0fa9988e6c5e138d01492a8d264787126c798e7e8de9a1dc14aa8571d456a2a3

Sharing

Copy URL Twitter E-mail

General

Target
PhonerLite64.zip
Size 6.4MB
Sample260721-gyrmsshx4v
SHA256 0fa9988e6c5e138d01492a8d264787126c798e7e8de9a1dc14aa8571d456a2a3
MD5 7b96ad80c1ee257f5c8d97e28c354b25
SHA1 2dbc524db63e102fc58d91639475b8f33822fddf
SHA512 c2a91c2bbb0f8799a6a060285cddd88a85db937ee915d33b684afc1dc5cb5d1122105aa60256376997a364fdd68a9389f73c353db2e079957df93be151e3aedf
SSDEEP 196608:bl5VbH7dWhNwZK+3qNZ+xx7MBmXhrYNzp5bYWQE77p2:x5VLJWhmZt3qSxFMSrezLT3w
TLSH
T143663341E5B5206ADA28D494DEE369311E3C2134974AC7B1FD920B5BAC78C031DEABDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

ransomware

Malware Config

Targets

- Target
  PhonerLite64.zip
- Size 6.4MB
- SHA256 0fa9988e6c5e138d01492a8d264787126c798e7e8de9a1dc14aa8571d456a2a3
- MD5 7b96ad80c1ee257f5c8d97e28c354b25
- SHA1 2dbc524db63e102fc58d91639475b8f33822fddf
- SHA512 c2a91c2bbb0f8799a6a060285cddd88a85db937ee915d33b684afc1dc5cb5d1122105aa60256376997a364fdd68a9389f73c353db2e079957df93be151e3aedf
- SSDEEP 196608:bl5VbH7dWhNwZK+3qNZ+xx7MBmXhrYNzp5bYWQE77p2:x5VLJWhmZt3qSxFMSrezLT3w
- TLSH
  T143663341E5B5206ADA28D494DEE369311E3C2134974AC7B1FD920B5BAC78C031DEABDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  CallWaiting.wav
- Size 15KB
- SHA256 bafd5c9c37e53bc5b54769bf4f02304c769c1c7613e70ea648cf3d8fb88f50ec
- MD5 c88bbbf018c2327562742a5f9604858d
- SHA1 f84fbaa4ea8c8baa16e9c61ca4524616c5afbb35
- SHA512 0cc6ff1f59e2f7a988c5c2fd900368ab637377b47de8fff0e07feb27a45e672635408b3dc94bf2e07bf4fb393a837929f1d07eb0118d40bd7f6150fea678c25d
- SSDEEP 192:3IiqVQh4aowmNOo0hcWWyufIqlK3mxfVw4AgzQ:32ZXN+hcnyuQqlK3mxf+EQ
- TLSH
  T15D623EE1DE1C48169A923CBAC96B1ECA77314ECD91DC11C225E5BD1C9A97CF2C8072A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  PhonerLite.exe
- Size 9.6MB
- SHA256 0c2395acce9c8bcb72a853b34370495bd17428868727ef01dc08999d4e52c143
- MD5 75aec94d1e3059f2fd20a48b893726c0
- SHA1 d2d28c8f9336b848d44aac8a25fc50a0306b7622
- SHA512 7b9e1630f10ec33d668a05bdf49305aa01036c2d8bdda78b2e46777beca7b53434d0884e3b609bf7d96d4355fd6f6e00a32d509c8e35f3bb53bb16d9311f6de2
- SSDEEP 98304:XxQGatkdD2doBvQW8NtOdWsqmZvExk0P/J7:XuGVD2dwK4dR+jPF
- TLSH
  T108A66C1BF1A4815DC12ED23AC4B34FA0993374B51B36D6FF629D225A4F6A6C05D3E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  RingIn.wav
- Size 17KB
- SHA256 5e69f6db9bab70d03c27bd76f1ec4c371504b507001a11c5a6a052ca1b70a302
- MD5 1f0a66b2c2c625535bf487e0a8268ddb
- SHA1 8b53ce574527c6b9efb722a98ac6ca347a47f06a
- SHA512 3c4e2808acaad204aa428bd8584646165c42ba1fd2fa0c820ed3b4733d21a5a7c83f46a408f77cd7fa81b7cbfb552ccea559ec7a1b60a9683485902824957ff3
