6c3e0dc030a6e574c5f499a374832eb4f8cd57bb70436f65332b0a9a9d1086ab

General

Target
Архив WinRAR.rar
Size 222.4MB
Sample260710-tkvthscw6r
SHA256 6c3e0dc030a6e574c5f499a374832eb4f8cd57bb70436f65332b0a9a9d1086ab
MD5 f34ab1beedca916a6da78fc8c50b890b
SHA1 aa49983924e056466b33cd4ebec63485f6dde174
SHA512 faa1b6562c38d2c5702eeb63e1c185dd094064142c2557a5fc3e8e5785b7c1e60027456b152216bbf81174c2235370730ef887b168d0c2fa6aef320b08823a03
SSDEEP 3145728:zLvLOW+bgZ4mY6sAUS8YffKXASdsLYTym5KTqLW7Ic/g/PmWFnsUgC2XiyMNrs6p:zTLOWIgZS6shnQSdsLYTyGh9c4nCng6k
TLSH
T109B83344CD2AE31523DE94ACFA77484E1F230EBA022B395597E85F975B6AD1D4FC300A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  dotnet-sdk-10.0.301-win-x64.exe
- Size 203.1MB
- SHA256 6e7c6111f0978566d9a10b8846bedac8385a22a234f86325b621decb9f25b235
- MD5 9b7f82db87024a1200897498a3ef92b5
- SHA1 54bbd19be15530a76c8dcd61ca7e86df30baa9f0
- SHA512 96b7793f0d1f40d8a8a05f9f076d6f4146045429ae2ca17906f109d8747ac34826d9775ffbd0afd9b01bc84bac1a3dba02a6d86af08fe2809276c3e3ffa49098
- SSDEEP 6291456:oCuw53828EEANiz6OhCrloVKdYXZ6rAIoR2b8:oEO2kANizUqod8Z6rI7
- TLSH
  T177A83371655A0C26EFF80B73F18662387E6C8708A77484E6E1C4D84D36A63D59FB720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1
- Target
  VelocityLite.dll
- Size 18.6MB
- SHA256 3867a2b72d32cf68210086edf0c94305578c3dbadbeb3f2bdabb3f79888bd9f7
- MD5 69674db1e8505fc001ba1bb544ffdfcd
- SHA1 10b7d17291d38a6fc5280c5db2e071290a53c068
- SHA512 b3d9d78c3a4369f6b948ba7f49f2259c5d59fbfceed6c989345d8fae762e4b343e814cc1b424eccc82d75ee4b7cd892b0f6aa7819ea03425a1d609955341636d
- SSDEEP 393216:pdtwpHrmXuabdwVorMb975j+ssedCCxr0DGfRJ9A8q:pTwpHrI1gowb975j+SCCxQJ8
- TLSH
  T100171247F389DE2EE25B1B3686730394A6359CA1BF5B030FA41A76B8AD733C01D146D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  VelocityLite.exe
- Size 232KB
- SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
- MD5 e4df8ee6e755c3da3088701eb1c05b76
- SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
- SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
- SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
- TLSH
  T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Новая папка (13)/Новая папка/winrar-x64-723ru.exe
- Size 3.8MB
- SHA256 84f4392d8412efea1039f1bceb1125c25aacd5db9ea7cf178fe9322d40f01943
- MD5 6fc7b36368ba8934d0e3246c5433811d
- SHA1 f2dab8bfb0de986522720265817f63d75d62d619
- SHA512 e4d213a30a7407dd244431e0ca1c67871947adad916186c538012e1a7c440f322ec2d2fc348d33fa14d65eb20a2f343ab88e2dcd310b873e9db17b3772f6908e
- SSDEEP 49152:FWyy3UuXBPUV6UeRBbJMK/OCZxjgpE4PovjrZrD8GShdqRpViAQXF7PlBZHcpRqW:DloBKnuxAcvjrNoGI17Pz5CqczJa2
- TLSH
  T14306231AD7E814F5F077E139C4624203EAA17CED6B61878F23DA2A962F732D05A3D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral4