7fe534b51e8f6b76f6a824fd0a1583a96220aa9e978560db0c8eda6ebef79cbf

Sharing

Copy URL Twitter E-mail

General

Target
Zin_Episode01.zip
Size 226.8MB
Sample260708-p37htafy5x
SHA256 7fe534b51e8f6b76f6a824fd0a1583a96220aa9e978560db0c8eda6ebef79cbf
MD5 571f6e103ebcba744040466c318265fd
SHA1 f9f2136bb3698f8aa5b64bb85fed09737b927bda
SHA512 b63d33c717ce01c9f207efbe4e70b13a023e34146e63c042d5ad94e650c30897329013d4fcba2be4bb810b36f55d085a76e0c168a56bc475165036fe334f918c
SSDEEP 6291456:BT/mOyeJu44qraeA6jUKkJU4avV3o1oLtzUWdCC1jYAZ8gO:BTp8h6jQJU4iqWX4De9O
TLSH
T108B83373E8887324E61FE037558EC04BCC59938DAD942B1A4F4376903BBD9C6BA1536B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Zin_Episode01.zip
- Size 226.8MB
- SHA256 7fe534b51e8f6b76f6a824fd0a1583a96220aa9e978560db0c8eda6ebef79cbf
- MD5 571f6e103ebcba744040466c318265fd
- SHA1 f9f2136bb3698f8aa5b64bb85fed09737b927bda
- SHA512 b63d33c717ce01c9f207efbe4e70b13a023e34146e63c042d5ad94e650c30897329013d4fcba2be4bb810b36f55d085a76e0c168a56bc475165036fe334f918c
- SSDEEP 6291456:BT/mOyeJu44qraeA6jUKkJU4avV3o1oLtzUWdCC1jYAZ8gO:BTp8h6jQJU4iqWX4De9O
- TLSH
  T108B83373E8887324E61FE037558EC04BCC59938DAD942B1A4F4376903BBD9C6BA1536B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Zin_Episode01/data/Map023.json
- Size 15KB
- SHA256 c52abc01cd2a33ab34af2bae6a66fa9a13f0ff189d122d01d1d814d0655ca838
- MD5 f5717343b05a1ce2cba0736c410ce806
- SHA1 6150a2d3aa2c0bbbc25539a4b8e7a9e61c1fe324
- SHA512 c7ce3d980e8f9478d1ba03026e36a3bae49d76c740012553aabee7add817fc9f4a30cd100a99ba5b1f6f22bb591548ef7b4f50d94a5956e4e6b8a49ceceac490
- SSDEEP 192:EFWsssssssssssVdPO+k7+kN+d+bA+Nm7zn6D3xO+H+kW8:EvHfYhNm7zn6D3xneF8
- TLSH
  T19C627A39351DAAAEE3831742714F100606ED40773D4C1811DFAD4B3CAE9B5F7AE6DA2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Zin_Episode01/data/Map024.json
- Size 23KB
- SHA256 394c0246f452d88ac86b32ddcd0134795b49f340e36380f8044e96c822dfc6a2
- MD5 6f1c6a32b2d59cdea3a783daa3d5467d
- SHA1 b25a5aa3164f0c5de32acc92e35351db6caf926e
- SHA512 04ee9f73e9f9173e21c214395cf9fb255153d2e8319fc3c92e3ed84ffd9cd0a0c03dbe5519468d548d66b3656bd2e0c7a6c9ffeb5212dc5d19b7aab7381de491
- SSDEEP 384:EyBkAL8myhfXBX9kCP/+fD82XAv/OsiNA:JBkAL8myhfXBX912fD82wXOsSA
- TLSH
  T1A3B2EF3C211C58ABE3D35799A54F144242EC44767D4C2520DFE84B2CFD9B2FB5B2AA2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Zin_Episode01/data/Map025.json
- Size 11KB
