eb5477a85a77e9605efd76e9f475c51e7a8077bacc247a023e47aa11650342c8

Sharing

Copy URL Twitter E-mail

General

Target
c0zes Hard HWID unban.zip
Size 18.3MB
Sample260727-qaqv2afk9s
SHA256 eb5477a85a77e9605efd76e9f475c51e7a8077bacc247a023e47aa11650342c8
MD5 9a11b7091c2fd011ccde1901f7b50737
SHA1 8e7ce576f617acf542b54334a6c091ecddb01ee3
SHA512 ead1e7212dec000265b04e26f1179ae6da3c894ebbe481b4910dd4b3de390bb4bf1dfad04bac522dd2c54d3b3844a18f6f905ce17441fb786302db59bd0ff475
SSDEEP 393216:ouVeT7BIt5lG/XYYK/LINXtJA0nczk7rkWLD:obpItrG/NOsNXs0ncY7D
TLSH
T17D173354C143B118EC636235113B0E1B7CC9B58F66E40ABEFA679C4EB1FCA541D24BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  c0zes Hard HWID unban.zip
- Size 18.3MB
- SHA256 eb5477a85a77e9605efd76e9f475c51e7a8077bacc247a023e47aa11650342c8
- MD5 9a11b7091c2fd011ccde1901f7b50737
- SHA1 8e7ce576f617acf542b54334a6c091ecddb01ee3
- SHA512 ead1e7212dec000265b04e26f1179ae6da3c894ebbe481b4910dd4b3de390bb4bf1dfad04bac522dd2c54d3b3844a18f6f905ce17441fb786302db59bd0ff475
- SSDEEP 393216:ouVeT7BIt5lG/XYYK/LINXtJA0nczk7rkWLD:obpItrG/NOsNXs0ncY7D
- TLSH
  T17D173354C143B118EC636235113B0E1B7CC9B58F66E40ABEFA679C4EB1FCA541D24BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  5/lang/turkish.ini
- Size 96KB
- SHA256 5f9e53abae5e8f438c1cb01d4de4c1eb459b340066ef8d19b9f677dd8c8bbdbd
- MD5 bb7c613587724040db123308d4a62fdf
- SHA1 190c1738f14952f9aaa5b0900b93e85c00700de3
- SHA512 fe0edfb942bcd54534b20d662b295e6d46d70730e4f865639b34be8ce86ffcb8fe444615699da78477a180b19b2165d563831289062e0ae321a714a438099e1e
- SSDEEP 3072:if5EZ/tnh2KhROYI66Vu4ANh5c5MNOCLllZwvBiz9CjOSJaSAoqTxlpo+VUW7znw:Hd35HYB
- TLSH
  T181A3041583EC4116F6F35F05BDF112624BA7BCBABE3CD20F128115981AF06E09566BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  5/lang/ukrainian.ini
- Size 104KB
- SHA256 d5b886dd759cd7442705a044cb12d174621e199bcea5e8728e63bcf6896f6bca
- MD5 83d527fe61a3cec460137d696af7465f
- SHA1 c6c2f9d8323ec851d3a973060fa0dcf8ba82d313
- SHA512 c1cf615536667825f2dea8a8cb763b0440ca23d3160f95bc2e960c1010bbe545b3a2832905ea927615a31810321268bf718f74af2d03dfb9a9e121a919e1f8e1
- SSDEEP 768:QoELKcU5ElkgV4WetF3BPSgFIrJYnkxZRSyZT6Yg9og4eLFK:GKcDlkgV4WetF3BPSZJY0vVTg5K
- TLSH
  T1DDA3670FF97C86649794D2508E9246EB11EAB70817B8D6C9A2CF7D6035AC63573223CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  5/lang/vietnamese.ini
- Size 98KB
- SHA256 8fcb33f7e9d3b8dba46c02c787c67f8b50433ff86be4930c6ee85389fd8ac0a0
- MD5 b49d6ab717329b552d1fcb73fcbe9b11
- SHA1 cc93f1a198adc734711023462d6bdbfbb1cd8191
- SHA512 b78dd5c490bc5ce69e6ccd59efc6dbfe8d1103ee0042891fcc5c6d85adb7d660af0e020ce5b5078c1d5dc174a6cbb709224017128d34a013123da4e86b8bff62
- SSDEEP 768:QoHHj/lYz22ES7J8U4vrmSDipIcSjBDqOGOjcrSaUTirBjOQF3aO0fXTl+N5XBQG:4FJ94TjDGzJBTxCXy
- TLSH
  T1E7A38B34C56FA115B6F2670181A912321E96FDE9A53FF706C3C65E8C27A8C006D93B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  5/settings.ini
- Size 3KB
- SHA256 cd34f9148dfd6047c89d6b6401ebad46216810da9196a409bedf2251ea70b5d7
- MD5 3424f791dd8cac995d10ae13dec336a2
- SHA1 8b5bd9fc5b9539fc274976ccc006ae3ceafeca47
- SHA512 e019bb32ccb2ccb90780c1c590599c37ee3b4878d467e3a1b6b19ecd752bfcf0ea1dc1abeee62f924066c04461a2a1771d172aff75b3d8b6564107a4f9b0cee7
- TLSH
  T12E81B1922AE4241AB373BF95EFB8D9688727BDE44C2AC51D42E0014F05F5A81D9327B7
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  5/un_report.dat
- Size 1KB
- SHA256 64642e9d8612c9ae2cc2ed4e1a08048cebcd540eddfc374425ab291efc7f3292
- MD5 7658c70859a6ab72cf8b9a026c49abbe
- SHA1 9f1203ea976d20c036b0c0ae81fd93cb82694780
- SHA512 810cb4f37916cf05e7ac27b4f461d29adfe92824a26dfed7cabba80d0de6dde253c498fa8e2da9f96e63c01976e523e1585ae0229930919071205b265dd91aff
- TLSH
  T17A211CAA77FF56C4F0F74F33D51A962156B8BCF83830A1A9774B02AD84B258448A0733
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  5/x64/RevoUn.exe
- Size 20.6MB
- SHA256 76428cf02598629a0d2a143a8fc02feb2a0fed00fdedbf89746422985b5460fd
- MD5 66edd1df967b88fb121116c7eeef89f5
- SHA1 0d0a0795d2bb93264effacf3d7d6344885744d71
- SHA512 83b046e90bc4180ed9e728b6b1dbf6a83d266e92c0f746a9d4d9d8b3e33a56d30744b221032534a725e278ab71b6fad8c25e044adff443b8cd5e66bbca07c755
- SSDEEP 196608:5w32yiqpdeABNLZhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIp:542UpdPZhlqPWpyR1pxP
- TLSH
  T16F2718B2991188CCDE2CA6B5CE1D89FDCEA27C5AAF9049AF41143D50EDB32C09D3D25D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral13 behavioral14
- Target
  5/x64/button.bmp
- Size 4KB
- SHA256 18d6342804edc786e5f3c5c6249e68681594809492880c4bcca7c5c490ea4e51
- MD5 adc319b9cde52444a7486ba50294d34c
- SHA1 7a7c4fa9896e6f3d12d8464ad8a98d75c51c1f78
- SHA512 785cfe2a03c6f292f012ee0435f436dab814cbf4282fdcd5a31c3df716124ee6c605e7a13b3f7723356db01baa52dcb844dc8e8486189a7fe8fc6522b87f8d5f
- SSDEEP 48:yJxwyvOO5Vs9RnMLK2UNsShRYmOB3gVKD4nLyjF:WvOlMK2esShRYmk8GjF
- TLSH
  T1F5810A02A6C17DC4CC3D9931F45205686A79EB6E59D8738458DCE7BA1B340A3A548ECE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  5/x86/RevoUn.exe
- Size 18.1MB
- SHA256 393b81a74551f5144cf3a04ccc64612374c1f6c06e8478de66f3e3d9b778f3c8
- MD5 1131f4842a33064db3eff44af3c244f2
- SHA1 87f85119a5b0b4f76c2b99931c29744fed7e3670
- SHA512 37ce09a7503c4fd12e9d96ca95f449f256db874b75037f9f8f12484ff4bb1a1df2c54601ce18dcd5b4a5f3281b7d62277c6bf00e5bcbb593cdcccce7bcf4a64f
- SSDEEP 196608:+RB9ZtZaY8aZGbCgaHQW6r9YdNELZhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIf:+nrjLZdg86ZhlqPWpyR1pxp
- TLSH
  T1E5171A72ED01C95CEE1C27B1CE1D8EFC1DAA5D6AEF9058AF91443C10E4B26C1693D68E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral17 behavioral18
- Target
  6/!!!!RUNME!!!!!.bat
- Size 1KB
- SHA256 f01a1d81cc15187304360905980a01fca029e221cfd7eff5543adeadfdd0b415
- MD5 b85b07c305578fe29c88fed4a348a891
- SHA1 028203b9a34fcc6ca6c47d67c14619d00b5b36f8
- SHA512 3cced910a3e9b772c0f6579ab5daefe9ce84836e7339caea4f070572b1f31f62e3c7d2cb38a66aba88f2b2e096d5560b7b1bd136daeed8cfcbc6c1efa3b28950
- TLSH
  T1BE21FF63A2D6E09019E0899F70C3BE15ED8B2DE7209F59EB3DC352D5006992DA704B92
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
behavioral19 behavioral20
- Target
