641d45c4036d46ea59296a11a04de51ee0e9e61ff1c139847bcc44f72847ad27

Sharing

Copy URL Twitter E-mail

General

Target
ZTweaks AIM PACK (2).rar
Size 655KB
Sample260706-ckf7pahs5t
SHA256 641d45c4036d46ea59296a11a04de51ee0e9e61ff1c139847bcc44f72847ad27
MD5 06b5b43101b37595ce7155408e9f1d71
SHA1 bf39e1012c2b9a9da2a79c4dda7491182eaaa84f
SHA512 dd6fd0ee9cac3b863e6ddd4e55aff1dd90d59ee829a7ee7403046e01a8964a1ec6002ddc185b3c4cf09e7a1d171de4243c98ea05c66122ca3e9c86f8e9c342e8
SSDEEP 12288:52M5O/gzoP5BnK6jwm/2am7XxVxZQryjjwRNfdgkUe/p/x2HNnfF6J:52M4/tP5BK9tam7jQrGWfSg/4ta
TLSH
T106E423EBF35334623565EA03A31FB8126DB94D6867C0E85B8F530A68C25596F210B7FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ZTweaks Aim pack/Aim Tweaks/3ShotgunPellet (1).bat
- Size 1007B
- SHA256 c74748b53fffd65646fd229ab52c51705db06f5d1ca04105809993a640c26a93
- MD5 bbeede7f538c0b60e774b104c4c93da7
- SHA1 120ae3b889a94456bbdefe98ce2172b0f0ec67b4
- SHA512 4a3e48ea52d5ecb6d900ad72ca419da8f8de964404e770db5bb9fbe2245953d59ca30657f5a74faaae9b985bc884e801b9fe968f61f6605999e60c22e81fa15c
- TLSH
  T14D113B2B7934C977866A4128ED0F87623B37604722520D7D41A39160FCD26AF116FBCD
- MD5 SHA1 SHA512 TLSH
Score

1^/10

defense_evasion
behavioral1 behavioral2
- Target
  ZTweaks Aim pack/Aim Tweaks/3ShotgunPellet.bat
- Size 1007B
- SHA256 c74748b53fffd65646fd229ab52c51705db06f5d1ca04105809993a640c26a93
- MD5 bbeede7f538c0b60e774b104c4c93da7
- SHA1 120ae3b889a94456bbdefe98ce2172b0f0ec67b4
- SHA512 4a3e48ea52d5ecb6d900ad72ca419da8f8de964404e770db5bb9fbe2245953d59ca30657f5a74faaae9b985bc884e801b9fe968f61f6605999e60c22e81fa15c
- TLSH
  T14D113B2B7934C977866A4128ED0F87623B37604722520D7D41A39160FCD26AF116FBCD
- MD5 SHA1 SHA512 TLSH
Score

1^/10

defense_evasion
behavioral3 behavioral4
- Target
  ZTweaks Aim pack/Aim Tweaks/6SmoothBlend_AIM.bat
- Size 1007B
- SHA256 c74748b53fffd65646fd229ab52c51705db06f5d1ca04105809993a640c26a93
- MD5 bbeede7f538c0b60e774b104c4c93da7
- SHA1 120ae3b889a94456bbdefe98ce2172b0f0ec67b4
- SHA512 4a3e48ea52d5ecb6d900ad72ca419da8f8de964404e770db5bb9fbe2245953d59ca30657f5a74faaae9b985bc884e801b9fe968f61f6605999e60c22e81fa15c
- TLSH
  T14D113B2B7934C977866A4128ED0F87623B37604722520D7D41A39160FCD26AF116FBCD
- MD5 SHA1 SHA512 TLSH
Score

1^/10

defense_evasion
behavioral5 behavioral6
- Target
  ZTweaks Aim pack/Aim Tweaks/Aphrodite_Shotgun_Regristaion_1.bat
- Size 12KB
- SHA256 cd39f1a50f7b97f6e9e6a0ae10367a7f1906717f304578f6b1be7c37e5f312dd
- MD5 065e258932551b18ab02861a9513ffbf
- SHA1 9e630b72c4295307c4fb7e8f013a788ad249cea2
- SHA512 c2eb437f763dff2a6503ad1aead1db32a2fedd263112e7fc60af332e382678f6373c010d10807be86928a823bfb39df6b0c9366fc10d9fc2b8d6290c8362daa7
- SSDEEP 384:g9+46YJSDjbhfCvQEh1zCwdTCKyQah1zCwm4j:y+jxDjZCvQEh1zCwdTCKyQah1zCwmK
- TLSH
  T10F52AB3B70EA53928E110B6B1830C9BEE31113CBCAF1994DF8CE056DAB94BA775141F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion execution
behavioral7 behavioral8
- Target
  ZTweaks Aim pack/Aim Tweaks/HIT_REG.bat
- Size 435B
- SHA256 d36766929cb4884dc1e918cb428fa0d20d93284f14dc058e5a48884c047650ed
- MD5 86c626ff572016dfc82ec887a491df94
- SHA1 8726d5864f54640560cfad9c4cebb3c8b0c60718
- SHA512 a085929a52d09d45c4970b6b6e3d7565c6efe832632b8090b930bc6ddd7b6a4638f67ff4582431a4d14bf1e9c3dd3d6df163cf49973f4efd84e7dea9af61aa46
- TLSH
  T1A4E02B71686531799DE2D53BE6F38E26C309F885A08CFEBC8912031C15A7500D771AF1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

persistence privilege_escalation
behavioral10 behavioral9
- Target
  ZTweaks Aim pack/Aim Tweaks/RISXN_Pack/Shotgun v1.bat
- Size 53KB
- SHA256 f039dcb14c953d5a1db17c1a910673171c71f9d6bd72a1df3397682d12561e52
- MD5 06c979f71c6b4f43d090f8d8de5f1e14
- SHA1 19d7d504ba038d2b40d649ff3ddb43c071803de8
- SHA512 99547e28adb97c72232dd3fa96f5d8a3d3fac57e6359b112dd46ec3ebc268e3dd981b7e34d133faea30c4a99791e7b39db3fd58053afaa51c2bfe34908ecaaf8
- SSDEEP 768:WhN6AiYQeeX3BG//6epUhIIqWq60/YscQfzQhFuXLnV6/PF2WlkrOfY/+wkPsiJp:bIIqWz0Kp
- TLSH
  T16B33DF20BE6B4233CB95F22074638515EF77AEC354404B55789E321E17BF58AC87D6E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion trojan
- UAC bypass
  defense_evasion trojan
behavioral11 behavioral12
- Target
  ZTweaks Aim pack/Aim Tweaks/Risxn_Bloom_V2 - Copy.bat
- Size 1.4MB
- SHA256 bfbd14b87671d9629c9956a27095a24229a68fe88a55768045fde3fe7cf75a7b
- MD5 a41e8c43301b7ff5b466f2bba71633aa
- SHA1 0bedf72c45569e700a43fd3c2884e007c2df3d75
- SHA512 c37013751193eb27dd7b97443f6237b7ac7638642d1ed356436a04e0a6d1a84104bffafac5367c63a63c9265a6f77dbebb6ba6426ca303cad4125a2d2d699989
- SSDEEP 24576:dVavLoNBTA/aqztcrIEoul9WPAbJxOWA5hLjOKQZuoc1/8j4kzUuqJf:dVavLoTTA/aqztcrIEoul9WPAbJxOWwj
- TLSH
  T171656B4323A2C0E9DE6791B6C525D232D6727C14173896DB14E0BE2FFFB3A911A3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  ZTweaks Aim pack/Aim Tweaks/Shotgun_v1_2.bat
- Size 53KB
- SHA256 f039dcb14c953d5a1db17c1a910673171c71f9d6bd72a1df3397682d12561e52
- MD5 06c979f71c6b4f43d090f8d8de5f1e14
- SHA1 19d7d504ba038d2b40d649ff3ddb43c071803de8
- SHA512 99547e28adb97c72232dd3fa96f5d8a3d3fac57e6359b112dd46ec3ebc268e3dd981b7e34d133faea30c4a99791e7b39db3fd58053afaa51c2bfe34908ecaaf8
- SSDEEP 768:WhN6AiYQeeX3BG//6epUhIIqWq60/YscQfzQhFuXLnV6/PF2WlkrOfY/+wkPsiJp:bIIqWz0Kp
- TLSH
  T16B33DF20BE6B4233CB95F22074638515EF77AEC354404B55789E321E17BF58AC87D6E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion trojan adware persistence ransomware spyware
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  ZTweaks Aim pack/Aim Tweaks/TIER 1/Fix_Recoil_No_Bloom.bat
- Size 1KB
- SHA256 6091d9acedcd6f3772430e148ea5831697f3952127606f7d9f018b04523020ee
- MD5 8b12c8bfe0b0ada27f331a75b8257c04
- SHA1 48e58f487651563286785b5e0d673158234ade1b
- SHA512 53d15c01d31ec3270ff4d16831637161059e9e12dfb87d5bad2150355aabc5ad940b80b9156ab11641c11bf52722de457e1d9e204eb63c64cef1b1a92e9d5116
- TLSH
  T19521AC0A8E2F03B4C646E277F33284179A33BD83D4804F416825752D20F78569AB65E8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ZTweaks Aim pack/Aim Tweaks/TIER 1/MAXBLEND.bat
- Size 1007B
- SHA256 c74748b53fffd65646fd229ab52c51705db06f5d1ca04105809993a640c26a93
- MD5 bbeede7f538c0b60e774b104c4c93da7
- SHA1 120ae3b889a94456bbdefe98ce2172b0f0ec67b4
- SHA512 4a3e48ea52d5ecb6d900ad72ca419da8f8de964404e770db5bb9fbe2245953d59ca30657f5a74faaae9b985bc884e801b9fe968f61f6605999e60c22e81fa15c
- TLSH
  T14D113B2B7934C977866A4128ED0F87623B37604722520D7D41A39160FCD26AF116FBCD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  ZTweaks Aim pack/Aim Tweaks/TIER 1/REUNITY_BLOOM_RUN_FIRST.bat
- Size 1019B
- SHA256 ac25e97a25eabf9fdf895eaeac2ba2b08663c6c2eb06ec04b307173f7bcbec0d
- MD5 fba2ac2e6b4afc1d8cfde8eccde586eb
- SHA1 cccc5f73531fa52928dc417aaf9ab1730cd32d45
- SHA512 aeb4588a429c4fd78d5ebc8612a2e2980a09fa07789c93eaf71b596165a616e71c6824dd4964c5f92e3b30a287c96b6b980f9f676354e6ca3e7da0133e669d08
- TLSH
  T108117B2AB834C5778A6A4129ED0F87323B37604722510D7D40A3D160FDD26AF116FBCD
- MD5 SHA1 SHA512 TLSH
Score

