4ee4a0c06107ac6799d97c915011e303b44d2742da2b5a64d97e18c52b953db7

Sharing

Copy URL Twitter E-mail

General

Target
Arcane.zip
Size 102.8MB
Sample260802-gcfcmstwbx
SHA256 4ee4a0c06107ac6799d97c915011e303b44d2742da2b5a64d97e18c52b953db7
MD5 7f96441a6c07b8b40be8cd67242a3f64
SHA1 609a75a4ac7e6954286a59dbd6450bc26ce89bec
SHA512 8f6ffb3ca6ec8cca048d8c779a6487a51c66d7aff414e512482ae90e295f2f283f06f6c2492198a936736386df61b0f20c45154ad9aee9c29b21d4398c99c86a
SSDEEP 3145728:kJFLrxamjQadfMUIhoN+jT5B9vd1n5WylK:YLrxDj7tMIN8D911g
TLSH
T1EE383301F94240305A4A0D78A3549C9FBA96FC41A4F0F21BAD48A9619F3BCFDD7586EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Arcane.zip
- Size 102.8MB
- SHA256 4ee4a0c06107ac6799d97c915011e303b44d2742da2b5a64d97e18c52b953db7
- MD5 7f96441a6c07b8b40be8cd67242a3f64
- SHA1 609a75a4ac7e6954286a59dbd6450bc26ce89bec
- SHA512 8f6ffb3ca6ec8cca048d8c779a6487a51c66d7aff414e512482ae90e295f2f283f06f6c2492198a936736386df61b0f20c45154ad9aee9c29b21d4398c99c86a
- SSDEEP 3145728:kJFLrxamjQadfMUIhoN+jT5B9vd1n5WylK:YLrxDj7tMIN8D911g
- TLSH
  T1EE383301F94240305A4A0D78A3549C9FBA96FC41A4F0F21BAD48A9619F3BCFDD7586EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Arcane/Arcane.msi
- Size 19.4MB
- SHA256 e688033ea14eb6a835e99c3f812be006317dafd2c8251475e4d4c63a7ac1ebf4
- MD5 d0bf9c8187460c377cbd20be0cefee82
- SHA1 4ea1d7dc2f56ba44008182cb7343085183f1447f
- SHA512 4e281909cddf1f690a32a68564edf0aaba17c92243294dfe9901699041c6a9d63d0a64323647aa88434308c9ea670a7c0cd3c4f7b9e0d85317519d25198b380e
- SSDEEP 393216:7zio6qS3glvKv87upG4GCAKUdCCu3et11G0a9I5iY:716qpy06NA7d9IeT8Y
- TLSH
  T11F2733A62C222E83CA6426BB23531342AF310DB33B1147512D79F96D1CBE1FA5B5D397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  Arcane/README.txt
- Size 23B
- SHA256 78da5dec1de3d4eebde667c597e0d7152064702c2e2c1ab738c4387c332b46df
- MD5 230bf9153062164dda12a454da040e69
- SHA1 b0a9cf58287f9cb39295b38448946bb4f15e9a9c
- SHA512 714696b3572aa912849d6013075687f8a60a2d02746e6df52d43ae264f2587bad71bb69cade69033c2db927992e0dc0ce955edca5a5220d7d7dd1d805e1297d1
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  Arcane/Settings/1 (2).mp4
- Size 45.4MB
- SHA256 2756a177c1f035c6117edaed575b27086cc4d7185744962696eab046f1fe06a7
- MD5 61292033324425f7974da673acd560fc
- SHA1 49d2eaaa3fd0ce67eb5e1ac1faab3a7daf2b1d46
- SHA512 b00d66c40c9d1440e10a31406c9152ba9f390561e48df16da32bd0d467de282b597195940ddbf69ebed8aa31e53bde3492de58fc496676f60319ff879e5501a7
- SSDEEP 786432:xiHzyT6JepwM5gRRoArhy4QJf/i4d47INDiVNUDZHAQuxMQU/WMZBLgjKihiX:4TyM8j4Mfq4d40QPU9HhOMlWOLg0
- TLSH
  T188A73302A3FEB607EC742BB1C6D63B10B53CCBA96754D7C78588CB296E16715BDA20D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Arcane/Settings/1.mp4
- Size 39.1MB
- SHA256 5ea20861824bd2d0e40af1880f25a7df28e6753271196c9524cbd880791dcdb8
- MD5 71c045c11d7746b30dbc9aa64969f5ea
- SHA1 7a2df2d1abd35d9f9064577378a4e9f32b614320
- SHA512 0740c29bc749b217469f05a2e5713b7278e67508565e51a179ab0eaa87c96ca31958b121c37c14a1efc394d279ad526587eb231ce5b0ed0c975d4cc9f3554a5d
- SSDEEP 786432:hp32d0UJPJ17uqHJbuhUVj2QgfZ4W6MjYYJYEA:D32djPJ1LpgUPgfZ1f9JG
- TLSH
  T1BE9733B0B7FD5256DF3553BBC6EA53450470F2290F62C3C7588D4BA16CA62ACAD831CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Arcane/Setup.txt
- Size 188B
- SHA256 54fb70f9be53a29f452246dc82b912cc7dd9665d2817283821e1b54daac3062c
- MD5 790208524995b6c5068328759ad8fd43
- SHA1 2ca48306129e969eebe8163c3d446db7881cbabb
- SHA512 17dba18ea6921b826c77fbed73567ae9c1a3dbcda224c887227834ee3d6d9ea064896a45c6c03c53b2b20f3cdc87c407a4a23a1132016c3391c75a93e9bcd7d5
- TLSH
  T167C0C0EE5D0BA7F2100415FCC16D50C0CC2490CC4300461031B0204DE230A8ACD47ECF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral11 behavioral12