48ad764a6ccc75601898722e593a46e52379549cb76f6300c73d9553d704dd36

Sharing

Copy URL Twitter E-mail

General

Target
Valhalla.DSP.Valhalla.FutureVerb.v1.0.0.8.Incl.Patched.and.Keygen-R2R.rar
Size 8.9MB
Sample260708-kkn7asdv7y
SHA256 48ad764a6ccc75601898722e593a46e52379549cb76f6300c73d9553d704dd36
MD5 7e8e94e975432037bdbb1d6d542f77fe
SHA1 3ede3082714487e92aacec7ecbb8f2d9a29f6b46
SHA512 c29b570a6d55a40663c96f6a5b493c10fb6d9a26f2a671d930643dfbaaefd6cb98f23a2d9770a0789b2204b8b3852105d986542d95d543aa5502bbad1e681366
SSDEEP 196608:b/U6sq/1TPsYeECSw42eCfgelQRnF3KDQZ0DL:bs6Pva4VCfgeAfZy
TLSH
T126963385AAB1DF7BC90B075A4F4232CD8311F599360B21A13D9ED1ACEB9FC2247E125D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Valhalla.DSP.Valhalla.FutureVerb.v1.0.0.8.Incl.Patched.and.Keygen-R2R.rar
- Size 8.9MB
- SHA256 48ad764a6ccc75601898722e593a46e52379549cb76f6300c73d9553d704dd36
- MD5 7e8e94e975432037bdbb1d6d542f77fe
- SHA1 3ede3082714487e92aacec7ecbb8f2d9a29f6b46
- SHA512 c29b570a6d55a40663c96f6a5b493c10fb6d9a26f2a671d930643dfbaaefd6cb98f23a2d9770a0789b2204b8b3852105d986542d95d543aa5502bbad1e681366
- SSDEEP 196608:b/U6sq/1TPsYeECSw42eCfgelQRnF3KDQZ0DL:bs6Pva4VCfgeAfZy
- TLSH
  T126963385AAB1DF7BC90B075A4F4232CD8311F599360B21A13D9ED1ACEB9FC2247E125D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery installer persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Valhalla.DSP.Valhalla.FutureVerb.v1.0.0.8.Incl.Patched.and.Keygen-R2R/R2R.nfo
- Size 13KB
- SHA256 7e24501d1a51d008282073c53342f9d64492dcf4042a1f394441c29e5b66334e
- MD5 9aeda322ce55c022b42ebc0378d983f0
- SHA1 66b949b81c234254b8273fe5345655aa45a89575
- SHA512 35295986a78b47049bbd23eb5c1e076abcbab9b4691d79252607aad1962f9d0e957cc2ea5e58adfb9f73a688e8c8e79e046bd0eb791cb8e4d7c41dc05a1bc9b5
- SSDEEP 192:2CyVUyaf/FLhps88fsS8h8J8y8NpbZSYJ9iKT9uOVSf29+M:2Laf/FLrhmD8h8J8y8NpB9r9uf29v
- TLSH
  T19A521D204B20E7B8AA23C67B0E4411C0F295DA0A2D3934DC72AFD5B5FB97D7615783AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Valhalla.DSP.Valhalla.FutureVerb.v1.0.0.8.Incl.Patched.and.Keygen-R2R/r2r15864.rar
- Size 8.9MB
- SHA256 2b1737e39f6d766bbe809636679818e9c4cec6c47138875468ef65273d51bc50
- MD5 18d6158e0e1c04c9d8f21d1f7a974e3e
- SHA1 abe2232d12f94130f5ec93562f158363e44dcc50
- SHA512 d0dca4c098b6ca560278f5f1a6f0584ce37999483d2acd8d4aa067cf822c54897d11da01c78adccc20341bb4638f8d1be306a4dfaa9480ddf851070c2f05949d
- SSDEEP 196608:H/U6sq/1TPsYeECSw42eCfgelQRnF3KDQZ0DB:Hs6Pva4VCfgeAfZC
- TLSH
  T11C96338AAAF1DF7BC90F07498F8332DD8311B5A9720B22B12D9DD19CDA9DC1747E2215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  R2R/ValhallaDSP_KeyGen.exe
- Size 517KB
- SHA256 fdf53ba6309dca2c76d41867335a136ebb74346216e80664de136e46581b27d9
- MD5 6fcb45f0965d2e14accd797c02d55962
- SHA1 f3c05c2b7c0e98a62bef0146fe5e80413bdb2a01
- SHA512 dcf28da49e4a6aa2bc582a64be0a70d3444476e3c0c19ebdb5921354d7a92c017c61d3e5b168866e272c32b44b22489ebe1edf0738a74aabec08e70ce2144e40
