83df04d754999cc4ec9fb9c2b6e501ed0abfe2a5504ebe7a9ab573731a692510

Sharing

Copy URL Twitter E-mail

General

Target
zapret-discord-youtube-1.6.1.rar
Size 1.1MB
Sample260728-vvsbta1dkg
SHA256 83df04d754999cc4ec9fb9c2b6e501ed0abfe2a5504ebe7a9ab573731a692510
MD5 09c0e3195adfb4a5af86e087676b4851
SHA1 34ea20d697f0435345ddf492b0ae99859fd64029
SHA512 f4aed03d69b8546afe7be71e0d7ed905a6d249e71700f5d35e05835bff44170a7ae1bff4e57151828575aa40fac12526380b91e32b61f43f30d4c5e0ed2e73c7
SSDEEP 24576:MzpOrx3ZikzzXl80BxdOqFtgQfYVVwc4NASTA+E/aZujf:+0hZ/zLxLz5fEy+TaMz
TLSH
T18C453385F7E4D3A067332FC70B7E351AC8113D6140F9A78A2226D1AF521EDD95E9CB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  zapret-discord-youtube-1.6.1/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  zapret-discord-youtube-1.6.1/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  zapret-discord-youtube-1.6.1/bin/cygwin1.dll
- Size 998KB
- SHA256 712c39a069541afa69cfcbe01b422bd67b4201eee7e94cc1327d4ed8b4fa2167
- MD5 c50b50303fae4afe7248307339a00d13
- SHA1 1b4a3f7666172809bd0d88f793ee855bd4b92938
- SHA512 123d06a0a5f891851e372881860b9d7fb8c453dcdbbca5970b9b2bf205f08f0a724595c6892f4afbbb4f85292a886dddffbf0d36dfe18d4b6eea7a5d12451762
- SSDEEP 24576:YbYJZPZf7KMuiA7Q4lsXBmStxacrFhG+wTGiPoy1u7MHltI:YAZfmM/A7Uk6xhpmGkoy1u7MH0
- TLSH
  T1522523CF5A6F996BC8A37831696011D74209127CFA49CAC1CF6ED1A8578CDFAB1005CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4 behavioral5
- Target
  zapret-discord-youtube-1.6.1/bin/winws.exe
- Size 246KB
- SHA256 0453fce6906402181dbff7e09b32181eb1c08bb002be89849e8992b832f43b89
- MD5 444fe359ca183016b93d8bfe398d5103
- SHA1 61716de8152bd3a59378a6cd11f6b07988a549d5
- SHA512 d6780503164e7abd0017b94aeac824b3d25124ac84e9bfe423b78fe1f03b3eb4b719f85676ad0fd2e9227e45328a6b6abda75ed1341ea2a4332c0717720a6f72
- SSDEEP 3072:0Us5NqvvO9ab6+x7KYGJ1DjgvgN4tn/qzWRG53HfErKM78Kxh2m889QB+5UswNV:0x6WA6w2Rx4ttn/qD3sr0Kx9EuiNV
- TLSH
  T1AC347E6BE36354ECC467C17482E39B32F931BC1511647D6F1BD4EB326E21F40A62E6A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6 behavioral7
- Target
  zapret-discord-youtube-1.6.1/check_updates.bat
- Size 2KB
- SHA256 438adfb9f66429e1b6b0474fe0cdbd397098d58c4b80ff2c74237c6f9b99df23
- MD5 c0af479b986a7e2095929a68136cd97c
- SHA1 27416746e57536606550bfc5f8a0f3153cb53c0e
- SHA512 1c9955cd962f79c21886ccafb62941654aad79c7c805edc20e5edff7ffed8ba94180df76ad7cd19b19385761090e1bb5509ce68ee2ac9fe94ae476cea5faa1d0
- TLSH
  T14F513163184460B204741AFBC94C9546F31AE09B97048AFDF46DF0696F3C99B03BE6FA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral8 behavioral9
- Target
  zapret-discord-youtube-1.6.1/discord.bat
- Size 730B
- SHA256 21adf614f58d39396c49bf10ae3f6187905f328e24d7363372d299f821d18cf6
- MD5 c01056f88c8646cab2d85a31f44f1186
- SHA1 9a94f23a042ed0b8f9ab1e07bacd60f229e7860d
- SHA512 f2632105f8c06223db1311f3b8c1a81695c9dc218393d3509bafb733e8b92645f7d901f3667c45fd58691ac4b30da23b086b7462020e24fb35ffc5ad66277f9b
- TLSH
  T14B0124A3A408C697B39E613DF07F3290722FED8366C6DA02524801FCDD1ED54654A49D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral11
- Target
  zapret-discord-youtube-1.6.1/general (ALT).bat
- Size 864B
- SHA256 adfa52beace1ff288d2cc20d6814e8eb04fae5a9256b600c402f91ab94af5886
- MD5 f2dfdb0ec74378d6defc004bcfcee491
- SHA1 4a72566e431835199959e2328de3f9b18dbb2d39
- SHA512 6201d3fb2e0db6b044bf17ced023bf7af2696870082620a9ab99d22c61b02668119a29107d488519f6b5952a15c0c33116cf7d852d2e76995f73415cff63f9da
- TLSH
  T1C71102A3A009C6A7B29E713DF07F7295B12BE94362C6D902518C01FCDC0ED24698B08D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral12 behavioral13
- Target
  zapret-discord-youtube-1.6.1/general (ALT2).bat
- Size 853B
- SHA256 16113cf48d720d27befbcddcf26c890515d5586967a0b536838d2c8f5d42974f
- MD5 4b24d1b6aca069dffb4a55c003ad89cf
- SHA1 29ad0c6a8a905efc1485b122c70bafc62cc22dd4
- SHA512 11ecba18360aba2411559f05d5407b3a4b938fabd84c0c68e77c815d9e7897466fb73f5dacb0d5f023d172f2a95ee6042ec081b3ff9b556f9059f0a7ff5ccfb5
- TLSH
  T1570148B3A009CAABB29F757EF06F7295B12BE84365C5C902514C12FCCD4ED60598B08E
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral14 behavioral15
- Target
  zapret-discord-youtube-1.6.1/general (ALT3).bat
- Size 818B
- SHA256 198fda8a2fc02a4a501f13b67d1232dfcb3157075d3ab76494d17c64742e82d3
- MD5 6e0fd8729815f1941c5fd4016c888ec5
- SHA1 d9a0d86665684b27e0a48f943074a1fb007acf1e
- SHA512 01055654e02ff325ca1fa3bbbb607efd59d600e2ca7d9e23bac1e9eaa39241f141f035399c8054dca077d359b13733d25ffbf724ea1528f3bcac3828ea0e55eb
- TLSH
  T1870144E3A009C6A6B79E753DF03F3291B12BE84361C1C901914C01FCE84ED24698B08E
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral16 behavioral17
- Target
  zapret-discord-youtube-1.6.1/general (ALT4).bat
- Size 842B
- SHA256 8ca143406a8d2007cf6e123da7d7dd8898bf230daea1a6d79de5a104d323e82b
- MD5 d731b6b9e4e68b70cab7721fd84af920
- SHA1 1b6e39692e15bf90e63265fe8b19df234d8f0692
- SHA512 28a612b5a334ee7e1ef73e4e49011d9d6c56aae6e5c4d026c9519b52b606f22a3aa39203d63f9f03771f936d822c0946abfcbe16ff10c3371605535e22c0ef6e
- TLSH
  T1370125B3A409C6A7B28EB53DF07F7295B13BE94762C5D901914C01FCDC0EC64698B08D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral18 behavioral19
- Target
  zapret-discord-youtube-1.6.1/general (ALT5).bat
- Size 730B
- SHA256 ad49282af6fc53da5cc11ffb91c8a3d276b711695ae2777262bec2685424fb03
- MD5 dc9657042904b682cdcf34b8ac732168
- SHA1 2297b6c1af31fa1ab653c0768e0224fe70d2f4f4
- SHA512 737640b32173b7a64b3d58e1b82a98c11054467e8626762de5fceda3280156f98e36c0d2724fa5dcd85edeca9d1f930fb4cdd343804e7cf285e7bcad15ae4355
- TLSH
  T1090164A3E809C6A7B18E713CF07B32A0B12FE80362C1D901508C01FCD80EC60A98B08E
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral20 behavioral21
- Target
  zapret-discord-youtube-1.6.1/general (МГТС).bat
- Size 858B
- SHA256 f34baa409a741866d3805b7f9e4b898a1e808c086a1229aff0adfebf582892c4
- MD5 88c364ac675032f53fda77a63f98c6aa
- SHA1 6fafb0e41415b697c8be2f379094a320403f4e54
- SHA512 6576cb89d3900d1f47eefcf51fdbbb50b35204e5e40693d88d17abc6c238e14faa7f05d70df14dbc56b7fd21e0f880a43844a8e78ff85ed5695ef568bc36fbe1
- TLSH
  T1F81121A3A009C6A7B29EB13DF07F7295B13BE94362C6D902518C01FCDC0ED24698B08D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral22 behavioral23
- Target
  zapret-discord-youtube-1.6.1/general (МГТС2).bat
- Size 835B
- SHA256 011332d582bf344b0543e8ec972c2c3a2a6b09a8d2052bc04ced067beb16dbc9
- MD5 68a787ee43d189566af3fd05db25bce6
- SHA1 87e0013173caeb22341dd99a9c824e4dcdeb2fd3
- SHA512 f6dc52364f89bc94fe6685f4812896c11c97bbf6a01296b0d7e6f3f5a60f44e5773d20c704dcc6f22b4a5687c3a171cf81698fdd4146db40df89a879b3520351
- TLSH
  T19701E5B3A409C6A7B29EB57DF07F7295B13BE94762C5D901514801BCDC4EC64658B08D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral24 behavioral25
- Target
  zapret-discord-youtube-1.6.1/general.bat
- Size 864B
- SHA256 af7ca78237dd2e3e66d581ebba166dc19d4ef7e02a269fb7a26d079592c72479
- MD5 1f9e2279f96b01b8c1723b77db9fc8b8
- SHA1 a154c36a322f549722dc4dc47de7cff13219214e
- SHA512 4b84133f75aa260cc3053be690139733cdcb79bceea1d7f628aae7a3ddacaab5aff96b6f87c99fede5ec2b2e181f440482d74e4109f75660ff682f8189b5858f
- TLSH
  T1D51102A3A009C6A7B29E713DF07F7295B12BE94362C6D901514C01FCDC0ED24698B08D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral26 behavioral27
- Target
  zapret-discord-youtube-1.6.1/service_goodbye_discord.bat
- Size 1KB
- SHA256 263102816588bd719fc628a75c8b73185110050564ea21a62b360f3ae545022b
- MD5 8b043f2a0ec87328dc40542b9739988f
- SHA1 c8b3c9c8c94ef379252a7048859a5f2c5934b52e
- SHA512 48e91951bb37882843a7438a56b8aaabf217a64aa5226e4d1bb6e40ae64276d0523f0d22bb0d5f15f02a952b6ecff470a5b871ae319b8d84f14a8f460a3eed86
- TLSH
  T162210FB32018C297738E927DF03F2251722BED8376C6C407700C92BCDF5C915948644D
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution persistence upx
- Creates new service(s)
  persistence execution
- Stops running service(s)
  defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28 behavioral29
- Target
  zapret-discord-youtube-1.6.1/service_install.bat
- Size 3KB
- SHA256 a77ac7abd0adcb995c701019bfe2d67133d6d0f94d90754046a13ade40adf693
- MD5 55d22378709dc7ea40e84cadced29e4a
- SHA1 4ef71d4a6c8bdcaca5355e2fce13ac9d8db8c7e9
- SHA512 b16e1f9b5f3134e661718ffe49a0b88d75a9383f45a6195e039e05ec1b7b5b86770e9c36740492382458b772204baf8ab69ae56b84cf16d17f56baabc73fd1a6
- TLSH
  T17F61B865100241999AB78BB37C64F0CEE30E81836A14D24E7C6CE055AFFE61756F66FC
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral30 behavioral31
- Target
  zapret-discord-youtube-1.6.1/service_remove.bat
- Size 416B
- SHA256 9d8f0b7105d86de09b9408515f30b2bc2bb935430f4e73196021368906b7f128
- MD5 f7ad12616404a382b1689c9e3937c9e5
- SHA1 fa45c9bfe7d43781daa96f7dfbfa9141164fa916
- SHA512 a40244d8aac46ce2431e7b3b00a2575f8801662f8d3770e71e27a995f01e1003e1e7ae88cc4ba2158144d73c4dbbd8e51ee308c4a89018136dd3af77890893ee
- TLSH
  T1A8E0AB67266B082303B5C2DAE5321472FF1D41CCE9AAF0863418FB45CF9019AECE207A
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

UPX packed file

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

Creates new service(s)

Stops running service(s)

Command and Scripting Interpreter: PowerShell

UPX packed file

Command and Scripting Interpreter: PowerShell

Stops running service(s)

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32