c93b6c802d283952884ee13b96a62b0d96b0452367221ce860c4b2a46a4356fc

General

Target
t.zip
Size 6.5MB
Sample260803-st945atzcy
SHA256 c93b6c802d283952884ee13b96a62b0d96b0452367221ce860c4b2a46a4356fc
MD5 8c15553c2b80854b74aaf227e36a6ce7
SHA1 ff5cdf0ec098ebb4b3bcdb19c01704559db48edc
SHA512 286787b595b4edfdcac6bb8b1691618c9a1d13f47afd7eeb01a40a2a54c14ce2e3b81b52d6abff8478f53ede4e3cce21da0de96c15638b0871e14eaa07e116a6
SSDEEP 196608:0JALBHEV8w6Zlyrhn9oGBbDt9ljFRb9Ce8rJbunc:7VgxgYtqGBPZjFRxB8rV
TLSH
T14966334DACD14ED1D8F756491E53D2B8EF6334ABA98B8C8BCE60714C44AB6D7903C887
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  t.zip
- Size 6.5MB
- SHA256 c93b6c802d283952884ee13b96a62b0d96b0452367221ce860c4b2a46a4356fc
- MD5 8c15553c2b80854b74aaf227e36a6ce7
- SHA1 ff5cdf0ec098ebb4b3bcdb19c01704559db48edc
- SHA512 286787b595b4edfdcac6bb8b1691618c9a1d13f47afd7eeb01a40a2a54c14ce2e3b81b52d6abff8478f53ede4e3cce21da0de96c15638b0871e14eaa07e116a6
- SSDEEP 196608:0JALBHEV8w6Zlyrhn9oGBbDt9ljFRb9Ce8rJbunc:7VgxgYtqGBPZjFRxB8rV
- TLSH
  T14966334DACD14ED1D8F756491E53D2B8EF6334ABA98B8C8BCE60714C44AB6D7903C887
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  t/mod-manager-v2.exe
- Size 18.8MB
- SHA256 b358acfa275e4e3df9f8588c2c106b3dc94d98acf75779e6391c328abf310d16
- MD5 a49b8253a2b51a442a22871332495b1b
- SHA1 7562db99a26de6e0b47cdd79a1ca5392346aaa56
- SHA512 ee3edc53cafc4468d2ad52be3e0b118c7f2b0c71cf992f299ad470bd79a3eb65b14d0126a2997528d13e4231089c81e3de180f0f01caa32cf58cae97c3decd3d
- SSDEEP 196608:txyatNZYDitAAmpVOz2A6gjzhjgNHFNWZ/Vy5SZIPtKT/Z:TPZYDitAAmpVOz2AHjBg9FNqVy0IPts
- TLSH
  T1B1172815AA9B98ACD49BC4B483478A725A3034CF0B3579BF45C492383F6DBF46F28719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3 behavioral4
- Target
  t/resources/settings.json
- Size 2KB
- SHA256 3461a743e523037381d05a970b14aeb5c13c3b1227aa0a5da75b104e742fa9dd
- MD5 64ab6344a67600885cc8109a5dba9e67
- SHA1 864384012334143450a289f1f53d3cf0aa43e41b
- SHA512 22ed5f76e83e1d0ca7703cb9368c11b380ae40b471c7fcb31a8a9068123e6b6764589bd4f037ec3243d7d8811b32d1b183cd3554be47c627d45f4bef5f3381e5
- TLSH
  T11151AC73D07A89330DF0649BC46A2052AA1348074950BD6DA7B6492D5BAF7B720F3EDF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6