787b60c9435b83ca173d42d92bc1076d02185ef17e8135a3581ce6891bb33d90

Sharing

Copy URL Twitter E-mail

General

Target
3_sobeit.rar
Size 705KB
Sample260731-gzkkwaware
SHA256 787b60c9435b83ca173d42d92bc1076d02185ef17e8135a3581ce6891bb33d90
MD5 a40c1397d5f043ffcb35822461e24842
SHA1 6ea163e70b067dd084c8742a443d8e901164c1e2
SHA512 c92710f7042749ca639da1f3448e8982240ce312b6b2caffbe8813848bbac8264de06a3d3c1ebde22c1ce780062d1eae7cde3bdc573c46e963574f301bb05b5a
SSDEEP 12288:UV+8zsgWMRbRL6HqMlhXxCG4ZuT3RbHxwTwjNloKLFPTUFzkyJmGFXe39WKMjbI0:i3TWMpRLkXT5Th76Tw5l3tBmPWqz
TLSH
T1A9F4334C7C368B421A6ED610EF5E1EB31CCE48F832B49C2C2576E56B5551398F8FA4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(rus).exe
- Size 730KB
- SHA256 cc8bcbfc26b42b2570d460fed996f39e18e1ded18f14fe2e17c2c6bb7689a645
- MD5 4ca37985bd2fee60d5216688d3227296
- SHA1 4ee020b9e1d2e57adec6ad065809d434ed2890b4
- SHA512 c42879a8c3080dd2c2ad719c213b1dad70ff900bea00ccd23ad1f24a7d69688af113d2c1fb9e4d9a079a575106b226a894a93612b0c6f4a44997870183aa4427
- SSDEEP 12288:DiBQLEyQrL5/c8Epy1tt41xnBh40n1+eUhOHiwzJifllKpxenZiV7FNsEtFF1tO1:WB9ZneY1w1dVRUIHiwUfnKpxwZcp2W3Q
- TLSH
  T1BBF423092289D463E745B5316FEBD67BDABECD005374CC930F2E675882861C7963B18E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bea71368433f91e32c597db990089ecb7599879f76a64f7f3446489578b2d5fb
- MD5 4c0c6163b636f627e0d505deda672c90
- SHA1 2eae4e6f00673a03ae2434f1b22dc9218e4761a8
- SHA512 e817ad35f0e89ecce9d73add641d9eab95de6c6c30153e594673c8e0243e738a31dfb872cc76a8d51bc513775fc1dabc9adb65019298048539d6c3aa7d33e2ef
- SSDEEP 192:MO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1apgMO:9KAFERdlxhGRYUzqZap
- TLSH
  T1E1225C6547A042F3DD61823C08973D276BA87B149EA54ED3CF9314429E296A6BCBC336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/bassmod.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/brandingurl.dll
- Size 3KB
- SHA256 798ce85390508959953b55d966ee3ad8fae938cb107233876566a5823d339a66
- MD5 028857ee4bf29e5379b19027df010071
- SHA1 8cba90942b3ea405f70e4ae899bb08f7b58dfe70
- SHA512 e08d91f53039a1ec0c768a873b91901cae3fa7b91f368157c3adca12cb439b627e9d4558b49d747ef7fe6250a51693183ca29422603bf102bee05aa410539b8c
- TLSH
  T13A61303637F919B2D3724F7B58A31BEB6A7AB4310726404F446B299A6042D63CD79B03
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/dumplog.dll
- Size 2KB
- SHA256 0dafc86043fc2d263570cd95b778721924bfcbce36744b828961529b779ca4a3
- MD5 a517578af0baffd5a235d8177a651a5c
- SHA1 900040ea61cb705f5529ffe87522640ca220c8fe
- SHA512 afc20fb8dcae46f65f92300cc51ccf0c21d76d2135e3a8beed2fe363a2b10b1525fc042d7e307ba173ad719c23705a5718d4059c834969bcff7a717845e9ae11
- TLSH
  T11D41EF7747A11DB1F826033771570DC56DE5F21016D3BB1D0A02ED8CF50676B8A2DD10
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/dxwebsetup.exe
- Size 285KB
- SHA256 b68ca13c29b2c9ad899f68fe3f9baff7ecbb848e963604ab5f66bcbf420a26c8
- MD5 14ca145edd4f381e1adad6c2ceda5e7a
- SHA1 1f785ac7c5da7cc2750de9991cbb2d72b570ab82
- SHA512 58c08005db38c9dee19d9ee02717fc9780fcd61a41e14491c51f7f23782511737ec8235637b797b3f83cef4028aad3edf746ab87e02ca08aac2727cd1ba7788f
- SSDEEP 6144:nWK8CN+qHUKfw5R8DPv5N6RkMphh++axWzfAHzxHtUiq4:ngKI5R8DpNakMpWn0zmtUiq4
- TLSH
  T11B54F15266E9817BE0F52BB40EF602533B71BED27D79F32E9382548C1C61395A938327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  Uninstall_mod_sa for CM.exe
- Size 46KB
- SHA256 49163831f55678fc559f4da178283086eeef32544ce1df3d6b4ec5a24bd9a9cc
- MD5 97387f97fd4a02e7cb5c23d8074a8b89
- SHA1 57ea3501a8d424066f465d54ee9868e9ac5caa74
- SHA512 74bbdcf6dc1ad76471f89592be1ba3bc5146581f77ebff1af9c92c9b29f99f56b50bce3de6a81584af20a08787a4b36036a7b124f825f96b0a57695b57795bc6
- SSDEEP 768:7Sup23EQCjlQRB8/ewZ1iU6nyYFxbssT/F/O71mJ5agd2iZQAm6kRRS+NoJRneX0:Wu4EQalMK/ewGnh0mJQgdLeAyNxAb
- TLSH
  T17E23AE0A36C4C8EBD56A067119BBDBBAF7F6F70112100A275B500FBF6921183EE16297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral13 behavioral14
- Target
  d3d9.dll
- Size 814KB
- SHA256 34801e5d4d1914605c2f27ce21e3ef846bf36cecd8af2c41e27bf9b79b870226
- MD5 f8c0e1668b31e4de213f3a0bec441896
- SHA1 40c1591222615c04bf35e5b3f1649145a7377de1
- SHA512 e12f401f502219768c1e321b0abd072686417e4eaa392f342fd4e6438d9898ff2473bcf8ead55af61533b4dc19f75fa65bdef349b85337460f7a000960fc3aa7
- SSDEEP 12288:jtyYA5oRPrjRR4LulaYemwedT83h7XFkW7:EYAWPAMsgl83h7XX
- TLSH
  T10F059E41368EC031E15E513C6A13F33A6BFDAA3444F399773B8616BE5D78362E939206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16