fe47322d0620e7a1cb0cb8de07c47af48349ac6e55a32bfb10c3599ea7387b9b

Sharing

Copy URL Twitter E-mail

General

Target
ok.zip
Size 4.3MB
Sample260715-vrss6sds5t
SHA256 fe47322d0620e7a1cb0cb8de07c47af48349ac6e55a32bfb10c3599ea7387b9b
MD5 b48471b71e7cfb02936b815f52d281a3
SHA1 3a26919ff2a13a2e9fee76e87ff3544d57d80510
SHA512 8ce75b07785f1a735773d0e1a1d8d879ceb00de3ae9ae6263f0241147b78d6c22f204ab25860c356bd2b39b867861becfc0965e38ee496de117a4d16cc43478d
SSDEEP 98304:0Gtc5FcrhJ/660+5ywXXkQ78POCYTEflEW5ykBvqaZAvmhbYf4:jhL5yAkQ78P75lEW5ykBvqaZAOVC4
TLSH
T1D326331AE6F5869ECC45EA3119ACC89DCBC9F7841BC11E4B9F5E0380B1ED36C985ED06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  aids.dll
- Size 8KB
- SHA256 91883d673202bc76c9e6a269e4ac7ab09da2fe669283d8ec9ee9f7ed0cdb753d
- MD5 6cac83c557fcdc791cddb82a6e16d054
- SHA1 c93921b86e35912a7ce9b3075cc862c4f9ef9b10
- SHA512 2d0b8395d2d08c32a0ab94251b8af98f24a517d16154512308b9babb3e15a94b676824aa6f770f5f5d8049187d96a0188b38560729d61f98c4c51fae115c054b
- SSDEEP 96:IsW/r6FDMGveXlFmviwod4FenlR5yqAXV5Phk6Z1LqQLsxdKc:etGvwqgpyfV5PhnNLO
- TLSH
  T117F1E506B7B48231E9AE0F3CDC3253601775FB846902CF3F66C9618E6D227194AA17F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  bin/libcrypto-3-x64.dll
- Size 7.1MB
- SHA256 16e85806333aa3b3a4fe8c31c9402b78ee01a4a143e9031db165c48386dd6289
- MD5 b47c9988a203a596803837c128853517
- SHA1 2f669bf535dde5727989da919ffa5c36cf9d78e2
- SHA512 24874b5902785cea67d3781e59471e6b8fb8c9d9e6e33e8c894745eb4324bfa1ab123ff2809269e1a7b2eb604343efe556183479c0e0d30214dec252c31fb69b
- SSDEEP 196608:uHhm399Xki0GiR/8yGX26ui1CPwDvt3uFOxC:uHhm399XkifiR/8rGfi1CPwDvt3uFoC
- TLSH
  T164767BADA67C0109E8AA81BDC2979327D771B91957F013CF186196F80F23FD92B7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bin/libcurl.dll
- Size 637KB
- SHA256 8645f1b6bec48f061e54941ec1d9c5e4b8096ce1a80d8ea0a0353e4cb557f8f5
- MD5 8c14feded4b94c4b72af1f710f236778
- SHA1 62dd8f17cff9916faa792a8188f8e82ed6edf9c8
- SHA512 c0222d788aef2be7eb205f923302a79b59ec6018210944cf6d807b073fcd2c08182f42e4a1766b7e42e190ac4ebb090f6afe026a52e5bb11f585db180bbe0fc8
- SSDEEP 12288:EzbJ84IyhxblduSGHhphyfiuEkatR5YI80OdnmqKENG:EzbJ84pjbWSGHz1uEkatR5YI80Odnmqt
- TLSH
  T13CD46C56B3F414A9D1A7C17CC6538227E3B2B0542361A7DB12B4CBBA6F13BE2573A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  bin/libssl-3-x64.dll
- Size 1.4MB
- SHA256 bfc059e16951fa90cc14489a8263f35c6703e762f2f5413682b4f7935bbced57
- MD5 754fff93ed112eb26bd4a6b0e8300deb
- SHA1 de9edf5c9ac80b1f26dcc91d89791065097a7d23
- SHA512 05d215d1e0cd65a98cf55a2a5e123992e5719006eb346261c0c03a629cfe2cde910765a1a87a3f5a93d2371ea9c15d677277b903d55c24731bcc7c7eed87a71a
- SSDEEP 24576:CV6b+rLptrBSFH+tK8olR+WmXWdEVB36eVE:CV6bedt9UlIzWdEVB3a
- TLSH
  T1F1656CAAA7B8019CD5B6C17CC2934B23D2B6F4162370A7DF0A658A781F63BD5173D384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  bin/module.dll
- Size 2.3MB
- SHA256 5815e348d9995009040125f5c338a8714b36cb3662e31c9973437bb03b4c337b
- MD5 ac523410fbcdc77a404bbf83d752e513
- SHA1 427d1bd5310d062e356dfea189b4e43887f2f083
- SHA512 5af2661f5eee464ad7070246b6355fd1824265d350e71d586dacb7f3fb59a7442b03d5d2e6800295920c1393069e0f99b17930cff2807daf0b1f275f27bf8bd4
- SSDEEP 49152:PIMHwQLHRlQWH8ra1/dtOyv37wVVpmZZuqrJ17/81wh:Pqz0/ZTB
- TLSH
  T1EAB59F17A6A901ECD076D1F88A5B5513E7B17C4903206BEB02E0B5752F27AF68F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  bin/zlib1.dll
- Size 88KB
- SHA256 f6b58fdde3bfef2c25c7254fadfed12d86d81c4a5c962262715868c48063fc76
- MD5 68cf6f98cb8b227814a59ff3f909a0af
- SHA1 0383a4d7a74417d3ec90526e61b7637256e0bb57
- SHA512 b59f9eeededd1f76f048b57ae753f79227aead32006fc649532a9bae3f441515bab85338d25b26e5002c54c65d661c0c3048f5c3c1ded6274638ee950afb4744
- SSDEEP 1536:QvkS6XmTzqbKxfXOTBpp/foyUaDmjGI23aIOcIOZhhkxBJNJ5:PdXozwBppnqG3oSZfkxBJNJ5
- TLSH
  T1C5936B4AAAB412A5D6F78178D8D207ADC331701407A44BDF9648A7691F23BE41F363FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  example.dll
- Size 6KB
- SHA256 abe73056b75479f5dedf69331001bbd9a4858d5e295ba674727f3d099d0f4588
- MD5 68ecd3060fac0d615d9260b93b4632c4
- SHA1 a78b566734caf6e36eff7e52bd11300061360eba
- SHA512 0f1cd4b706acd6718a55575aa2c8bdf54d87b392b4e52192bcccbb6dab81b1c908a92d69d0c4491775a1e3a305f98b3334322c8c65c531e78ee418b851f00606
- SSDEEP 96:d2uqB6wDbB+bhsonwK+vrBcKT9zAcixjawDxTMh/OQoRtA+gPnyxOYEzNt:d2vUeowKqrB75AcMjnDNk2QCtArAOH
- TLSH
  T114D1F93A73A48273CA670231AA7362400376F5165CE7DFEE18C9519BED877014653B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  example.exe
- Size 152KB
- SHA256 c781ae92228b761e78026765a54abf7108e03e3ec2f8d37f2c8919511933231a
- MD5 841e6e9eb9068df2dd618847f13fc1f3
- SHA1 e166b3c811cd790f20508e6401ed88bf00cef576
- SHA512 fcd69812e44c151f4cc1e049fcbdfb983155e806de71c753338afbddcb0c9fcad657ac597e0bef9be4a61b5d22330c1d5b24fa1c0cf41bdfaec9fb7f08cb1c82
- SSDEEP 3072:l20jWfVKLer59aSpfO9D/87jXEkeFZA4nsSqU3:IIhSpfO9jC/4IU
- TLSH
  T14DE33A07A6A840FEE1B7D679CD924941FB7238598B71A6CF07504AB60F777D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16