548736f279070da7d9c4681768e915dc5e8771980c90dd523389acd13871cc64

General

Target
kioop.zip
Size 31.3MB
Sample260805-kl71ssytfy
SHA256 548736f279070da7d9c4681768e915dc5e8771980c90dd523389acd13871cc64
MD5 09fade334353f266f4e1eec46720938b
SHA1 6bacdf7a28c27da94cb0ae6b2a12621aacd7778c
SHA512 ef7da62a66047e9cd144dd82a13d9b2b8075e2f6623df619102b12e619d9b52c4b5f5d867497bf96a83c5f243a810651bc969d12cbb7e0bb77b686fd6bc0d6b9
SSDEEP 786432:YCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Eab:NxbXnfCJMAYDi4D0C5Z9nT3Db
TLSH
T1DB7733F1B043895A9DC19CE0E6C5C144E28A41E5CE743AB7D17A53F6C2E7AC7A4E73A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  kioop.zip
- Size 31.3MB
- SHA256 548736f279070da7d9c4681768e915dc5e8771980c90dd523389acd13871cc64
- MD5 09fade334353f266f4e1eec46720938b
- SHA1 6bacdf7a28c27da94cb0ae6b2a12621aacd7778c
- SHA512 ef7da62a66047e9cd144dd82a13d9b2b8075e2f6623df619102b12e619d9b52c4b5f5d867497bf96a83c5f243a810651bc969d12cbb7e0bb77b686fd6bc0d6b9
- SSDEEP 786432:YCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Eab:NxbXnfCJMAYDi4D0C5Z9nT3Db
- TLSH
  T1DB7733F1B043895A9DC19CE0E6C5C144E28A41E5CE743AB7D17A53F6C2E7AC7A4E73A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution ransomware spyware trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  setup.bat
- Size 2KB
- SHA256 91f784bf3dd83c0f5135ac1fd00a0fdd430720ebc57ec4c2eccb7875dbc8a90d
- MD5 9cb71612a1aa60c6a9c893bcefced81f
- SHA1 b9259cb454959dca0a42de49c5ad6f336719a384
- SHA512 3eac954bc561dd2f1ba88324acc5baaaedca2c7b3932135a6ccb7ae69b8057a8540b85a70cbd25d5b4a558254789c977bd9439ca0643b8d655a3bf802c3120eb
- TLSH
  T11351E0D48F112F641465CF09E46B81C3E733D0416ACA753404AC7C6F7B8D6AA3D3EAA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  setup1.vbs
- Size 1KB
- SHA256 3d1a86ad729817d85377f59c3d5dcc67ba59af9824ae64aea8e626f6a4956d52
- MD5 4ee143d2618554b4d1e2852c433e46b1
- SHA1 59002f85299ef75a7e781b0cf3161573a70dd8be
- SHA512 b6ef5c25df25d0e35e8736e0c2f5a127e20563015cb992b6393fe9e967c9640efa3d17c4ca317758d3dcc777c9cb22760b1f04179668788a6afca782f10e6644
- TLSH
  T1F4313348E92FCD01C9758A7341076C4EC6B717552434006EBB6C8C7AAB2923ADF70562
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution spyware trojan
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6