b0c1e541004aa289dfd6236622b60b189e7925bf21ffa0639cad440056dbbae2

Sharing

Copy URL Twitter E-mail

General

Target
AdobeAfterEffects26AllTrial_maxon.zip
Size 358.7MB
Sample260805-wfz9jsda32
SHA256 b0c1e541004aa289dfd6236622b60b189e7925bf21ffa0639cad440056dbbae2
MD5 38bc9964112c930e1753f5a827b9fee2
SHA1 2d8b3e34ca56f0857ee773436260ad02a06ba4f8
SHA512 94fe2096b06bac473dc53707a1919750378b4b6f27b1c585b1b7935328cd111149291a7f6e5a15d10f6be0cfcda5d5b21bcbf8f98435b829790ffa7af04fddf5
SSDEEP 6291456:ArJkUxtgUF6zASlKN2G63XCGqHI0HpnQc+aVqJ1Te8XzinvYAimNr8Qf6JnuXlOr:ArJk2tgrkj+8HHeaE3jmnwAZxf6JnuXc
TLSH
T19A0933B485F8D85FD043D69F6BCA57EC047FD23AC1B8FC23B66DA95EE1684A005E0609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  AdobeAfterEffects26AllTrial_maxon.zip
- Size 358.7MB
- SHA256 b0c1e541004aa289dfd6236622b60b189e7925bf21ffa0639cad440056dbbae2
- MD5 38bc9964112c930e1753f5a827b9fee2
- SHA1 2d8b3e34ca56f0857ee773436260ad02a06ba4f8
- SHA512 94fe2096b06bac473dc53707a1919750378b4b6f27b1c585b1b7935328cd111149291a7f6e5a15d10f6be0cfcda5d5b21bcbf8f98435b829790ffa7af04fddf5
- SSDEEP 6291456:ArJkUxtgUF6zASlKN2G63XCGqHI0HpnQc+aVqJ1Te8XzinvYAimNr8Qf6JnuXlOr:ArJk2tgrkj+8HHeaE3jmnwAZxf6JnuXc
- TLSH
  T19A0933B485F8D85FD043D69F6BCA57EC047FD23AC1B8FC23B66DA95EE1684A005E0609
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  2/support/keyfiles/CustomHook/win/Cinema 4D Installer.exe
- Size 360.3MB
- SHA256 0ecef98e7cae98e9c90d92cfb55b553f0126594a20f2d72c19b915ec079ea9a8
- MD5 e7fe9919f6ad631d50abb143f1edf0ba
- SHA1 d05c22101eaeae90f298befcb2772f9cab45ce0a
- SHA512 8d461d762f55affd0846c7d0d16aee6e37dfcf6e9bb6a0262c0b6d52c6e1c69b61e52cd7570fd7b1c460e55f0a4deb67c18d09624998f1bf4cd8e10546db1234
- SSDEEP 6291456:fDyahpqsDO1KuX4doSkRpSeqTYqz9VkqOMzwHtxWYpd85LwWc6VJCCvSp3yD52mf:fDyapqz8FkWTNSMcDLa5MWPdvSp3yD5j
- TLSH
  T169093327D2E244EEC027C17987CBA3B52872FC291034BD2B7668EB357F35DA01769619
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence ransomware trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  2/support/keyfiles/CustomHook/win/RunOnce.cmd
- Size 178B
- SHA256 855fef9e3f479ae5c3b9a3bc9482276b5a4df47e62785e25d7c9e9112ddb3e15
- MD5 afa7a1b5220fc14d191f850c1860f5b3
- SHA1 c540677103fba74d43de1e87fe7c315bb4dd432c
- SHA512 158382a03adde557ce27e8c351a6ff79a75a7a33bb94695ff6c39e98dbf0b20faf8e729f72fd36fa55c27e82009948badcce59c094f95d7d78a9994075f9a8e5
- TLSH
  T1EAC002DA723B896C431AFC9155CA0EA7AE375CF363048716A409044DD237B1D4FAB5F5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  AdobeAfterEffects26AllTrial_maxon.pimx
- Size 1KB
- SHA256 b15c40c43c60d0213528c56ef0a436c27edb4db9b1bd221a057d00bcb0c4d8da
- MD5 6cd6960c57dc51cae20a8c55ebd2a6bd
- SHA1 155107d5a94ec0b3c361789dbc30e4726111f90a
- SHA512 df8d761a203de7fc7fba0362963cc86db91880381f33fe270274fcadbb61bf3c97d89226fec88c2cf519a16a382aaff48f1b2209222d98aa23e032b715954988
- TLSH
  T1C321088066F868E3F6C416ACD1F7FF056D946F77350881A8F29E49600F9BD92047B463
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8