- SSDEEP 12288:BX4Lc9t2Sll1iwizuhIK8sZFCWHlev/amZNQN58OJoWJ7YUdA9ePQpNT:B4LcL3iwiXKvZHFaNG58OuWXA9aoT
- TLSH
  T129B41215FA6485A3CC7247B158FFDE617AB7AC2E97AA19472384771CF9B3381810B342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  $TEMP/R2RJUCE.dll
- Size 238KB
- SHA256 09cc1c611ed98944314e3ac99ef4c5568cbd05d60c31bc2fee3877b28afba1d4
- MD5 a2bdcc5daa462c869fe58c6c77216ce1
- SHA1 4a8e96a8ed6e22381664d86c87dcfaa8aa007369
- SHA512 155d4a3985f107c4c656addd169cf674d05b41798ba4218686e66e4d57004da142c68b6968741240ebe31cf995540c77132830ed613e661371832075888f91dc
- SSDEEP 3072:eq8t6hY2ZbNIRlLOXf+3Y+MSUgyz0HWkQUENVIvg++CIWwryfsCTsGtOIT:qt62ONIlSP+IbRAOUEYvLXTsf
- TLSH
  T121347C01B891C472DA6E0934CC75DB649ABEB8504FB0E9DBB7941EAE4E305C0DB3671B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  $TEMP/bgm.mod
- Size 52KB
- SHA256 014ff2aea33267ae4bb89274b5b6dc48bf22caf051dcc882c339a8c0da705e23
- MD5 d6beadc81bc8481c95996e6333735bbe
- SHA1 cae63073b1a77fdd6f101d4b44a3d0c8578829b2
- SHA512 139a9ece9a2f7b1ac2fa530be205f545a60c67df1343cba1024ad7b1eb27c39ae84287598be43ba1414eace77814a1359f01361940b5650fcab4e2bd280a4d19
- SSDEEP 768:FJ2IWfkpGAgaxsaXAny2ESpZ5JCmBPw/VWgyUZ3DveY9:FWfkpGsx9CdCmH+37l9
- TLSH
  T1A13337DE9F177B1AC4896A705C5F4AA53F854063EA9205BEF058BF20F7BE3700E54224
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  $TEMP/keygen.exe
- Size 585KB
- SHA256 1293ffb2805fbd701c104d4b6be5c1a8d831ddbd929157f884aab01487356ddc
- MD5 bc544595d3f5ebd477b88390eea454b1
- SHA1 33ded970dc9a745714473a21afd2c303143d1357
- SHA512 b575a7a9f66c796f25d312d19960257966b694140edf8285e420e70c4233de4f0288564d29edcdfb04db96644d58a3b0be49385de354a68bc32bc5f5a819a255
- SSDEEP 6144:icmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOXEOAaZDCt/qPFo:ic/kEPDonR6Y436vR+OZiSto
- TLSH
  T1DFD46E45DF00CEFFF9B1B23E04A93996C9146F28461265BBF2EE0BF598BD28011E91D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Setup Valhalla FutureVerb v1.0.0.8.exe
- Size 19.3MB
- SHA256 214e5f59174e178d3737d48cfc59ff9fdbf78bfcbe626029619e70636f5567b6
- MD5 e214fbb248ab0cedbece67735f982907
- SHA1 591ad169e14ec9cd65f4535b29fe17e8b56977a5
- SHA512 ef1dd06a80b3ca7aa3c5961de5562dc6b3230fe2f1d7a00b9ae2efd06a88130d558da281e6b2cf7b14208b5656a4d606b54069b7a1596f80ee8396b9e001ec79
- SSDEEP 393216:pDRp2uleK4eiWbQHtdKyTWAjFoO3CKkzG:/p2ulv4NWUasj2O3CKkq
- TLSH
  T1CA17BE03677580A5C06AC13D96A79A87E7B274150B709BEB12A9475E2F33BF20D7B331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral17 behavioral18
- Target
  Valhalla.DSP.Valhalla.FutureVerb.v1.0.0.8.Incl.Patched.and.Keygen-R2R/r2r15864.sfv
- Size 23B
- SHA256 63a239937c08a8a66cf32afe871fcb544f50886981fc11c796bd636f740c7f05
- MD5 8c7f4a161615cce4b17747c2b1b8c0e5
- SHA1 ab461b344e8c365c93704352d34e0f2ba9cc625a
- SHA512 de7df6e58c8fb077ec7bcb91364eb218eed9f0f8d300e0a04781e191ea512179688c379471bfb623daa51ef0fccd57039554fb32893bdc3d29284b1801c760e5
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20