85e1b2eb7ad893242e74a323cb2226eede2257a8b97a2781b9dbdd4430de4aba

General

Target
Clip_Studio_Paint_EX_5.0.2_Rev3.sanet.st.rar
Size 539.1MB
Sample260803-tylsrsfk2s
SHA256 85e1b2eb7ad893242e74a323cb2226eede2257a8b97a2781b9dbdd4430de4aba
MD5 4ac176ea06ceba212979eaaf5b244d2d
SHA1 633425946a51f6f5a5561eeea833049ecb1b5c7d
SHA512 85d85acdcbf767ab090bb06cdf989601ed0f704016642511c0dcc4603ac6e6238eee6b26b8f4e34dd417c3c85ad8494a227e28642777cdc8c92c65ae7534603d
SSDEEP 12582912:Lo9gt6t/F8I8+bAYzYX+IrX+HIumpJvOFBKZDoFL:0+tiFK+8Yzg+rIJvOFI1+L
TLSH
T1D9491296B2A000E4E1B9C0B6CF599D13DBB138960731D7E709D1F9A79E7BDF095BA200
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Clip_Studio_Paint_EX_5.0.2_Rev3.sanet.st.rar
- Size 539.1MB
- SHA256 85e1b2eb7ad893242e74a323cb2226eede2257a8b97a2781b9dbdd4430de4aba
- MD5 4ac176ea06ceba212979eaaf5b244d2d
- SHA1 633425946a51f6f5a5561eeea833049ecb1b5c7d
- SHA512 85d85acdcbf767ab090bb06cdf989601ed0f704016642511c0dcc4603ac6e6238eee6b26b8f4e34dd417c3c85ad8494a227e28642777cdc8c92c65ae7534603d
- SSDEEP 12582912:Lo9gt6t/F8I8+bAYzYX+IrX+HIumpJvOFBKZDoFL:0+tiFK+8Yzg+rIJvOFI1+L
- TLSH
  T1D9491296B2A000E4E1B9C0B6CF599D13DBB138960731D7E709D1F9A79E7BDF095BA200
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  CSP_502w_setup.exe
- Size 463.9MB
- SHA256 037e5ffbd8f21af13f774bfb3bd8d736ce6d0b7f750b0f99fb1d5815f3853865
- MD5 ca39eeb3fd4f93b64a01076e1a80f419
- SHA1 8136ed68eb48f1e617c264f948b0997fc0beb501
- SHA512 46815771bee241608be6e541b285acf21d5dc149d3d4fc1fe8adb692a8b8ee141d82ff2788ff38365f23a8d1571d8656de46315f889c7aad197d947172d59630
- SSDEEP 12582912:rQ7rPNPK6s7qj4ONsAtF/pkZ2VF0U1h2Pc8xY:rQ7JPvs7qjvsAtF/m40Xcr
- TLSH
  T1F13933177584491EE57B4332EEAF0E52B6613C336721848BB2D0FB681CF16D1BE63A16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation ransomware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral2
- Target
  crack/CLIPStudioPaint.exe
- Size 88.5MB
- SHA256 a6630ea90a8a074b91407afdf152696e0f47939f1c0f44b746026fce00e85353
- MD5 f654e2f66ce0e5bbf96f4a1b7510b698
- SHA1 6c5242617ea336e193906cbb137bc0b4813ae910
- SHA512 61a6add872d1e09777054ca15f5df998ca6e74be3e19b606ba922ae322f69047950f596af825e029dbcb81126881a200461ce5464309f3eeb93b5834d8d72ceb
- SSDEEP 393216:pDOkxEkqoZtt/nJzlL+vZASk27PdJ77lRjN4vKAtnyp+++71mR0LoGgyE1wz2dpG:jPtryp7lRxQnboG
- TLSH
  T1B2182B96B2A000E4E1B9C0B6CF599D13DBB138960731D7E709D1F9A79E7BDF095BA200
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  readme.txt
- Size 81B
- SHA256 9747274b713f69443b0fd645ec89f5da33d6e506212d5d37cc85c441a3935d6f
- MD5 e65ca719b60c2453f8494a1f8e7fb564
- SHA1 dff4107ccc70da7b6db78f24232b7fab34e410e9
- SHA512 84a1fe6dbb0a4f518af3dea6c2230dda402c95b354c80aeaeb4e1e2dfd8f3bb64acf9dc4512a76b62fd31edc4023f87198eab3f0d70337e2ab157212c85d2df8
- TLSH
  T19DA00140EDDAE2D02AB972564B143CA0A52A6C5C93461569AA49EA0EBA8851290590F5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral4