b9544314d2e33efcd38ccfbdc56586a616ab3d971176e040004259af8102d861

General

Target
netutil-win_2.3.1359.zip
Size 4.4MB
Sample260706-wtm65sa12y
SHA256 b9544314d2e33efcd38ccfbdc56586a616ab3d971176e040004259af8102d861
MD5 b59eda50e5b740dfd8cf92dbbfe28ca4
SHA1 6ece07f65af8744459af6b9bfce550fb5d3630d4
SHA512 d959dd1053a6b1356869c0448f19d594d006ca6fb095b7c1e514435959c46f5820863f341815e04bd9497141bef27e5b8fa0097da894ce21377411495fe8b4f1
SSDEEP 98304:gSq1fu2aBgmxsacgs3Kvku6G4bF+Vu73l3MSz5uZVu78B5fl0szB:gSmhamKZk3KvMbFu+N3Es7M59T
TLSH
T1AB263371860AD7E3613C267795991CDB0AF79D58B1212AF739CD8F52042AECB31E9CB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  8x8 Network Utility Setup.exe
- Size 4.3MB
- SHA256 9e89c1c28465470484ae5234daa8b05d73e32b23c3d6af44a5120b30b733ca56
- MD5 766a3fbf7c2e488e46ba28f6088dbe59
- SHA1 facc6d1cb4a847a84dbb9f66856067b15854e2b8
- SHA512 005ceb806c58e91c136be82031894458b3680e40feecebf0200b8e31a66f6686ff170002c300a190df2fc5ed651fe6d4a9e5341db9fb4fa771620ef2ee2f1756
- SSDEEP 98304:XT0kiYVomX2siCHWd2G0suDxmBmrPXRES55G7dcvEXXl10nu:XTmYGEVRHWdeDxwwJ/sevIXXcu
- TLSH
  T118261331501041B2E2F706F3BC24B5302D78AF1827F9C9AAE6C4BD19EAB94C527F755A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  0
- Size 184KB
- SHA256 2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80
- MD5 fe7e0bd53f52e6630473c31299a49fdd
- SHA1 f706f45768bfb95f4c96dfa0be36df57aa863898
- SHA512 feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c
- SSDEEP 3072:iaVVzf0r2vM357+pwnohBIiv8+2kt2GOTALPN2obXbE7PKPU9+Wxhsz7CMD:iaLzfpIsHhBIqgGOTALFdbz7f
- TLSH
  T15F048E1175D19079E7FB1E3C593866206A7FBA200FA0C9DE57489D6B2EB01C19F36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  engine.exe
- Size 658KB
- SHA256 700160b38089aa82c0d2544628b3fd0fa81d874a87df2e84ddb6a4e697483a62
- MD5 e2d91114ec42f0fbe0d3d0d7cc402d2d
- SHA1 74188ccd710a9a0176a9eab4890a25da4053eb00
- SHA512 972ce67d7d5b87d5d90000f61a1fecdb4ee054ae4e75e197b9aedcbfa8f3316363ee793959f9faa38995eef2ff04a43f21f4f24616fff2ec02359fd19cacaaae
- SSDEEP 12288:6zNB0JfiwSdYSui8zZH94I3H1v1NCKq2gbbL/I:+NsfiTdYSuVzZH9tH1v1r0bs
- TLSH
  T1EFE45C31645040A2E6F302F3BD24B5303D6CAF2817F9C9AAD6D4B91DFAB448567B721E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
behavioral5 behavioral6