75f591ec8e82ecd143769c515f919cb1d61be158ead37238edec58080d6cb575

General

Target
Madium-Bootstrapper.zip
Size 3.2MB
Sample260705-s7gpqsgz7k
SHA256 75f591ec8e82ecd143769c515f919cb1d61be158ead37238edec58080d6cb575
MD5 6b4f0b1696256b71541bc6a293103704
SHA1 978f7c7b04fba2e6966c23927de29a51ae2506aa
SHA512 cf963828f21386b084014f4296d998f18985d7cf7d372803a37c275b3b4527133026241592ddf25daa8df0fb967054de4d089fd31ea02a2f7bf7b372df719bed
SSDEEP 49152:00gdei9Ls69ridKJ7yk8csy59GbnhOAG6fyoK+wocWALjE66eQmHcBGAQkIZlFJ1:JG3pJO9nOAG6frcOYQccBGAz8lFJIGvb
TLSH
T1EDE53396BFEC2C05EE2D7C9F4B501250FFA22A479B8D4294471646BF0825E21C6ADCDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Madium-Bootstrapper.zip
- Size 3.2MB
- SHA256 75f591ec8e82ecd143769c515f919cb1d61be158ead37238edec58080d6cb575
- MD5 6b4f0b1696256b71541bc6a293103704
- SHA1 978f7c7b04fba2e6966c23927de29a51ae2506aa
- SHA512 cf963828f21386b084014f4296d998f18985d7cf7d372803a37c275b3b4527133026241592ddf25daa8df0fb967054de4d089fd31ea02a2f7bf7b372df719bed
- SSDEEP 49152:00gdei9Ls69ridKJ7yk8csy59GbnhOAG6fyoK+wocWALjE66eQmHcBGAQkIZlFJ1:JG3pJO9nOAG6frcOYQccBGAz8lFJIGvb
- TLSH
  T1EDE53396BFEC2C05EE2D7C9F4B501250FFA22A479B8D4294471646BF0825E21C6ADCDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Madium-Bootstrapper.exe
- Size 6.9MB
- SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
- MD5 eb557c8a6c10e7d92e2955fea2ac788b
- SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
- SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
- SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
- TLSH
  T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery trojan adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3 behavioral4