e0817df61f051b81af83d66dda968eae7c48cbef1ddba98bda6741f469a55999

Sharing

Copy URL Twitter E-mail

General

Target
Vortex Loader.rar
Size 24.7MB
Sample260706-ts5npadt3k
SHA256 e0817df61f051b81af83d66dda968eae7c48cbef1ddba98bda6741f469a55999
MD5 09d1caea96587bf32d3f0c4793569cb2
SHA1 a4d16cfee8489293e826d35df7b9a76746f26678
SHA512 14097bea9078b980298945caeab02188116b9b67a4da96c1f39e21f0d328213607a0b408192273182e1e664976be61da9052df45e4a8547d590ab94c70900bfb
SSDEEP 786432:OJvTXnJtpeUl0THSIQafgu+VwszYIZIiDiEfo:mttrl0bou+KszYZFEfo
TLSH
T13A473336F2F6F11C29FCC4BC5BCE8B2B041E282A4540B90A69B953B97E2175B7341E57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  HACK/DbgHelp.dll
- Size 1.8MB
- SHA256 3d92df0984662298a09d988aff0bb7c3081a46bf48177b7af02d3552641f77e9
- MD5 3fbb5bbc320109a3adf8866289a81211
- SHA1 543b936a89fbdb0220381eeff0824b3968390e82
- SHA512 e4fe89ffa2b723a8162a7eae05f42639a6cf86bca77495d2834fa0f58131ab8fac8336901f8bdce19c5b5b49aa6c5c4b0056febccf42b8fe395401696d0694cc
- SSDEEP 24576:VOTeT88eTQhAWiJhXsg/537W7rDLIVn0a1pCVBz2P583pdj8DqF2gIMYT5q4NZrn:gCTwOkh37W7zI1JDUA583pEqF2gIr5vb
- TLSH
  T118957C5693AC01A8EEBBD23CC946851AD3F4740517218BCF21A8879E6F13FE7577A360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  HACK/HELPERS/CleanSystem/Check HWID.bat
- Size 1KB
- SHA256 62d2ef6369e8a4a04d1ab143bf8a4e72cede9cdc01722c387cdf94fb7df96ca9
- MD5 ed48ef00185dde33cfb5ed2538231d4a
- SHA1 6a62f8f2cc6b7a28a545657bf42ebc2c246f8371
- SHA512 54855af8359335a07e904e8d3a51dd1988733b726f411639705982a82554a84f6d5cce6af2b93be6857a8acbff35eebacf32610de805fd98c690b87e86740099
- TLSH
  T18C21C109BD8886C065DAFAC86B3A4272F1B5D05384711DCC2F6755205F81ACCBBEEB1E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral2 behavioral3
- Target
  HACK/HELPERS/CleanSystem/JurnalClear.bat
- Size 9KB
- SHA256 0cfa0ac908cb962bd283fdf4fb008e95d54394e5ff0d206c35e1bf9cdd6ad0a2
- MD5 94451f678eb3872903c7984feb1c8ab3
- SHA1 74f2037b3ed35cfcca1a73f2145b0de522b0fd2b
- SHA512 4a53708bee5e41d73e1aa7264b690cd9544cde6a952284e743a0670c547c1290431f5cb42dcf62aeee26390fde4b7a5db0d46b7086ebd50dbeb90280732013d9
- SSDEEP 96:gDf2GF6s+jRa1xwOw8sSr0T81Z1W1y1z1+dbJK4irfkJe0xH1Tcxv7xZeZancZ0T:Cf2s6sHbW8keMHucACvjjFoH
- TLSH
  T1561222805CDD851292D1F7623B6B8921C3BBB685AD189B9B48CC0A20591EECDC17E1FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence ransomware
- Clears Windows event logs
  defense_evasion ransomware
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral4 behavioral5
- Target
  HACK/HELPERS/CleanSystem/TRACECLEAR.bat
- Size 82KB
- SHA256 d5a862b6d01e066de296d48442b7d66adbaca27eb2b4e0751449a3b4ab98ea3e
- MD5 abc4ce15e67b86e8456873d6e66cc378
- SHA1 ff5395472fd050eac295e679d106f6b82c2d27a8
- SHA512 25b47219e8f78de3ff59fc3f584a46ad1531e789937eda0051aa81da44cb1c78de454bd280db8336aab86966f0e533ad890ed3e41861d8c4df71def6120a4f1a
- SSDEEP 768:z/SpfwYnYUOUphhOo8YDTEKaCaIu9mKe5AzwHIc2D7YruhgP+Irehni:z/S2IB84rZ
- TLSH
  T1AF83258035489731D43376D897CF9929AAB6E18B39F57A0744E17A0C994B82CC1793FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6 behavioral7
- Target
  HACK/HELPERS/Enable hyperV Home.bat
- Size 319B
- SHA256 9a4dfde5eb1781a9f605f41d9e43e9f2c0661b0c56067496663750a7ce2bf425
- MD5 641858fff1a914e98e1fd8a079232106
- SHA1 28b14e7cfad4516b2db1db14bb3cfa34fd31d72f
- SHA512 97c95c238370c576ddd5501b3344077dda843d38ffd74aa42095a63ead693ba71a982165a8e50fd97b2aa3ef1df488b07f82ee5b5cb0b89d057d87987fe9f9e2
- TLSH
  T17AE0CD2FD7E4D850A8061447F235C04A598C34571B11E5D57920B1E6D79552DE235B81
- MD5 SHA1 SHA512 TLSH
Score