  6/AMIDEWINx64.EXE
- Size 377KB
- SHA256 2c67fb6eb81630c917f08295e4ff3b5f777cb41b26f7b09dc36d79f089e61bc4
- MD5 64ae4aa4904d3b259dda8cc53769064f
- SHA1 24be8fb54afd8182652819b9a307b6f66f3fc58d
- SHA512 6c16d2bc23c20a7456b4db7136e1bb5fcee9cbf83a73d8de507b7b3ffc618f81f020cde638d2cd1ef5f154541b745a2a0e27b4c654683a21571183f7a1bffd16
- SSDEEP 6144:4NFU+vVycygjjsp5dcAONdA22xVK8LRPo4WBIeX+oD9/nwbr9W9v6i:4bygjjsrdcAONdA22xVK8LRPo4WGkD90
- TLSH
  T1ED84296AEBA620E4EC7791BC84912302F7A1B4644731D7E7B3AD451A4F33BE4A93D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  6/Made by c0ze from 0x21 Discord Server.txt
- Size 31B
- SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
- MD5 d51610a0ecc803427c069e21cac7f914
- SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
- SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  6/amifldrv64.sys
- Size 28KB
- SHA256 20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb
- MD5 0dff47f3b14fb1c1bad47cc517f0581a
- SHA1 db3538f324f9e52defaba7be1ab991008e43d012
- SHA512 f572e741b5a7e854353420bfe072f4e8d10ea61bd0be06a48f3b07bb58e98987761a4cbd77423bf1ab4a9a79b599b824b6b2951bae9e8ad16bca98c84c72b0a6
- SSDEEP 384:Hv+RD9ZsRVl8jqiZchbao0HMrEDulUoLdZFnJtQSZsHLPK6jzOO9bvFR3lZbI1:HvyJZmmqlHCMmulJLZJt6PKgaO9Po1
- TLSH
  T1C6D24B91C6784C43EEA3DD3062F4D6277D34B6822B60CACF411AD0A44B927C1AB7C36D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  6/amigendrv64.sys
- Size 33KB
- SHA256 38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20
- MD5 119f0656ab4bb872f79ee5d421e2b9f9
- SHA1 e35969966769e7760094cbcffb294d0d04a09db6
- SHA512 428c2a7db1559cb39a882a7dce5a0559efd9d83c2e86ca94bbe3c10c9989fe63c160ab7f475db0400a2ed016ab21f00faa9d0e0b7fdba5e3c34daadab24e71f2
- SSDEEP 768:Jn9+pli0X09luuJ4j/2HGra+Jt6PKgeGPeHPc:t0muuJK1a+JtkwGPMc
- TLSH
  T1F8F25C9197B84C92FDAB9E3062E0D6577D78F6D23A30C7CF0164C0640F63BC26928369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  7/Made by c0ze from 0x21 Discord Server.txt
- Size 31B
- SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
- MD5 d51610a0ecc803427c069e21cac7f914
- SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
- SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
- MD5 SHA1 SHA512
Score

1^/10
behavioral28 behavioral29
- Target
  7/READ.txt
- Size 64B
- SHA256 0ce09b03a154a204d22e1e43bafd10f70d629c40384bdddaa1b2823f1ad96700
- MD5 aa25337592c3803ad18413b5d4d703dd
- SHA1 4bc511ee499f93e058f72f26a237323d25699863
- SHA512 62e0d83d9b11970aac851d0ed21f1f27f3981cf99f173cad067e67c9e1a3f0f5072243669d5402a5f85ce6ff1fc16610a5d01c8e10c85d474fcc296ae4704494
- TLSH
  T1ADA00272F30A64E9985B880018C7B6F4D41D974991A454CC9CE9024C27B543ED511D4D
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral30 behavioral31
- Target
  8/Made by c0ze from 0x21 Discord Server.txt
- Size 31B
- SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
- MD5 d51610a0ecc803427c069e21cac7f914
- SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
- SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
- MD5 SHA1 SHA512
Score

1^/10
behavioral32