4cfbe684f8c502d6e40c827ab4793f8a56af30caaf2fdf10ff16601f92ba79c5

General

Target
Megadownloader1.9.6_Release.zip
Size 2.3MB
Sample260731-2cg7fshr5s
SHA256 4cfbe684f8c502d6e40c827ab4793f8a56af30caaf2fdf10ff16601f92ba79c5
MD5 019ea991dfe4ae72f91a22acbe4cc19e
SHA1 c2935272e1f7f67f5d488803e226a7c73c5106c5
SHA512 5e1ef93d8ab1f6acb0e4a80dc93b93722d40b951203e3980ff0b06660da321b1ab8c6f02844622d254deb42d899544d26795acffc1eb4049779e4e45b2f5e95f
SSDEEP 49152:LLxvg3Akw0PR2KmfybeehaWMCXqLRFNHeNupI4/29TksAK5v:LNIwMPr2CSFNHeEIY29TkC
TLSH
T143B533461833D473ECFB29709A8207C29AF46D6A39D44F1CCA80D998505FDCC9DA5FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Megadownloader1.9.6_Release.zip
- Size 2.3MB
- SHA256 4cfbe684f8c502d6e40c827ab4793f8a56af30caaf2fdf10ff16601f92ba79c5
- MD5 019ea991dfe4ae72f91a22acbe4cc19e
- SHA1 c2935272e1f7f67f5d488803e226a7c73c5106c5
- SHA512 5e1ef93d8ab1f6acb0e4a80dc93b93722d40b951203e3980ff0b06660da321b1ab8c6f02844622d254deb42d899544d26795acffc1eb4049779e4e45b2f5e95f
- SSDEEP 49152:LLxvg3Akw0PR2KmfybeehaWMCXqLRFNHeNupI4/29TksAK5v:LNIwMPr2CSFNHeEIY29TkC
- TLSH
  T143B533461833D473ECFB29709A8207C29AF46D6A39D44F1CCA80D998505FDCC9DA5FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  MegaDownloader.dll.config
- Size 1KB
- SHA256 bf40f2174f35d94a29def8fe77ee1d3dafd38aa56e858333fc1c875e91c36bea
- MD5 d6413926b46cafb97d46fa35d212d5ab
- SHA1 7212bae2f90fb77119fdebab8cbb20574e63ba56
- SHA512 c0e55e4ccd64299c84dc280d4175187b8cdd0a05c66ba5b4cee30891f21a1d602c5802375a6b0d1c6dd604002ad80a79024d31eaf6db3d47c171c580204feedc
- TLSH
  T11C31F295B1D49DB58A6256A37D6409C0EF3B4BAB354C014CF4EEBAAB8F3242C53071A6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral2
- Target
  MegaDownloader.exe
- Size 7.0MB
- SHA256 eb98ece07943c82ea341ed2268b8fd39dbda50f0d61a6e308b5ce910522e92c5
- MD5 845f928bd6fffab20ef577f60c45e44e
- SHA1 36729149f5a681fb1f9f46d9388997ee716f8393
- SHA512 8ff6f63b1c140c94ba3686b066ab5865f87b290ae27054fe71ac3c25efd78744a58c5a45a7cbdfbb262c31623b9f3cf0855c41bd6738b73e8b5a20c6c792ea11
- SSDEEP 98304:opfNjWgpfNjWepfNjWOpfNjWrtfXjWdwRkx/re:opfJ9pfJBpfJbpfJctfTUwRkNK
- TLSH
  T13B765C1033D45557D2BE33F1E062A82282F5EE8A6A16DB4EA874B4D90C73B53DD4263F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  spider.txt
- Size 73B
- SHA256 eb87fff7c06b1e9a325c23cad5b3c43cd2f2ac65497c926b52b970ce7a0eca9e
- MD5 d51911ff46ba0e589eb94fe88055944d
- SHA1 b679869eda02d2381c3876f8f24786dd4a56df2b
- SHA512 2edd5f77c7deb0ceb2b72f443b47b7cc12b1f45e507e5533972273e9916acb906a367bd8042239d3dec2410deb866da67ab9e6a955f1315dd1d190ea5a28bfa7
- TLSH
  T115A022AF0080A0C0AC80B082FA3C0B8E0033C2FCAE0C2C88C0E30AAC003822808A380C
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral4