f1b835e4d2f2844ca735e5b31caca9b226d48b6038448f2d1758a20e6e398209

General

Target
Client.zip
Size 123.5MB
Sample260710-m2m2nsa13v
SHA256 f1b835e4d2f2844ca735e5b31caca9b226d48b6038448f2d1758a20e6e398209
MD5 2fbc82cae53ad0159c572833251ab077
SHA1 6f1ddf527c32bff3841160ac71777f2412430540
SHA512 ff93892d1fec55984595e0f673336cfcda9ba63dbb71937da64d316294c4b7e7bb0c3ec563d717ce6467877d1ca12345f4764239902a3a3ac516eee225dd10c1
SSDEEP 3145728:J2YmsF3iDrB6rDvKtZerORjFgxEe985SaZM0phbLV4lN/ddE2GG:YuSJ6qtZeCjFde9HaHhPVqTlB
TLSH
T11758336C166DD04CEF15B8C72896BE4BF3D2D21572B21CEA85E492B1EB460CEB9CD113
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Client/Client.exe
- Size 81.1MB
- SHA256 a47d2cf30bb33d4eec873cd051fb6678072d0c281a2925668614ad62b1d62ea6
- MD5 a66d91f93c0c1a388a01d8289cb73f94
- SHA1 e2dad9d13decccca84033132227f4e0cc1c22d4b
- SHA512 4addf7f83ca0a5739db195d262b3657e2d319ff4b8f7a5566bc0dd4ec1dc2f0e2a89d06a4d5e34d0bde5eec80dea9dc1b8fdb3e591650078b6acef204582dcfa
- SSDEEP 1572864:Nt9IKPYMvViJygRWYk2IpeL+QvGRJMpuoF3bI3IRVAIa5Ki7:NUKwMvV+ygRWvHpeLDGRaRBbI3ik5Ki7
- TLSH
  T1C918332C2931E09CEB2962F715A6BE73F384C7127135949E04745AB097EB8CEF08D697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  Client/NvMessageBus.dll
- Size 2.8MB
- SHA256 72e44e7574ae55ff005e8f285af460698ee12a4ed602fbe1fb7c0aa247d1bf8d
- MD5 a6f80a222e7e892ab68fdf239b290084
- SHA1 37d34731c68e4435c6a9fbdc3e5e09b9819f0814
- SHA512 43857c84b21180adb66911b63ef355aa3c2fd5e43140803d673e70a8a2527d39678135754459bb18b4aa940d49d5ec984529c69b5e74e0ee9210e2ee301a1f6a
- SSDEEP 49152:0daCFxIuIq4jU6rxu7bYJzRxBng3ycj3ZSNygqxjygzP4XUcMMmshlFc51JLU0u:0cCH4/2ygzP4X1xgK
- TLSH
  T1D0D57E303757C836D68B6276496EA67F579CA7500F2104D3A39C2B2FEA346C31F32996
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2