359dd01d1f0f91b43b34ecb40f8b3771c2756063b7d1a566528bf0a6306517f9

Sharing

Copy URL Twitter E-mail

General

Target
OverWolf cryptor.zip.rar
Size 35.9MB
Sample260724-p77dlsen4v
SHA256 359dd01d1f0f91b43b34ecb40f8b3771c2756063b7d1a566528bf0a6306517f9
MD5 908237174567656cb385d5bd733d47cc
SHA1 18893c266a0f96089ef34d092a6e038121c4db5b
SHA512 decaa834d7c7d517df29d82a92398077956efcd0c629b379c61f9be7d9d8e4299752bfd5c831618a17710e97415ca6a7185a01cca644a666fa3e5eb19c62edbb
SSDEEP 786432:u645LmbgytUaXZTIwuXEvHm7jZ4UupGOPXChOm8:FsFsRMAqjZ7ZThOm8
TLSH
T1D58733F074E7AECF150EEF9D6969C1E95212E2ADC06A27617AEB531C70D02C0DF04CA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  OverWolf cryptor.zip.rar
- Size 35.9MB
- SHA256 359dd01d1f0f91b43b34ecb40f8b3771c2756063b7d1a566528bf0a6306517f9
- MD5 908237174567656cb385d5bd733d47cc
- SHA1 18893c266a0f96089ef34d092a6e038121c4db5b
- SHA512 decaa834d7c7d517df29d82a92398077956efcd0c629b379c61f9be7d9d8e4299752bfd5c831618a17710e97415ca6a7185a01cca644a666fa3e5eb19c62edbb
- SSDEEP 786432:u645LmbgytUaXZTIwuXEvHm7jZ4UupGOPXChOm8:FsFsRMAqjZ7ZThOm8
- TLSH
  T1D58733F074E7AECF150EEF9D6969C1E95212E2ADC06A27617AEB531C70D02C0DF04CA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  OverWolf cryptor/AntiDebugging.dll
- Size 377KB
- SHA256 8758099b848b222af582be74cbcf51fe32c1e48fcce9e253e2579ee262d10942
- MD5 d234238a1b487610207ba8c60a51dc49
- SHA1 fa1e1562360f284fae212fcb52b176c481c9e293
- SHA512 92b6a413b7e0670b5dbd1e87a0b373e8a46f21ca86e30ecd33cf87445b4a15745f837f6d5154c5eab390ddc1aed8b6b56b2925460dce618f6d29422f06b8ae09
- SSDEEP 3072:UCos+eAkaVVWGJjIo1vQnPfr6+6cYhhNnsPTjfvjUDgkaXQVnrK2Jx8LRBdM:Os2kaV3IaQnPjOsPTjfvjUDgkEQRQN
- TLSH
  T12684060BBEC4C936C89D5231BDC789FD252FAC31D413845E69FE6A09697AE417F12A03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  OverWolf cryptor/Costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  OverWolf cryptor/Dynamitey.dll
- Size 164KB
- SHA256 db29f47dc1918253a36a09ff5804d14ddc81098ecf627e668ca617e3a0e2ab5e
- MD5 c5fa3518d32e1e5290113ac31f3bbc6d
- SHA1 3a735f84575d3e19408f2c0b60a032166cea51a7
- SHA512 c1c508a014501f558df21ca9bc063eee1aa117a9c34617e76d9cc88f7d2d1a348377446c1f997fdff3564fe1e1424f113e36f309822563cfa1b471eb4b909a9d
- SSDEEP 3072:RnLcuy9J8ZC/jpYZ0u+yegE1My1KnSe+Iev:pLcTJ8ZC/jp+09vG+Ie
- TLSH
  T1A0F3D51D2B5DA2A3C2BE8B716890114746B0C637F84BD71E46C4FDE63A077C4A744AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  OverWolf cryptor/FontsInstaller.dll
- Size 371KB
- SHA256 3c357e4d067d2c9322b6d4a4a691698913a76570982af561c6c9438832f42ccc
- MD5 5063ada08270d629a051121a8ecb4160
- SHA1 0e2d0391523fe5595c408507f7b80918bfe23552
- SHA512 d9eb54f867ca0796dad47e9ebc5c40ca055a0bea90868220c6ae6dc6ad4d863dab24e38f51284fb33d7733f8034c384c8044946c14d92553a7b3a0dd379ad13f
- SSDEEP 3072:BZSayK7cup8yzxJQKhopX4Etl8Q+/EHz8c/TzyGl+qF0HWN/InbBv8ZtSOQ9duOk:D7ccWXPETcr0qF06/0bytQ3uOFXA
- TLSH
  T192849620B015AD50C4F9CF7E494295B48D33DE77C1A6A51720F3B45B22AF792EB28A73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  ookii.dialogs.dll
- Size 130KB
- SHA256 c52b7193346e6f6db6f9803367422e321c268d33e0fd956fcafc43750c276cd7
- MD5 228449524708906fc1e9dceaf988a951
- SHA1 d5b92628815427d0f5b44c602590fa55a0e76e8d
- SHA512 d9627262e81a895a0d3ea5655508865c1fb63976db8b27f9427d1c9362899ed7272937adca90f93b73c8a926a44e3e72e638d50a64b2a454e3f9da60d266383a
- SSDEEP 1536:fI47bCYiWACk62smhs2A+d37gdQjs5OaHkKYxWXcQJSAqzspI5kWWJYr39+d5jyo:fI47bCYQiY1Wk303JSAqzJ8CJlG
- TLSH
  T12CD35B22335C466FCBEF0EB4E8157085C371DAA57626DF2F4848B31D09637918BA22E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  progresscontrols.dll
- Size 12KB
- SHA256 86d3053ad9366fef9ada575c9a4898ee5ac62067f1fa4c5914831f26b4dc9642
- MD5 c57a6c026cd6ea2870b83a423e6de4eb
- SHA1 4177bd227f4bed55c7715091c7117f210650343d
- SHA512 86bcfa9a1f3dfe2356f1589f01873a4ca09e262e881dd97ec0028cd674332e0b9ab4129716e7bd4b810fccb59608e067e5ab56783e63e0b222f4821581073063
- SSDEEP 192:2jUP8+NzDs8p/N4gTkl+OQylPdpfpt4VzxYx3Peoz:E6hDvBkl+OFpfpcN+Prz
- TLSH
