9a88f135d57fe68dd630854343f81f699f8f277bd76ad1f4cf07609443926059

Sharing

Copy URL Twitter E-mail

General

Target
25-Nuke-main.rar
Size 15KB
Sample260709-tw3cqset5s
SHA256 9a88f135d57fe68dd630854343f81f699f8f277bd76ad1f4cf07609443926059
MD5 7ac6ca38d2d7eb83642c392a66a3dce5
SHA1 568d9fd6ef366376c0f9a13d356f13c86f16c200
SHA512 ebbd105c46bb87371a7b3a75130e5bd16e3a641bc808d317801d7af24a80d1c8a6b0e327e51dfe9832aca6e190294ee44f40986c4fe8bf9b5fce44cee06a28cb
SSDEEP 384:uCrEMtSGMQPDZKZUg5oRpHoz+rZv3uVxOUoj:3YMYGM8jg5SbrZPIUj
TLSH
T1FC72C052C8CAE7621FBACC85DFA2D26101268E13D64D2ED717FD2F03DED52023647661
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  25-Nuke-main/main.py
- Size 51KB
- SHA256 5b02faad3adaa4a345767c2cf832cb84b585426722eb1805c309d20a4e2b9323
- MD5 b2c28fd269fbcd2ad3dd8006b65fc46e
- SHA1 ac7098e98baddd8129f3e86a4ca8c82585058821
- SHA512 cdc67f0b699b4a51af7719bf8dd767f75b76e780aecc845eb7baacee8fc6e8e79444fc3acee6f8bff626e7f55ae373e11981aef32aa2fa3df527f56745c4f48c
- SSDEEP 1536:hrMdcAJP5xH4erATTpvsB31ozkD+HYwUwVxeUasvP+D0wxOlGB53AguWS:hrMdc4P5xH4eETTpvk31ozkD+HYwUwVb
- TLSH
  T1A73371319C4A51229532DC1D48B6AD12F35C3243A9385527B9ECA4C9AFFC530EEB8E7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  25-Nuke-main/python_installer.bat
- Size 4KB
- SHA256 dcf91485a3bc4aeacb7624ad8d343d1c266980b2094f49455fa3a502c070b02d
- MD5 4f31ac0b42feb3428c352af017835ad5
- SHA1 fb5e1946364f156d4a210c60c44ed5bacd65d0ba
- SHA512 6108e51c07cb35f2efbc493480da39548ee829a7ec6155c370de21a2375f8cb4b1fbee7b6c480764978be9f276b7274de43d8220ee1ac0670af510cd17f8975a
- SSDEEP 96:SnXBF0XkzDdaRRE3HHFul/viMGNzQcydKiMJmIrjN8N7U:mZzDdaLqul/vrGNEdK7VXN8N7U
- TLSH
  T194A162573C28D47062B4C6AA5D9D4162F78693D309016DC936BF80E86F163E623BE37E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral3 behavioral4
- Target
  25-Nuke-main/setup.bat
- Size 108B
- SHA256 1e1e029ebddd4a22cc6f7a9552ce241785debbd6eb30e884f295f64996362cc1
- MD5 135cc021096adb7045649c5d640e19b0
- SHA1 b9f0c1640c18df001a6f59c9f0e22e66edd402ca
- SHA512 89a4e319b4f42950eaa94c0b493a8d29a588345558622c9644003e3d67a94ce27f95af3aff9e0f52b20e10ddbd398b1fe56c04d4f20ca7f31ebf2105a349c087
- TLSH
  T1BDB0920B0021C1BBAEAE4A3A184A52C0A2860140B835300236AE5CB26857E62A40324B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  25-Nuke-main/start.bat
- Size 40B
- SHA256 40802ca59426d3ebe1cfb3909dde469b625b66d994499dac4d36fc79850eb9db
- MD5 3c6b34942cc704ad089e4653e9543ff6
- SHA1 f8f1adad9a5b4e2ceb8386ca96167ce75d6f7f96
- SHA512 e8a429408fc881699fa1fb794dc0225d199f6242ddf923e6c6de5f5f8a2e2f12b952c1305912bfe04c1e3a1b862aa425b2ace69662df967ab51b0bb6d403bf68
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8