- SHA256 f4edfb7a5f1ea0127117b905911bd089280464dc0320c94c76f46c934fab20f3
- MD5 068c5b39f10e8ad4d92b03547a6ab655
- SHA1 2ac63f3cfe2616a19bc7d7e56ba97e4c13d22a8e
- SHA512 f1c7b4c5658069f6e3769a145bcd8ee44bd709a2e41e830ad3e1e6dc44a7d57cded5a691a568680d4d7175631180e8d9c7a8a6d1f330729ff1e09c58e03465e6
- SSDEEP 192:+w5C+O+z+g+QC+k8+k8+kXuF3bFA0+C0+V:+Uni9QDKk1LFApCpV
- TLSH
  T16D42FE3D265D6C9FD2C3A389905F284252EC417B3D8C2520DF944B28FD9B7EB0B29A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Zin_Episode01/data/Map026.json
- Size 11KB
- SHA256 94b461bbb362000a46219adbc46feacc2fc3cc168bcbdae2d34163a03632f973
- MD5 c4e25aa3489e0628755c8019d38139c8
- SHA1 0e6fe4ca88ae6137d9af1fe234a7a19e765b3104
- SHA512 bbfa79c23cc936e7e4f77fcf44847e2127aa2bb84c592428851d17ea028f4952836ed6b0644688762425e8e3df3842641745bb36bdfe0db33ef7eddb2f68511a
- SSDEEP 96:+wFQGMRn+wk8Rn+wkVRn+wkORn+wkK6IQn+ktzMLon+ktkBuqn+ktdzE8R1/in+p:+w5C+O+z+g+QC+kX+ki+kXr1/0+mn+V
- TLSH
  T1A432FE3926586C9FD2C3A389915F384252EC417B3DCC2524DF944B28FD9B7EB0B29A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Zin_Episode01/data/Map027.json
- Size 5KB
- SHA256 a982e9f50e2121acb937fc15355c612a9d3795f2617e6939052fec7395a51873
- MD5 9d00e5f59da6adbbf11feb31f8288925
- SHA1 6b71658698e691198feaec83fc7e0b6746860c19
- SHA512 a465ef7749f9569ba2bb7c342722692b16de4193df736eb174e4d4f786c30ff0185551cf804472285e85675fcd32fc2ca4168ca86faa95fdcc04c377f70d90e8
- SSDEEP 96:EyFDjejjjjjyAb3HuYThLVR5n+wkUusn+ktdV:EyYXNJVRB+k+kx
- TLSH
  T18FB1BD79210A78D6D2431745A44F021A82AD407ABC5C3160CBAECD28DE8BDF39FBDB17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Zin_Episode01/data/Map028.json
- Size 6KB
- SHA256 e4f1ef46d5243f9b2f499270c2a6303399f87973c0974c792bf7708a3126eda4
- MD5 3bea209de0a43662676ebdaa2a12d1bf
- SHA1 b4bf0889ab75be4d9bdb649d4186652e5c8c6fd5
- SHA512 28e68378d099ae78bc40248f2bd7e30e148155188c3ca96dd105b05e3ba377806f78f2852a607b05a70290a0a86498f21c91b9f76dd4d0f1b7d4ac2222177723
- SSDEEP 96:EKFwXklS7wn+fk8wn+fk9uVVn+ktd0o8Jn+wkC:EKAklSe+S+H+kS+2
- TLSH
  T1DBD1AC3821A96E9BF2C34359A54F118506AC04753D8D5120EFE64B2CEDEF5F70B2DA1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Zin_Episode01/data/Map029.json
- Size 15KB
- SHA256 1433052ca2b59041b80c3000a400effc0fa79dde254bb8326238ebf0fb6be4d6
- MD5 f2de0628881fdbf834d8ad8c8e4f701e
- SHA1 9aa49a1f535a2e179d6abad878f5e4033ed30153
- SHA512 7b3dcae2695dfb89a6706479b49464d25a5828044da4411979bac5b7dd74e91917e598eb6c341bb5654347a4811cb1886438bdd5a1872f619dabe2718b5d7e55
