f644e5c0ebeeca10069d5cf0c68af17240c9894d95923bc287a7bdd36b9280fe

Sharing

Copy URL Twitter E-mail

General

Target
nikkeminiloader_aq84jigzveb.wg.intl.exe
Size 9.0MB
Sample260712-ta9vpacw7k
SHA256 f644e5c0ebeeca10069d5cf0c68af17240c9894d95923bc287a7bdd36b9280fe
MD5 4a9f6cb099a1f6763c3a8e2656a9f9d2
SHA1 0bae8273091cd33b6cd321346fabfd0e831fb073
SHA512 2885316d7f7b58147bf0be8992ff0d0d6c9b26ecf1c26a767d7320866a2e9c47746a22354abc4cddb529ae8b93f6a6599ef63109679a40fb56ca02248609426d
SSDEEP 196608:EIBgyIPpswqoFFuY0Pd/xrF8AIO8muSTs5Lb/RgzoD:ZgyLwqdfuGP0Rb/Rgs
TLSH
T15396339972D02047ED66487AF13985B212D3ECFD1E30E96603EBFE2F3A395576C48426
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  nikkeminiloader_aq84jigzveb.wg.intl.exe
- Size 9.0MB
- SHA256 f644e5c0ebeeca10069d5cf0c68af17240c9894d95923bc287a7bdd36b9280fe
- MD5 4a9f6cb099a1f6763c3a8e2656a9f9d2
- SHA1 0bae8273091cd33b6cd321346fabfd0e831fb073
- SHA512 2885316d7f7b58147bf0be8992ff0d0d6c9b26ecf1c26a767d7320866a2e9c47746a22354abc4cddb529ae8b93f6a6599ef63109679a40fb56ca02248609426d
- SSDEEP 196608:EIBgyIPpswqoFFuY0Pd/xrF8AIO8muSTs5Lb/RgzoD:ZgyLwqdfuGP0Rb/Rgs
- TLSH
  T15396339972D02047ED66487AF13985B212D3ECFD1E30E96603EBFE2F3A395576C48426
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit discovery persistence ransomware
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISPlugin.dll
- Size 1.0MB
- SHA256 1b9a09720ab5f6fed43d366cdf1d314b15e29e4eeabefdc528bf4053a0c1b0ef
- MD5 7c1b00e82c60c4850fcb098d48c40410
- SHA1 4430e0632c75ca4a8ef5093a70b6e82ec7d3de3f
- SHA512 8a089435e5e4291526041362d3247ab46c95d2c2669ef1530a8029b6c898e8ee23fa5af9dd43bbdb27e1c51f74ce588068611db52954dd750219169d2f7e97c8
- SSDEEP 24576:MN7rmqhBdVUSpMqn2prMjE5RtqecX+UNvSgpT9FqrQyKo:Ut72lpa9TTCrQyK
- TLSH
  T17E356B00F28280F4E99656702DBAD77A9B357E464F1586C7F394FF9E29322E1E53130A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  nikkeminiloader.exe
- Size 5.1MB
- SHA256 ba944005a99ea940ae08b53374291b78263f61cda594840a48a59b037c266da6
- MD5 7b5f2f6e75ad1d96d694254bb74117fd
- SHA1 b26ccbdfa3f9e9e4cd081bd36fce79da3c3e5812
- SHA512 5b002d049eb7a230fcd16253c98162658fe28f3d95ceb62d5b3172c60537b681503502ba10873126f92249d985e8716ed8cd8b4dcdb770bbf931277a93da562f
- SSDEEP 98304:NcLsuPSAop5/4URGRJtFxBr8EnUdDU+AkDuFYBVwsoz90fmSAx3:wq+kGXYEnkuFYBvoz2AZ
- TLSH
  T17D36AE02BA8150B2E9B242301D76FFB995BFAF240F74A5C362943B1D5D351C2493E6AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  tiny_dl/VersionService.exe
- Size 10.3MB
- SHA256 b00b12163469e0de8ff5a95edf53af3dfdcd04a13d55602b2709f72e1d93f189
- MD5 e7ee950a1aa4a3432231017478b9ee99
- SHA1 ed9c5d47e438c05037358c5a3a24a6c9e2832f77
- SHA512 3724695b8226ba7cc3e4f994fb114ebc459d85afc3690e51e5ec02090547ac9a8393d3c7138091745392cd58ce4581564ae8d617973d72c95fb1484dc960b5de
- SSDEEP 196608:9ixg5NkeeNG7ll5GU3mwBDXbz3hQiTpBS1GEI0rj0wVtQi/iW1n:0C6axVNT61Zj0k9KWF
- TLSH
  T1D7B68C31B740D53FC6130573552E66FF106877328BB588CBA7082A6C5BB4AD2A734EA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  tiny_dl/VersionServiceProxy.dll
- Size 1.8MB
- SHA256 57834ebb0c81779e8a63140648dd3aa947a1f6f6494a43f666881df4014c7890
- MD5 83ce4d547c4f4fd385cad3188df3568e
- SHA1 ff850229c62f58ad633adf4ba8142c82ca328e70
- SHA512 99c3a5552849a3bf626e29c78f95981d1724ca2a661eb9802b875afe67b6e0b546baa66e1fa9c8a4cd55cac62ff31ca4e9a8277bebcdab8328a02670d5f69942
- SSDEEP 49152:69J/pUW2MknzBLD1cze5G6D0WZTdX2UPki0c9GE2:69J/pYnFLqzeg6ol
- TLSH
  T1EF957D327640C43AC65F1232983DA5AF019CBB7107B445DF679C7A7EAF744C29A31A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9