ae3ec63290a5b41c097c00b5904d024f00a1ed8dca921e2d0cc965808688ff6e

Sharing

Copy URL Twitter E-mail

General

Target
dreamspoofer.zip
Size 7.9MB
Sample260707-tml96ahz9k
SHA256 ae3ec63290a5b41c097c00b5904d024f00a1ed8dca921e2d0cc965808688ff6e
MD5 34934994770750cfda9e7a49795b931f
SHA1 04da59bee72b155b2b1c36f56314b91bdaab7c8d
SHA512 3fcaead99da7134540197d55035275f5533941ec6f2ba480ef4469dbd155e7c7604539a2a5f30660c3b75a66e4b8ba882520f255f67a2f9781c0a6621bedffed
SSDEEP 196608:FJanaW40Y+X54dIrn7anaW40Y+X54dIrn4:WnabaX54dIrnmnabaX54dIrn4
TLSH
T11D863340CE00BEF4C45B2B746236DA67191BA59CA372EC660927777E71C143B6EA30F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  dreamspoofer.zip
- Size 7.9MB
- SHA256 ae3ec63290a5b41c097c00b5904d024f00a1ed8dca921e2d0cc965808688ff6e
- MD5 34934994770750cfda9e7a49795b931f
- SHA1 04da59bee72b155b2b1c36f56314b91bdaab7c8d
- SHA512 3fcaead99da7134540197d55035275f5533941ec6f2ba480ef4469dbd155e7c7604539a2a5f30660c3b75a66e4b8ba882520f255f67a2f9781c0a6621bedffed
- SSDEEP 196608:FJanaW40Y+X54dIrn7anaW40Y+X54dIrn4:WnabaX54dIrnmnabaX54dIrn4
- TLSH
  T11D863340CE00BEF4C45B2B746236DA67191BA59CA372EC660927777E71C143B6EA30F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral1 behavioral2
- Target
  dreamspoofer/cleaner stuff/FED9.bat
- Size 104KB
- SHA256 bae4759483da860870bfcf32fbf9995bd92096f29c4f8507836a3038d8b2fd7f
- MD5 cbe07887333a77b4b80e15b4421ec6f1
- SHA1 3133524201bac56e92d276d5430aaa6ccaaab084
- SHA512 5c76ef45fbfa7e5af8a73e85b0f4541b43fa0d0c9b106581cccedca1dbdbc7a6e6234eaf4a4373c5fe70edb2948b0180347b78a623e8e1947c37e040fa6f8c5c
- SSDEEP 768:X/KZzmezl/svUsfg8gVhCBL1oPY8xC01n5xpoL8oPlRPOpL5LvLpLjLgzJ6:vg8gU61nvplxL5LvLpLjLwY
- TLSH
  T126A3E392621895B2D96704CC83EF864D3C7CE0CA25F5376242F2BA4CD94A83C567ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
behavioral3 behavioral4
- Target
  dreamspoofer/fixed-decomp.py
- Size 37KB
- SHA256 44c671dce0f559a2b9c79964f50927bafc857605d0ceb62c61ba52c10c5bc26d
- MD5 8ea4434aae6d379a2a5e1be42d69f045
- SHA1 9fee346b7b7589e6a2495d2738fabc41e77ba223
- SHA512 de3faf4fd9e8af364d892ea02b315834634082919e1e35d0b1ae22a818ee9edba1f10deb9e9e85ee5180d094c3c9d5cca173d6e689fc4441effa84e53a7f5fa5
- SSDEEP 768:4W/7U3LmIwB8dCTTi1+bjDEs7PaySD9u92x7SaqMIhhrnJ5a:4WYe2yMuBva
- TLSH
  T16303836AA5084012C393DDAE9857B8076F4F1EA7220D5634BDBCE1406FD523186F9FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  dreamspoofer/readme.txt
- Size 449B
- SHA256 4e8a3f5e2cc44fc230cd3fbf616cca02d5aa1289a61ddea930a25a2c87e3562c
- MD5 02e8333875507bb872f0ae6476a7df69
- SHA1 32e94770900dd4a6d80381cb931523d16ce76b79
- SHA512 397a5f220042fbc955bc25e342ebba768fec6720878755056ffd1d5ddb5228ed1a367f84c60c038309ae7c57dc20bfff48fbb09e3c257a82e5ddac577e50654f
- TLSH
  T18FF05CB9578AE2714245D5687718BDC88F1204B8E30ED751DE650C4F629100C9312AE5
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  dreamspoofer/resources/cleaner stuff/FED9.bat
- Size 104KB
- SHA256 bae4759483da860870bfcf32fbf9995bd92096f29c4f8507836a3038d8b2fd7f
- MD5 cbe07887333a77b4b80e15b4421ec6f1
- SHA1 3133524201bac56e92d276d5430aaa6ccaaab084
- SHA512 5c76ef45fbfa7e5af8a73e85b0f4541b43fa0d0c9b106581cccedca1dbdbc7a6e6234eaf4a4373c5fe70edb2948b0180347b78a623e8e1947c37e040fa6f8c5c
- SSDEEP 768:X/KZzmezl/svUsfg8gVhCBL1oPY8xC01n5xpoL8oPlRPOpL5LvLpLjLgzJ6:vg8gU61nvplxL5LvLpLjLwY
- TLSH
  T126A3E392621895B2D96704CC83EF864D3C7CE0CA25F5376242F2BA4CD94A83C567ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
behavioral10 behavioral9
- Target
  dreamspoofer/resources/dreamCleaner.exe
- Size 224KB
- SHA256 172f6c873b246e71c6ecf1c0fffb57ca96bc93b7c55046433b4218f514eddf29
- MD5 1c55c014e426a853488ceb2b9e3e1e4c
- SHA1 e818495d167286154a36dab6e98c7c7a434bc6c1
- SHA512 b9534a16f231d94ccde98ee7515e1f647a1672fd17adee49c1dd79370c06ce7710edaa87262c06c409c8cad0c14e9cf54f7dddaf18ebbc860fbfdf2b38657ed3
- SSDEEP 6144:rt5hBPi0BW69hd1MMdxPe9N9uA069TB2ayKcDtbqGN8P1erIjECij:rtzww69TQayKcRbqs89eztj
- TLSH
  T18E249D57B2A01188EBF581F6D9920746E73074321725A3DB277852B71B2B8CA9F3D3E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Stops running service(s)
  defense_evasion execution
behavioral11 behavioral12
- Target
  dreamspoofer/resources/tempv2.sys
- Size 1.0MB
- SHA256 b395103a618ec58c406ebd3d02fab1ea312b60f6e6287f94ca8a6bd5bb429470
- MD5 1d4a330b99e381728a2f1aa6694bfc1a
- SHA1 47b08200382a58051d0442bc6a63832c129566da
- SHA512 f9d2a1d111d423d6270c435f3271d2d8fa7c9d9b1c1aacc1b5dc8dd2e01c2344476f40e05692433ef96c4058fd28a8b2b1a06d4a1b0faf4de4c2a2349196661e
- SSDEEP 384:jztVRdFf06hAAq5/7kFWwT2Wb/wfT3iEx7bLDUJrX:jzjRdtkwXi3iUbLDUpX
- TLSH
  T11A256CE67B203CD7EA6B4078E0D44127F571F1922B2105DF4BB1C16A8E577F22A3694E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  dreamspoofer/resources/udmapper.exe
- Size 3.9MB
- SHA256 57ed53ba0ac715c8de18c67eb2e8dc0d04a061208f4a9947fed350e83a5fda72
- MD5 b7a6aae627a16e3e67825503c826933f
- SHA1 3b5385e392aec43b4507e145f50c895db31e9525
- SHA512 369e83401930695c2a01a307294727a3b749e991dbbf707e34842c930743ad334c5242a8cb062b31a4caddd2c70465cc3a75fec8c8919f04ef62f6397e46e0a3
- SSDEEP 98304:utftYwaghIxulQullaedyxX5zujLOn6ocWwywq/9:PDvMCxX5b6ocewq/9
- TLSH
  T1601633BEB7A14703CFFD33B59309CB4A8A37A9059444F5E73A32FB66885A53F8054168
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral14 behavioral15
- Target
  dreamspoofer/tempv2.sys
- Size 1.0MB
- SHA256 b395103a618ec58c406ebd3d02fab1ea312b60f6e6287f94ca8a6bd5bb429470
- MD5 1d4a330b99e381728a2f1aa6694bfc1a
- SHA1 47b08200382a58051d0442bc6a63832c129566da
- SHA512 f9d2a1d111d423d6270c435f3271d2d8fa7c9d9b1c1aacc1b5dc8dd2e01c2344476f40e05692433ef96c4058fd28a8b2b1a06d4a1b0faf4de4c2a2349196661e
- SSDEEP 384:jztVRdFf06hAAq5/7kFWwT2Wb/wfT3iEx7bLDUJrX:jzjRdtkwXi3iUbLDUpX
- TLSH
  T11A256CE67B203CD7EA6B4078E0D44127F571F1922B2105DF4BB1C16A8E577F22A3694E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  dreamspoofer/udmapper.exe
- Size 3.9MB
- SHA256 57ed53ba0ac715c8de18c67eb2e8dc0d04a061208f4a9947fed350e83a5fda72
- MD5 b7a6aae627a16e3e67825503c826933f
- SHA1 3b5385e392aec43b4507e145f50c895db31e9525
- SHA512 369e83401930695c2a01a307294727a3b749e991dbbf707e34842c930743ad334c5242a8cb062b31a4caddd2c70465cc3a75fec8c8919f04ef62f6397e46e0a3
- SSDEEP 98304:utftYwaghIxulQullaedyxX5zujLOn6ocWwywq/9:PDvMCxX5b6ocewq/9
- TLSH
  T1601633BEB7A14703CFFD33B59309CB4A8A37A9059444F5E73A32FB66885A53F8054168
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral17 behavioral18