78bd2a9dcd4d2e2bf0f429325a859abe61598129e852aa6834c53f9ce58374d0

Sharing

Copy URL Twitter E-mail

General

Target
rebooted.lol_cracked.rar
Size 37.2MB
Sample260709-p74mqaaz3k
SHA256 78bd2a9dcd4d2e2bf0f429325a859abe61598129e852aa6834c53f9ce58374d0
MD5 e397a167b846fc4fa38b5e579c6eaa5a
SHA1 644312b28424c1c809fb8462a03f93d7e765e129
SHA512 09808857e20cc91e7db5dc62d8ec7e470cd37db0a42bcee987695ea9d85000033d11cd67aedecfad7a9254b21417d944ec7d6388c88851b92039d126448e6774
SSDEEP 786432:eNmbTZ8RXYgVvt8oTM66yKjI8XzaMBqDEgaKSSXTWV7mBv67S+3FOCKk:eGTwRTMqKM87XgaHSDxv67D3Fx
TLSH
T18C873341A95E5230F197E81A4FECA978762EF073EAEF49D0867163521D0C68B12CB53F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  rebooted.lol_cracked.rar
- Size 37.2MB
- SHA256 78bd2a9dcd4d2e2bf0f429325a859abe61598129e852aa6834c53f9ce58374d0
- MD5 e397a167b846fc4fa38b5e579c6eaa5a
- SHA1 644312b28424c1c809fb8462a03f93d7e765e129
- SHA512 09808857e20cc91e7db5dc62d8ec7e470cd37db0a42bcee987695ea9d85000033d11cd67aedecfad7a9254b21417d944ec7d6388c88851b92039d126448e6774
- SSDEEP 786432:eNmbTZ8RXYgVvt8oTM66yKjI8XzaMBqDEgaKSSXTWV7mBv67S+3FOCKk:eGTwRTMqKM87XgaHSDxv67D3Fx
- TLSH
  T18C873341A95E5230F197E81A4FECA978762EF073EAEF49D0867163521D0C68B12CB53F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  LAUNCHER.bat
- Size 393B
- SHA256 00c0f5856b30a76be23c5af9053280b2025d6ed62e33d3b599733ce6b6d830f1
- MD5 4227591794b4f124d4b9526ffb068515
- SHA1 2a3a865ead848210aff105619c51ed6c6bfa06b6
- SHA512 320a8d32f18e936f045fc3a6cf86fe039ea70b2bc534267671c8906d2d897b809151e9f7f26c232ad43a592ae7bbc31dbce5b98ff9ebbd37879e482c090c5010
- TLSH
  T1BFE0F10126EA03BF8334E541C15821A5ED5C634B301844DA32A1A1743B05580C7F4CCC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution persistence privilege_escalation
- Drops file in Drivers directory
behavioral3 behavioral4
- Target
  LAUNCHER.ps1
- Size 5KB
- SHA256 c231e689b09727f7a2595efa66b1257236fb2d23011af82d8ca29bea2368e811
- MD5 c3baaf5c95735830eda889278e3be518
- SHA1 146c6b4aed5c74007759556cc0187de141dbca6a
- SHA512 34707e3f00cb58bdbac7ff69fd9265013a48d76d55c3fef8dad19b70409a7812ff74ef5ef7e97af6977f1580cc5c2a8910800726af685ac550949531a040556c
- SSDEEP 96:aNmi3mPELpcET9NpIhF9OSMnHxaDNX84d38zM2UJ8Yg:Pi34EdcWIhF9OSMHCXWFUJU
- TLSH
  T19BB13134E105251E95F6169E0501B26CFC87C03752C70EC4B55C86AEBBF6BAE0B29DB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence privilege_escalation
- Drops file in Drivers directory
behavioral5 behavioral6
- Target
  REBOOTEDSPOOFER.exe
- Size 43.0MB
