Overview

overview

7

Static

static

3

XZP-Tool-v...up.msi

windows10-2004-x64

7

XZP-Tool-v...up.msi

windows11-ltsc_2024-x64

7

XZP-Tool-v... 2.exe

windows10-2004-x64

3

XZP-Tool-v... 2.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    wow.rar
  • Size 15.1MB
  • Sample260714-a4glfsdx7v
  • SHA256 92bd4e1d84ec55b7aa164b0d0c114c6bcffee8cd915f6319e8402a0255e54223
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target
      XZP-Tool-v2.0/Setup.msi
    • Size 698KB
    • SHA256 1f4bf89c8c3f2b41d95e0bb2dc3bf5923edfdbdfb0d73ff135ad8c79772fa4ee
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistenceprivilege_escalationransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      XZP-Tool-v2.0/XzpTool 2.exe
    • Size 374KB
    • SHA256 ebd0e5e091384ac81574eade9d82639fed6ff060cacee7764ff44cbc6a74d7fa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks