ffd6914cda855eedb75f1c45344b63cb6d9256c8b4263635e4ee425a01807108

Sharing

Copy URL Twitter E-mail

General

Target
zcpf-finder-main.zip
Size 6KB
Sample260715-wldbzady7s
SHA256 ffd6914cda855eedb75f1c45344b63cb6d9256c8b4263635e4ee425a01807108
MD5 eaed81446f3ff37eb9cadb6e40d5c533
SHA1 81fe893bf2b59b80999247ba79d0bf344fba0f2b
SHA512 b3584f46a48bbfaf64ec5bf47ab59ec71d23c6f65e22409777e8f44a723d1038c74ad90c9a0433db6410f247486afb841af25b84229097b2e3120c7adc7617d2
SSDEEP 192:iJCaLDFwxdkcSeaUxg0C9/z5hJwRWQkEu0ZqhTU4lK/mdlaLmP0O:aCr7NCR5hJwRBUTCurQ05
TLSH
T1B2E16B0683044D05E5658ABFBAD7DD6EA32335447C16EF0145BCDC3E1C2B3A16929B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  zcpf-finder-main.zip
- Size 6KB
- SHA256 ffd6914cda855eedb75f1c45344b63cb6d9256c8b4263635e4ee425a01807108
- MD5 eaed81446f3ff37eb9cadb6e40d5c533
- SHA1 81fe893bf2b59b80999247ba79d0bf344fba0f2b
- SHA512 b3584f46a48bbfaf64ec5bf47ab59ec71d23c6f65e22409777e8f44a723d1038c74ad90c9a0433db6410f247486afb841af25b84229097b2e3120c7adc7617d2
- SSDEEP 192:iJCaLDFwxdkcSeaUxg0C9/z5hJwRWQkEu0ZqhTU4lK/mdlaLmP0O:aCr7NCR5hJwRBUTCurQ05
- TLSH
  T1B2E16B0683044D05E5658ABFBAD7DD6EA32335447C16EF0145BCDC3E1C2B3A16929B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  zcpf-finder-main/.gitignore
- Size 37B
- SHA256 269dc4d7c99b4ab889e685dd5c75fde06123d43a58bed3452af86448f8d1ef87
- MD5 31b31cdbf49631df6bd89c4550859816
- SHA1 6164807c7c263466b7d1dcecaa27834459f9c316
- SHA512 3db65751b384ec19905cbf285302236efdec601acec6bfc9ed3478a2bf000ba44d9aca25f924743dc9a30dfc5f5631cc1c05f59f45a970cde85c239a9b75b70e
- MD5 SHA1 SHA512
Score

3^/10
behavioral3 behavioral4
- Target
  zcpf-finder-main/LICENSE
- Size 1KB
- SHA256 0e1a2803683328ab7d3b1a217edc1efeaad959daae74b41f3d1e4eea7ffe811a
- MD5 cb3b4cfbdaa3a753a71a61c97f658081
- SHA1 079b633e423c5bae839e4c971bf651589640e1ef
- SHA512 4630b574a150bf23898f26ebd558343f2b1ccce8676a8af4449ffb14caec9320c60bf2294d28ad10c3926d8ad740b385dcb173ea4888264a1acffa0a163ef424
- TLSH
  T10B11461EB25107A6189B1360557468D5B12B715A7A5F2A84246DF345232A06CD5FB840
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  zcpf-finder-main/README.md
- Size 2KB
- SHA256 24d3af58cb67934e89f1a6cdf6e56faa9c33f19521b6e7d471eaf01346101a8d
- MD5 8ca04ffec22c75cec9548b4fa20f1d66
- SHA1 e92714ca347216c7f9366b76bf24e31dfbed5526
- SHA512 1acf5b81e741e58983349666e108df767fa2fd20b8fb05f2dc12a25b571c65b2a148faf9a06cd103c6afc6331f352346c18baa30472db953f103eb88b18f4adf
- TLSH
  T12841A6A82C4722095722D387E2046DE3EBC47C87661A8587DC8B4542D2CC7EDD08DF56
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  zcpf-finder-main/cpf_finder.py
- Size 12KB
- SHA256 92b328decd9f15d97cc7ba4ab6bdb3829c739acea22d2027112e27cd03655cf1
- MD5 ac6d01840c38b82891fdde5e46212c05
- SHA1 94e7848fc965eed4e58614d4e1d9686403243aa2
- SHA512 a362f0877019d8a1a29959ba1b647887faad9fa877f3f98fff36b88edb0696c307cdc6c829acff90cc47e124ec456a40ad27a6e19d8de42e8694a2ca08a35973
- SSDEEP 192:0Y3GEgi36kBfdf2IpW5NeWGxva/Ey8DGTYS5AqpxwztWduceX/A6SdQi:0Y3GIBBHpjpFesO7EvA7
- TLSH
  T14442833088312631F393D66DDD629201A739B9073B845862B68C73582FCD83EDAB5E7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  zcpf-finder-main/requirements.txt
- Size 54B
- SHA256 3244e4fba04118eb17c4d04e94ecbe010cd8d9277b5d1502ceccfa11dff1bdde
- MD5 b79cf411814a192f44f0a184a4651549
- SHA1 d6c2b4bd25096b4f975ef70910557ba47b039758
- SHA512 5668b6e81180162db31265b51d3852dc7695ee9cbb18fd9040a827a35f4a43e9f4e2e1e2445d4042dd53d20fc02a2a2c0900078149d6cf8769a8a6855a4b08d4
- TLSH
  T151900220635496A92745C5AB62565019794325840821AB06721C6A0602058E6C0D594F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12