f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa

Sharing

Copy URL Twitter E-mail

General

Target
Velocity (1).7z
Size 19.7MB
Sample260730-ejmdescn9s
SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
MD5 34be7067f85591003987566f89d44875
SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
TLSH
T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
- MD5 225af3c55fbb7376a11dbc4648a2b582
- SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
- SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
- SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
- TLSH
  T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 08c7014d311979c3e37ea56ae8233f3bdf363013498b11b1c7ee2bcfb29cf08a
- MD5 b76acca7a4248b6a6472915a0dfd5c79
- SHA1 ab44abcf54f42211d64fd219a94df06573191a7d
- SHA512 064fb0e7a366d26fb83ced4bca1edb2b39653d75bb0c4c4b9dfd545e2b1fb8e77fe021535478d2a57ed4a0fdcd4b39a952f320ae8fdaa2e213962732a6016ec1
- SSDEEP 768:1caNb2/itGt3JrbYbKQzZDgcEST3p4Jjrjh2je+SG2au8vxJKia5/Zi/wGQSxKFp:zb2/D8+QzZDgcEST3p4Jjrjae+SG2auF
- TLSH
  T198034B4083ECC517E6EB1E78A9B486620B7ABEC33DA1D79D1D88F1D90C7379055113AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Microsoft.Web.WebView2.Wpf.dll
- Size 81KB
- SHA256 b6a200f3dfcf2cb6c3b6e6179da0590e01525b111e8f85b94c6060456102972f
- MD5 57c8c00f0b851a4c8e6cf39a44351adf
- SHA1 bbf68f3d6e9ba8fc7dfc24a0b38e453853a1cab3
- SHA512 c51149361d5c8eae121a42694d28d087fe5a515c0aceaf7ba4c9c44bee5d6b2b397e9370cf5296729702f0c31dbd82be0c08167aac936d0cc10bbc26da4c1649
- SSDEEP 1536:mh/Ha+etdl9Zk3DcLoSJVgCthp8dYNUDHfF7yEW30bpc4Jjr4YeUq7HhvU0sdndR:mh/6+etdlWDGo/Ap8yUDHfFy30bpc4Jf
- TLSH
  T10A837DA123BC8D23C6FE1EB9786540555F7AEB837E12D74F6584B1E80CE738121123AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Microsoft.Windows.SDK.NET.dll
- Size 23.7MB
- SHA256 0ec371d93798852e36461c8adddbeadce0f963a04752f0b64e54fe19c1c834a7
- MD5 a00b91c2e00b89e387705af95b72bd6e
- SHA1 eb57d8d9b8c1e4434044c28b608113e49d53ccf9
- SHA512 93b88a2ef85206765144c7c082662da7a3ad57fb08af9f8bbc0355721c12cf52f6a6920adad08778c4d2054652636d24d095b998c282f9b1e92b9234808f3165
- SSDEEP 98304:POCu/R1ZTAk4bl5EUBMXyLImPbjAd+deA/tlCjvT7HiYyhILyV3K3CrLtHOpdGxD:POCu51ZTAFLzbjblIjvT7CThIPPBrYj
- TLSH
  T15D477E2297A44E3DC98F5773E4B603264335C60AAF4393EA581C979D2F833460B59AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  VelocityApi.dll
- Size 21KB
- SHA256 9945bf0b137c9f60e4fdd18e8d77b1e7c874936d6993d9e29b70820ba39a607c
- MD5 3d3059e39636ddd2ffcbddd4d162da54
- SHA1 c19b0f304637ea162799850d03617d021121e7cb
- SHA512 8756ec8ab8782ac734bb5cedc3b9ae2a6a87a167e2b23d59ede7e4b1b64eb3cb1d32b5fd62ced093e3dde9c164a1e26295e1b36818fd4b862a0337db832d999a
- SSDEEP 384:hBwpwnR3zxm2p6iThnjsL3BHsxxSIRtJa+hLuv266mNEQEQrzdaYU6Ud:n62R31BjOHcDRnryVVu
- TLSH
  T185A218087BF88265F5FF8F786CB082100677B9166432FB4D1CD251A92D7BB904A90B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  VelocityLite.dll
- Size 18.6MB
- SHA256 3867a2b72d32cf68210086edf0c94305578c3dbadbeb3f2bdabb3f79888bd9f7
- MD5 69674db1e8505fc001ba1bb544ffdfcd
- SHA1 10b7d17291d38a6fc5280c5db2e071290a53c068
- SHA512 b3d9d78c3a4369f6b948ba7f49f2259c5d59fbfceed6c989345d8fae762e4b343e814cc1b424eccc82d75ee4b7cd892b0f6aa7819ea03425a1d609955341636d
- SSDEEP 393216:pdtwpHrmXuabdwVorMb975j+ssedCCxr0DGfRJ9A8q:pTwpHrI1gowb975j+SCCxQJ8
- TLSH
  T100171247F389DE2EE25B1B3686730394A6359CA1BF5B030FA41A76B8AD733C01D146D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware defense_evasion discovery execution trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Probable phishing domain
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12
- Target
  VelocityLite.exe
- Size 232KB
- SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
- MD5 e4df8ee6e755c3da3088701eb1c05b76
- SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
- SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
- SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
- TLSH
  T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Loads dropped DLL
behavioral13 behavioral14
- Target
  WinRT.Runtime.dll
- Size 516KB
- SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
- MD5 edb1f8d15fe41838cd449141187ae032
- SHA1 c7344afcdaced6911ab5288b0ade76f66dd41203
- SHA512 5756ccbafa1440d114f8d9b163ea0c2678300ba24c9979b837ba232cc6813f74a29fc0a23b9bc1d7f53c6ce5f15cdacd6804a755ac816116536c56cd9ca43c0e
- SSDEEP 12288:A4Yh4z+uZSlne+7/SQ2YaxhaNHav96iTtqen:HRSucPTx2YaxhaW
- TLSH
  T12CB44A80A7FD9A1AE7BE1334B03416144B71FC17AA13E39F674895B81D637998E40BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  XamlAnimatedGif.dll
- Size 98KB
- SHA256 557f3e03f38beeae6e2c6c554afe6c7a763843f3571e7ba4afce75dc70a182a9
- MD5 80a78bc47019df113af3b69bb19c1110
- SHA1 2f5968aee35e12dc89ced1aa2490fe8f45b04990
- SHA512 757ce5da02f8d565643f2e6122ae736b931bb3e7d5f5f7676e07c42ac86e8abc4521b759371883f6b326a3529e2916ce3eaed7642e15201e36161870e5d71ef1
- SSDEEP 1536:VHbNmCWH8u09u6kR7apGhHAL3kLvq7OY+hgbbZVoIl6cGGyd:V7HQ6iaghWwqyY+hgbboYyd
- TLSH
  T142A33B7483B98F96C79FB6FDE5B8939987358206681BFB4F690CA1DD24473E185002B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  runtimes/win-x64/native/WebView2Loader.dll
- Size 156KB
- SHA256 8427b1fc58ec707813e5c0a51eb5d69397bb333250a7b891be4d3b123f1e0f1c
- MD5 b7f10b8066ee96c628e09c439b8d0b9b
- SHA1 3a2fe02d9d43100056b7dd1ccd2dfb3f30ad0f55
- SHA512 4ce26a59faadfa0a20e098caf297f3403ac1542706f72879ed7248dee4026a5c7ffc3aa95912d8e3510ac7593082429ce0e83978a5843cfce52fb475cc975333
- SSDEEP 3072:1mJgy7/ph9euiDNQ6A93jJBC9JGv6T/MEtJ6mj4UrqhQ:w/NVZ6A93j//EtJnrX
- TLSH
  T173F35C5BB2E900BBE17BC278C5A34A15E772B8111760AAEF036447791F137D0AE3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  runtimes/win-x86/native/WebView2Loader.dll
- Size 118KB
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH
  T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22