032be547f5163d65af0638ad696ea3973abcaee22e6fe0b1398ca28ab39b79bd

General

Target
mantra.zip
Size 10.4MB
Sample260709-ckr9yscx2s
SHA256 032be547f5163d65af0638ad696ea3973abcaee22e6fe0b1398ca28ab39b79bd
MD5 89027e4f7c4557651782a0467a74f6bd
SHA1 fd07933cc116b40e5e8ec9b4c430918bdef3e0f2
SHA512 e0460b8d12b955433f1862d17408fd78446bf9bae387ae46ac0952fb5e595bc70041af72b4db05b87f359559071ea64bdccb9d9e9a7aa73dbe5d819266359dc3
SSDEEP 196608:BakrWVwM30KsgZUHmxNVaUFqc3bRt/oMF7CHKCbt8aJQ/zVhUDi5cH/8:BoR/ZnxNIoRtobbt8wEd5cH/8
TLSH
T151B6331E8E5C0996FC6E660CD57020B24FCD9C1E0F698F11F463D285EEE1AEEB585263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  mantra.exe
- Size 18.3MB
- SHA256 3518ce8376982e3ec66f3520d2c19edb32c3e33c7e614008e55752bf85bc79ca
- MD5 638fe084cf4a48870bbb2e92a1995f6c
- SHA1 3208634d04167efc8edbf1d4aee400e5388b9c73
- SHA512 5ea1d30e8b23e06a44bd5da7dad1ee00d6b0696882caf1475d5a324a89189205ac0b2b063fb19db17a54d72d07b130cf6568b451301e945ff42859c7f11249d5
- SSDEEP 393216:eqxN+MxNcDPG7B3Zdp1uPGiSPWw1JLrqo2:eqxN+MDc67Vfp1uVS+w1
- TLSH
  T1E117AE33FAA105E9C1AE963085719362BF31BC465F2527C36B90BB292E73BD05E75390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  mantra_installer.exe
- Size 2.1MB
- SHA256 a89aa98c188c1f14d0eeff7cf10a215c85cd60394eb037d5a0917b95a736bb4e
- MD5 dcbb6a06b012c91519d18a419eefc0e7
- SHA1 4a849c675e6569ce2a19cbcf330fbf46961cb99d
- SHA512 706d3658fb5bfcd0c782cc97661b2c3eeaddb476cf1c161ff552c93d4bc2110b2100e4bb48dcd9e741a9b599f0660034ff211c4e16fce477664b483a2b47b47c
- SSDEEP 24576:mu3/Q7VS9nDsk47PpERJQ17sXY6weHByMs1SNcuEORIBelejKKzVgZOzuYrPKWGI:mu3oQ9B4tERJQ8Y6VhyMs1SNNYG
- TLSH
  T1ECA53947BCA548E5C4AE92328D7791A27AB1BC450F3123D72E60B7782FB2BE05DB5740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral3 behavioral4