- SSDEEP 384:k6ML9TxJMJAYlokA/dqOKG0WMiRjfd0aVfUoSOhZTngCPq0+4dL:sL99JNYJAFqU1fdBVfUChZTvKO
- TLSH
  T12782C181B442F4CCCE129FB2BEBD9C4A5662BC342E2D59B230046D15BC66DA3DE5D335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  RingInInternal.wav
- Size 15KB
- SHA256 4f5226b930373cafb62e6596c0c8db43e724ca6adaaaed69322d5e54c0367344
- MD5 63def6439c8f078d295213cb6c3df646
- SHA1 a59e2e6157abe3abbbbad134ebc4c850ca463759
- SHA512 bc45e8bc3253211792ce24e52701a6fa02a3172339af11852775009aa249886ff3e5027b2c875f7aebc0a922cd0ebe9162eaea1828e4eb700f759790b6828e3b
- SSDEEP 384:Ss7TgyhEyQLi15lJT/d/4BEeC9zOXJuvpHd9cX+rFI4YzSUnpARJlPKkMk:f7TgyhEy2iHFQBEeC9wud9cMFNACHlP1
- TLSH
  T1A97249647746EC46C845383EA98AC2E86B37BF95AF01920770A2B77B1B7D8115CDE1C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  WebView2Loader.dll
- Size 161KB
- SHA256 f4d811cda483adb33220c5a856c5ec8dca3a095fde54b44f08e1279a6a5efd33
- MD5 3fac859547077abafe806ff1e4709f47
- SHA1 0366df220c5d224ee64a42c929574407d2e6d2c9
- SHA512 9b7b7aabf6bdc11dfd74430336e02d7d2b96b6bbf352f1e2d158a4900bead364900820af56cf9af25366ff5704e2ffcc2458d45dc3efe00ebd0843d127ab7435
- SSDEEP 3072:JX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipT3YEtJ5+PON2Yo:JDTlTRTFOYfThTNTvDhvZkPEKdI7pxEG
- TLSH
  T180F36C5772E5007BE16B8274C9A34A11E77778510B60ABEF03A4477A1F237D4AE3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  licencia.txt
- Size 1KB
- SHA256 b551707baaab775c96657f49985c18c1393ddcd1d3c7e3147b9b192b5d288202
- MD5 6d8f67fc25fa17c494514b011ba498e8
- SHA1 9a355f272e6af16ff6ec53104c8f96e420f40cc9
- SHA512 be8ad6313b0bd00152450bb30c1fa5ea53ec3ce3038ca6b98578b74242d5cc7772cc28c27de3cfe5b595afe6b737d773dc46e8bf0cf0d9429be4af4da4ab9c83
- TLSH
  T11D41836D249C53AE2867A3C2A4A6CC86F5032AC0B04F62F6F109D6643005740E3FF5C8
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7
- Target
  license.txt
- Size 1KB
- SHA256 329021f1146e9a25923bf923f67c1ff79f5d4890ac47c750a060f2a8c9caeed4
- MD5 d91ea03e4a86c868157e7af8960cf76c
- SHA1 f6440f8c3f91152f588b294eaf8d128f86b730d2
- SHA512 77830d65466fc2c8376901d03c75359781ee6153b8577d975b97cf9ca1c41caa2cd8f52b8df900af10d52c0adeb8f2b283f86871f2ac52da1ed863cbf3a39cbb
- TLSH
  T19331529E378D43B629F206C7A95BC9C1F317A650BA9F1992305CC27C2282B5097B00CD
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral8
- Target
  licença.txt
- Size 2KB
- SHA256 55d96f55c9e7ed3aca435b40698e8ef95c499aad8015174e40ffe489ffca3757
- MD5 a9354b841bf9ceda0346ccc6009e202b
- SHA1 b84792ed6e86e4faa5c8c3a5e328ded350cd08dd
- SHA512 20a2e7d6faeb4a6811c900bfd728f5fd9ba997624c29b18d42f39a6f6683d9d134942a826fb184d050b2652c7f55b95102e78b75fdc55851a1394857b90ccf75
- TLSH
  T13741535C25ED222A186647C77273CE51E417FB84B04FA6DBF19C8E687141B409AF968C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral9
- Target
  lizenz.txt
- Size 1KB
- SHA256 eb896245d6d30f577bbe4cb7e3f98900daf9ee68650870ffbe46a445406e7970
- MD5 270d4db9d171f30c6c45857e1830048e
- SHA1 6f13afbf40e74c480792ddf02fb0de4bed4d25b5
- SHA512 c0e57b24f3f443a563dfc45322ad0def54007280317cc5bb15356fa273ca60a289bbc27af47b9ab76e3f6ed744d8b62736c5b64e6a28cca959394ca2620a1226
- TLSH
  T1A141B6877C8A600932DB3792B129DCCAFB6B93C6D6472447B28CE3B591007B152C45A8
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10
- Target
  provider.ini
- Size 724B
- SHA256 f7b2b13f40ce34845e4f49f04d6dbe81355ae694ff50c0c230eccfbb6a235c76
- MD5 a6ed3ceba55a0a429a965f30eb8dfa8f
- SHA1 2dc056578397bcba025835e6824a4728e1f3eb48
- SHA512 a9e462fb7b2bd4ba242dd19aa727e81cbf95d8b3295527dff46e9f9e3e95562c933d2131e274ccfc92f2dbc60552c36e35dbca68ccddf8b95c1b89a01c8d35c4
- TLSH
  T16E01DC49CB40F47E15828A4960F08ACA1853FC20E84842B49BB0B4809CF816E30FB1E9
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral11
- Target
  sipper64.dll
- Size 7.0MB
- SHA256 506c4595ee63586630e0e7820a1b53cba7618585616ae721747a1ea61b1e3be4
- MD5 bc57519c054d1891bb58c9010b19ee03
- SHA1 0d5c4eb2e11ab9b55b60d51e2e4cf6fbf1f43e7c
- SHA512 c5a2d11ca979f7ea591ce23cf944cf7a957c45f22466ecc42ccdec1410bf66f49a03db39d3d3660dfc3d51053acde9654d68ea33b8ccca61f84dd97332c8cf38
- SSDEEP 98304:51/McQOfNfUWV6cuMY64hHUtKQRbmOlsQZGchiKdN:DMcQOfdhJM6kcKdOlD84iKdN
- TLSH
  T10476BF17B6E401BDD477C138CA574617EBF2BC492370D78B12E4AB692F237A25A2E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Drops file in System32 directory
behavioral12
- Target
  Лицензия.txt
- Size 3KB
- SHA256 b01fdd59a9de4d5d907e125c0a0fbc67adac80408527a7bffdf6384c4be56364
- MD5 5d0e29cb923f2b7aa0bf6ca10ca336cd
- SHA1 22b7b6203713b34767bb2559833780950ea49bd7
- SHA512 a8435866c0de0743b0c3f5b8c0d1590eae4ee115c22730c12a5849639423b29288c2c6abd8e236a93b20b24a05fec35db1246ad564f1663a685c8fb1beb981cd
- TLSH
  T17D518E6055AE10CB2215E04BD804BE09BAFB42FE7B67931326983D7E34F1234C7A9A5D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  Ліцензія.txt
- Size 2KB
- SHA256 7e6b8b319f807cd20a304aa18e2d888bc4440184934e15e8a932dec6b6508572
- MD5 2f31cd06589ecde878bf1097fbb678de
- SHA1 272aa0903198d06cb301df8baacdf77fd81961c2
- SHA512 9a904b27dfef3c348e2b0886672c348d3670bd6c5e423f1757796707546330682de9946b79c40acbe846d32e4ed3b243f99dad474c2c798d7a22ce1df043fd26
- TLSH
  T14D5158A9269E54CF4112E05BE845790DBEEB06BE7BA7530332A47D7F35E0830CA38658
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14