7eeb814d72d8be71283121400580b5368302aa9239a95a074920c35fb3561c7f

General

Target
Arcane.zip
Size 102.9MB
Sample260727-w6arkscf48
SHA256 7eeb814d72d8be71283121400580b5368302aa9239a95a074920c35fb3561c7f
MD5 c278a96c612251a49a2fd1e2b068b2e2
SHA1 251ef953f8486dfd097c29010b3fc5d4e3844609
SHA512 463d4f82925a1879fbde7bfe5d6aa86f93238c1e6b3a5698b17ba6bf529ec6bd79ef3a69052dd6bda2843368c9db637804f6e9e8fb2d0c0d25baaefa691fce8b
SSDEEP 1572864:/KiE1ezhvNJ90SM54Qornof8Mv+yKzwIZ0LyvVkcwMc+xBfTC0Fgjyh:FTNrTMGUpwVkeBfTN9h
TLSH
T1EB3833587A5ACD7568FF6BE2F887133F50C86984E4B72B5273CBAF8308A5105DE424C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Arcane.zip
- Size 102.9MB
- SHA256 7eeb814d72d8be71283121400580b5368302aa9239a95a074920c35fb3561c7f
- MD5 c278a96c612251a49a2fd1e2b068b2e2
- SHA1 251ef953f8486dfd097c29010b3fc5d4e3844609
- SHA512 463d4f82925a1879fbde7bfe5d6aa86f93238c1e6b3a5698b17ba6bf529ec6bd79ef3a69052dd6bda2843368c9db637804f6e9e8fb2d0c0d25baaefa691fce8b
- SSDEEP 1572864:/KiE1ezhvNJ90SM54Qornof8Mv+yKzwIZ0LyvVkcwMc+xBfTC0Fgjyh:FTNrTMGUpwVkeBfTN9h
- TLSH
  T1EB3833587A5ACD7568FF6BE2F887133F50C86984E4B72B5273CBAF8308A5105DE424C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Arcane/Arcane.msi
- Size 19.4MB
- SHA256 877bae76f6bbab9e67abd12d43831e6deed1033a80e5a307de24af76f887589e
- MD5 1b5de3e8c4fa421d9b5387534a528009
- SHA1 c9288921afca717a72a017dce9b4c5ce33c80fcf
- SHA512 fafa881471b462de319fb7da47967df4f895ca4f7e1c27ec05d464fd0bcac5ef6a5c55e40f88a56987ae174f6d63612d0dc373a9b7f4ff6ff288fea2b7f3f1d4
- SSDEEP 393216:/rcmtXuwSlgl9Qv87upe4GCAKUduCu3et11Gva5iZiY:/xt5lq06dA7dBIeqcY
- TLSH
  T1F42733A66C262E83CA5526BB23431342AF310DB33B1187112D79F96D1CBD1FA5B5D38B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  Arcane/README.txt
- Size 23B
- SHA256 78da5dec1de3d4eebde667c597e0d7152064702c2e2c1ab738c4387c332b46df
- MD5 230bf9153062164dda12a454da040e69
- SHA1 b0a9cf58287f9cb39295b38448946bb4f15e9a9c
- SHA512 714696b3572aa912849d6013075687f8a60a2d02746e6df52d43ae264f2587bad71bb69cade69033c2db927992e0dc0ce955edca5a5220d7d7dd1d805e1297d1
- MD5 SHA1 SHA512
Score

3^/10

execution ransomware
behavioral3
- Target
  Arcane/Settings/1 (2).mp4
- Size 45.4MB
- SHA256 2756a177c1f035c6117edaed575b27086cc4d7185744962696eab046f1fe06a7
- MD5 61292033324425f7974da673acd560fc
- SHA1 49d2eaaa3fd0ce67eb5e1ac1faab3a7daf2b1d46
- SHA512 b00d66c40c9d1440e10a31406c9152ba9f390561e48df16da32bd0d467de282b597195940ddbf69ebed8aa31e53bde3492de58fc496676f60319ff879e5501a7
- SSDEEP 786432:xiHzyT6JepwM5gRRoArhy4QJf/i4d47INDiVNUDZHAQuxMQU/WMZBLgjKihiX:4TyM8j4Mfq4d40QPU9HhOMlWOLg0
- TLSH
  T188A73302A3FEB607EC742BB1C6D63B10B53CCBA96754D7C78588CB296E16715BDA20D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  Arcane/Settings/1.mp4
- Size 39.1MB
- SHA256 5ea20861824bd2d0e40af1880f25a7df28e6753271196c9524cbd880791dcdb8
- MD5 71c045c11d7746b30dbc9aa64969f5ea
- SHA1 7a2df2d1abd35d9f9064577378a4e9f32b614320
- SHA512 0740c29bc749b217469f05a2e5713b7278e67508565e51a179ab0eaa87c96ca31958b121c37c14a1efc394d279ad526587eb231ce5b0ed0c975d4cc9f3554a5d
- SSDEEP 786432:hp32d0UJPJ17uqHJbuhUVj2QgfZ4W6MjYYJYEA:D32djPJ1LpgUPgfZ1f9JG
- TLSH
  T1BE9733B0B7FD5256DF3553BBC6EA53450470F2290F62C3C7588D4BA16CA62ACAD831CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  Arcane/Setup.txt
- Size 188B
- SHA256 54fb70f9be53a29f452246dc82b912cc7dd9665d2817283821e1b54daac3062c
- MD5 790208524995b6c5068328759ad8fd43
- SHA1 2ca48306129e969eebe8163c3d446db7881cbabb
- SHA512 17dba18ea6921b826c77fbed73567ae9c1a3dbcda224c887227834ee3d6d9ea064896a45c6c03c53b2b20f3cdc87c407a4a23a1132016c3391c75a93e9bcd7d5
- TLSH
  T167C0C0EE5D0BA7F2100415FCC16D50C0CC2490CC4300461031B0204DE230A8ACD47ECF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral6