046a092fa17dd66e94089a15b53e47c4c2b439222461910621bed31ffc42b1dd

Sharing

Copy URL Twitter E-mail

General

Target
kaspersky_premium_21_22_klyuchi.rar
Size 615.2MB
Sample260723-x98nfstyay
SHA256 046a092fa17dd66e94089a15b53e47c4c2b439222461910621bed31ffc42b1dd
MD5 dd91cb4fa3f73c2160b8cfac2213e941
SHA1 c95a485308fe12a8147c728089fe1f31a7f4d655
SHA512 0be64d73e94ddd219c08e2c57a6d9155ff55b8099ad78af1a45c03812b6f68217b0ec914270c137832ab647917c6ed16f69240ff832fb00079edb52a11030a37
SSDEEP 12582912:7VKBPWuK/+8p+wS2am9OMZykynX2d7ai2N4iR+m+Q/M7+fhSkRMwsICEuTk3:4Z9j2am9mRnGVaiwZRf+ST2wZX
TLSH
T1D66933C90634C9E5AC64937F81FDCAD2D5FBBB75574790AB0253E343898887C20629EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  kaspersky_premium_21_22_klyuchi.rar
- Size 615.2MB
- SHA256 046a092fa17dd66e94089a15b53e47c4c2b439222461910621bed31ffc42b1dd
- MD5 dd91cb4fa3f73c2160b8cfac2213e941
- SHA1 c95a485308fe12a8147c728089fe1f31a7f4d655
- SHA512 0be64d73e94ddd219c08e2c57a6d9155ff55b8099ad78af1a45c03812b6f68217b0ec914270c137832ab647917c6ed16f69240ff832fb00079edb52a11030a37
- SSDEEP 12582912:7VKBPWuK/+8p+wS2am9OMZykynX2d7ai2N4iR+m+Q/M7+fhSkRMwsICEuTk3:4Z9j2am9mRnGVaiwZRf+ST2wZX
- TLSH
  T1D66933C90634C9E5AC64937F81FDCAD2D5FBBB75574790AB0253E343898887C20629EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery persistence spyware trojan
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  Kaspersky Premium 21.22/Kaspersky Premium 21.22.exe
- Size 615.4MB
- SHA256 3a2a773da3399382e5a96d66dd764dbe2c1542a8c8ca395ced039a0b1f6aded9
- MD5 3b723239740a67f725ccd1de55195ea5
- SHA1 b34b340ebbc9c8f49d6e3d11026517250ef27984
- SHA512 27cd86f9274e76cc084697a735b964a9a172223bda572bc67e0ddffd134594f015d4a5f15ccfa5926ea2b3300c9f58260805b1d6f6302741ca5eba9dcdffd4b7
- SSDEEP 12582912:Q7pygtUXOXbvO+vfSIatw52OVZlhEmFCLWRiIHhEdm00zRtgo/eSuk:Qlyg2eX7rvfmQ2IlhE4CLxIBEdm04RrP
- TLSH
  T1E06933566DBE064AF808A93C285D3937C23336EE730FA42765B816B31A137C1A53D376
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery spyware trojan
- Checks for any installed AV software in registry
behavioral3 behavioral4
- Target
  Kaspersky Premium 21.22/ВОТ-СОФТ.РУ.url
- Size 114B
- SHA256 bc6b5d9d6d711bd43c9d6be5f6229fbfbbd1c57e060227b9d2a5fcf3b9dbaa3f
- MD5 39281db939652c22b35be5aa97a83162
- SHA1 9466854c7f5170766a9172890ba296028a42e37c
- SHA512 1e45b4ae9bfd1e0cb290501ee3f4aac23ba7c016010f6d627b714d269eaa2982e041ec680d5b4a865fec51cb0369fc1c6b283a61d5a2a3935de719371ebf076f
- TLSH
  T18AB012BF5405C399D141840E50B0F808DC0F79B04CD3E0DCA148DFDB0D080D1C559B36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Kaspersky Premium 21.22/Ключ.txt
- Size 530B
- SHA256 9c0626c948dee8bf6c5685b3be44066d9e7dd997c8db1d8550ce19054d0adebc
- MD5 696becd71b33f9bcfbc47b97eded01b3
- SHA1 df77654fd145f267bf0a568164e7a00be4bebe42
- SHA512 d111119d389a98dda00f7b294d77c76cea31b010eb79f69594aa884911b54b234301ccafac4d12e88186a8d9d55508c316623c340d1c0cdcaf433a16d1fe35f3
- TLSH
  T1DEF0C9DC1CE8C440BE84DC2C0390AB58537D58ED283E08CD3A8E70228FECA93C718400
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8