6dad7050573d5f639471cd60a98e9a9182e8939d220b707ba5d9d97561387ee2

Sharing

Copy URL Twitter E-mail

General

Target
Progi_do_100_kb.rar
Size 1.1MB
Sample260718-pex98sev2z
SHA256 6dad7050573d5f639471cd60a98e9a9182e8939d220b707ba5d9d97561387ee2
MD5 9cf83f1ec31d0bfef348f2053093e82f
SHA1 abc51534adff9db113edc434451118b0462f9abd
SHA512 c289ea479b3fcc29780c92aed8ecbb3fb39018bff215a407aa6fcf2576d8fe33cd927029ff1832bf72372a4bef2b659395225a19176bc32126f2c33894299479
SSDEEP 24576:R8xmWre28OS5g1Wbm6TmVCWSlVu8jJVHZ4c:ex5eGSW1I+VLuu8jJVac
TLSH
T1DF35DF16BA904263E5698131087397B4EB36BC2669329E433F6CBF1C2F76182EF71355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Aml Maple/AmlMaple/AmlMaple.exe
- Size 50KB
- SHA256 e061da19174524bbb11a2de3feb4f1312da574d32821367c9367e94961cad898
- MD5 6096d538d5c81734b46966fc97ac1d9f
- SHA1 f2911f4d76e358cc824e3fc0b780204594d7989e
- SHA512 74c0dab3d729e06ae2b2188eafafe243d59f6c24251e34c230753e536135a7d7d2a7e19161f33d7c1f7af4c8ac1e4c4a66ea4eb329fb796d9ccb027587e271a9
- SSDEEP 768:7fvoh0rgo2prGPuaLfRUjFiNG1GDMsDI1/JW9+j6soHRjj//:7YHo2prGPuaLJUmCGVDaJJj6soHRf//
- TLSH
  T1E4337196B290C876E0590E32ED17DBF456A5FCA959688A537FC47F0E3C312909B30B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  CPUiD/cpuid/x_cpuid.exe
- Size 5KB
- SHA256 c760d2d93bfc47bfa212a6b39e674c6f44245cced29e1e3f71939464269394ce
- MD5 c38bca19aa7c66df4e5149edbadd98fd
- SHA1 990076012de769a77c4e0c3be4869406ff5002d2
- SHA512 6933aca82a7e24dbea6d38bf9db0b9018abbc4dbcc438c08face6f7cecd88a3771249254eed8b56fb8ef2e86089a2743b829ffefe778190e33072ca2b283aaac
- SSDEEP 96:Ye3dyagesF2hwhKhvhihThJhOhYFWI4wAOGVBlUD:FyavsF2qkJ8VXsrldh6
- TLSH
  T1EDB1316776A8A423C2E457B342F3CE92FEAE37122331435A97D3686CB1B45879D1D604
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  EVE/eve/eve.exe
- Size 73KB
- SHA256 dcfc9f6a3b8243397a7d33a8bf241a1ac1674e946f52fa1e11822717f2c29cfa
- MD5 cc11d88dce4316f1f2817cfc37cbfdc5
- SHA1 03b8876918149d6c4f8fc43674f2983bf3dc467e
- SHA512 95ddcdd7dd2a5dfdb4720fa9b2057d992b99b2b6894bb3a9603d52fdd80d7caed906ed59e30d6477946ea4d7025fc962eedbbde788d28907d0896bc649be9cd0
- SSDEEP 1536:WOc9V+aRuSIY2UahOI7DkcS1pUkbahMdALcURn31P46jVlBdt2qP:WOc9kDSIY2UtI7A91pUkbahMqQUJC6vh
- TLSH
  T14B7302C1CE314B48CEA6737107A98259B104F2FE23599F574F247CAEFC2615636267E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  EVE/eve/eve_faq.rtf
- Size 12KB
- SHA256 638b63fd351137c637aa1043dfd63cc2d3d1f93444ac8f25d9618edfa7797de1
- MD5 d249adb29faff74f7a9ce27b2991c8b5
- SHA1 80a8ba80c1e110784a530c70cb939f5238e7a921
- SHA512 6cdc83f1b4606e58c958ab5b13c119a4d77e9d167eb6d0fe2d84a4348f55cab6296e49ef5417ec295c9957c218c25520842d7956352977720b798316e024b3a0
- SSDEEP 192:E8+/+O7z6e/D2zdTpU3tfXjVtJJrXVc02hk0WzAG+J2gkShqBPUcFQG:E8+/+O/6e/UU3DtTrFcN1V2gBiPBuG
- TLSH
  T1464295CBAE044B7216AD03D3670D66C6DB12C0FC27A6E4E5745CB06833B2966737B6D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  EVE/eve/readme.htm
- Size 2KB
- SHA256 e0af07be2a8c0803c28c9dad5f275d23498f64320a6b1c2e856c7a1e6ec460db
- MD5 52656a7e3f832b1ba6e5e8b2de237bf6
- SHA1 4336e03597e98ccad2ba997592602f06d7b92f49
- SHA512 daadece64e1765181f755535f246569efb302bbe7e87ee5df23398413a99bc641ceb950800e43373b1d1b6339f2780df0a23d085778fdb51a78b0e6e34cf4dd1
- TLSH
  T14441B5EF550316720B92B139E899B0C5FB36D0ED7AA56244E099305F42A307C832BBCA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  FAIM с исходниками/faim021src/faim.exe
- Size 33KB
- SHA256 4e066f3a4146a308a898a60dd09f5445354efa2d1a0f5e2856ea11f28384a996
- MD5 744c42b639e913d8edf8a6fd13ae3c76
- SHA1 5ce25464a0bbdd891eb376fd524cc5d7823ace8f
- SHA512 ac1083c82942ae5b1834eaccb1753f3b9ca2a3da32801a0e766015cc093e8258b235188038b19c4e52b8dfe1231e44a89f8a763aacc23f62465a1869caf1deb2
- SSDEEP 384:H7gsSMdLUju1bS6hwlW0wXGvnSXvLFQyXolxgxXVwoF+X2UKDvKD+VNzCWC:0lYL50wXGvnS/uyX0gxXVwi3NzCWC
- TLSH
  T1FFE2B746FDA0D863D6601C3443BB4F63672BB8734821AA4B0BC9AD6E9D1DC50DDE5345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  FAIM/faim021src/faim.exe
- Size 33KB
- SHA256 4e066f3a4146a308a898a60dd09f5445354efa2d1a0f5e2856ea11f28384a996
- MD5 744c42b639e913d8edf8a6fd13ae3c76
- SHA1 5ce25464a0bbdd891eb376fd524cc5d7823ace8f
- SHA512 ac1083c82942ae5b1834eaccb1753f3b9ca2a3da32801a0e766015cc093e8258b235188038b19c4e52b8dfe1231e44a89f8a763aacc23f62465a1869caf1deb2
- SSDEEP 384:H7gsSMdLUju1bS6hwlW0wXGvnSXvLFQyXolxgxXVwoF+X2UKDvKD+VNzCWC:0lYL50wXGvnS/uyX0gxXVwi3NzCWC
- TLSH
  T1FFE2B746FDA0D863D6601C3443BB4F63672BB8734821AA4B0BC9AD6E9D1DC50DDE5345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.exe
- Size 24KB
- SHA256 16ea0c847d9a04332185cb70ee5a94457f2d39172efcadf29492e406e50d8473
- MD5 7e5e9f99e284d0e8edad60ba5cd0a2c9
- SHA1 040f3d65539815cf9bad9463165f02e5a06a732e
- SHA512 6f953800bfa7079d4e82c76217598f21c55a729757a7e26c1661c7667c741a1d4aedc52119990d60da21f93dece18f320ff51a3994643e4b2da9bf1a736077c9
- SSDEEP 384:/El96CUOQvvyTH0fxEJjAx9rAe7Z7TBAMreDEo1cKENM:Ml9ZDQv6TH050jY7ZHBAMqDEA7
- TLSH
  T136B2D4FC3E33CA73E62FC13D14825770EE595AA2D8204A57A773EF1A59B42037A2515C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral15 behavioral16
- Target
  Internet Maniac/Internet Maniac.exe
- Size 97KB
- SHA256 a90f2124e3be40a0127a023fcc5423bc0981ab2131ab03fd807a76bc16a897da
- MD5 c825c62d3c699aaf5c173aebc115daba
- SHA1 55d239a4bff281202845a9645ddb871259b37e2a
- SHA512 7ea6d6f1e7145c51afc39f74614e668b04183b32f5afc32b86832aa21406d112a8eb991d3184936432212eebdb1d82dc585b61c3e60b252a1e8f65b1c35ba9cd
- SSDEEP 1536:04jj2Enld2CEmaJ8AKedqitpjBBdojDMF4QSlxr5+nsQZ:hjj2Eld2CEmfp0PtpVDoPMLSlxr5+ns
- TLSH
  T198A33B60F5E081AAF07ED63124F5AF35AB39BC352B34869BAF34A57F5C325408E25712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  MPW/mpw.exe
- Size 40KB
- SHA256 cf296ec1cf5459d982c4eb31b06760e05af279de7160aa6a5f1b3051c589ff67
- MD5 ea3202a79c5c1bb3dd074b10d6fa2996
- SHA1 8d247a681452090f2fe82151f5d2fdf8e2f137ff
- SHA512 90e6279b2bfbf5c880fd1b40dad848356be35643a77b11ef2b4e3f83a1a41e16d6cdbe834f1813acb3a640d165f6cfbf91d73593e826fb917b27b71d5997fac4
- SSDEEP 768:xNaStY5zr7/vrdXcoIarG0kOwCLAJHMwXGLbFHLrrvXcZ:xZ4fvpMohrGtOwCLbmGLbqZ
- TLSH
  T1A5136CD2FB900F92D155943568923BF2FF6E4A182F6963061F002B5EEEA3453471939F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  OpenedFilesView/ofview/OpenedFilesView.chm
- Size 14KB
- SHA256 e00dd541de5675f890f9e6fbf417f73cd24547f1e8acc11310f8ba2bf251f301
- MD5 abff6a0be170dbfdc77bc3fb8a075d5d
- SHA1 3e1e4a32886c409cf2491546d6f5a48f4a0c5fb6
- SHA512 2c2e6caa76ba25fd9cd744261fee024a5e4ceee2d3f3347f8b3e6f169fe499fa99f251c3f3cd6fc399ccdfe4104fdc945a6bccaac0be3ae04f96ee9c2b3dd6fe
- SSDEEP 96:UDu+OnY6G42DtYE/cj7z594fs04fAkLAriT4FljN7/SU/IHQhn4Mu+JglAtziMc:gu+OuDJA/QoII4ZAUDh4J+JO
- TLSH
  T10C528E343A801D19E4758639DBD6EDA723A43C8F1EB207B9430BC31159F5A2FD6741A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  OpenedFilesView/ofview/OpenedFilesView.exe
- Size 37KB
- SHA256 be3bbeee45bb8b2a9a4331a9517226aae017b7a1a5577d14b17626053489d23e
- MD5 e735aeea761b0bba4c5999d7f14f3423
- SHA1 b68864ce2bba46f2b7c6b5f5351040213c90e82b
- SHA512 5db36c2dc71ba6d98d8967d1fd1fd67eb3c1c6034b31ca2940689600b0439a64040b7e44e6da49f1a5a55845a508cb14a19550a659fb1081c50835ee1b1d0727
- SSDEEP 768:+8gbtDa5eCH3+4+sWcI7xUk0h+7TaO3tcPCIcd7AY2Z:ZgZmqcc+Pcvo5c7+Z
- TLSH
  T18A03D11353B9B5EBD49A153844B3CB042BF9F8319B09CB3769E8328EDC70B42AC4D609
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery persistence upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23 behavioral24
- Target
  ScreenShoter/ScreenShoter/ScreenShoter.exe
- Size 104KB
- SHA256 a3758c1969af974e38fc83367cc60f2d56a8725017ec7142aeeb6ca89697f031
- MD5 7ffa56bd7eacd62ee244f0a24cec73e1
- SHA1 a7a389e544bbd8bd56d6fdeec2e970bf2f5d0cdb
- SHA512 245a64f0a2060f2249882e6538b11a4a00fe587edf550364bcc97de57cebdf476713c7de3f83d05b0a7351626beb511ed0af636945e3e33953e5c49e61ec4c26
- SSDEEP 1536:V2UOmalJ90sssiYwAiPQ4/g/mvVfILYidHS0Q1p8cn4cfqf:Xuas36PRHVUE0QAcn4cf8
- TLSH
  T15CA31A33AD241693EA0106F10D1996693A166C2874309F0763D6FE686876FC3FEF725B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  fSekrit/fsekrit/fSekrit.exe
- Size 50KB
- SHA256 d5db7972c8db0917311ac366c048a58d42d428a51d613b8fca1344d74edabea0
- MD5 d61dfbacd180305c3546d4dfa7f8f0bb
- SHA1 a8c1bbccdfd79cd98c1dd44fdbed8ac1d45e351c
- SHA512 f9b5d6219694bdc1e5ac31351587aaf2a6777ccc6478d433f22fde64a6790b2ec8400b63fca2e03d31374b06d642253d0b3630681a377b1a472273a02f253bd9
- SSDEEP 1536:ZSXmXAUQCtymhygrNfFJKoUzsDpD+0MYWJK:ZvXAUBNhfJxssZhKJK
- TLSH
  T1C533F1806F125383C68591F8EC62C8B8D393FC5064E2176FBD9AEA0F2BB5717C959325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28