8fc22c7cc8246f3a8fb84ed12a1eb668959b184975f7048b2b46095a0aabc559

Sharing

Copy URL Twitter E-mail

General

Target
Vylora-Keeper.zip
Size 7.6MB
Sample260723-pfqa1scj4t
SHA256 8fc22c7cc8246f3a8fb84ed12a1eb668959b184975f7048b2b46095a0aabc559
MD5 57f2ddd2067afab73f3127f774415383
SHA1 5746473cd8e5bd780596be4e5f39c6037b8a7b86
SHA512 aeaf646c8bb58929599b6e3160cbaebf8a5b361615fe9708ad8729096047ede7e1f2f14e933ab32b926db74f4e6279e272ea28c6a3f1c50199006930276751ff
SSDEEP 196608:uGZR9c7KobIXOLGtwUM0aGqvk6QUK9kAV38D1HKyjjXf:uORK7KPycwrTvk6bKVuxqyjjXf
TLSH
T1A58633C0C897C98C59394CD749FC229DFF546DF479C9B7432218C792A38C39A0A6DA6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Vylora-Keeper.zip
- Size 7.6MB
- SHA256 8fc22c7cc8246f3a8fb84ed12a1eb668959b184975f7048b2b46095a0aabc559
- MD5 57f2ddd2067afab73f3127f774415383
- SHA1 5746473cd8e5bd780596be4e5f39c6037b8a7b86
- SHA512 aeaf646c8bb58929599b6e3160cbaebf8a5b361615fe9708ad8729096047ede7e1f2f14e933ab32b926db74f4e6279e272ea28c6a3f1c50199006930276751ff
- SSDEEP 196608:uGZR9c7KobIXOLGtwUM0aGqvk6QUK9kAV38D1HKyjjXf:uORK7KPycwrTvk6bKVuxqyjjXf
- TLSH
  T1A58633C0C897C98C59394CD749FC229DFF546DF479C9B7432218C792A38C39A0A6DA6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Vylora-Keeper/Vylora-Keeper.exe
- Size 303KB
- SHA256 f4961c6f5ef680fc790e0d12356c089d28f351930e39d8f69d489eacd252fd8b
- MD5 7366de3d7011ed69934687a58046cf86
- SHA1 223bc477d2eabf98671cddbd290d1cabf788e17f
- SHA512 4358d4f9da941d13f26284ef2896479bd802d705e15c7f0de6fdc28dbd26569207daf2be3cae092c0d48b80e97a43878d28b6b74c69452a909247f032b236ea2
- SSDEEP 3072:s18fOvaXqB8iTPIm/PVE//N94TfJa/NY8ei6iSa9lAuslI1sN93bV/7ys8/ROZ:s18qaXqBPIm/PVWwQlY8e2SZusLNN
- TLSH
  T1E0646C15E7A510F9EAB7D67CCD524806EA72BC164770E6CF03904A962F277D08E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
behavioral3 behavioral4
- Target
  Vylora-Keeper/VyloraKeeperHook.dll
- Size 175KB
- SHA256 dd470b51db4d3d54f6e0f1af4a3fe96151e547b90c6835c34fb57388a6303cf8
- MD5 ddbbca7c53bf98ead0ce3b23cd05a653
- SHA1 64a144924aad7915e7e8a8d75370bbb42fcb25be
- SHA512 956177100d2405f5c6277535e9c60be0f5a17dfff1fecb0b81d225d342723ae7c9756875f8a894d16f17375dba9e88b0520102eb2b447ab203b6449e17d08bc2
- SSDEEP 3072:TYHm1hTwf/Ly2u4TsmiJLRKET6SlV4rAQE8IN9b49dVElP:TUm1xwf/LM4TUK46SnQ5Kl
- TLSH
  T1E0047D16F7A950BBEA27C578C9430906EB327C4147A0AADF43900BB69E2F7D49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Vylora-Keeper/core/Loader.exe
- Size 16.9MB
- SHA256 cb4d3e700143c23aab09238be0f6985b6781c59eef7d525ec266bc0d7f43970d
- MD5 8f0b908bd7f3c06f447d9033d5d7f4e3
- SHA1 a01d0a474834b25e055ba04e06efe39241219c40
- SHA512 2b4bcd9c7c3f0486b98cec1f5b4d47c71b93fb35f321a2bc22e41ad300d3051605c5140b50039b6a84dd9aa22f31ebc2036bc89fff8049250f564610d2b747bf
- SSDEEP 393216:4nbhEKzw1AxHXdzJ57b4BRGAiyJn/Dwy25QFBGuRoVilm:4ZgdRGAiq8L
- TLSH
  T1F707AF5A6BAC00A8D066D279C54B8617D7F27C041731DFCB27949EAA1F27BE06E3B740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Vylora-Keeper/keeper.log
- Size 4KB
- SHA256 17f16351c098f45a77cb73058336d1321e204588cd512fd4120cd49179880362
- MD5 376194e59fda08848bcd88b74f4406e8
- SHA1 d36f48e4ee7e3a31922b7ceec25c67e7785f5251
- SHA512 69595b67a83727adea142851c4d7ed3fdb707b042c67612d9b59e97bb84a0eb026d9953b045962c39072e112057b89682eb05086fcf6d65027ebd8504d09ed6f
- SSDEEP 48:obbnuNOfUSz9AUDSz9APtS0Sz9AvNaWjYVHo3maWjYUbZqqaWjYMAo:oku9AP9A+9AMqrUbZQMl
- TLSH
  T11191E1574BFF0267DC624A85F5851CE095CBE2AB51CBCB12720C458D06C2AFB9CE9726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Vylora-Keeper/profiles/CB4D3E700143C23AAB09238BE0F6985B6781C59EEF7D525EC266BC0D7F43970D.vkp
- Size 6KB
- SHA256 d1cfd8c5119b17b55b1eccf2508871e40b5fa371e0ea54060364992f6fc9b293
- MD5 d175f42f92d9034e65e4ba43912c0244
- SHA1 32a0ea0795d07fe6237e0af57ed1e3807b2d3162
- SHA512 8a7589c36b718b1e2b9477a903bef1299a02d900ba5e6fb0015f16edd9d507babb2c218bcef157c727aecd13eeb261849a1d90db38da81a6403422e48a6c4cb4
- SSDEEP 192:z+mhvdermga1ssbs7brtne/ewMu/qZZa+IZ8B2Ls:z+mhvdermgWssbs7brtne/vBAZaN8Bss
- TLSH
  T10ED19704F9C4CD59CC325B39B9F28621EED09C898187D3434FA87DAB0BBB5C7E98A415
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Vylora-Keeper/profiles/D8365C024EA18272020B63E6902CCF01C8A448308CC758AB0F78B7A8415477EF.vkp
- Size 6KB
- SHA256 be1bdd535b15679566bcb5d33a27f74adce44a76c58ae14903aa174c8da0a042
- MD5 7f56d46536883d92ec6560571baf73f8
- SHA1 f2a2629818bcf3660112a15e7177c856fddef550
- SHA512 5a24f88d6c646d38eaab9ef3fa9f95f4c8d0a51762c0aeae9b665418b1114f8ec4087ad894c633b6a87dafa44fbb631cfb74beacb02beccfd49050c05de3066d
- SSDEEP 192:ooM98wtvs1Uj6ZC/E9Xc0iwyL822vHbdxWvW4lhBW7w:9M98wtvs1Uj6ZCM9X7ir9VhBWs
- TLSH
  T1E7D18608E9C0CD59FC625A30F9F78621EDE0D88A4107D3578BA97DB21FA35CFA19A514
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14