  T19542F8276BE8C23AE97E1B39A5F505501731F510A977D72F0694001D6C6BF209FA2787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  progresscontrols.pdb
- Size 23KB
- SHA256 18c6a67d6b353b561b0dbc8cb3c71bd69853d261dd50dcd35e25a08164f11752
- MD5 34f1c22f7e9a19b34137757dfebed32e
- SHA1 9896a864bd2c9f2dc4ae9c818febba85534a276a
- SHA512 253cd6b125124eb7be08804315e1527bbabc2e9c9b68bcd3925f0f6aa0fa394e1d59b3701abb262010d3a00e821e28a346d4e5740155dd04aeb2003ca2a45bc7
- SSDEEP 384:sv+v60+e9/si9uKuN3YObijWdNcz15vHvC:z/si9tu2lWdNcz1
- TLSH
  T14DB2F9277F80C533C51685746BEB4F2A0338ED984B8B978F5768B16D3EB236A1E46350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  OverWolf cryptor/FontsInstaller.xml
- Size 43KB
- SHA256 089c9b63cfed530c5bd6d492954d602f7fb94e34b8faa72db8a9e442b428fec9
- MD5 531f8be30cbbce50349de56644c66e34
- SHA1 cf2ffb0c7f60596db3060c3ad0cef9c73de96943
- SHA512 949b00317bb41f4351ee744fe4cbfbd3df9e1d172b752645bb9790e0856136dfedb866e2bd289a52d36dc46c91f3dd2b0bebdc2a420216b9d6c4fc2dd5a2c2c8
- SSDEEP 384:nLFclSEsb/h0jvmKTNfjoMHYNdAPkSZBPVgGvmeMN+eBDP8oUEt4QBN6:Ls6/PSP8P8oUEtV8
- TLSH
  T1E013F00563CB86351933422B5B16B8E9FE199837550A1E3838CE2E5B5FB784212F77B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral9
- Target
  OverWolf cryptor/Guna.UI.dll
- Size 1.1MB
- SHA256 576d2de2c9ef5bc1ea9bdd73ae8f408004260037c3b72227eed27e995166276d
- MD5 8673eae95d67e5eb19f0eca3111408e8
- SHA1 ad3e1ce93782537ffd3cd9e0bb9d30ae22d40ddb
- SHA512 65c4eadf448a643f45fa9a0d91497bb25af404c41a3a32686d9e99ba4f4e50783d73f5b13d5df505cc62c465be300746d84a2eaa8000531893cd0b19d6436239
- SSDEEP 24576:hUsmpWNSUFmCqJPNsTuJDYYviEcHy1t6Y:hSUQWSF8q
- TLSH
  T199356CD173E4C9C3E0A947BA501641DC0FB5C109BF47B35782A8A29C3E467A79E3E993
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  OverWolf cryptor/Guna.UI2.dll
- Size 2.3MB
- SHA256 78e51511b28efc474e92d060dd5123343631ee7d3400b6c317a518412c3544db
- MD5 9fb60db5dbddc1ec521625d416b17aa6
- SHA1 7f1da0b32a51a59298afae41f14e0ae6691d46a0
- SHA512 5607c16a7f5e51e14e6b697e1171fbbfc7df84ea3395738935bc12a52b5ef7d769071d7d0cd241b3e2daab3bf0657f4f2411da2a3c2091a422287cca79b81b73
- SSDEEP 49152:dF1h+CUn8yaJS7YmLdxvOOuOi6oUdzt159QoFosA9y9/H8/qW5rwGxdfkowGQJDM:gbLjv9UMGTke41u
- TLSH
  T12AB59D1A36CA2F1AE55419F818541325E760C5623797EB0BE182F6B5CFAF36C0FC52CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  OverWolf cryptor/ILMerge.exe
- Size 668KB
- SHA256 8110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd
- MD5 2bb6322885e6ca0986206de174e842c9
- SHA1 c5ea70169106d32bc513d28ea76ae8ea1e49380b
- SHA512 9750180c54a5bd8f0e1fa8a8f529364430f2ef444efbf8ac51e8d2a0aaa4e3d21fe553865ba8567c7c19e4ae84d04b20464f391743e88c52c00cac0bf20fc2a7
- SSDEEP 12288:8E8Q+HlWx+TV7109nrRoTQhfL40+FQT7gWoi:hn+HQp9UQ2dFNi
- TLSH
  T111E44B107FE4D617D1BA87B2A8B3091457FCE046F357EB8F59806AE91C03741AD262BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  OverWolf cryptor/Newtonsoft.Json.dll
- Size 679KB
- SHA256 72cf291d4bab0edd08a9b07c6173e1e7ad1abb7ab727fd7044bf6305d7515661
- MD5 916d32b899f1bc23b209648d007b99fd
- SHA1 e3673d05d46f29e68241d4536bddf18cdd0a913d
- SHA512 60bd2693daa42637f8ae6d6460c3013c87f46f28e9b0dbf9d7f6764703b904a7c8c22e30b4ba13f1f23f6cbee7d9640ee3821c48110e67440f237c2bb2ee5eb6
- SSDEEP 12288:1eos/POdGV5jfWrV/9Yeh9eRcyLfLYtT5mWxTZ/B7jW5JMtRRpKzQk:10/POdGV5jfW5VnhFyvOB7jW5JMty
- TLSH
  T173E4598563F88F6AE29F2B74B830490E4BF1F44AA6B6EBCF4404D4A51CA3755AD00777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  OverWolf cryptor/OverWolf Crypter 1.1.exe
- Size 35.3MB
- SHA256 50062d171fd4f80379d3a1bdadc1c4c6c4ac6a2640e708d8471f3dc9614e5ed4
- MD5 dea64aebd0b2051617afb8125de0d53e
- SHA1 b0e4a4b64505d739e8b6cf0cb19daf7f19934e00
- SHA512 4d8f781c98dcfbfb9a262127a8fba6042901a49e2dfbeab57212b2ae72930718840dfdbf20058b206c149039c19a8f7be4b13a5c9d8185e572664f2c93160a4e
- SSDEEP 786432:MfeJhmSTrKdgwppe+aJEe77zZY+HRzO/DPeZry7zd0:jpR+a6CJYGRzO/beVym
- TLSH
  T1418723FB794A6C12D789390100BADA52276EBB3396A02715D5754C0EF38AED93303E5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

agilenet costura defense_evasion discovery packer themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral14
- Target
  OverWolf cryptor/System.Diagnostics.DiagnosticSource.dll
- Size 34KB
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- TLSH
  T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  OverWolf cryptor/System.Security.Principal.Windows.dll
- Size 14KB
- SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
- MD5 b40bda63658a012d46f930c243b77056
- SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
- SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
- SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
- TLSH
  T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  OverWolf cryptor/System.Web.Optimization.dll
- Size 69KB
- SHA256 321b29486a5c3195574552ad05dba2199572db3a3ba3952bd1ee768cc3f8cedd
- MD5 68abd36d1bc8a214214d4551dcda5162
- SHA1 72a420f9026890fc6c7f6f3a8050fd4dcf7e2d4d
- SHA512 bde5737d5e5bc81089ce89975a52c3f502b76d0b4fc6c0543e8edcc2790cbc55b48a9f8b522a0c87f98388d7d0533fe7048d79a10325f38b5a9c1f3e54c4c838
- SSDEEP 768:O7wHXoDClYMX6UYg2okay6kz+0TmzYJe+nxPDC0jrqVjSEd6BrQjLwnGUP5HpoDA:OwHMahf2o/BfYJZx7AMEdurKLmDiz8J
- TLSH
  T130636D7533AC476ADBDE4EB4B47051140BB6E6872C02DB7A5E88E09E1C777A00712AB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  OverWolf cryptor/dnlib.dll
- Size 1.1MB
- SHA256 4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a
- MD5 508ccde8bc7003696f32af7054ca3d97
- SHA1 1f6a0303c5ae5dc95853ec92fd8b979683c3f356
- SHA512 92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d
- SSDEEP 24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww
- TLSH
  T1EB356B0177E9AB3BC49E837AD432091943F2D40677A3EB0F1654EBB92C837959C217A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18