5b1ede536b472445c7535721eaa6e70531a9ff11c22688f8ae954ba18735d3b5

Sharing

Copy URL Twitter E-mail

General

Target
ARC.rar
Size 83.7MB
Sample260723-n5tjasaf66
SHA256 5b1ede536b472445c7535721eaa6e70531a9ff11c22688f8ae954ba18735d3b5
MD5 edf71a7fede265ccb4e35b7600a6de07
SHA1 9f37265ee0e764d5c9e8424dea4df91ef73fd3fe
SHA512 b80cbaaca8d325c28dd881e2887aa28ce8ec326638534871ea8d81c385f1b779cfbef3c7f45ee081dc013ca4bcbd40cc1a1458143b2a21b0469dac058109cab6
SSDEEP 1572864:NpD844+6SelgyZw0CKSr4iaI190ngXEvoRRC4LMeRlvBWTjcD9:Nd844+6SCgyZSLr4iH1unhvcQ4LrTacx
TLSH
T1661833F2327F66A9ED8245506BAC4E8CA398A6B15BDCC8B396D47D3460ED7E01530F1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ARC/build/bin/RONIN.exe
- Size 15.3MB
- SHA256 e22025683b1e6ada5eb4a63c3742457959bf9951554fb998098d7dd5ddb88a21
- MD5 62c05241effd62d0a3116a7f730fae9f
- SHA1 70859777daee43bf6bc4a07e51ae1dec5524e95b
- SHA512 4b6495c4057478932a436d0bd4ba2b3ddc3751ad751e4a831e83f8f55dc26f55f0903ef6b769a3c3efb8b0b8be5c3e4d25b5e3e63f7c6ad1d886603440169a6c
- SSDEEP 98304:EXjDZmVCWbmTLi+J4Trt4cbYAyropVQ8w/Wxur5S3rPLQH04FXo1fu1JXfhOaZGy:oDZ5yC4Trt4cbDe8w/HIuuCfUaZJp
- TLSH
  T158F65C32A29642F2E53DC17D8E811A32B9B731424B1EB6DB05C7AB160D10FD8AD75FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
behavioral1
- Target
  ARC/build/bin/RONIN1.2x.exe
- Size 4.8MB
- SHA256 6f3bc99b3deb237a7d38362c8784229bdd74fc772d200a933d01da0f271528af
- MD5 840aed21cf3f851b0b0cc6157f86ebbb
- SHA1 8923af6b99892d4b4b3019317ddb34e2bd595299
- SHA512 8576818bdbb32bbb079caadce7ca4f33e6b2f160b570867f95826a36842fcafadd8d4c9c0e4e97686d9ed5405357a822f7597f5be3d906d18f8f086ee47e54e1
- SSDEEP 98304:z8Ecyx9YKYb2fGedX5PS7GDPcxjNinV8G2vnzr/mZ+LX:ztb9YKYbdedpPSAPcx8Kzr/mZ+LX
- TLSH
  T19E362322FA494BFCD15AC47482028663AA76B48F07217AFF42E056383F65FE65B3D741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  ARC/build/bin/RONINV1.0.exe
- Size 4.8MB
- SHA256 4610a97deaa977b8cd4e8ea85fdb27d2e20d7ebbc3ac8b63295f8e872fedeaa8
- MD5 4da4c6f9c84a2d6727d116d2d46f6d07
- SHA1 0440341da8b04248034c1daaa04af22c3fef0fad
- SHA512 a674bb6a0005a2a78edf606533793849dabae3fd738b0a010aac41caca9e6a3a7353b950f336c73d7ec7b55f209246de8b1bab55bf89b708ae655554963a4e77
- SSDEEP 98304:z8sIy6m30uCwnJbnOYmjADX6fBnq5ETKO/pnkjYzpy6Mj9MU1PEFkMe:zUy6kIwJbnOxjADXTw/9kjYij9MKcWMe
- TLSH
  T13C362322FB499BBDC45AC47883424263FA7274C917316AFF01A486793E1BFE56A3D701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  ARC/build/bin/RONINV1.exe
- Size 4.8MB
- SHA256 c573fac7d848799eb249c10dca96ae15c7307daee8f71e60cef36064ac684de2
- MD5 201ec3e2cd4a26569df01d116ebf3add
- SHA1 f7cff0525d2baa438886f7f8ad63926acc808f0b
- SHA512 16be3f7c42af10d4deca42b48eadd782be637b0dab2ea1488132f2d1e8fb3c391bd323fdddfe8a2aba9344dfa4c1b5a7bc84379e76b7b9e99430fca71f6d294f
- SSDEEP 98304:z8i1JbfuSOIe7SiWNeGdh64KNbjba4hJAJCxSo0svIO0TAAn:zhnbG77480hiNbiecCKsh0TAAn
- TLSH
  T140362326FB859BF8C01AC478C6528663D97AB4CE036579FF06D096793F1ABE41B38341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  ARC/build/bin/RONINX.exe
- Size 15.6MB
- SHA256 a08238740d963200ca58bce5bdf580df278853bb50196ef1048c5f73d63b9ca3
- MD5 6cb70a09ae93d80a177fe2173b395377
- SHA1 304234c71d17a42b0d46434ea21c3f458c4f19be
- SHA512 45f8d6eaa66b80fb338be61a0e49037e3e1f17e6da43eda8564e15a308644b958772404bae4f4a8c5cd6db509f3f2cfe0bea09ae4988b8c8477d44b536b7d0f7
- SSDEEP 196608:6tq3u54npgSSa6hTYu74lVmDuCfUaZJD3DGj:KFXSSa6hil6cj
- TLSH
  T162F65C32A29642F2E53DC17D8E811A32B9B731424B1EB6DB09C7AB160D10FD4AD75FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  ARC/build/bin/RONINX1.exe
- Size 4.8MB
- SHA256 31217361dd86260a6caa1fe52d449523b12c7506ee0cb39c3269f40785c2feb3
- MD5 46af22fc8fdf54d4cf16ce015fd9fb68
- SHA1 f5c3915e8251c75bbbe2ecaa80dafc91c3b45287
- SHA512 0beeb465417b5bde643e35c35542b21f98c8588e376b731c896020d84bf4f04fcbdfed6c7ba362d72962ee3e657e90b5f1e88b49897583d969bba2b17cddeb37
- SSDEEP 98304:z8kKpQpMHpaEtqxgeWj7HvLlBJqRFtP+9LqSjAS5C3kB3kRie7gc03A3T6:z1qQpMJa0ylWjzjlBiFtPTRhUB6iUgt9
- TLSH
  T102362316FB469AF8C11FC074C2534A63AA76B48E1B2179FB02D48A393F59BE51B3C351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral6
- Target
  ARC/build/bin/RONIN_Launcher.exe
- Size 15.6MB
- SHA256 4cb6077d1ec4f4429116f968dea3c6d3d690eed1cca5e1c18878689fd1bb433f
- MD5 cec02b45b389dc68acb45ab87e1523aa
- SHA1 6e4879a6c3807da3b32159a72db032f293b548ef
- SHA512 19759cef4821b3faed25457150581726d409f4c7bd96e37095ed9767a7aeb8bc74e2c74edbe4f39914c6dbd3ab513ed274ba800e0d9ec09cd46cc0c2a7f26c3f
- SSDEEP 196608:5nt0DZ5yC4Trt4cbDe8w/HIuuCfUaZJpHGj:Hk0rt4cbC/haj
- TLSH
  T121F65C32A29642F2E53DC17D8E811A32B9B731424B1EB6DB05C7AB160D10FD8AD75FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  ARC/build/dist/RONIN_Launcher.exe
- Size 15.6MB
- SHA256 4cb6077d1ec4f4429116f968dea3c6d3d690eed1cca5e1c18878689fd1bb433f
- MD5 cec02b45b389dc68acb45ab87e1523aa
- SHA1 6e4879a6c3807da3b32159a72db032f293b548ef
