38739612065da1abd9c46f4d97c472d2a4f677d379219bb160a762ffb9ac140c

Sharing

Copy URL Twitter E-mail

General

Target
install_ideaMaker_5.4.2.8790.exe
Size 116.8MB
Sample260722-ad2hyagf35
SHA256 38739612065da1abd9c46f4d97c472d2a4f677d379219bb160a762ffb9ac140c
MD5 5a388e385c7be636c884e72e9933db81
SHA1 221411f5181eb055bddd1a569b1d6a235c743769
SHA512 a086c0a1a851e5b4c40de6fa3a9f474b1610be1bc89b4fa9df9b1b513ef785dc2eb38eca56dc1cc77f15a03380c4472bbe8838077416f79c4dce6eb62f344159
SSDEEP 3145728:r/Oct26cXpQOOjQrwPAQT++PB3Ta3+itmQP:7OupcGObUoQbPodd
TLSH
T1CD48334ABDD8AE49EEAF0D7438FB1C36142B8E0B551F63E5B2D8532C732A08C1987D55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  install_ideaMaker_5.4.2.8790.exe
- Size 116.8MB
- SHA256 38739612065da1abd9c46f4d97c472d2a4f677d379219bb160a762ffb9ac140c
- MD5 5a388e385c7be636c884e72e9933db81
- SHA1 221411f5181eb055bddd1a569b1d6a235c743769
- SHA512 a086c0a1a851e5b4c40de6fa3a9f474b1610be1bc89b4fa9df9b1b513ef785dc2eb38eca56dc1cc77f15a03380c4472bbe8838077416f79c4dce6eb62f344159
- SSDEEP 3145728:r/Oct26cXpQOOjQrwPAQT++PB3Ta3+itmQP:7OupcGObUoQbPodd
- TLSH
  T1CD48334ABDD8AE49EEAF0D7438FB1C36142B8E0B551F63E5B2D8532C732A08C1987D55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  ideaMaker.exe
- Size 27.3MB
- SHA256 e3554b6acb70225b138cd90bb00e2549d25ea4877fac43edacc6f10f0e4467ec
- MD5 5197a40c46608f75a5566386a527ad05
- SHA1 181286dcc9e09b50efacd4a436d3e1541057177d
- SHA512 9ff5d669d11c4163060ab11be4ff958e0bf2d0da920604b43a7b5da6f8b6ab19b4f261e762ce88c4e221c5f3740a025eb03536cfd90c48a7e8de953890996ee0
- SSDEEP 196608:LV274cDtW9/kVd2qW9wsyJHcvkjZDGJor7AUywyr0LN9BuS68pvDeLN9ZUkBxXyt:LV2SaVgjyRcv1OrRy0RrDWLZ4YNbptvw
- TLSH
  T12B579E47F263409CC0A7C13853AB9633B674B89D4634BFAF6A609B763F60FA05719718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  imageformats/qgif.dll
- Size 78KB
- SHA256 d50521b169a6326aef57437e6e51efd4bfad298f958cf51b778a5990c3311a68
- MD5 6643793ba0c0d45dd5cccde0a5b25d33
- SHA1 92cc3a8febb2178e90da189ba8a1bd2bd7732ea2
- SHA512 5dd99c63ed9b915e2678195be7815e7abc2f2b1f71441679810be215b840d28830c230ceb56f67ffc3c1d4a2067971e31e6a861563396990447a5130d841e543
- SSDEEP 1536:GJ1xnxBXZoy2Eo9WYghCnKfvmaIMFqq9AcfiUfDsZUfF:GJ1xnxBXZoYo9WYgbmHMFqq9AcfiUfDD
- TLSH
  T1257360D6B7E49D9AEA62823C92CAC232633CFED152138B57113C96311F12FC239D571A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  imageformats/qicns.dll
- Size 97KB
- SHA256 497013b978978761e372779d724232a1874f0c00624e83dd66bc30915c672f4e
- MD5 6cad5fde4760196bef345ba4aaf8b921
- SHA1 ed2fd0a2166ade2d7debbf3db9342a471c7f9fc9
- SHA512 8b30fcbf1b4393ee258716e8c37a4c5b63b4707987664799f3b9d14cb779d7ffece1efdca0fa6cc01d5d8697782a9a6e76b7b8a284c8b4d0cd4e0cc8591f1167
- SSDEEP 1536:wnKJWwxRYl9lnamsJ7UW3oemveLrliGQCP1fHaVbrf0HNMb5UfN:Ay7fJ7UW4eweFiVCP1fHmbrf0HNMb+
- TLSH
  T1F6A362E6B7D89EDAEA55823C42C6C322773CBDD146528F1B512C96324F12FC23AD5316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  imageformats/qico.dll
- Size 81KB
- SHA256 a721b24ca1fa0187891ec899a8a0e969e4e2c3a7d1d01edc97ceffea9e379026
- MD5 7da403414b84b57eaee35fef9a907152
- SHA1 19dab25959851e5c5876131ae6479e2809ac51eb
- SHA512 2b1037bff4e07e3f91a52140770f755e03f54204d91d0a81ebad472aaae73ad5b20d450de5a9748434a7d1727046bb1a0342608c578377b02854364a3f2ef1fa
- SSDEEP 1536:T9vXN/kS6XMWxZsJDJRIvEAzloT/vqfM+AbeBTUfE:BNqXMWxZtEAzloT/vqfM+AbeBf
- TLSH
  T1FF835FE6B7E89E86EA6582784386C332673CFDE056238B57113C96324F52FC639C5306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  imageformats/qjpeg.dll
- Size 476KB
- SHA256 830442002bb18dc98a97090942cf8dd892d264e6031123c856e2acee8b2d89d7
- MD5 5efa4cbf69cea6e2e5db46492b6fb31a
- SHA1 4c282dffbebcab838e56cd3ab11e71b62ed7e0fd
- SHA512 14686738e281113caec512b30165a18b8dbb982add6bab3447508fe69c666f1072d93febedbd07bde0660143b5489bf3a2ca5900375a7e8f8ccd2c1de3b43926
- SSDEEP 6144:kNnLzZc+4dtRABmfnvJru/rmIjwP3oXg4fzAWYyRH9OirkePfWiZBkM:kNnL9xOnDzN4Zdr4M
- TLSH
  T111A4D597B5A11C8FDBD68138CE96D232673879AD53F38B773128D5F03E12D913A89A04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  imageformats/qsvg.dll
- Size 74KB
- SHA256 eb6861b1577f7ebc210a8120198c199e24b666f79b67b28f64aaeb77331378ad
- MD5 0cf17da428a03ff8825abca5405da38a
- SHA1 ba397600e84587c4dec0bdcaa4b645dac2bfb42c
- SHA512 fc04d23e3809808f337790ad62570237f4fc6d87802e6fbce9a49d8bc973165e13b3311feb8803f1c12241d56ca7073928006d70a945024be9d10b5c50bf8575
- SSDEEP 1536:9VJZnhMkWkDnT8apNWDD2FE+Mf54uUcd024Ufw:5ZhMkWk75oDCFE+Mf54uUZ2U
- TLSH
  T1ED733DA5B6D89E86EA64827C93CAD322633CFED047138F17523C86325F52F8679D5306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  imageformats/qtga.dll
- Size 72KB
- SHA256 b70dc43d84d08222b7175a2a5e2452db95f3ebecf0dedf4485ae087acaa76f74
- MD5 86ee3c496d61bfc93bbad3c1234d8710
- SHA1 aa355bc436c4aa4a97fd0b5988300580c0269904
- SHA512 edf2a141f71dd95e728cc4c5c5855779ab20aa1d74e7d29c3d545158fb4c958ba084b2a7755818d119675cd7b482af85480526e3cbdd802715497ade5f975fbc
- SSDEEP 1536:fiEGdgXW1RrvdRJdcJInkzHJIDfAD8ONCUfj8:fIdgXW1R5/OJInkzHJIDfAD8ONS
- TLSH
  T1767350E6B7D89D86EA55827C92DAC322633CFAD047138F17513C86325F52BC27AD9306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  imageformats/qtiff.dll
- Size 516KB
- SHA256 62e080d982fb454ba8650a4a70894aba823e9c2d6c24902fba170a3c4b87a969
- MD5 c073546b7fcfb2541cd3da1542542388
- SHA1 d658a197c2442dc94e86a2381c6ed058ca2af8ae
- SHA512 2e37007c5019f883c266db3a5848efef609f33887ccba856fb1b9313d03f43a378ffa5fa007d9a0e6b3543de363e971024443812d5c4983c7a9142d0679a1530
- SSDEEP 6144:KLW2dhwfA86DFthcb+C57e0XSnr8u+XWwdsj2tTWx/i31zIX2dikgufcHenHS9:eW2duI869cb+C5y0X/ukdu04iW2dty9
- TLSH
  T17BB4C855DAD14DAFD936813456E7C222B276F8953B12CB6B921CB1303E02BD039876FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  imageformats/qwbmp.dll
- Size 69KB
- SHA256 de00e10787fcab379b14eccaa1dddf508a93dc05b94a35bacc71e6a3781f686d
- MD5 226ac86d3401242f3ef518adbaacb4e7
- SHA1 1a02cdec82469b96edbd3569668cee41b5c7bb00
- SHA512 8cd7b1975bab9bfe0e0bc37c85d8422940717df8be4009c883d6b66e7f7fa541191445d88873505cc6004eddbb2598ab61de5a635a30306a1ecf71bd4c9dec53
- SSDEEP 1536:pJDT6us9IQWdtJZBh2hYf63twbfxds6m/UfM:pt61+QWdtlF63twbfxds6mN
- TLSH
  T1A3633EE6B7D89EC6EA25827C53D6D322633CBAE047139B57113C85321F52F8279CA306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  imageformats/qwebp.dll
- Size 664KB
- SHA256 68c67b346722bb40114306ebeb74ce0a1e6e8783b785fd303a2f58ed258c425a
- MD5 5c71d226462237ca2d3e9773360bc82f
- SHA1 9f821323fb4c3bc1c80f0b8c05560aea77e8c660
- SHA512 deba453d6ebfe966c1d78fc8f8d977e8f8837b3566cd4e2d818ab8812449cd8bbb7c36276f23c069d18c0d3e48f9c72827f579450afa2a3186b324b7d9c5de1c
- SSDEEP 12288:0jJrIJC7cPy0lRapkX8VQzhUfHtbfGFeAX:Wd7cCU8whU/RGFeU
- TLSH
  T118E44C5AA1D228DDFA278134C7AE9373B7397CA542319F2B0650A9311D32FC0BF5AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  jkqtplotterlib.dll
- Size 4.3MB
- SHA256 589fdc1f0a6e619737600590a6c5a0bc461bfd33ed48b0095e06c05d5b8035a3
- MD5 52c7d5f54874ef54ada1e4d5bee539d6
- SHA1 8f935816a1f4838f5da44ccb29a591d3e27f67f9
- SHA512 10445e61cac715b6d1e51875380016545537a0816688d29640318070fb83094e4e6401e04c9e5a7cb0f7892bca734622206181e5ed5c5b24d2410d442238d285
- SSDEEP 49152:ykbrF9JSidKET31ut2V7WLajt10llwIxen9/sU20F230FlsBh2Z7nSgP5H:yy9TZF+a5Iaa0i6lsT2nSgP
- TLSH
  T1DB268D47B3A7A5DDC067D83802AB6272F4B1B8585235BE2F9B44CF392E21F50571BB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  libEGL.dll
- Size 67KB
- SHA256 b1070d55627c2899d5928eff2f2e3187537162e93e189458fadd7ccfd6a2ca3d
- MD5 2874582e39562af961a6d1c59447459c
- SHA1 3cf7d154637aac69913b1f549938a21c7c4b16ba
- SHA512 eeca63a7020346bda9a399b83f4e57b6b54bbb222c4a3cf7191ab7fe0271f6473bcc58f0e60ce5f7d5cbd57298b858ffa042b62ed9a9be0806e08e4c6f5c7091
- SSDEEP 768:YCXkrV/vHAZmTi4V63ACh9/sfzjcdDGSUf2hC:Y//oWmz5rUf5
- TLSH
  T1416321E577D95C9AEA75923C81D6D332A13CFAD126534F13A23880320F41F8279E97DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  libGLESv2.dll
- Size 6.0MB
- SHA256 138ca7e61f59826d72b60480db3fec7a3b58de008d146d8699e97b5838240a4c
- MD5 9fe8bb1f6c6c61c0d882139198667bfa
- SHA1 da4999660d04edab3daf8f94ebc83dbdae6a5ab3
- SHA512 a9de204f699c70182410274155f612a5857634d1163deaa9a2169b94fbd67bbb3654464324e75d4a559f7f596b3a1f89c272a36153c7b560f84b1003d33e6c6e
- SSDEEP 49152:tI54/yM7wXl/tDoU7hvC27KdmfbZWOFJQrcy3ZWZf2XGJFoqA/eZwvISmVYJH4HN:PyFL7dn23r/nKy2x+gxy6LokYjbFWL
- TLSH
  T101565B93E19B589ECD6BE33592876332BA307C545236BB5B9900C2351E93FC09B2FB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  libHalf-2_5.dll
- Size 307KB
- SHA256 bcc88457bfeb776df2c5ee0865335d9b2ce191a4125efed7cf353b9c92f59089
- MD5 15c142bb73efdc998024c23d3109958c
- SHA1 d1cb634c4292d1d71af404021392f8fb0b1a83ab
- SHA512 943147c38b319ea2424f40d9219b98600d6a7c424d06249622a0defd65d619c84b1673112098ac607011adbd0c03ba33db86d8bd92f5a00dfc03dafe9c75e916
- SSDEEP 6144:QHWP0bUtZIWqt8DWHs3jhb4wcwl/9ZRvQQEkrNTK3c:yvb+HE8SHs3dv/T58krdKs
- TLSH
  T196648EE256B288E1FC9D647779FBBD5BC7A2D08400721520537B9D9E2B273500FBB2A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  libTKBO.dll
- Size 2.3MB
- SHA256 442a3eacaf9fcb244c1eb314001c732f9457d2d493ae5c9eab35a79e8d4b5824
- MD5 cf4095167b623e573c3038217dc866c5
- SHA1 6d0431abba642b84f253a3ba2f9a4c82cd69ed35
- SHA512 5c089fde0d5491b97da40233d7768be1db6e65d29ad589d1ba0dcdc3804883af539bdeb45fa25072c8713c4a954bf886821ae7039045812cc07c4cb0fd4e6df6
- SSDEEP 24576:mRlSd1H4uHTynSr9M02+Un1hZoqeh9AFiP5YrRjURgziLS+DE+jJr:mWd1H4BieCqemrRjURgziLS+
- TLSH
  T1ADB53B13FAA255FCC15BD03C96A7E172E170399E003876AA4360CB285FA5F90977F729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Enumerates connected drives

Checks computer location settings

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32