dd3603e25a9d50fc38f2e7ad99404ff4e9a68da5aff578dd085915779291768d

Sharing

Copy URL Twitter E-mail

General

Target
xtreme.zip
Size 10.9MB
Sample260726-24lc7asenh
SHA256 dd3603e25a9d50fc38f2e7ad99404ff4e9a68da5aff578dd085915779291768d
MD5 08335123b19a7ed0dc5334510f014af6
SHA1 e38d1cfb9cdbd85f299f150113380f27413d3293
SHA512 68d6a28af9c39df5bed6e767c86337584099b502d004d75025b8206373ba03d7decde6f80395a7ebcabb63e56d73ff28f9c06cc3c7ef5ac79cd6386511588c98
SSDEEP 196608:YfulWBbbZ0vmZ8lzGxP5I7ZhcFK8qSaty9jf+8rTuXl5GtfgwXKEqOqirh4+p5sb:UucBbbR8R+P5I7QLRl9q8nel5GtznqiI
TLSH
T158B633AAAEF492B4E19FF4C821BC40D04A66C5F6071D51865B700ADF05F533EE2AD93E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  install/ScreenConnect.ClientSetup.exe
- Size 12.2MB
- SHA256 4851a6b3aaef9416dca65e7ee6705fb0cb661b28498c4fbbb48e91fa8f23b02a
- MD5 de7d70e1c705a84d090f245d98c50360
- SHA1 fa720ad47ffa541fd78691bc31f029f8b49482d5
- SHA512 37b9a6d0dd8665449a5dfb93b72362b8604e8375e879f1ec99bd7780b995569346a9ccb7548c9a6ce0d457f825e484bf31ce57ec430bf4ad72b76f1558cbbee7
- SSDEEP 393216:GCXvI5MvHx9JiCXvI5MvHx6CXvI5MvHx9CXvI5MvHxK:GZ6HxKZ6Hx6Z6Hx9Z6HxK
- TLSH
  T112D61211B3E595F6D0BF1678E87992655632FC044722C2AF53A4B96E2C32BC08E32777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  install/index.html
- Size 6KB
- SHA256 67b48c22090edd7cbafd066c91215a613b65ce82d95f48bd42eab6e10ad70b15
- MD5 892490ad34bce5d96f4173e110f78341
- SHA1 7e6f910c926abba0e33e73ed2edd2d88c6a8cd6d
- SHA512 f873ac088304941bfecd891fab6a4c23a6ce3c5a38d2e9daed8a81c143223621997b1f4bd1fb31d8b84e56f9e53e2b9427605b7abaf03e46ea3bb10bf19c6493
- SSDEEP 192:UCC97CZMd64SmioHK+C1A/lUQkRUi+82i13b0z85:Wd8miQK++ulViKi1rt
- TLSH
  T198D1811DA22600555533A3EA9FE35309FB6240032603C2497FEDB2168FB5E44C6B7FCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  install/telegramConfig.js
- Size 138B
- SHA256 bc2a0867eb17fe17de7f99e6ed1a913ead35cc61e5be39d5c810f757403890b9
- MD5 3e3c5355f58caf0225b90a7383672fdb
- SHA1 86f13f498d6e9ba0e81a757bdb9f8c68eefb3363
- SHA512 306f689bed1db7487b112efaa5ae115b4fb810c112bfd15a31ab104848b00c9c148ca1f4789093afbee23d83f1900c685080c35f9d4e64d7281ce4890e75ce0a
- TLSH
  T14DC02B83118F081074F4FCC513C0D100C601D9903E15EC00F82CC3025B08C0481F022D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  install/telegramNotify.js
- Size 940B
- SHA256 3da1717a8cf1ca8539d52a940f5e365a3fe4b700ac337098b04ab9c44bc0687e
- MD5 3e9484b65827d8a9b5a8a741eabe681f
- SHA1 b330dc8397645e1d84f86399ef1b5e3c18d92ae7
- SHA512 fa2a08ef22cf59573ed4f66f4a14aa03662c94928c7bb9d449321477748f3a5f6f05228aaefc2c40053504b6c658333e3fe8e44a45dc76860842e3dc5eaf1e93
- TLSH
  T1BF1123429B5E9D182AB320221E06F008F721D35F3494FAA2F35E43668F2DF180423DCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8