- SHA256 702a9a60b898192ca046399b9ec0a3ff17c3126e5a030c691ffa0bc271b90eee
- MD5 02cb99b7a27d1dd6c44d7402749a723f
- SHA1 7665693b3a690c2c8d215f6adab45bdbe66f1a53
- SHA512 f9a500a1c6431ecfbdf2f1854b5d0338304eb881bb1bdabeb43cbabcb247385360e2fdd5a9a3fdddd3f854f04e25918b785440d7d91269d12f92141fe3ed3115
- SSDEEP 786432:k615BMqw6B5LSzSzYo6FvR8VhFyLXLJej8aCmaoWLVFw0TwL7TuhyJ2u56v:ZMqtLSzpfvmrFyLtejLCma5ZF3MLfuhZ
- TLSH
  T175A723DB2AEA52ECD4C34B8057CF22DA51C1B53A85AD986D2FCB2C031530DBBD549A37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  keyauth_emulator.py
- Size 8KB
- SHA256 ada1de20789bb5efa3dcb0943510f34148b9ccc7849873e1c8228944a7ebc38d
- MD5 92a9cafe7c5fecf9a8bb9b049d777cd8
- SHA1 e9d291147d875081a91e93bc33f815a32e8401da
- SHA512 3aaf0fb26edf9f6168c4220493fe1b7655a784e03838f25d5e88ecab0804229af911f44b4dfb119f28e8a73f608f2eb8f768b975bd1f024750d0c143a8d54bf5
- SSDEEP 192:a6B01FOQiS02V2sGS1TDSRDGlF6FB6O/J7hNf5y8AybyGaf79WdA:pBCHZo61TDSRDGlF67fBG794A
- TLSH
  T1860212259D15547701B38A9EE42AE842F21E550333ACA80B787C57EC1FB8C26D5F2EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  server.crt
- Size 1KB
- SHA256 3a5252e6652f1a379b34d409097352608d1f0737e888a4f450243290ce727e27
- MD5 33d52c49d8cccfedbe8f59dcbbbff941
- SHA1 59db2b186822a7e5180c2817499dac754889e296
- SHA512 5788c8e298fb13d308f81bc4462ff5c10e7601155cb4f987e3b5795462acc3b2cb00f9862b15b482ee9453028c94d17e3d92ef3fbfe9098d54eccb4bbf15d588
- TLSH
  T17721E75E4EB12A48989AF42B8AEB9250CEFCFCF181AC44C440189503B59D91C32EE846
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral13 behavioral14
- Target
  server.key
- Size 1KB
- SHA256 2b9ff7a06f3667f8690f32831ce4f2fd75c1b3fb98a9b97acd93c4e787d68794
- MD5 7e0851e93ad4dad949c7d3a06d1fa7ac
- SHA1 e325543c61d89ccbf249dcb64ba68b06520da45c
- SHA512 7597efcf3217f1f3ba598219c415e6abd7216b25a0b3d347c7c4aed2dcdf09c684fdff78b5c4f07f9303184561564393f5ee2a793fa3f1d2d2af063562646ca0
- TLSH
  T19131FA392DF095EDCEECE0738697332E5A79F7380184A4648133B8A2A179F28686D951
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  server.pfx
- Size 2KB
- SHA256 a86c438032f56d49abd2e3b066b515ae5a67247fb1207a0d2ef0089d8598e10c
- MD5 b34f60fe3a20b7ba0e1fc020850eb6fd
- SHA1 47f3c19591fff5def64df24106b7d315c0def06d
- SHA512 f1db1a616caa2f2e207951fcf550bebebf35d0344d02d655aa53310cc959cf5c078bea5e4649c87e76b4f3c073dc1033d1a0e17695ea22ecac3306c46d3fccc3
- TLSH
  T1F6513A3B5EF710B9F932CFC65C3D4AC248A2CFE33E348A8F161550E04D46825A4E8927
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral16 behavioral17