d24f288f230997bcc86bbd296baf21717e3fced6fa26d0380ca135085f0a11a8

Sharing

Copy URL Twitter E-mail

General

Target
MrsMajor-main.zip
Size 1.6MB
Sample260720-cgp1escs8m
SHA256 d24f288f230997bcc86bbd296baf21717e3fced6fa26d0380ca135085f0a11a8
MD5 c60f55c8ccd31632f46a0b7c8fe60728
SHA1 6c919be459e3fc71b4171917e29cfa382431c6d1
SHA512 2116d0b6df474e8eeb47ea25bce08a91dcc0c5976b193b79289eca4d2738fccd80e3279802cf187d4f94043dfbc1ebe8d665f61fa6500a0b9053ca4bf3f60df9
SSDEEP 49152:2/Zell/uCmctj7CMlozsfcjvvRDA/l0mIS0blIcALI8dx+:2/Z8/RbtSmgIGvCmmJ0blIcALIp
TLSH
T1F77533BD4C12E5C9C834027A31D971A6C14DB8ED1854C8ABCC8E84D6CDF5BB61AADE93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  MrsMajor-main/CPUUsage.vbs
- Size 92B
- SHA256 28e69e90466034ce392e84db2bde3ad43ad556d12609e3860f92016641b2a738
- MD5 0e4c01bf30b13c953f8f76db4a7e857d
- SHA1 b8ddbc05adcf890b55d82a9f00922376c1a22696
- SHA512 5e66e2793e7bc88066b8df3dccb554351287dea18207e280b69d7798ecd5cdc99bd4c126c3e394db9f45f54bb561e6688f928de4f638c5eca4f101dc2cea54a1
- TLSH
  T15DB0045D0DC3C07F171014010C51CCC051407014D043CC1C715CD7401015140050554D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2 behavioral3
- Target
  MrsMajor-main/DreS_X.bat
- Size 360B
- SHA256 2590879a8cd745dbbe7ad66a548f31375ccfb0f8090d56b5e4bd5909573ac816
- MD5 ba81d7fa0662e8ee3780c5becc355a14
- SHA1 0bd3d86116f431a43d02894337af084caf2b4de1
- SHA512 0b768995187f988dc15d055f9689cee3ab3908d10b05a625b40d9757c101e067bbd6067ccbcf1951ebb683f5259eec562802ea6161d59475ce86cf6bc7c957f2
- TLSH
  T127E0F7438803A00AD9982AE0C3DE0384F88BC0B38C7081A2A4473030B8A128DC23FFDF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4 behavioral5 behavioral6
- Target
  MrsMajor-main/Launcher.vbs
- Size 590B
- SHA256 6f0bb8cc239af15c9215867d6225c8ff344052aaa0deeb3452dbf463b8c46529
- MD5 b5a1c9ae4c2ae863ac3f6a019f556a22
- SHA1 9ae506e04b4b7394796d5c5640b8ba9eba71a4a6
- SHA512 a644c48562e38190720fb55a6c6e7d5ccfab60f362236fe7d63caebdc01758f17196d123fb37bd11f7e247ce8ab21812165b27496d3bd6ca5e2c5efefab8fb03
- TLSH
  T155F0C90D9A87C708235CE0C10A84EC08CAB08E48FC24A9B17F4AC311D4183B82EBA68D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8 behavioral9
- Target
  MrsMajor-main/MrsMjrGui.exe
- Size 71KB
- SHA256 087fca40e079746b9c1dfaf777d3994c0321ea8f69d08238cdfc02fb109add1d
- MD5 450f49426b4519ecaac8cd04814c03a4
- SHA1 063ee81f46d56544a5c217ffab69ee949eaa6f45
- SHA512 0cae15d863120f4edc6b6dabfe2f0f3d2e028057025d7d5ffe615cde8144f29bdaf099850e91e101e95d13f8a83cb1410a06172dda25a5f92967abcbc8453cbc
- SSDEEP 1536:M1GJbcJVksz/mYyXki6GHcSVp5l/eq/mh78EZuMdUQL+ZZN24W6yos1:M4I/mYyX16rSVvl/zCQXMdUQLK211
- TLSH
  T10163E024F260C775C86947301852E1B217B2EE098E95AE2C55DCFD1FBEB360406EB3E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11 behavioral12
- Target
  MrsMajor-main/MrsMjrGuiLauncher.bat
- Size 98B
- SHA256 47e6c9f62ffc41fbc555f8644ad099a96573c8c023797127f78b1a952ca1b963
- MD5 c7146f88f4184c6ee5dcf7a62846aa23
- SHA1 215adb85d81cc4130154e73a2ab76c6e0f6f2ff3
- SHA512 3b30fa1334b88af3e3382813d316104e3698173bb159c20ff3468cf3494ecfbbc32a9ae78b4919ecd47c05d506435af4a7ccee0576c0d0018a81fbd1b2dfcf10
- TLSH
  T1CEB00214C701C2AA3013A1C44391BC11110158C87E2C88661388524756C5554522EE54
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14 behavioral15
- Target
  MrsMajor-main/WinLogon.bat
- Size 117B
- SHA256 2798dad008f62aace1841edfb43146147a9cade388c419c96da788fcaa2f76bc
- MD5 870bce376c1b71365390a9e9aefb9a33
- SHA1 176fdbdb8e5795fb5fddc81b2b4e1d9677779786
- SHA512 f17c9898f81387daf42c9b858f507889919474ac2a17f96fc6d4606be94327e0b941b23a3ccc3f4af92b8abc0522e94745616da0564cdef1c3f20ee17ee31f53
- TLSH
  T180B092048F89D551B01630809321B550832164E4271B94B353DAE30B6183EEE8726F98
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral16 behavioral17 behavioral18
- Target
  MrsMajor-main/default.vbs
- Size 266B
- SHA256 e1ebbd3abfcaddf7d6960708f3ccd8eda64c944723f0905ff76551c692b94210
- MD5 30cfd8bb946a7e889090fb148ea6f501
- SHA1 c49dbc93f0f17ff65faf3b313562c655ef3f9753
- SHA512 8e7d98e6d0c05d199114d2d6ab8da886aed68de690c4d79643868eaf051c229fff94c88d937adb3da5e31fe48116613cf79dd00dda30f296746ce0a8aded9fe2
- TLSH
  T101D0125E6553C229371450D3CDAECC1DD1B09900EC31B98039C5D384C1103B41DA98DE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20 behavioral21
- Target
  MrsMajor-main/mrsmajorlauncher.vbs
- Size 3KB
- SHA256 4d3aa3ecd16a6ba46a9d6c0bdacdcd9dce70d93585941a94e544696e3e6f7d92
- MD5 e3fdf285b14fb588f674ebfc2134200c
- SHA1 30fba2298b6e1fade4b5f9c8c80f7f1ea07de811
- SHA512 9b0bfbb07c77d9e9979a6c0f88b0a93010133f7dd3cf01e1de5dfbe812a5ed920e916d16d6a32fe21b9ee4b5425e61a616ded1aeeb35a410d4f77c0f9392ed0a
- TLSH
  T1E5710F4CA963CA3FD3F2718106DA9F06A779A538F2A14D7A709CE34085E33DC54A59CE
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies system executable filetype association
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral22 behavioral23 behavioral24
- Target
  MrsMajor-main/reStart.vbs
- Size 638B
- SHA256 2cbd8bc239c5cfc3ef02f8472d867dff61e5aed9fde8a3823cda28cc37d77722
- MD5 0851e8d791f618daa5b72d40e0c8e32b
- SHA1 80bea0443dc4cc508e846fefdb9de6c44ad8ff91
- SHA512 57a9d1d75dbbab842060b29f01958f7e6b27d0175ff9a3f7b97e423c1b4e3fae94547a569c2e5c88224fc5dcc785f5a1d49c61199a8c7b3afeb4fc520600df40
- TLSH
  T125F0EB0E1A8FC30D5B8EE1A10A98DD19D2614A4CFC30D971BA46C30480083BD5FAA5EE
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral25 behavioral26 behavioral27