374e4d6ad681e4f5040f6767671377dcb25471fe914d10dac258323210392dc0

Sharing

Copy URL Twitter E-mail

General

Target
374e4d6ad681e4f5040f6767671377dcb25471fe914d10dac258323210392dc0
Size 15.8MB
Sample260801-pa55aaac58
SHA256 374e4d6ad681e4f5040f6767671377dcb25471fe914d10dac258323210392dc0
MD5 45d2651e9ca8490f538c7fbb42bf4f83
SHA1 5becf290bf03ce166fa3868538cb519933242e17
SHA512 fc428276aded62e924b03607f84558532dd62756cc76b37f7be19e01a4c773208d67e0713b2d874c3aec7606cf608424a8ced64ed8e5840276ced95444e19a00
SSDEEP 393216:Vx+PcP2uSeB7JeEwVCnnvSZ2virdiTa0Q/7EbqXw/:VecP2q2x278ditKEbZ/
TLSH
T1F5F633713479393B7D8C28C8A19049B28565D6F202B7E2F1CFDE775522A2CF2C6669C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  APToolV7200(2021-02-01)/APToolV6A.exe
- Size 1.2MB
- SHA256 48b1ab9face467cfcd8366820dbeec4709fe3c0750271189abd2d5042e775f61
- MD5 f372ce96fcb8ec5de734696dd8c973f6
- SHA1 dfc1130867b0813dbf8215f8399e452c890f80be
- SHA512 e9f4452e094cf7bb5735d0c34d3fdc476bea424649c1d5111efb9e60b1db44fd4e9a2c8743d0c5e4f994739a84154d3763ba422241855b0c26113a99ef70ccc3
- SSDEEP 24576:JUERJXPCG0GlSnasbheXC7eeMzOKLF9g7cCZS2puT8u9:kfIvsbhQC7zHb7cCZSNTv9
- TLSH
  T1F1458E20BB53C537E97B20F249BE96AEA158A5B0033654C7A3C80D3E0DB55D27F36267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery evasion ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  APToolV7200(2021-02-01)/AutoH2/h2testw.exe
- Size 409KB
- SHA256 029bf1846f7cc55cbcd83128225f8be3760d71901771d464340ac37ccafe3147
- MD5 716fe4603626a74e63179ef7803f3237
- SHA1 e45787836fbade4ebc1a178d656e9821267e133c
- SHA512 0efb1a3008770999bb86df67cb010da72269a81cf203cef097e490428166eec2e1b4b6fb4494be56653274ca4dc48acc4b5c8b29e67ef7cb14b7c789479e0b1f
- SSDEEP 12288:ZS8pyu8vquNsWvC3bTm7npfqqRIsr/d8E:BpHruNsW7npfq4L1
- TLSH
  T16A946B1177D0D036D2B235754A76E3746AAEBC318E31834B3B903B3E5E70691DA3971A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  APToolV7200(2021-02-01)/Dll/APDeviceMP.dll
- Size 1.1MB
- SHA256 97916a530730167622cacaa3aeffbda28a153ec0d923286191cf141845a82042
- MD5 f42e054d5ec9ac21d36f460d71af5249
- SHA1 e932e7dc922cc896d617b114a8f1f23cb4f1b6a4
- SHA512 4652b29d5f56d6336fc298bb0db9b8ed8d5309b82aa789337d0da80ec4525858efd8ce72c882feb3f66547279ea35b315c3f28a06f8e5d0f89c6436f8cb7f6a2
- SSDEEP 24576:gs2OeeW4RzsOem/n31qwLKPzCNRY84af9byOdzc:gMP/n35tNRx4a1byOdzc
- TLSH
  T1A5359E41FBC781B5CA0F26B10177A32B9775560007389BD7BB907E69ED306E3AD39289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  APToolV7200(2021-02-01)/Dll/APSetting.dll