7^/10

ransomware
- Executes dropped EXE
- Loads dropped DLL
behavioral8 behavioral9
- Target
  HACK/HELPERS/FIX DRIVER ERROR.bat
- Size 2KB
- SHA256 bc59df7c616b5f91a81a239e6da6b237376a3a7b9e0d3bab72dcf75ea470b2cd
- MD5 9a2f5a7c171c95e61fbbfe90c71e3e92
- SHA1 63cd733abb48a2c9ea6645fb058fc1fd56d66c12
- SHA512 642f077fa8285776a05ada5156ffba7807b3d5a70987230c8745d1ee4afb06ce12a93ac8ac79f6408c6828d3f1e82499d293bdeeac99368bd01f006b7768aae9
- TLSH
  T17E51279715E367B1A001CA7ABB63CA36C721F5938A3A6162055D341E9D8F40884F7ECF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
behavioral10 behavioral11
- Target
  HACK/HELPERS/system fix.bat
- Size 67B
- SHA256 f9355fa872a8e258d55a3805c7e22d6d9a7f56aceca27afba67aa657c922cc9b
- MD5 5079aeb73a034f7315155b336cda293c
- SHA1 09e80f7be773aee16f4f6808372ad5aba742eba6
- SHA512 8c139af67163c15c49dcfb037165d50095b57dd6387acc3ab72426a4245c9c20b61ccff00a0f1e3e66a66af09f3526850ee785bfd74e7aaab9778a3acba48974
- TLSH
  T146A0220C0B88C332C0008BCB320203228CA2A80A2A20A203EC220088A8C023CBE0000A
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral12 behavioral13
- Target
  HACK/StartMe.exe
- Size 28.4MB
- SHA256 ba1a117c249cfd13c60cadca56db798ce74d8639f2afa99c1ec3f70c6171304a
- MD5 e50ca0a93a00d1feb614e2affa9b008f
- SHA1 4d70b66eb55b1fe7afcc3319e4464bb593b3d82d
- SHA512 ce704ca0330f1c5428d0e95526c0825436c7beb8a5b620ed06036970ee33c3d0e319565973cc679dff21103e3b9df3bda5904da8bc4cb66024d16d1722530934
- SSDEEP 786432:1YEcIWF6DNQIx7xDArKviG+Lj69J/N65DNbM:1YlF+OOArKvQjKJ/Y5h
- TLSH
  T18D6713CA78E591ACC442C635D3852BFDD0D9789A4EB9942FBFC648023530D86CCF6A76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  HACK/libcrypto-1_1-x64.dll
- Size 2.7MB
- SHA256 7eb3fba2dbc1ea25c95bf6247ad03d769d71bec5498dee218d4c066cc07c3824
- MD5 a0c031afb19bc9a2a9f53cb3b5bf7ff8
- SHA1 ff8e61895ef976a45ba5b5ebeacbdbf68ab6f8ce
- SHA512 4f7e988251644bcc4c3ce0fb1148ab9fd4c21496f94076302e6e9582f42540ea6d5d78f896028e92e67af5eac00abbced899419c2aa14497f1db81e2510afd79
- SSDEEP 49152:aMxNIS+qKUEy5D5gfj/2kV2dHrnifBAD7yPOesVI1CPwDv3uFh+of:Na3GD51aBAD7tesS1CPwDv3uFh+
- TLSH
  T1A0D57B2AA7AC0584E9BEC17C89574627D3F1B85907709BCF14A689780F23BDB273DB44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  HACK/libssl-1_1-x64.dll
- Size 670KB
- SHA256 69f1d1dd8cc363a734972a67ac51538f9bfff990f1298d8d3665fa38ee41a084
- MD5 04b5bd1135fa4f31cb9c021bb7ff4725
- SHA1 62623b7fa42353db63482af4231ec6772bb8444d
- SHA512 887ca8412f47d4591984316c147d907344cb0b8630c24765a7f7e0d26d52048a55a7fc3604594c402dbbd1dde58471f374cb810e87b06c05039d269fbfb20246
- SSDEEP 12288:DkJ9vSIIiF7LMg4Ffduf17m7rj3ptZQReSo0yVpxw9CNGQgU2lvzh:eZMg4FFae3pbICNkU2lvz
- TLSH
  T18DE42A95ABB514A8D9F6C17D8A534A23E376F4141330AFCF0661893E0F1B7D82B3A758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  HACK/symsrv.dll
- Size 153KB
- SHA256 dda85902f54b459e7d151f4b7446f9e40fd56f6bbc58ba139853631cb16aa1cf
- MD5 8e40a8a8318e1cb168258013663b5a5e
- SHA1 2033f86d8434c9a317da7dc594cc66f164d4a83b
- SHA512 5571b39e3165736a776461af3b15247c4c1b80bae58ef4f516fc70af958d95fa8ccc12c18110ea0eb4fd32f06858bfdc095feefd07c8bbe2c696ce3c91f57551
- SSDEEP 3072:hjRFxAMpm8PzHhtOqck39e6rtmQTeKbTZfr83pPHh:hjRFKMpmmjOqcST8h
- TLSH
  T193E33A0677F80066E5B2A678CAB38617DB76B8501772C3DF0160C59E1F93BE59E38362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Clears Windows event logs

Power Settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Modify Registry: Disable Windows Driver Blocklist

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20