60af3bb57536cffe38cc5ce3af7058b3356772a8621efab8f2ca8e9a1b87af16

Sharing

Copy URL Twitter E-mail

General

Target
GP.Software.Directory.Opus.v13.23.9483.x64-CRD.rar
Size 27.3MB
Sample260712-bzsnlabx7p
SHA256 60af3bb57536cffe38cc5ce3af7058b3356772a8621efab8f2ca8e9a1b87af16
MD5 375a01eff9b2dc72c2425691c91a6d5b
SHA1 b3bd5eb3ce708fb8a30e1d5bedb69b6981c74f43
SHA512 b2d19f7b03f7d338ea6b024f360f7eed8f37ebc747984f187bd20256b6c983276546ac48982c1a7c8d39e754a9a083fbb8da880d94047fc3fc7e3d4c2d7650e8
SSDEEP 786432:2oBecCBHeVdLjDqSPOYDkQ5/3+DFo6bz9PLEhx98ofnA:rInBHeVRSSPOYDP/+19PghxA
TLSH
T1F35733C7078DC1086D95BE4635BBAED8C900FC11603F368D1283B87697ACDA4E5ADDE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Download More.url
- Size 122B
- SHA256 45eacd3e6cb034cc63b8c23a5d430ce2fc096e584dde6d85edef9e8bbf6b07b2
- MD5 850a1ecd29f3438c5d77474d4b04c6db
- SHA1 20e5f8db6226fbddfcb1f29d0668dbf454e55bab
- SHA512 592c5a4154c3dbdbb4c6918f5b1b689bf470e37186d1677dff49c0c536852c9467f68439643b22980db741ec78bccb56167b386b428ff64cba71182aed4ab7aa
- TLSH
  T1A1B012AE8246828BD351950AB0F0F9099E0FBDA40CD2D09CBA58DEDB0C880D3C948B36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Join Telegram for more.url
- Size 130B
- SHA256 aa92b284c31d842ccb9dd8b1b515f22fb70d7b69387d85f42884a711d60d23c2
- MD5 54e39957b019fc7c1d2b005ca23f759c
- SHA1 b76214cc619139a076594fba6048aedfa4754cbf
- SHA512 902eb84dd12397ef4be22ba9eb240f59aa9bbc4091512d3987893ea57b59c2a82e9f433cd7f6f710945e4accd9ecc891c7de127ca3a5231b18bedbdb5be84650
- TLSH
  T166C02B7F4202C245C241C0051070FC08444E78B809D1D00C1508CF870C880C0C004F35
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  crack/dopuslib.dll
- Size 1.2MB
- SHA256 72fc9908f11d74ecc74e06a61f899475f8693da308086e3d660c6db7a1505ee0
- MD5 a174fabcc2bb483b4e39d0501a3bb82b
- SHA1 d337f4820c5f3e93f5b033cbd55040c72fd626b3
- SHA512 8b1a57965144b8887275a1c45e23467e72048a4fd99211dc41feec69f9df3936f0dd7a680e963486de5b6768459fdc4be37059fd84e679a67d0e8679d4d187f9
- SSDEEP 12288:1rf0xOKnStbc5G4dvObOz8ZNUwzvMHbWsahvCitui0m0iT1kMGaLBlSoz0C7ed3:1rw3nQjCvOMkv8mNCiMi0rko0lS4ed3
- TLSH
  T11F559E01B7A900E9D4BBC178CAA74A17E67778540370DBDF13909B6A2F33BE15A39325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware persistence privilege_escalation spyware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  setup/DOpusInstall-13.23.exe
- Size 27.2MB
- SHA256 61f97c6fdf2572fbc09b232fbf050802591510c22767d010181a7747b994e97c
- MD5 b4c750d8f9df90d1f6f2c68f9e23a773
- SHA1 2718ab028c012944b3065c1ba11158b2a5310653
- SHA512 012447b6b2d5d611b36892e0fc1a5109f60632ba3ebc623bcd389660b6dd7525dad649f7010c018e448e8cf132d850c6c30b10e3ee55ca2fa9470927e4aa92cc
- SSDEEP 786432:+y3c4muDW/KsQSviHDxBUzEmx/urLSujPe/7:+yM4PDW/K7SvCtBUXvP7
- TLSH
  T14257331362872A3FE47E4A360877C266583B7B2161268C66E7F4097DDF260E11E3F617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery installer persistence privilege_escalation ransomware spyware trojan stealer
- Drops startup file
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8