- Size 702KB
- SHA256 5beb6810c1a042050cc9d9893163f9b02037071a34ebb697dbeaa1f0f33f9aad
- MD5 38b6dc5815915e506b245c501b831586
- SHA1 da88730676c1812589b02b1d03c3998510dcdca2
- SHA512 4a0542cda69148c0386bda8b5e800a5a215c82c77d63741721dfc4b8a9ff5045f63383c14ca94dd11793c4ef6c18e1564b99e15d7664a2a4d7f6a0c50581609e
- SSDEEP 12288:GWRqvvEfHSWZi2Sy3rH9q+Ym43NzLEOUBuBTje:2nUfZiIrHMN//9BT6
- TLSH
  T172E45B429FC5C1B6C32D117B10A3A77B226D76605B344ED36EA43E6EA9709C37D3A306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  APToolV7200(2021-02-01)/Dll/AutoH2Main.dll
- Size 298KB
- SHA256 8c467853d2a9bc2d1fa9d3bde1d6ad70729fd439f7168024da5a443e58540a8d
- MD5 cb31cbb6c6ea349c96fadf082fd8b9a7
- SHA1 ba82a450fa93b8ec51efe5bdfa5cc7fbf4402e77
- SHA512 89d3e907d51c4384aabd4996487cb4d446f55b0292b6081d1db83479df2edd67ddd6101836aca127767e99ad7dc89f45ac0f58e5f7fa5eb86548142989673452
- SSDEEP 6144:BLzue9FeJg2KKtCGZX5dooQodRxRcXaxiyOc:5dKtCqX5d1dGXax
- TLSH
  T1FB546C11B780C472C59E2138141BD77566EABC319BE5C6C7FF903A7E6F321C29A3825A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  APToolV7200(2021-02-01)/Dll/DeviceAnalyse.dll
- Size 1017KB
- SHA256 a99b18837b67b7689b2fc2dfbc87c6e48914ed38b27ce229faf168632287b842
- MD5 a5b4166ca8de228d6bd814a803103edb
- SHA1 54de15fc779d3dda138d29964f983c81100facff
- SHA512 317874bbe9468670fefa79403a7f48e8048f160e84be92cfa828f207bfb9887fc7edd7e02bf09a611801f21da097d99e63c5ed23a46fd213c0fbc1967ad7b5f5
- SSDEEP 24576:2lQe7l+zrukCbXEec/jOQdUJupDBtF0H0M:+blUOBupDfeH5
- TLSH
  T19B259F01EBC2C1B5CA4F15B1103AD32AAA39562217245AE3EBD47FA9ED305D3F93D349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  APToolV7200(2021-02-01)/Dll/DeviceFormatAndCopyFile.dll
- Size 392KB
- SHA256 cccb498a451184c9edf834ae1d8482838dc8e0079edddc667c7ab571960afb6c
- MD5 3152e0d52047e2cc832ba080af78e8ec
- SHA1 03fc61caeda96cbd2715d42c187e05d9279adec3
- SHA512 26eba9c54e5a0c7f78ac2cbd1dbf9e290a3d938bf9dbf07267151d25fb46e7aa93f82afea1f3ec43439284e38b6d5f671f0c22c59174c5cbdd0dad6890069109
- SSDEEP 6144:Z63+EBfYjcHkHwBQCTRZlz9oeuLBXYmbRn3RWjLSwVep:Z63/9KcHFz9yBImbZ38OH
- TLSH
  T115848D11F785C0B2C11E10356566AB7666AD6E606B3887C3F7D07E7E9F347C26A3830A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  APToolV7200(2021-02-01)/Dll/DeviceOpen.dll
- Size 649KB
- SHA256 5a087646e0bcce1ec0ec4f89fbd515b5f8a1586b6aa9cf679fbc0bdf6ec36983
- MD5 39ac89fbb2d55dae802ab00f7389969f
- SHA1 0b5b94ebbbdc8c96f8b630395030ba9547080fd1
- SHA512 276c60b5e0616c4b437eae67fe7b86fb6bcab82163e28085daa3a91164ecf879ef8a64ea4c70d3d6f4cdd7a9568696faae88dc2d1f3065c1367f27accad1645e
- SSDEEP 12288:Z+1e5LwQHG+7EGRkbpERv2iShtkjSx1sgBEXZbP:Z+1e5LY+fEQMx1JBEXZ
- TLSH
  T126E47C123680C0B6D26E3136415AE73867EEA9314F31D6C76BD4AA7E5E349C2693C31F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  APToolV7200(2021-02-01)/Dll/DeviceScan.dll
- Size 494KB
- SHA256 c46d6b9e2370763c1861d0ce3bb78ae1029af386ab88d3d7a83ef2b2f7bafaf4
- MD5 a5854f390cf9393fe7f6984d3f9dfe66
- SHA1 f0b22153f7ebb9da3f261311a8a107fed0ed18c4
- SHA512 1f6a2264947c2beb63136707dfc287564feb4daa86b5b086009d7f980b4979ee2819a83febbba82e9e1fe56085c58dd711f3a91d218aa9b307b2a4b335effdba
- SSDEEP 12288:PN7FKL7Xr5W1FDtACRiixLv4uv2EGs4JNoIplv:17FKL7X1WbDt4sLv4uKjoIp1
- TLSH
  T158B48E40B7C2C0B2C65F217510A6E33A7ABA6D6157248AD3E7D47E3EBD711D2A93C309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  APToolV7200(2021-02-01)/Dll/DeviceWF.dll
- Size 361KB
- SHA256 1b556572ba59e212ca5c2360d95b650076438a7887098b9645162d2a338e6cf2
- MD5 4d7ef70c1eee40d2f0b8548532ac717c
- SHA1 6cb920e188877b3dac9423b61f60f761cf5e163c
- SHA512 74864d5ea6519ba96f8fc5b9cca2335ad1aaf3258def5fccbb6c7fcc0f9fb33fe7cb858dc5adfc8ae91c23868944dc090d3e064c1f7155506002bc449bc9f747
- SSDEEP 6144:ILC+HEW/8mbyBKeOV3GSosB9HseChVeKQdvikEfS5abgeqYIbK/r18q:Ie+HE+0gosrseqzfS5EqOW
- TLSH
  T1D7748D00B7C5C072C55E21392157D7396A6E6E605B3196C3F794BEA96E302C2AE3C37E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  APToolV7200(2021-02-01)/Dll/PMEditor.dll
- Size 327KB
- SHA256 84bd61720c7fc9a290e4057e137c5db9bd9e577f13d435e47637a46206f05cde
- MD5 dd8f2245d643eba0b0c2873c9f490cec
- SHA1 ce0fa3fd8f0f93249e12efd7116239b244280e8e
- SHA512 67f35712f06faa09ad0f04355a3320a705d9aa3bb1379ed07cd34cb5c05112fe7b78f2689e53593c39735452c536b58a181066bd3b09681bccabf1375be0d327
- SSDEEP 6144:Yz7eY2yD1Ffzab2g0aC5QPH6CYMmhxI+NLZ0C0xItYOygOW6/6Kzun:Yz7eVb21WH6Wms+N
- TLSH
  T14D646A10BE95C0B2C65E25794466D3A917DD7E319F708B83FF907B7D6D322C2A93820A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  APToolV7200(2021-02-01)/LoginTool/LoginTool.exe
- Size 389KB
- SHA256 42332db5078f8364a3c29cd3c9e267e143daa45c7dc17fad41b2b51d7934ad7d
- MD5 1e813d9bdc87d4bde12d7a8b42ab31ad
- SHA1 7e7cf729466219299e7ff9764aeaf0b2ca89da6a
- SHA512 7e72d24df430c3384b16588be922ff1f888ec4246fe46e2eee61c6b84f607eb0da4fb0f7ff77d485b1d5115644bb27dd18dbe034f3f4493958447f8d5f67ef5c
- SSDEEP 6144:STrIQIwVvC1EihCJPSTT/kGtDyWMyJKakLBVJOkguMmZKItmBa:IihGPAWWMyJKaaYSlKgI
- TLSH
  T11D843A12378CD072C21233714B56D675E6AEA8615F2743872BB02BFD9E371D2993B70A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  BOSCH.exe
- Size 289KB
- SHA256 d81ed08a8729715b36038f417c439f8e3ba426d174424aece3bc269b158c8a7b
- MD5 5d6fbce5f0b0220a9b8d03f3cad1088b
- SHA1 63fa8731ddc7cad0629a945e14b1f9676669ab99
- SHA512 bf27b728e6c92ad121f6d754782a082b0588d8046c1f94fbe3b3283c20c8695924fbb4e4bc1f65f35bec2b8b201f41d64f8f5882597ff78688424048f90175a8
- SSDEEP 6144:YrwPFyBtvwqncgzmhTmfws/2ScX1iGMCD7I9stx2pK:LYbc/TRo2l1PM+JP
- TLSH
  T14654324E02D684A4CD8A69A20EF3BADCFE91784D748B68347E64FD048C4D17F5ACD3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  APToolV7200(2021-02-01)/bootFile/AUTOEXEC.BAT
- Size 1KB
- SHA256 a6fd61aee15172be95f2a656d0315bee342e14c240322a4f39f64b41b9d9ad43
- MD5 ada36523ad72c4b9057da21de0e899a1
- SHA1 dfbaf5daa9cd0fe922c85efd920a5b757cceab8a
- SHA512 eea3dddcc2581a1064d9dba78ecc0552992985ada4384e4d220e367f9a1adffc8e0e99c5d19949a7b543c6612e07a5c4298d6dd56a225aef4e352a57731b6f44
- TLSH
  T17911FC21B8867440FAF31F629DB161B7DA26F4E333C2DE18848F5A70060D90972B1A69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  APToolV7200(2021-02-01)/bootFile/COMMAND.COM
- Size 92KB
- SHA256 931d25c31d04d61bb44394eeed1f64d4278d764a9eb7da4edf683d6893cb7006
- MD5 17c1021dd38323dd3a558e334dc7aaf2
- SHA1 13fa1e00940a541c61d5f53c8ba9fb689595f6a3
- SHA512 9787d6f07eab719aa6ec919519d770755282aa196bf998d8e98f7d735e965228c7d94f6800b56dc0737babc5749312cdc899886ea73b6bf055d4f1fb3018f5ec
- SSDEEP 1536:lCGWsTYWhSBFxfcfxzeXidzvU+Yv7FKHV:QGiDzJSdA+E7e
- TLSH
  T18C93BF0B1F8C125DF04ADBB45205D2A2D3AEC1AC327952057DECD61C3B2BE59A3EF994
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  ATTRIB.EXE
- Size 14KB
- SHA256 263759f52520f35b2bdbf74a8920ae1689f14612a69233107e20250ae761d6a1
- MD5 8cb1b6769d1df8a0fc0088b50ebe14ab
- SHA1 5ca8dfc8ece2599b60be1a24ff8dfc1588654bd8
- SHA512 6bfc0c030fbdbb31be941b1744d79dc65f993b4696f2de974c7760193df7fdd25bf41d95d175ab4770110dae20f39259129a2fd06ba96ef840023a3c9675275a
- SSDEEP 384:cYJdFAFyEj5GPKAIpXu66BSZ6qbHewsdD8J7fRdqLb62133aI:cYJYFyEIKxfks6iHeJk7K+2
- TLSH
  T11E628DBE5DC0C356F8CBD2B40E0FD5D7A5DCC82D8160B9BE01F98B16512A08816B6ED3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Tasks

Sharing

General

Malware Config

Targets

Modifies boot configuration data using bcdedit

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32