- SHA512 19759cef4821b3faed25457150581726d409f4c7bd96e37095ed9767a7aeb8bc74e2c74edbe4f39914c6dbd3ab513ed274ba800e0d9ec09cd46cc0c2a7f26c3f
- SSDEEP 196608:5nt0DZ5yC4Trt4cbDe8w/HIuuCfUaZJpHGj:Hk0rt4cbC/haj
- TLSH
  T121F65C32A29642F2E53DC17D8E811A32B9B731424B1EB6DB05C7AB160D10FD8AD75FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  ARC/entry.cpp
- Size 18KB
- SHA256 4790a02c17cad54c166fc712f17ccd80aaac68fdbbbaeba4e3270e79d6651fda
- MD5 a47c5489f794fe736578d1d4642bca2d
- SHA1 6dbac9b305366fcded5fcf6922224b3182fd3773
- SHA512 0cd14902f6c028a099df0048ad9b462b94b133c069e06cbc02ae573094d376fbb25ad2e758a5bd1b271bfef44fdf69b89a6331470f7c76f62d5245d267959052
- SSDEEP 384:6OhsWy4YmR/9b01+VU+jcfLGCcWsXlqLD/FKZG:6OLELDGpG
- TLSH
  T17F82E891FBAC959EC2B172655C2910DA3B6ED132278C0C6AFD5EA748B59006ED031F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  ARC/launcher/embedded/RONIN.exe
- Size 15.3MB
- SHA256 e22025683b1e6ada5eb4a63c3742457959bf9951554fb998098d7dd5ddb88a21
- MD5 62c05241effd62d0a3116a7f730fae9f
- SHA1 70859777daee43bf6bc4a07e51ae1dec5524e95b
- SHA512 4b6495c4057478932a436d0bd4ba2b3ddc3751ad751e4a831e83f8f55dc26f55f0903ef6b769a3c3efb8b0b8be5c3e4d25b5e3e63f7c6ad1d886603440169a6c
- SSDEEP 98304:EXjDZmVCWbmTLi+J4Trt4cbYAyropVQ8w/Wxur5S3rPLQH04FXo1fu1JXfhOaZGy:oDZ5yC4Trt4cbDe8w/HIuuCfUaZJp
- TLSH
  T158F65C32A29642F2E53DC17D8E811A32B9B731424B1EB6DB05C7AB160D10FD8AD75FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
behavioral10
- Target
  ARC/overlay/overlay.cpp
- Size 35KB
- SHA256 a39980f67a879ba43466ea223cbf92631835c294df1ec7f53e2680704068adfd
- MD5 3d42ae52e748366513c8523baefa8125
- SHA1 8321eb40345fb1ada129017e993eeaba852965a0
- SHA512 8bf43af1585f8c750372ad140e17beddfdf094c36b9d4dd99bc161ffcc22f6298987a83b49592c71e309c2a6e43beedf75bd205c7efc2563a441eee146f25aba
- SSDEEP 384:MmaCwk4MOfiBxaFe+sPQ4ck9AcKeCXCuxRs747aaFBEUMuWE7s:MmaCSM5jaFeHaHekC3YaaXWZ
- TLSH
  T171F2839634A39015C63760378B97B161B3298453936DC97DFB0D932CEF901B6A2B4FCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  ARC/payload/driver.sys
- Size 4KB
- SHA256 4a9d4823801cda6465d49ceb1f7bc7ba03bcf8488dd830bcd1541710a1d53086
- MD5 70344a4ad895eebbdb60dc5100677f3a
- SHA1 94d1096f6744cb4f8d108a4bdf67c4ead9c268ba
- SHA512 2901cba7f9423747e322f327ff60e1f432ac7982e23e35511406993d431608b7e90c05dc80241b6cacdd4b88b90d20565431d60de51db3a1469d4465616c3b1e
- SSDEEP 48:6flZJSrvF2c/hf7kQQvdzd2NaC6xbASO3bg/bhobpoPhIh773Aax9l/YzgR1hM2N:CvSBhTtQGNaCgbASOsNiH/YsD1