- SSDEEP 192:gSF9bgkjaS+kAC+3+ky+Omb+E+R+/+k3j+L+k2f1+kI:gvHDuGOmaZUmUyqWV
- TLSH
  T1FA628B3A2568DDDB9393E389B94F114246AD007A3DCC6161DBD54E2DEECB0E30A35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Zin_Episode01/data/Map030.json
- Size 11KB
- SHA256 c1cf54c498bfb3952f9774da1195f7a37a22225c964c61d2b3a91ebd99f94a80
- MD5 eaacfa60b68c51d5de19f75925a222b6
- SHA1 bf4692159c56a9cf83c7f076010633d1e985eed2
- SHA512 b0745db60081fa82327c47882e852dc4088bf05cc3517980018d26ce6042ab551b19a7f341a999184e743f774376d692970b253eb50b352d29b69b188713596a
- SSDEEP 96:+wFQGMRn+wk8Rn+wkVRn+wkORn+wkK6IQn+ktzMAon+ktkSuBn+ktdzE8DpL7inn:+w5C+O+z+g+QC+k2+km+kXdpL70+VV+V
- TLSH
  T12A32FD39265C6C9FD2C3A789915F284252EC417B3D8C2520DF944B28FD9B7FB0B29A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Zin_Episode01/data/Map031.json
- Size 11KB
- SHA256 055ce5ac34cf4634f74a6e72af1785c9d46328dd7bf5b2e035864edd35a855e0
- MD5 4fa066d5d1ae93ff25f8b50fe56ff44f
- SHA1 3210733147712c7835684742d362e7489086b251
- SHA512 0b1cf930bb270248e2c35a9a5208511b4ea7eb97622871909f85041ba06654a82ab83e4169e9d8af107add899043c71c2bf14069d8283add40b51c7d65b345e0
- SSDEEP 96:+wFQGMRn+wk8Rn+wkVRn+wkORn+wkK6IQn+ktzMlon+ktk8uin+ktdzEYwD/in+x:+w5C+O+z+g+QC+kJ+kv+kXHwL0+S+V
- TLSH
  T16D42F03D26586C9FD2C3A389915F284251EC417B3D8C6520DF944B28FD9B7FB0B29A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Zin_Episode01/data/Map032.json
- Size 7KB
- SHA256 abc6d6986717791b206f07f50a01088980b6087bce7c248ebab39b045331d143
- MD5 020f9961664773d9cc181c37254020e4
- SHA1 9a95021ca70a86e32c58e0656c3f9c9d91a269aa
- SHA512 0a26ae95182e176637e61d07f539ebf47cb8c2821a6a25b24ab2f69138661d59019e2746ac7f5077414e20be5a1b9acd30dee3ee22580bbdfb2c99b68b8d904d
- SSDEEP 48:lAEAxkSo5OdOTCMZBccTsb8f621GICbIWQ2ffL0xLWPBpbEEcAiJuPwIJIX2r6uK:lFEgprRTmd29IKLkAEWnu0n+ktdbW/u
- TLSH
  T1D1E1F9B4036636A79085C784DD9E03A807A903713A983220EB6BCD69CDA74D30EB9F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Zin_Episode01/data/Map033.json
- Size 17KB
- SHA256 2bb4f2771596ea05e5610aa33654a1e28fc56eefe948fba6100eadf52bff161f
- MD5 307fdf3f595c0a9df05ca2fae771947c
- SHA1 bc65cc9d6893c9c2bf5fd9ca62628e3f2ea98f38
- SHA512 5a5109aea2f6b33e7750a2580e27a4be94120b9b9beedc55979e29e2fe9919c67349b326de3c0428eb20d94ea8cdc2de32e352054171e29233909bc70df48cfd
