MtAgIdlUJGIyHnM6Aile0y3+2AwY1mwqRepQZIqPlyiPtqz:TqarF9WX+7UJgHnMPiTmjZVA9TMmRt
- TLSH
  T119F31928F65390E2D4723A3E499881787E6E6CDDF6B1023EF14CF31A5E70D845A9C267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9