6d68cac0477bedd3fdac978e9553dcbac1719ddb1a2e5c5deeb8179f53dc2c80

Sharing

Copy URL Twitter E-mail

General

Target
25405092496.zip
Size 31.3MB
Sample260709-rxlp9scs2j
SHA256 6d68cac0477bedd3fdac978e9553dcbac1719ddb1a2e5c5deeb8179f53dc2c80
MD5 e16d639fd63f4712cff7b40d5b566c46
SHA1 46d6304e7b4368a29dc6467ff8287ebcab31749a
SHA512 0abef88f920650649b2f79235ebcd2b1710b793fcfb8363159675860513ce9e44517f8375c2bc1bbe600383b6bd7081641d7a7677fff08b14cb7f98b3931d5b1
SSDEEP 786432:qNmsw2Ige3eMKz7fcOS7dTWoECnF/xhdyvwpHRywSaiN7KoFV+gWk:qNW/gOeMecOrQn5dfzywS1zcgWk
TLSH
T1AC7733DBE747F5A6A84CDC290011E6BA27F53E733016F6A3E03E5412D14D7EAE688352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  f0ca28df5607f66448229439e0bd2adb0a3a134952ad83bb41aa5e45cdf9eed2
- Size 31.3MB
- SHA256 f0ca28df5607f66448229439e0bd2adb0a3a134952ad83bb41aa5e45cdf9eed2
- MD5 2007633cf66b0cb7e7a939959a39a182
- SHA1 0173e0628766e9df4c982fcecdb1f88082106de0
- SHA512 c7d2f98f816f0e8739bc4204e4f4754ab09f843e1e4212f8435c43c7e54ecb38412bf47d90322198b9f613fb359a578a90c25ad5dc7dc18d9aa34e127aed7aa2
- SSDEEP 786432:tCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Eab:sxbXnfCJMAYDi4D0C5Z9nT3Db
- TLSH
  T1887733F1B043895A9DC19CE0E6C5C144E28A41E5CA743EB7D17A53F6C2E7AC7A4E73A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral1 behavioral2
- Target
  DCAgentServerInfo.json
- Size 1KB
- SHA256 b57b23342e6d7dbaf4cebd3e3664bb2697eca3e8593aee6a81757cd30dbf6e92
- MD5 f76ccded7c2754f2dfb581092f952928
- SHA1 cb03cbb1152c8fd0a0377bac489a7a9b2a70d38f
- SHA512 37d0f2ffa452ba5569e4c22e8a6cf1692a866d959b03eb05e472a96e7ca16d655129fdd333afe6015de2295b76501d4174f8522d893a1b2828318f7269b2845d
- TLSH
  T182311CB8E8131F176ACDAA58549C180962B8002B0D153888B72CE8CEBF9D31F5BF352D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  README.html
- Size 1KB
- SHA256 02595856ad354a47e9c664a55dc428aad19ce73a00fe95228bbe590cfca944d8
- MD5 2d939d7afe37b02f77e4eb4d5e5916fc
- SHA1 7aaea8ffacef9986f3c99c9a172763fc90c71217
- SHA512 26df83433c38890b4e5bfe29b508666257b3abd562568c5fe7558925128c28d89d237420aa872db4710ef7d511b478e867751cb6426679a52554dc7b89ac948a
- TLSH
  T10021FEB3C2526B3AB563034E305BD6D42F12F28150545F5C72B640DAB8CA227B41B3DE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  UEMSAgent.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH
  T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  setup.bat
- Size 2KB
- SHA256 91f784bf3dd83c0f5135ac1fd00a0fdd430720ebc57ec4c2eccb7875dbc8a90d
- MD5 9cb71612a1aa60c6a9c893bcefced81f
- SHA1 b9259cb454959dca0a42de49c5ad6f336719a384
- SHA512 3eac954bc561dd2f1ba88324acc5baaaedca2c7b3932135a6ccb7ae69b8057a8540b85a70cbd25d5b4a558254789c977bd9439ca0643b8d655a3bf802c3120eb
- TLSH
  T11351E0D48F112F641465CF09E46B81C3E733D0416ACA753404AC7C6F7B8D6AA3D3EAA4
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  setup1.vbs
- Size 1KB
- SHA256 3d1a86ad729817d85377f59c3d5dcc67ba59af9824ae64aea8e626f6a4956d52
- MD5 4ee143d2618554b4d1e2852c433e46b1
- SHA1 59002f85299ef75a7e781b0cf3161573a70dd8be
- SHA512 b6ef5c25df25d0e35e8736e0c2f5a127e20563015cb992b6393fe9e967c9640efa3d17c4ca317758d3dcc777c9cb22760b1f04179668788a6afca782f10e6644
- TLSH
  T1F4313348E92FCD01C9758A7341076C4EC6B717552434006EBB6C8C7AAB2923ADF70562
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery spyware trojan persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral11 behavioral12