- TLSH
  T1FE9132BA76E61EB7F77EA17C89938A56F078340127120ACF8421DA890A42DCC6C71A4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  ARC/payload/kdmapper.exe
- Size 154KB
- SHA256 abc175b4502a600296691389287b3f887b1f441c9f0d5902a0e8ae0378d047cf
- MD5 30d0e7d3fd59bff7c3920cdd0fee884f
- SHA1 ad82c3eb50846b377254f239d350be3cb673168f
- SHA512 b0d8fff9247579d17a0bc85950603861a3368d2593ecd2266cc8f70791e621d8fe474c1a60e814338fd50470d9523d9e4400855a38cdb9c8ee8e82c0647af831
- SSDEEP 3072:V8rcbaY0lzUnXIcfWkwjmJTQSaMm5/60Xt6:V8AOY0lz4X9PWl/Xt6
- TLSH
  T1EAF32B5697A51069F2B7D978CAB20511EBB27C550B74D2CF135048BA0F72BE0BB3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  ARC/utilities/unicorn/emulator.cpp
- Size 18KB
- SHA256 01ad733a8227af3761a8c6b29b36d86d876e61b54ec7e42d2249446a3dd7ab72
- MD5 f4d069e9fc95972e2ad2c80b0bd38a16
- SHA1 76ff335332f2d47a01ca2a696d64bd0b3fa88442
- SHA512 963903a6f416a2c0c036b048e7e3843e1560a372804c86f53dbc62eb74b74d18706038b3f210f86e5ba66229f651ad3f1c87c1add2dd8244d48c79fed46edb6c
- SSDEEP 384:kFhCuITwNsBY5xy6jjHZX3GivABLBi4dADd7oVC9t0x3mmjrt0xNJ:kFhCuITwNsBsUGjHZX3GivABLBi4dAZ/
- TLSH
  T1CF828589287B4D116763413C6B9FB405B226904772ACEB047FCDC3607FD68BC8A767A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  ARC/utilities/unicorn/unicorn/build/unicorn.dll
- Size 9.0MB
- SHA256 0ab07595f56a6fc3f4a2f9652582aa48e0d4945ba8fcb2239992404b3d28a703
- MD5 d959c709b696755cfc245325ab0e07aa
- SHA1 23fdf6a33c6126d64d13c1ab0abd0e3732e8eedc
- SHA512 09c81344114204092b47bdfe976e41eaebf01da31ddc632d47cb325ffc3f6d1fc1c6bc17b2ec7ccdb72e28bedbf300eec5e53131623074db830a3dcf0bd4ac3e
- SSDEEP 196608:WHl05S3JRZpwi4t0Zfu28vOwHDcCa/oxhjJV+aTN5+:aUIJRZpwi4t0Zfu282ADcCa/oxhjJV+T
- TLSH
  T140A66A4AF7AE01E5C0BBD478C657521BFBB1702413A06BCF05A1968A6F77BE0553B322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  ARC/utilities/unicorn/unicorn/include/uc_priv.h
- Size 20KB
- SHA256 622e9eda4160f8f1c9d1b02730f11d8bcf352d3df0fc8b5732e353b31f43ab78
- MD5 aa03410877393c386de9a00b7c83759c
- SHA1 7efdad2d6b54ddcee71e95bfb0942855a23e6370
- SHA512 a5ef26de3372ee4ffd5e16179f4138cdce366499483429a41aac4f780f2f4c58d46dcb47bd5a244877cdec7e0ac1aee721e19e411ccc5d30516f28a53639f58e
- SSDEEP 192:TiIHqF1gU3rIr72A7mmJXlswCHNaJQ51pUOm7hlWH2UqK6XcW1o/++Rymz3sA:TZHqpruKA7/1swocOmVlWWUqxLIjyg
- TLSH
  T1DD92D68A2AFA92D1AAE14C31DB4E74223153925744C4FCA4778EC3384F96E7D85B37C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral16