690cf46edbb0bf7e35dc7a17edac3c594e598a773d0b25b69d709a243f48c890

Sharing

Copy URL Twitter E-mail

General

Target
wolfteam_mrmavzer.rar
Size 901.1MB
Sample260704-k2thcadv9t
SHA256 690cf46edbb0bf7e35dc7a17edac3c594e598a773d0b25b69d709a243f48c890
MD5 0bc90bd04cf4764f8d9b9bda8ac29b41
SHA1 b61449846c25c34ead0420fd4e5300a110a6b6e6
SHA512 0a14f44fbe98d9c232e5b621fc2fc79157309cd9f0095cba128776ba542f28f0a0d9ceffc31d0fee1b7dd2713ad7b6e8a81aca000c1c502f4ea29d06ea9df0bb
SSDEEP 25165824:AY3O44Fr6kUpEPoy+IGqAMBDZ8TzTiYlRehj5YLXtookqmn:RWUp6+ItAMBDK+8ehj5YLXhg
TLSH
T13FA933DD4A1AF4F35FE4692FB7BEEF8E528E4124093DD04EB29C25A5850385849F08B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  wolfteam_mrmavzer/Buddy2.dll
- Size 797KB
- SHA256 f9c5baa0d252d484cc2c911850ed0f25431ed17d1e10a6dd22db708d5c76d3e4
- MD5 3cc78c4b429d2659f76b7cde8d032559
- SHA1 8d34f96f74e29f27868c0cb09f16f3b29c7b2559
- SHA512 3f9b21f32c3055bc375ecdb9e6810b1de48f6b4368e8d17bbf8620c2cb4f34782c931bdb77f1519c66c958a3e6907b195dca0d461dde5deb1f29eae77a65380e
- SSDEEP 12288:vtI8LIY8mv7DugjiicOO9+aU1id3dEwCUtyeVmRDEgh+zglYF5oTnYqn6SWRl:lIVYsgARxZVmRRFlyIY+6n
- TLSH
  T19D054B10A7508039FDE711B65BFEA0BC982D79B08B9850C7B1C557FE5B3A6E06D32287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wolfteam_mrmavzer/BugTrap.dll
- Size 270KB
- SHA256 75f2e957f4c918349b575d89b709c7ed5139ef77efae67cd32b802779e131d4e
- MD5 82bb0fc80ec02a7cc288f66f84905a17
- SHA1 c92964abee647edaabc180b3e7dfac8f0a5d62c8
- SHA512 259f247a63ea5fa7f0e8b77cdf44c225c22550dc81d20dd29829659c2b7c5226668a0267b41c53dbe679f709f3d70162169d26b71177ae9699164c3ffc071afc
- SSDEEP 6144:S09fqFxCHyE6tJ6aAO9oQxdb3cwQwEyOfTBJ5:HHyE6tJ6aAO9o0t1hEyOfTr5
- TLSH
  T11B44AC117AC5C43BD1B2273858F797316FFA7920153ACA4FB7401B5E6E23A81CB1639A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  wolfteam_mrmavzer/MFC71.dll
- Size 1.0MB
- SHA256 4da5efdc46d126b45daeee8bc69c0ba2aa243589046b7dfd12a7e21b9bee6a32
- MD5 f35a584e947a5b401feb0fe01db4a0d7
- SHA1 664dc99e78261a43d876311931694b6ef87cc8b9
- SHA512 b1ced222c3b7e63e22d093c8aa3467f5ea20312fe76a112baed7c63d238bbe8dee94dfe8f42474f7b1de7aa7acb8ba8e2b36fdd0a3cda83ee85ac9a34f859fa4
- SSDEEP 24576:Tnc0xa+xDaWhzSenZncQfT0ExftQqDEu:Tn7VxWWhzSenZncQLVxft5DEu
- TLSH
  T127358D1272F1C132C6A315385E2EB77DB2EFEB7098319A0772441F4D6E76A4A871A317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  wolfteam_mrmavzer/NyxLauncher.exe
- Size 1.1MB
- SHA256 7e9014c0e945d47d8f1c2fd24fe397caeb8c50fcf88515f4697dc5d40c03cef9
- MD5 4290669ba0e1537d9cf5024df84e6bef
- SHA1 0bec30e6c552808179bbc588402f142fa34e6160
- SHA512 2479f951c75f3fc36f29e83de04719091d51f25934fcb531f0d22ba37ef8c4d032e7b8810888e00ac240b342469f148a28203df5a1ab59ffe1719508532fa3e7
- SSDEEP 24576:+/m5HfmQjwOFB+f6iMUfdFfEzYH8N4I0i7vXM3+63TXe25GB:zfmQjwcUfdFfEM3Y7vX/CTtGB
- TLSH
  T131357C0176EAC278F6B327309976D327063BBD458FB486DF53205E0D69B06D0993A3B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  wolfteam_mrmavzer/Replacer.exe
- Size 44KB
- SHA256 2c521a61562295aa61803c19faa63b36b3346e87adfba62a6709f0a3b4be37ba
- MD5 703b1fa40e1e68e3ac5003ad282cca04
- SHA1 495708a33cdebe75e2358049d1e52f3acee2627c
- SHA512 ccefb7721da22a8df5c4026a6833abf09428778e115fb2c3b24c6c430a9ef1c217629412f1ca98bd299c61278ac4a668ec75a0af2cd637a3db05656acab8c9d3
- SSDEEP 768:aDC8lCMwrIAsLo9e4Dy09gmi8kP96HLdQd2Pls:aJGvsLwe47tFkP0Rls
- TLSH
  T1AC137D23B4D2C173C84242B018788789AB7BA51117F466F36BA4169FBF227D1DE3A356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  wolfteam_mrmavzer/ServerDir.dll
- Size 577KB
- SHA256 341d04f7e2405e79d8f2dd98581fde02ae2cd2f6b162dee12e62e507c3f9b598
- MD5 8112ece844657265539349f9f37717c3
- SHA1 7633b2eb833e1bdc79bd79ce9c38f937b2ce3971
- SHA512 0a65da1362337a736e42f63939a2b438aa968fb499aafb23e0174cbd9cebf624621ebeb0026cc840fd9f8d7b9c88ce6db2357eb989b1c58113ba500f985a66ad
- SSDEEP 12288:PIQkEumOZm0o/P/2lWTWfrCq58+zCfNQpPMw1Yw2NlyIrZRFRLUnRVpL/k2p49rS:5bAm0o/P/2lWP8l2Tl2LdicoG
- TLSH
  T1A5C41861FC4181B1FADA01BFCBFD3E28994C8162173C15D3999D6D8AAE706E36732193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  wolfteam_mrmavzer/SndDrv.dll
- Size 72KB
- SHA256 84c3f1845abd41d1e83d858bbbd0402ba6655a6e9bec9dcc6f1488ea976de1b0
- MD5 18a79259103bfcaf7e7f99dcab24c3a8
- SHA1 366d2fa39a190344dee931628761e9549e686a9a
- SHA512 85327c81ac6dd34d7c855386ce8456ecd755a5feb3621bf6566a21934b9a99de1b9d7ebeb66b2d6fe26041009c3548a1df98b357712cb88e26bf4174b5642b24
- SSDEEP 1536:qiMK0h02dY33Ql3fKVepwfyUU47FachC7IuKN+Zldus:qiMK0e2dYwgRyUU47F/MEm1us
- TLSH
  T142736D32A3EA8EF4C68A2378151D2B5D06B7EF4187D845C7CB512F67C8351E36B3A186
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  wolfteam_mrmavzer/WolfTeam.url
- Size 74B
- SHA256 a86a59b16f53db8d9b344094eea9e98ca6df109efbafe561bfb8f6d704f92e1d
- MD5 110b384d47abbd79e9383ccf041763b3
- SHA1 9d932dc3d61e79c87e80d7a5c934bebf2acc1c9f
- SHA512 354e2961a674f63e83a81a35b2c336034fc5382620916dce2540e09b844d59e4a5fc8bd89d838c2e5038e1fccb2d46dfbc9374929a868ec28c256145389e9f52
- TLSH
  T13EA0220CB20FC0A0C802CC0CA2BCF800888230C38C82C8F0ECA08F0EB88A080A288388
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  wolfteam_mrmavzer/Wolftaym.exe
- Size 111KB
- SHA256 a2c901469929aee016e5a953a5a7de552797d8701589b6580fe1a860f9b1bbd1
- MD5 2690727c48f896cd7949cec043d1b07c
- SHA1 b60caa1eb071b9a03884707ebd76e768c63e4260
- SHA512 fd0fc6135c392a0043329a5e43eb23f7c971a6f00f0033603662d1640b1ad60f146d891629156e368fd62bf01cb9d2a2974e14d26c017bb57c1bce5d00d700bb
- SSDEEP 3072:S7QQUF/1XVI3kEALLSSWovLbxwvjVQyCulsxagz7p:oQQwPFvLNrLS7XI
- TLSH
  T17DB35B0135D1C570E6A605352860DFB18B7DFE704FA19EEB73840B7A4E742C26A39E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  wolfteam_mrmavzer/Wolfteam.bin
- Size 995KB
- SHA256 52361ce746f04c461d7dd51c0318ab35634bd1df9318381ebc53550ca41ba6b0
- MD5 543c5e6889f19782162019ef1cbd7651
- SHA1 f607e6ca557933c8f0f874beb89159bf4af06900
- SHA512 4e4da765535614ee4c3c99cd5dd5c00ffb46f1b8e47b5c0911158fe1d71a9188a29629ad8d5030a9e45ae6960650cba958969afe03f7e0fa3b13a2c7c9706399
- SSDEEP 24576:+LQCJHzkddR8VEZ+1iS+jI6lvScbcGG6NTeVY1GEQ:+LJVkddR8mA+8UacbcGrNT6MGEQ
- TLSH
  T17F251250B7D0C0B1E46512354532EB218E767C61AB39C6DB73907E8EEE303D9EA39366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral19 behavioral20
- Target
  wolfteam_mrmavzer/Wolfteam.dat
- Size 995KB
- SHA256 52361ce746f04c461d7dd51c0318ab35634bd1df9318381ebc53550ca41ba6b0
- MD5 543c5e6889f19782162019ef1cbd7651
- SHA1 f607e6ca557933c8f0f874beb89159bf4af06900
- SHA512 4e4da765535614ee4c3c99cd5dd5c00ffb46f1b8e47b5c0911158fe1d71a9188a29629ad8d5030a9e45ae6960650cba958969afe03f7e0fa3b13a2c7c9706399
- SSDEEP 24576:+LQCJHzkddR8VEZ+1iS+jI6lvScbcGG6NTeVY1GEQ:+LJVkddR8mA+8UacbcGrNT6MGEQ
- TLSH
  T17F251250B7D0C0B1E46512354532EB218E767C61AB39C6DB73907E8EEE303D9EA39366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral21 behavioral22
- Target
  wolfteam_mrmavzer/apf001.sys
- Size 10KB
- SHA256 7cb91f1a00c8ebeea13fd18abef1ea1710435e43aabd93abbf5e8e5967b418fa
- MD5 7b4beb577c5d0171f9b66f390ec29284
- SHA1 e74157f7d6b597b68d7b2d0964bdba0a07cfb3a3
- SHA512 248ae88b2e500304d05e0031a09aaa8a12659d43ab3a1a175182dd3bae379e365489b8cbe8d668101725c0cccabe31e209bc2650e9ae0527e79303e90a4d5f88
- SSDEEP 192:J+xKmyowJL/8Qpkqs1I5ZgjlhZNOl+ebCfluX:J+xYJLu1M6jRNO7bC9m
- TLSH
  T1ED22D79317252C63DC894FB0D1DEE662AE72F3C92FC1A187407985DA7D867F46B6800E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  wolfteam_mrmavzer/apl001.sys
- Size 12KB
- SHA256 4d149aadb785d33e1b5f4334b22e976a6ae1fc066e80c90d1294f1fff07fc1de
- MD5 4e755eb00b1fab59666a05d12a53b5a1
- SHA1 b019881f0129e1b79aca74c6cbcce8df9e090fa5
- SHA512 5236ad8533f72a8b1934113e5c157cf20893b725e83d14fddf5b38423cb0a7441132f8952d0c8498e4c6479be7969c8fe3f9d1592a80fc5c943394721c33db9f
- SSDEEP 192:EJJgFsBkdCp721ayowJL/8Qpkqs1I5ZgjlhZNOl+ebCfluyc2T:W2FsBkdy21aYJLu1M6jRNO7bC9Em
- TLSH
  T1094209A307212862ECC51F70D0EEE1566F76F2C62FC151DB447882DAAD867F4AF6814E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  wolfteam_mrmavzer/atl100.dll
- Size 134KB
- SHA256 87d88235f69c062e5b759f91253abaf7bd055937dd119bd26858237f812d3ded
- MD5 c85670ab64068f8080998aeba6c5019c
- SHA1 ef762c375486594f6604f39311d32442156ac8bb
- SHA512 870a27585f72e444fa9a2b46ab53ed420932952be8a3c4ddd0d831d72be0ac1b44992cf757de76d0cd667cd5b6150e9eb96ac2a8e7161a22c7d557946a12e5c6
- SSDEEP 3072:ZEi2/YxBFZNAWH6Gk5BsyGfGM8WzkAFoX:0OFZKWaj5BstfbZx8
- TLSH
  T182D36C1172D8C132D4E220B4869CB272076DBDA1076195CB6AD92BEECDF43D49F38B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  wolfteam_mrmavzer/avital/ApexProgress.da_
- Size 52KB
- SHA256 9e7e8c5b42600481f657ca67d36873b3efa635025bafc22bb069e4cfa34f2449
- MD5 1413cfdf241672a7fbd6bbef880affd4
- SHA1 a44d39cb612293d71a5b427cca3e4d70ebdddb5e
- SHA512 ea0eb27832a77d51d8d1cc8363e131992cc6841e8e2def6e14db8b9a38d465cb33394f9e61c1af51ae8bd66c6715347e392a3cde080413a66609bd3b6f0512e0
- SSDEEP 768:ff+zG6jw+DpSjnJZrK+6z78LO+/0dyWmPzzhHZY9610QZGc7XXqcHlt:ff+Fjw+An6kLO+/8yzzY9k0QocXlt
- TLSH
  T137337E13B8D1C672CC0255B109794B09A777E6110BB15AC3BFA82A8DAFB23D15E373D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  wolfteam_mrmavzer/avital/ApexProgress.dat
- Size 52KB
- SHA256 9e7e8c5b42600481f657ca67d36873b3efa635025bafc22bb069e4cfa34f2449
- MD5 1413cfdf241672a7fbd6bbef880affd4
- SHA1 a44d39cb612293d71a5b427cca3e4d70ebdddb5e
- SHA512 ea0eb27832a77d51d8d1cc8363e131992cc6841e8e2def6e14db8b9a38d465cb33394f9e61c1af51ae8bd66c6715347e392a3cde080413a66609bd3b6f0512e0
- SSDEEP 768:ff+zG6jw+DpSjnJZrK+6z78LO+/0dyWmPzzhHZY9610QZGc7XXqcHlt:ff+Fjw+An6kLO+/8yzzY9k0QocXlt
- TLSH
  T137337E13B8D1C672CC0255B109794B09A777E6110BB15AC3BFA82A8DAFB23D15E373D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32