1^/10

defense_evasion
behavioral21 behavioral22
- Target
  ZTweaks Aim pack/Aim Tweaks/TIER 1/ULTIMAETWEAKS_1___.bat
- Size 328KB
- SHA256 e6a4ec9a67fecd64098c926270c3bc82baf510311d96b22bdcc815aaa2c12dce
- MD5 7b6518e3cc3bf7f253b26b88e0b8de33
- SHA1 c098a71e88ad6ef05c55afb2b83bca821cb8d1d3
- SHA512 d49b06a3efb085553ff9ba4dbb04109fbc2a6a276c7be581cdd0492fc4e34d5f4eb9671d7306cafc2cf58ecbadf24119511448cc4319ba89d16f3e0cc060e8aa
- SSDEEP 1536:/giw5Cj5ChKCzKCFxE34OBHM8hD39h2Eq3ZqIfIqK/Ffwa+T:e5y5qK4KCn85Nh2NK/Ffwa+T
- TLSH
  T16B64F144463F4273C5D6F229A5838917AFBBBF8364C28B112C69B11E11BB647C87E7D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  ZTweaks Aim pack/Aim Tweaks/TIER 1/sabet.bat
- Size 1007B
- SHA256 c74748b53fffd65646fd229ab52c51705db06f5d1ca04105809993a640c26a93
- MD5 bbeede7f538c0b60e774b104c4c93da7
- SHA1 120ae3b889a94456bbdefe98ce2172b0f0ec67b4
- SHA512 4a3e48ea52d5ecb6d900ad72ca419da8f8de964404e770db5bb9fbe2245953d59ca30657f5a74faaae9b985bc884e801b9fe968f61f6605999e60c22e81fa15c
- TLSH
  T14D113B2B7934C977866A4128ED0F87623B37604722520D7D41A39160FCD26AF116FBCD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  ZTweaks Aim pack/Aim Tweaks/TIER 1/secret_sauce.bat
- Size 1007B
- SHA256 c74748b53fffd65646fd229ab52c51705db06f5d1ca04105809993a640c26a93
- MD5 bbeede7f538c0b60e774b104c4c93da7
- SHA1 120ae3b889a94456bbdefe98ce2172b0f0ec67b4
- SHA512 4a3e48ea52d5ecb6d900ad72ca419da8f8de964404e770db5bb9fbe2245953d59ca30657f5a74faaae9b985bc884e801b9fe968f61f6605999e60c22e81fa15c
- TLSH
  T14D113B2B7934C977866A4128ED0F87623B37604722520D7D41A39160FCD26AF116FBCD
- MD5 SHA1 SHA512 TLSH
Score

1^/10

defense_evasion
behavioral27 behavioral28
- Target
  ZTweaks Aim pack/Aim Tweaks/TIER 1/strafe.bat
- Size 3KB
- SHA256 828635dbd87c754db74efe2bd7913a314bd6d9d49c87672e393ebd73c3fe2aad
- MD5 96f7e670d2ef4fb7300660284df98ee9
- SHA1 2d427b13dcfb13d6a38dca49f9ca7a77871d06dd
- SHA512 f325a57c84c9e6d75522728c6c4ffb1fd8272335a55823220d7a5aadd7901a5fdc25ced9013626b6e2885fe6470498b67c9bcfb6189f16f06723cfe1a9aaecc0
- TLSH
  T16D51F12BB119B15286F14A64DC355275FE62B0CB07054CECE0B7A270B6926CF313E6DA
- MD5 SHA1 SHA512 TLSH
Score

1^/10

defense_evasion
behavioral29 behavioral30
- Target
  ZTweaks Aim pack/Aim Tweaks/Tm Bloom M&K/100_cpu_usage_2.bat
- Size 1KB
- SHA256 8ccf6a10aaaeca0aa14d81f8d01e8bdd2de8b3d22c45aca68845bb3ec8afbc70
- MD5 f19f46e26be8c375089453492d2407c5
- SHA1 b79cd1fa55686761f1882e95728e825aab0476b7
- SHA512 90923bc9b270f829b2eecce017f4dccab3177705793bc42b6edee72fe61b2de0e067f7fced04e5f942d3f564ecc6bc7c9623b73e8a98a66ded820b4939337b28
- TLSH
  T10D21F83AB414733147AE9E1404B5FC2E53D96AE6E6728904F6EF99C43F32CA0EC458D4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32