eb6cdc0c02723802092df6f6ce7a9446eae1c4666e38b393e8f8cf5260fb6e28

General

Target
Simple checker.rar
Size 29.2MB
Sample260802-v6xexadd68
SHA256 eb6cdc0c02723802092df6f6ce7a9446eae1c4666e38b393e8f8cf5260fb6e28
MD5 8e66205ef6a4b5840607843c50e251ef
SHA1 a4aa8fd08deadc6ce92d139cb78efea25233937b
SHA512 1a4adf8a5f2d82492175ba761374c7b5d41ce163951b06433343ab9547b187f26ac7924a7b1a67b4bdca18c4f42e68e4325675e489ff1a98d5ea0551dfbef3dc
SSDEEP 786432:pND4W0CcCAchF+PR/xad560/U9FrX5hCRBk3K/j:pyW0CDBoR/wK0/Swfq0
TLSH
T1C667338C59F0F09316E12F1E050B928AC152B8B76F9D8E956F0547721AFCE4A41AF72F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Simple checker.rar
- Size 29.2MB
- SHA256 eb6cdc0c02723802092df6f6ce7a9446eae1c4666e38b393e8f8cf5260fb6e28
- MD5 8e66205ef6a4b5840607843c50e251ef
- SHA1 a4aa8fd08deadc6ce92d139cb78efea25233937b
- SHA512 1a4adf8a5f2d82492175ba761374c7b5d41ce163951b06433343ab9547b187f26ac7924a7b1a67b4bdca18c4f42e68e4325675e489ff1a98d5ea0551dfbef3dc
- SSDEEP 786432:pND4W0CcCAchF+PR/xad560/U9FrX5hCRBk3K/j:pyW0CDBoR/wK0/Swfq0
- TLSH
  T1C667338C59F0F09316E12F1E050B928AC152B8B76F9D8E956F0547721AFCE4A41AF72F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  Simple checker/README.txt
- Size 328B
- SHA256 47efa51360ef0f811d615aedf90ab4a38e11cf978e8cd02953f76f621a4bd34a
- MD5 1cf6b207fd3950bd7ae21efc37331bde
- SHA1 9f41834efb36d750a0636469b35fdf9be2d0d0d7
- SHA512 3b59ec97b33f6e9ad274d9700e928a84d40731ff123012d391288d696ebecdee33f64f70d754d6f8628b3f4525e79d7239d7dbaf33915d56b984efbafdc35c69
- TLSH
  T1B3E095118C33F5941491D08F8063F440F05D553B0C1E02395DD0157C1DD00F45C1F64B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  Simple checker/Simple Checker.exe
- Size 24.9MB
- SHA256 afe46999748f64442631212d001564f04af2526060f914161d25992e619e3802
- MD5 5909ec156143e7c049bb2c4225f7e84d
- SHA1 7defb9761982a91fd76aeed19860c7689cb2dac7
- SHA512 e5717354b216227506dbc7c8cbb03490f8080a17610ed0c5912ca097bf95611cb10a4de017690e655943b60e05a68cb89b91cddac3f56e298fed5fe9c1659811
- SSDEEP 786432:YxVHh/IOUMJl0Fm9YxLrJGzzWK7xdXPX:YxVHaOUMJ6Fmu5iLX
- TLSH
  T1F047235A288C526CC0D1D230D60A7EEDE1E5F9784D391C1A7FCE1E607E3BD45C4A7A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  Simple checker/skyline.dll
- Size 33B
- SHA256 6b2dc0ec3dd6c783df5d39fd23d47a1567b010dbf805fd7400eea046622f1477
- MD5 b534068707b7f9c9aeedd89550c2063a
- SHA1 90008f30fdc8b9c7f1453992efeae455c44216d1
- SHA512 406c8b548b66bf98d219c411050980589f00aece16c0c99937ccbb25bd4a7502cb939c251412ae66789355a07444d8f8a1b7b1731b761321694c9dc38fdb3349
- MD5 SHA1 SHA512
Score

1^/10
behavioral4
- Target
  Simple checker/skylineloader.exe
- Size 127.2MB
- SHA256 40795ef2d612895ba43cf3187ef4f7f02f14517d3d35647e5909185ee60696ef
- MD5 ea6a89602c5ffa1f4013aa1a5efd2efc
- SHA1 579bb1c036c99b3a9fe9b6f12c645466c513f498
- SHA512 2a51633295d5b48b3cc112a20b544d4dfa83de27c6f9c444d0e02a864d9d8aee23210e485607e0d6fba050476745dcbe5a97d5f3c454a54e6cd014772d1be3ba
- SSDEEP 196608:U6z9Emd6YE3kN0lXH+5FrPBYHNeSCOCnyWrSLFl5mP:UM9EM2kN0lX+nZYHNejhXAa
- TLSH
  T150582333B28A653EE07E4A365AB6D610493B6A61AC138D0AD7F4446CDF261603D3F74B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery installer persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  Simple checker/w64ms.exe
- Size 34KB
- SHA256 64c36651082bdfc658efecc4f71bcdcb20bdd63d0f5c835d2ad39babf3d6cd22
- MD5 a25b776bed8a3e46bdff60cf1316ba09
- SHA1 302e72ccb7bbeedb2921e4bf50fe04156db67640
- SHA512 52d078bd8019ed3dcbab037ce3a736d5083cb57fdc7a876ccdef2faa74001b56f02c888fbe8e1d9d44d55126ef15ba7f454b94e58f764fc89c6779b33a174dc0
- SSDEEP 48:PWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWX:W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6