016a8932867e00ee81b7a32ae45039ebcb494f1bc833a5ebf0b9305f22e8a54c

General

Target
V1.0.5.zip
Size 1.4MB
Sample260705-wam22aev9y
SHA256 016a8932867e00ee81b7a32ae45039ebcb494f1bc833a5ebf0b9305f22e8a54c
MD5 ed001f4f7ccb97d5789f356e7db32f24
SHA1 98a0fb6d1f6d9e7282149e3f7306496c1b8b26d8
SHA512 d39f9923b0e17bcfac246e5d460f416e4600e7be333cb3cb6151e6e2ee4cdd21da9a98cb1c4c795e52665d9b2321ce746a42e7ad1d8a74c0c16de7a47aa5a84c
SSDEEP 24576:rSGgY63NsnDRzpdVY2uGrz3+QfEGyV94+qqfAKvMiYUDM4WGil5EbLscy5sTckcJ:WGgZdkD3dVD73TMhg6VpY0M4PDbrWsTS
TLSH
T1EE6533A14F913E8B7627D264E24686B6F787138FE15058C3A750F9B089F728FCB89650
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  V1.0.5.zip
- Size 1.4MB
- SHA256 016a8932867e00ee81b7a32ae45039ebcb494f1bc833a5ebf0b9305f22e8a54c
- MD5 ed001f4f7ccb97d5789f356e7db32f24
- SHA1 98a0fb6d1f6d9e7282149e3f7306496c1b8b26d8
- SHA512 d39f9923b0e17bcfac246e5d460f416e4600e7be333cb3cb6151e6e2ee4cdd21da9a98cb1c4c795e52665d9b2321ce746a42e7ad1d8a74c0c16de7a47aa5a84c
- SSDEEP 24576:rSGgY63NsnDRzpdVY2uGrz3+QfEGyV94+qqfAKvMiYUDM4WGil5EbLscy5sTckcJ:WGgZdkD3dVD73TMhg6VpY0M4PDbrWsTS
- TLSH
  T1EE6533A14F913E8B7627D264E24686B6F787138FE15058C3A750F9B089F728FCB89650
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  LionInjectable.exe
- Size 275KB
- SHA256 d841bd3e0d1678b30e9c13fea3334b5abfa677e69ee6f64d5735faee1bb35b64
- MD5 c434a2d8f65eb6b7beb1e8b3f44f9914
- SHA1 e66bd5ab95f1f026dcb476b6288d208d844ccec9
- SHA512 5f7579109e6c9b03497f15cb1611a9ebfb9929ff6dec40fd5ee81f624632ab350d3122ead9d22384e2def5c1d1fb68caac6cd5e6a0f8ec37919dd2368642c567
- SSDEEP 6144:fs30FtPZiOdsa+xF6qQCHxoEwn6IjMMxds1oqMZHuAx9CnuFB2539kWQvNpuv22R:vqt5nlv22i8X
- TLSH
  T1B2548B1ED242296DF23B817DCAFB5952F9627C0C03D1C9CB13A199E81967EEC477A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral2
- Target
  client.jar
- Size 1.3MB
- SHA256 433b7f18d5b55848abb2bb33c298d604a67e9b60aff321ad11391e4e06418eab
- MD5 0766b80f37fc770eac8afec0d040511c
- SHA1 c28562f3fc989c3378fd2166323f5bfa4d32eb43
- SHA512 bcf90869a52287dbd7359b6987a53b61295643912c0402ba43255d5d9331667aa5b913f22d727e53b23ee1f117ec4ef57eec54e20c9d5e64a955d9792dcc7ec3
- SSDEEP 24576:DRZX9TdrSE541PWH+B/3+yfMSybFoecqMlKrEiYORM4OGi5VB58cMFspW9GHZ1w5:FZXDSE5wf3vkzUNI9YuM4XIVBd2sUo5e
- TLSH
  T14055136155EDE8BADD3B5332F2844122FE3E13DDE08A50A368687AC568F1D891F4C79C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  payload.dll
- Size 204KB
- SHA256 b900847ec44942d99732b817fd870ae81a44b71f658f0a57a6b484b36175f6dc
- MD5 9ac1a46d64e05533e93db904c6d78189
- SHA1 b772c3e2fb6a2df5996b1aaf237513eacc0d55c9
- SHA512 0d1f4507d4540c4d6cacf32864add0d219d7a8521fc6f907c594eefe0f357e807aa690b6bcc59d9fa03647c5c6acf34cead0042ca493acd1ffbd52fa1f6c0e7d
- SSDEEP 6144:b3M5u0myk1oqMZHuAx9O8ZVFM2X3NkWQFep62XGntW27p:vuU2XGZ
- TLSH
  T1AF248B1D9592396DFB2B803D89BA2562FC22BC1C43D1C9C723B299F80997FEC5379611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4