1ab37ea1bd22a3530e933d4e4fc8b0d5c629a9d1b31978aece2ab9525c9b3c35

Sharing

Copy URL Twitter E-mail

General

Target
rus.7z
Size 77.8MB
Sample260705-l45ttsbw8s
SHA256 1ab37ea1bd22a3530e933d4e4fc8b0d5c629a9d1b31978aece2ab9525c9b3c35
MD5 b454815525883830947cb58579de507a
SHA1 d4fb290dde87d0b767ad619cc08d1f2e8a21a5cf
SHA512 48ee37b80a389aa8d6a4474fb0bc0893a9bcc421ce9477b2eddbfca0c8c1338c1a1514e9f16cc3b6a43c080f2bc864206c8fc9192b85fcd01b38c78893ab0a99
SSDEEP 1572864:RiKewaquXlUiiSQ18bu5rGGlkyy+WaHspv5tuUK28PRv0dsxm:RHwd2yEiMkmpZHm
TLSH
T1AC083365628A3E84BB6FFCD5207F81942BD84D364E26477B0E56B3259870FC0643DAB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  rus.7z
- Size 77.8MB
- SHA256 1ab37ea1bd22a3530e933d4e4fc8b0d5c629a9d1b31978aece2ab9525c9b3c35
- MD5 b454815525883830947cb58579de507a
- SHA1 d4fb290dde87d0b767ad619cc08d1f2e8a21a5cf
- SHA512 48ee37b80a389aa8d6a4474fb0bc0893a9bcc421ce9477b2eddbfca0c8c1338c1a1514e9f16cc3b6a43c080f2bc864206c8fc9192b85fcd01b38c78893ab0a99
- SSDEEP 1572864:RiKewaquXlUiiSQ18bu5rGGlkyy+WaHspv5tuUK28PRv0dsxm:RHwd2yEiMkmpZHm
- TLSH
  T1AC083365628A3E84BB6FFCD5207F81942BD84D364E26477B0E56B3259870FC0643DAB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Switch to English.bat
- Size 184B
- SHA256 db519e32ca0e7902af79ee2ca2c7c083f603bc7eafb71a3b1756eca32879d31a
- MD5 f5c4c384efd078c303d8f18a0369e198
- SHA1 46fc8b15ec748a5387065a9d57b81bcdae4aa534
- SHA512 c67cf2e9eec89f70ad9ebb94d2ab36952ffad77c794387fe1849c0bedf17c936b3d3ee3b0a863a44157ea096b509435dd3812aa4927e6f57f70341e7c42c0e1d
- TLSH
  T18FC00205B199362E29D98FA490371F2FD83BB15AA310FF00060D24B97BC5F706352460
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Switch to Russian.bat
- Size 184B
- SHA256 af6adef14c4c85fcc10a9ebf2f018798ccccbce781956b501d27f85b24e31a50
- MD5 b3f443ab2dbb6f4900588bfc207f042e
- SHA1 cb7a98af4be8edd21cb02a607ca38a0f6004bcb5
- SHA512 d81d74be4e497e168d569bb8fdef6e3c24cda0db46534285195c064f9c12e2d6424ca15018c1f188ebc7f19ee63a35fa6d42821b187bd3a4878947069045820c
- TLSH
  T129C00205A159341D20A18DA690372F1BD83BB11AA010FF00050D35B9BBC5F70E352868
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  _Russian/common.eng
- Size 9.3MB
- SHA256 3fa40de52113ac5b7485f08c3252e063d6c6c731edc87f49e398e708b848e899
- MD5 d9576d5060b5227759c32418eaf33a8f
- SHA1 66ecb8cd68f054dc2273fb071ffcde967304d177
- SHA512 416f7d9fdac1d017dd7399a1b66456bb0f7b88e0e9018a3aaa40d51f3cce6902c9709aee28ad3fd714c33d271f1e320b9b5f2602fea95a84b23024b75812f4b2
- SSDEEP 196608:v3uMnOw7gJNQ8dTACLqeKGF7/cWXqm1eiMkpm3DntznWCL7Ukp:vtnb78FACWeH1/3X31jpexzVPUu
- TLSH
  T14AA60243F5979E83C9AECB3DC47B5E6259766400B103CD0B7318AA4EA9D33106B8B76D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  _Russian/common.rus
- Size 36.2MB
- SHA256 b3c029913f4e8db77123c13f73fbb6bf9775939d6629bee0997d7d989c705549
- MD5 5e68a32d41e55122bd45e12f40986786
- SHA1 6084ffe95510472ba8c794e821d8554cfbd2ab4d
- SHA512 87e82120e121e0f1bba0afc16b992c0e132e6e362b9e09667f9ba5f2296482813f8299c904b110e781d8126ce82a997e9afee5b25822ca68325f38fcd654aa15
- SSDEEP 786432:pFSKF7ve9ZlxXi48/65D42bJCeOYdmCXJJgKHQ0mQ:dsnxiJi5EglpPXwHQ
- TLSH
  T1088733C3F1D32E4FD63BED7920DAB73155EE0C0AD646895B9628BF00627278057AE247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  _Russian/info.eng
- Size 690KB
- SHA256 2cf95a2da6eb48acd4cf9b47db1aa5280bc02e809ace4184ba4654feda4b89bc
- MD5 d4e212f3653cab4ed899c194ce414427
- SHA1 6e4ae9f5babc60bd6e9c96a0d3e2676c48887b39
- SHA512 b1b0c20ba205ced6b30ebb6d933ca8b64a9170c737a70320d476fab8019d14bc4febd0eb658a0a8fd8b38f51e5678d5c2ef4225e55a1fa63e5216a727d4f84fe
- SSDEEP 12288:J7NWE0dOrpCIV6IfLni44jHqNIH9iiqUr6Er1f8BgDVBe5hjao:JpWHdapCIYqYnf8BgDVUhjao
- TLSH
  T184E40122EFBE5D46C1FE3F79A16F47077D360BCADE21E581672C8A2224457510ECA98C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  _Russian/info.rus
- Size 526KB
- SHA256 467c75fd6f5c9d402d39071228b19afa3fbe3f6b19b8ec3b34b768305a8ce0f3
- MD5 9411f68d67754abcd783a9fe905e42ca
- SHA1 bc3e99cf48d575989e07f1a7f6b47555df89cfd8
- SHA512 85c772cd407761c6ea101915e1fc4ec5e83aa10792cdcc6be497247e58fbf8320bfaa91ebf571acb238b73338af723318215e224b0858adf9d0ffd5150d56667
- SSDEEP 12288:rpDOK+FbPgveO0qJmDA+SvqBDlMA6kogtA/sJhLBkhEOY11V77QGpi9w1SQrdBMh:NDSFb7O03DH4qpl/oysuBkhEOU7pucSL
- TLSH
  T1E2B423F623684B0B11A68DD50EDA24DDEF5F80AE54D39C91A799CC536B030B388EC677
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  _Russian/lang1.eng
- Size 592B
- SHA256 03a94681307bf36dd7df324d6a50625d864838f23723103be5a1848b07d44846
- MD5 8dbdfbebf50657e6b6d279ff7c28a1fc
- SHA1 2a9229271e1e873155ad0d93cc4e0f82a899ee98
- SHA512 e721fbb247114a7f74f0f99697c5be616cf8294f85ab8342b321bf6a433c1c866ce1cd8b036e9b867971883381f00bb8f326271084cd41ba2e07f6d78c5095b0
- TLSH
  T193F084CBC31B21D2F182EBFDD4484E42A912D3823068E6476848D2CF2DF5434AA13EE6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  _Russian/lang1.rus
- Size 592B
- SHA256 03a94681307bf36dd7df324d6a50625d864838f23723103be5a1848b07d44846
- MD5 8dbdfbebf50657e6b6d279ff7c28a1fc
- SHA1 2a9229271e1e873155ad0d93cc4e0f82a899ee98
- SHA512 e721fbb247114a7f74f0f99697c5be616cf8294f85ab8342b321bf6a433c1c866ce1cd8b036e9b867971883381f00bb8f326271084cd41ba2e07f6d78c5095b0
- TLSH
  T193F084CBC31B21D2F182EBFDD4484E42A912D3823068E6476848D2CF2DF5434AA13EE6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  _Russian/lang2.eng
- Size 816B
- SHA256 3692299c766fcdd767b3cf0997432c06046be8e916c2e06b98956022d649efde
- MD5 cf4b559c53ae3066ef5e9aae897073af
- SHA1 29f77552d6e4c7864162ff6d9e5b79687979daa9
- SHA512 a8bb9565f57534dd16ec2801c91b9f8eb93e83a3545e79863ff856871684c865c2c116d6447b6ad123ba5804cd5b7b308a3f36181799faf39c3bfc0bad1ca850
- TLSH
  T1C90149C6C72F54C3F182DBFDD0D80A615896E2C26168D963286886CB1FD50347C5B9E1
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  _Russian/lang2.rus
- Size 816B
- SHA256 3692299c766fcdd767b3cf0997432c06046be8e916c2e06b98956022d649efde
- MD5 cf4b559c53ae3066ef5e9aae897073af
- SHA1 29f77552d6e4c7864162ff6d9e5b79687979daa9
- SHA512 a8bb9565f57534dd16ec2801c91b9f8eb93e83a3545e79863ff856871684c865c2c116d6447b6ad123ba5804cd5b7b308a3f36181799faf39c3bfc0bad1ca850
- TLSH
  T1C90149C6C72F54C3F182DBFDD0D80A615896E2C26168D963286886CB1FD50347C5B9E1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  data/common.arc
- Size 36.2MB
- SHA256 33e13dd11819990ecf4c0c4608f5d754b144704e8c8ab905e0059131910b3dad
- MD5 0fd3ba1866b7a7ba02231db7c6ae9829
- SHA1 6e67c9d9748d333739ab349effb3f1f41004c35d
- SHA512 95f4c7496929d73cc6be24bde198fcc8fe373c1a91498828573a787dabe0f3e1be26788e3b740ac8794573200bffc79daf848d4b4efa670e47815720ade6e660
- SSDEEP 786432:JFSKF7WBPGsr94mVTk0TKVscBDUGZnQdSyTC7OXm8G2xSslW:9KGEL9nMhvUSymqXm8pSsE
- TLSH
  T13E873372F0D39C41EAFBD83382AB6E6225E04C0AD5164F17475D7B01AA73B946F9E10B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  data/info.arc
- Size 526KB
- SHA256 7e5231aa1a5ae041193f33c27d3074b8e21618334bb87ae26abb61efdb0844bd
- MD5 807bedadf39d8756e8c8cf78e5cd8f61
- SHA1 dd5a75aa97b5e6cd4f3efd19903a4fc55f012f61
- SHA512 6a54ff9098b8ebd37f871b254f04f5966a0c56e2aa935e0824eca980402857d790dbbf131a26d9f469d6d3d2126b2bc66812448543eeaf9a91fde1c0b1f47d24
- SSDEEP 12288:rpZ1OVRoeX5KspIbFXlFSbC5sJhLBkhEOY11V77QGpi9w1SQrdBMU9EX/:NZ14RTknbrFTuBkhEOU7pucSQh2U9Ev
- TLSH
  T104B423E223508B07046A2EE64F7F38958F2D5C5304E2F9E5FA486453AFB1363E5CD916
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  data/lang1.arc
- Size 592B
- SHA256 03a94681307bf36dd7df324d6a50625d864838f23723103be5a1848b07d44846
- MD5 8dbdfbebf50657e6b6d279ff7c28a1fc
- SHA1 2a9229271e1e873155ad0d93cc4e0f82a899ee98
- SHA512 e721fbb247114a7f74f0f99697c5be616cf8294f85ab8342b321bf6a433c1c866ce1cd8b036e9b867971883381f00bb8f326271084cd41ba2e07f6d78c5095b0
- TLSH
  T193F084CBC31B21D2F182EBFDD4484E42A912D3823068E6476848D2CF2DF5434AA13EE6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  data/lang2.arc
- Size 816B
- SHA256 3692299c766fcdd767b3cf0997432c06046be8e916c2e06b98956022d649efde
- MD5 cf4b559c53ae3066ef5e9aae897073af
- SHA1 29f77552d6e4c7864162ff6d9e5b79687979daa9
- SHA512 a8bb9565f57534dd16ec2801c91b9f8eb93e83a3545e79863ff856871684c865c2c116d6447b6ad123ba5804cd5b7b308a3f36181799faf39c3bfc0bad1ca850
- TLSH
  T1C90149C6C72F54C3F182DBFDD0D80A615896E2C26168D963286886CB1FD50347C5B9E1
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30