b18b306141ed600d1484c9f39f709b90f3e0e8debe8eb07b1f7a30c0429dcc19

General

Target
ReplaceOSK-2.5.zip
Size 167KB
Sample260724-qcldbsen91
SHA256 b18b306141ed600d1484c9f39f709b90f3e0e8debe8eb07b1f7a30c0429dcc19
MD5 836ea7adac27e52a43c873cef6facc0a
SHA1 e8f75651a537d7cd4d2bb7e7a64e5449175a6ae6
SHA512 2a09acfa9963c363283d7ada3407a126ded7b1c93a5f6ba0fffed15c5068380f8e6eafdf9089817e1bc7de6bedf8aed3b2bd3b2e2f2346c1a5aff85a738711c1
SSDEEP 3072:jKM7ixrwOKlSbHC7ZeN9mPsz97LvoRzuKONkEK60kJbE2HsvI6GQPa:jKM7atQJa9AzuPkEK60+oZvI9oa
TLSH
T1EBF31265D2352A6DDC28F4307AAC8039DC0F0B56C991FF16ECA389727CAD56136BF41A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ReplaceOSK-2.5/ReplaceOSK.bat
- Size 153KB
- SHA256 3b2404c56dc76382ebcffd6ab163c508a3a31d0806472d5d667f3d02a61660db
- MD5 a5776b643514412d9866264f63e1d7ca
- SHA1 7a8d952ebd506817cd77195dcf30feaa3eded305
- SHA512 43c9d60bda60916c28eebe031403bf519a3b3668218f612a90be65e9d9b400b7b06f12291298802371c14a562c74ac50f1889d0923b16752f3b6386d07fb4ccb
- SSDEEP 768:6z2ZbgjeTK8XVPZllOY0bGMvAU58dkjmMNliL2iO:lbrOY0bGMvAU58ajmMGCX
- TLSH
  T158E31BB1C147EC674969360C50082BB29CB81DBB4D21E864740CFF9BA66FDB6F91CDA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Possible privilege escalation attempt
  exploit
- Modifies file permissions
  discovery
- Uses the VBS compiler for execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  ReplaceOSK-2.5/bin/TabTipProxy.exe
- Size 106KB
- SHA256 5df72e7bbf140360e541e210b8f2bd9650ac04ca0617fbaf90eaf87df38a3c19
- MD5 da1973e29d41b0c2be8456bb1b411c77
- SHA1 a9f492166f16eacd7ba07518721de3088ecc046b
- SHA512 16c7a24e02d009cf95f0010607d1058b84fe5849edb82881088920fab1c4cfba9994484c30863431cbb2724b329eb477ab79928e92439c573e50fbbd0d40071b
- SSDEEP 384:mTzS8FpcLtCgyBLaCXkMzXKyBqpoYyyyyyyyyyyyyyyyyLxfXBpBCllX:lRoXK8qZD
- TLSH
  T123B3F9667FA0F561C9952A74CC82E1F127257C08ED6683073AE07F5FFABA4638D08261
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4