62175c709054d909d9210e962ccd91d818bdd800be8350cecfdec914d23d12ae

Sharing

Copy URL Twitter E-mail

General

Target
Resanance.zip
Size 92.8MB
Sample260708-yyn1cags7k
SHA256 62175c709054d909d9210e962ccd91d818bdd800be8350cecfdec914d23d12ae
MD5 b55a86b5e39b8e87039946e6ca88cc91
SHA1 9b75a2a5811d41f077330bb189e49b3dda17073d
SHA512 6cade7e63f03a85110e79e6a380f40ad0d53d9ba25dd5ab3cd7c27b996d8a818e931f5b0c3522e8f4339b8ad1e2ec021e9eb9059a8320d8e19c76872046d479a
SSDEEP 1572864:Okg4K6/JDVgwwtYY1gEQLCLKx6XKKsiaO8816/oa0UUm3e/ACFDI3+ZayC:Xg4K6/JDWHSY1BLKYK9L1816gahM/ACY
TLSH
T1BC2833D3D610739BB146AD7ECBA3E39892087593954982B02B753761239F387237E873
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Resanance.zip
- Size 92.8MB
- SHA256 62175c709054d909d9210e962ccd91d818bdd800be8350cecfdec914d23d12ae
- MD5 b55a86b5e39b8e87039946e6ca88cc91
- SHA1 9b75a2a5811d41f077330bb189e49b3dda17073d
- SHA512 6cade7e63f03a85110e79e6a380f40ad0d53d9ba25dd5ab3cd7c27b996d8a818e931f5b0c3522e8f4339b8ad1e2ec021e9eb9059a8320d8e19c76872046d479a
- SSDEEP 1572864:Okg4K6/JDVgwwtYY1gEQLCLKx6XKKsiaO8816/oa0UUm3e/ACFDI3+ZayC:Xg4K6/JDWHSY1BLKYK9L1816gahM/ACY
- TLSH
  T1BC2833D3D610739BB146AD7ECBA3E39892087593954982B02B753761239F387237E873
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Resanance.msi
- Size 93.4MB
- SHA256 d1d2167fb741c96ba88b843647bd95ff36d28c5c5e15e3a5390f5583f742d9f2
- MD5 e39eaf13bf286d05580abc22071a2cab
- SHA1 575e3441a2c0d841400107a49fbdc867831db6f3
- SHA512 b54462340c6508912b5ee46f4cff39adf6066d2a0332a256f0f6497643f60cf3b052e56b2f083a31f9b93d6c68cc9db946daa5687aeed1183d4a0a8156ebd776
- SSDEEP 1572864:BQbYdb6tvbSp0PORauFdIPuV6kRjHsW1pXg4OTEx/AORJb1d501oQiD8cpSH1Kqj:KbYN6tvbS22QuFRV6LWHQxQx/LRzj01T
- TLSH
  T1C42833DDF748D306E5E6CD3A461AF242D434BE223B56443CC66C356FAB7EAD02725222
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral3 behavioral4
- Target
  VBCable_Driver_Pack43/VBCABLE_ControlPanel.exe
- Size 847KB
- SHA256 290ce0f5a52ab17c35de5782c390ef62d56ee61ac6f64290cb6c96873400718c
- MD5 bf51f5d7f3caccbc18d4b75c0b5161ac
- SHA1 26b2a247a162a59e95d1b389cd28a3220c7ba13a
- SHA512 87645c65e45d93f568cb8856bea4ceab4854e26fec3c115d52e41d64e7181db4caa59fcf7cc26d40e41aaa519daef0e19eb27cf27b28273059a989f309b5d7c8
- SSDEEP 6144:IC+J+1Hh9aphA2hwrYqrgLuBj2Xhntm5hJ2r9Un+LdqscE6:iJYDkLuBj2xntmgr9+yRh6
- TLSH
  T1CD05CF72475D32B0C440C6FF4B8F3241B401ADED219F947ABF4A3C699378E6D928AD96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  VBCable_Driver_Pack43/VBCABLE_Setup.exe
- Size 867KB
- SHA256 6020bbc2bfd20a5252379db011dba6935db1f8a2307419685e66bd55f13489e7
- MD5 6b77f43b3062f28b5e474ead1af1572d
- SHA1 767b3804ce2621886c401d43914c9d63a427c500
- SHA512 2e2443b99b5b084b18716235c6d3d673424bee7029686390b43e1bb580c754e141fc8c6e5aa8bde93307b678a6727bc4ca2a42add1ac8b92effdf3ba998f7bd3
- SSDEEP 6144:Kj/kqlQkyKdibdK2UTmPLagFOdhufzlmZeT7UmQBCDyUtHKwwo6dCnS9AzrLT2Ga:sphTZUI6HKhgS9APmGKRH8MYmmBHC3
- TLSH
  T10915A5E530623A03C9DC45769918BBFDB9C41C44D625F974AA3BB90C103A7D0B93A7EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  VBCable_Driver_Pack43/VBCABLE_Setup_x64.exe
- Size 892KB
- SHA256 369ce46f8544739e2a2c8d437e2873e3f13a0377934aca757c65eef75109f2d0
- MD5 a78c52d8910adc67950a45f654ae0953
- SHA1 3fb3acd091ae0afe62dfdac568b1475d953c2898
- SHA512 74adfdf9206d15b2e62f06b5b6dcf52788ebef9e29b8b607cb9abd2c7484ee43caea5ea2737d636252a123bc6d4979267a7a14df98b525f4fdb6c1c94e969d5c
- SSDEEP 6144:CjwbeTQngzHRhLcSTHQkyKdibdK2UTmPLagFOdhufzlmZeT7UmQBCDyUtHKwwo6p:zqpzhTZUI6HKhgS9APmGKRH8MYmmBHno
- TLSH
  T16715C7E531223A03C9DC45369918BBFDB9C41C44D625FA74A93BB91C103A7D0B93A7EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  VBCable_Driver_Pack43/vbaudio_cable64_2003.sys
- Size 40KB
- SHA256 5a726f3f1616f587c9f118bf337fd359df3f7cb9fc967a14229d59a31f2a9720
- MD5 326fab289623bcf815c38fcd71330f3b
- SHA1 fbf2925e172903220367421225cd2f103b44cb43
- SHA512 e41bcf4546ca6622814f0e7ef1bf3d0419368dc4e6255564e4af26b35bf1180b26e10491db4ad8e05356f7ee2c995b481f948df732ed49886bd1cc66e88ba10c
- SSDEEP 768:MvF2FV3Pibpw3bDe3Hs/iWyuZ0wuePi+4gj+qBbtWbZ:M92HibbxQu+JVbtmZ
- TLSH
  T1EB036C96E390654AD4D74678CAD493A3FB70B6C51B4283CF12A186E90E87BE4AF3D305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  VBCable_Driver_Pack43/vbaudio_cable64_vista.sys
- Size 40KB
- SHA256 703572fa9e8aa1616e6b2abd36b91a4718de77eadc02ae05ed2c8f304d058afc
- MD5 96b795de860f111144632a3aae5422c5
- SHA1 f33e58da294213a95ff6037db392e5e0656a9017
- SHA512 1642e9befffcb72e9daeb7a678df45b18216a0a0b64dbd4972ad4c9066fe61568e6caeb2a96ee8229c6b0999d79903a8af2685e605b4bb1a4a7c75e4b17fe652
- SSDEEP 768:Ak2Fde3TzpnexUGb/ieyuZnw+eXCd4gxqBmtyb09R:R27WzGO1+1Jomtq0n
- TLSH
  T1C9037D56E790648AD4964678CBD093A7FF30F6C51B4283CF12A186EA0E47BE46F3D315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  VBCable_Driver_Pack43/vbaudio_cable64_win7.sys
- Size 40KB
- SHA256 c7f3be383c81ab9aa642479f95872e40e19a4cfd72d4c8d7de80abc11b713e21
- MD5 e7204d7fd7362f0efaa502a4cb91ca1e
- SHA1 6ca8b4db6f9887b96dc1a38db85c688bb6b7ac5f
- SHA512 70f5b6356e42c88cb0e4ce65e6d2f4d634b057609ed1423339194d762e5f9a5125cfb87be919d5692f289f2bca9a87b01805d86840ecd4cd9f43ffc06e22d5e7
