ea7f3a2d6403b663f75e691e03a7d38fb1e7a0cbebc53bb9fb1c3202e10b7bf7

Sharing

Copy URL Twitter E-mail

General

Target
UNLOCK+TOOL+2022-09-04-0+Crack+Loader.zip
Size 142.7MB
Sample260709-jltbzae13y
SHA256 ea7f3a2d6403b663f75e691e03a7d38fb1e7a0cbebc53bb9fb1c3202e10b7bf7
MD5 b064676c1f89df2397cd3e902c8d41ae
SHA1 276f4d0d425879aeaa017d2983db90b1d9e53b7a
SHA512 49a61ce687f6ed4187315507f8d2458eb900ddbce4df61451f4772240c304d6736b8783e435982361fc7ecd05549ceb9791dc0f8ada558e8beead478d31f7edb
SSDEEP 3145728:zB7Dw5Xlsz42GGMZVEY7N3St1q+KTFI6saOfEvk2iQ7iKbnE:zBY1842MZp7h2q+yNsaOf6GQ7iKbE
TLSH
T107683371067A5EF0DCB84FB2A1895D981A3E7B57FB4A6B462BA2F4133C047735C6B804
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  UNLOCK TOOL 2022-09-04-0 Crack Loader/GautamGreat.dll
- Size 7.7MB
- SHA256 bc937e6481633b05269f860e1f2a372cbbc1992010062bb62fdbe3843c602677
- MD5 f8a639d2b157329e5ef24edf885ca955
- SHA1 1f20bb270b3749c8a1fddf0e5202c822a4c13d76
- SHA512 6c719f3326621f8f7c350e27b7ccf0069091dd93693e5cddfc51cdf1c5e0abe40d8804a69d56ac937cf402013305a470afce1cfaf99e4ad0fd16cd09e02b76df
- SSDEEP 98304:FY1O5ShkLmsV0792t+/RjrAW/54R9YTtWHU4eDbMsMa5hrURWm77xPXfoSQVz3Bo:FSRkL5QPpjd/54RWhiU4e8bxWNK
- TLSH
  T16A8633731662414EE0F9CE3DD527BDE0B0F6035B9A91B87935EABAC029129A1F353D43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  UNLOCK TOOL 2022-09-04-0 Crack Loader/Must Readme .txt
- Size 114B
- SHA256 b91b7ac6469a8f968b0ccf62052eb75305d3abdb6893753cbe7e264c23551930
- MD5 738870423b950398b89c62715077b62f
- SHA1 d7621850db4bb2010292ba6edea0ed706b4508fc
- SHA512 ac05c92760e326bab118743d379d8774a728a4da7b398e205903570440b16705a59a101bef0733a7cabec7bf1a089575b42c1e80a06cf04368b71efac06390e3
- TLSH
  T119B092A6EED2A77502A196A4A08A09A143044680B29641CB922CF7727B261748E308E8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  UNLOCK TOOL 2022-09-04-0 Crack Loader/Run it as Administrator.exe
- Size 154KB
- SHA256 846c474d466f8a8cbd113d06b00ab7221e1ba92d3b7253f5dea4b7fb7d71c79c
- MD5 450b04acd5335344bba076ef4ee2ebaa
- SHA1 4f26abe9cb2886567b88e3d5ee0149f039d3bfda
- SHA512 749cabf26315d455013c3fd11bf055972e8ea3382df1665632c1e02493ea418a3ab233c1c40b902d6a39432a25023e31690403ec145a3fd3d4b0900fcdaa3c28
- SSDEEP 1536:JDe0EMBqrZg7E1RjPuJrj5MfWVuMX1bRMUi5vJG2llt8OESMafevxW8brXReaBvt:FZ9e1d8j6+bXdmIxDrhh468M
- TLSH
  T1C4F35B2EE681CB76E0A10738C5D2A314A93F7E1117334F5A29E47EDCC92939E2C196D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  UNLOCK TOOL 2022-09-04-0 Crack Loader/UnlockTool-2022-09-04-0.bak
- Size 135.2MB
- SHA256 e25ae29eab429e4f2c0eccf2c37273acb1b2a6af366b6f5b334d968dfe6b19a5
- MD5 964dcdb6df45a23050f935c2fcc93dd1
- SHA1 2e5b85d339a93b28b3c06cca204d7226368fb2d1
- SHA512 59b296432f4c2d559e3dd4499f9ddd4c9b39b02ed1c8d2fb6b86d82758d8db43bd9d0b7bc245a9f4ada3605071818be4142833d08ef76a9a55716685851a9425
- SSDEEP 3145728:8p50xfhUTOWECQNFqeH/RIdVwiuFz2akkmPYvKo+STISxjm:1pGOW8NhH5GwiS9kkmP+kSTIStm
- TLSH
  T1096833230225D4A3EEB44F34912D1CA9117D3DDD6A1DB55E3696BCBE3B3F8A16822331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  UNLOCK TOOL 2022-09-04-0 Crack Loader/UnlockTool-2022-09-04-0.exe_
- Size 137.1MB
- SHA256 85f07465ecb0e34595e6477836cfb313fdae4e4412bd59fcbdf085f52cb8f20b
- MD5 08abc413018bcf94fc66cd741c37b273
- SHA1 ffcbaa99983bdb002e866a2af6b9c68c114b54e4
- SHA512 50397ef872715cf949ec8d845bc43e0a20bd7a0b23d3b42d4f90fc78865eded5616e93b84ad4c02495c1aa86d8d3d3eb02698bf780a198888bfdb65e02d1b386
- SSDEEP 1536:HZ1niuVy8/e5t34aJzbjfq5LB3XRTOt+LlAlFTWU2t4hLpFbOIJxo+:HZ1iug82DhF69BnRKclAG1A3bO
- TLSH
  T13768F1239EA3A477E1C8883D459B3AC633FB011C8683DB5944AEE5C70E646DCD98D91F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  UNLOCK TOOL 2022-09-04-0 Crack Loader/User Name and Password.txt
- Size 46B
- SHA256 a596e8a85f7fca5b976c2a0aecf0dd3cb4588679ae3fabcc3e56bd0ee865e1de
- MD5 28fe4f5bd81ba9b89c59efadf62afc72
- SHA1 a56dfde5f54eb0f70189ba9ef0ae93f998480985
- SHA512 27ded38d961b69378c165d7db8aad42cc44cc25c4fe24607ebc48cd47650f865ef13dfe0448400fd25aefc378385d89e1ed2fd5efe80c1421859314d231de003
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12