- SSDEEP 96:QqT866FO1UmmmmmmmOL6XgUFJsAs3ZLj8oJZjpRn+fdiuEn+ktdH:3T6TmmmmmmmOLQgUFJsRZLXb+A+kr
- TLSH
  T1958202B16B1EB5D6E1054B8169DE03310AEE617834A87010E78FD9A7CCA7993DCF2727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Zin_Episode01/data/Map034.json
- Size 17KB
- SHA256 0b6fe1a44c7f37ef674a8e88143af455dffa0cc00aa4f69f24c26469da6fe27e
- MD5 86ef48b26a5b1a84737920160ff2b597
- SHA1 15e7dffa742159bacb6049b1b6beed91e42320f4
- SHA512 4c06ed34988e6aa3be0932dd0989590cfedb03f6bd5a1557560071ffb66c870a5bbcd301ba91a7edfc7048abc2494be5a1ae77b936ff6c6b93ab330b985430c0
- SSDEEP 192:chKthBw4hp+oA+++Z+L+h+R+kM+kS+kqX+k6a+k:c6hBiC3MqEUmM6Bk
- TLSH
  T1F482BBB9212D58ABD2C38345A24F25410DBC417A3D8C1660DFE50B7CEE9B4F35FA5A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Zin_Episode01/data/Map035.json
- Size 34KB
- SHA256 0992899941b26093cb4b19a28c74295680a8fbace4e6aba4e19b35c114657337
- MD5 e721b1e2638ee0383d4553a5dc8a1aa9
- SHA1 d3e6163ee473b159cacd81bd8052559d23b5c7ba
- SHA512 fa760cb2582e705186a848e7a7e9938b7e375201a7afc725984cecfa8d14145b4c05c30c8cb7d96310a90dacc4a96c560fe4a8dac96acd9bea730662dac4bb2b
- SSDEEP 384:+83FpJpcpErSrBrazHcycY3Y7n6kGYbI0nZPvpFMf:r3FpJpcpErSrBrGJyGv0nZPvpFMf
- TLSH
  T12EF26939311DA9AE93935786B14F004206ED04723D4C2511CFAC4B7CEE9B5F7AE6DA2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Zin_Episode01/data/Map036.json
- Size 7KB
- SHA256 70463aa15a9feaaaa3ab480c9bab28dd55f6d535a6fc0975a191ee8f0e4a9b30
- MD5 b569b659d1c4b5c90c9c2b58547d7f2e
- SHA1 3b049ea525e009308db3722873474b544d814229
- SHA512 9990e38216ca033b34400ba49f3353b2015f0baf0baf89d9699e77bfa19ca6ab5c872dc17d4003939c44e027aa61f34e3effe141ba26b666ddb8179d996cb01e
- SSDEEP 96:E8Fp6sRpDbblwwkFn+kOdGizYjn+wkDibrn+wkWWuBn+ktdu:E8LrRRbmJ+khr+Cj+6+k6
- TLSH
  T193F102B9105858ABD2C34349A14F25421DBC41763D8C2260DBEA0B7CEEDB4F38FB5A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Zin_Episode01/data/Map037.json
- Size 20KB
- SHA256 69bd2d93b22df3b93151b9a20af350a86602e5abe15fc35cd101a8f66ac9b937
- MD5 a7cbb70f5311cd68668dde80b3a24542
- SHA1 8371b9f5a3dfcae612055f7ad308203f672842c2
- SHA512 d5e64fc696b52ae473e6b3c1b633b7209193265bb50e10896b9cb1974d352db58a6038adee9688d1cc5f89f284370705afd06ba5fdfad596a7a4f4e1bbe2e7a0
- SSDEEP 192:bLpC+t+S+q+aC+kL+kKUe+Ie1hjsdOsY3R0CSJG+U++:bpIzbaDZBUXIeLsOsY3R0CSJvJ+
- TLSH
  T19B927D39360DA99E93536785701F144212EE40B73D8C1812CF9C4B7C9E5F7BB6A2DE2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32