- SSDEEP 768:Sk2Fde3Tzpne1YC4/ieyuZnw+eXCd4gxqBQtnbw/b:f27WzSt1+1JoQtb2
- TLSH
  T1D0037C66E690658AD4974738CBD09397FF30B6C51B4283CF12A186D91E8BBE4AF39305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  VBCable_Driver_Pack43/vbaudio_cable_2003.sys
- Size 33KB
- SHA256 9650e20c38429d4680a7e603ecbe6601914ec4c94f8473112f21515bf53b84cf
- MD5 af264799ca75a33db63f3761bad046ff
- SHA1 1e013a57fb770d2981e09168ca9fedc8bbd693a6
- SHA512 9452f67027182c525a9b6f99bf286aa8fe9e8c84c3753e8b3e449c262478573adb6fd79f1b9ac1bbd9152362f76dc392ee114b90790c63b4459c8f576b181d15
- SSDEEP 384:srRCW0Hd7txBF465IJIPEM4PNGDWDyqKYWL17hH9oarNcT2U/nYPLyB1XTUHeMd:aC17txLJ5dedDyqKnjJrNcnbi
- TLSH
  T108E26C623A916A35FCC336F0829E76B57ABCE6A5170642C700280BF56F94BC06F7854F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  VBCable_Driver_Pack43/vbaudio_cable_vista.sys
- Size 33KB
- SHA256 8b02c26313b75ceb8fb9bd16b6b167cf70d7f3bc977dfc1986c0859f8c72b49f
- MD5 6cc2ce471671f7665ba15a177a3ccf10
- SHA1 196f0a41dbefcc0a2d58d6f65aa19f89968fe011
- SHA512 aae5439c5c828a53534b9c5df7888c49e9357b2165bbe66308bdd465bcbe248608e9a144ff8079667e54a850788a961e6b7c870052217c0275dc87c3436772ca
- SSDEEP 384:LCW0Hd7txBF465IJIPl4P3GDWDyqKYWL17hH9oazFsGT2UrnYPLyB1XTUHeMO5:LC17txLJ5RefDyqKnjJRsGjbN5
- TLSH
  T1E6E25C623A916635FCC336F0869D76B6BABCE6A5170652C700280BF16F94BC06F7854F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  VBCable_Driver_Pack43/vbaudio_cable_win7.sys
- Size 33KB
- SHA256 d047e3ee66e3ee023e598232ea22aa28dbb39adeabe818adfb2a72ab738df0b9
- MD5 f23a66967591aea2b8840f02b3da993a
- SHA1 abbf429459c844e72ebc472dc3b59a1aef705514
- SHA512 5576abd387696bc49d024680161f1092a66533eae6b648c65e924289cd8186c93a5263f1deebbd01a52b742c692660498cb48b33270f98b1a1b5660924272bc1
- SSDEEP 384:WCW0Hd7txBF465IJIP14PKGDWDyqKYWL17hH9oa37sB2UMnYPLyB1XTUHeM6:WC17txLJ5heKDyqKnjJ37sObV
- TLSH
  T106E26C613A916A35FCC336F0869D76B57ABCE6A51B0652C700280BF16F94BC06F7854F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  VBCable_Driver_Pack43/vbaudio_cable_xp.sys
- Size 33KB
- SHA256 9f9bc80a96cc94c761887749e51d9b4fb7ee6741ce624b8b2f9f85cd2e3fb02e
- MD5 37b9ba59092adfc1ca318a29d94f9d4e
- SHA1 d4f61969c38135eb3343ed34deea5bbc5bbc1a4a
- SHA512 86ddb1bc3120474176eac3b049e7df0167fed440db0e10cc092e20c6411a1071663991d0d4299f8cc37084a7ee7c7409b44d865273699b248f36b1e746e96c83
- SSDEEP 384:vPgW0Hd7txBF46lSbuvZ8w+Wb7NUQsAz76qKYMr1dhPCAA3vqnYPLyB1XTUHeMGN:ng17txLJl8wPUu6qKNdbA3SbdA8
- TLSH
  T1C1E24B613AA0A535ECC322F4C79E76B6AA7CE6A51B0252D7002807F56F947C16F3858F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24