725164fab1c57cc861e7f3e9c916c0a32941d2b70c4f185a01abbb89eca2700f

General

Target
Addictive_Keys_v1.6.3.2.zip
Size 71.4MB
Sample260808-14dsnsvhmf
SHA256 725164fab1c57cc861e7f3e9c916c0a32941d2b70c4f185a01abbb89eca2700f
MD5 78c224f9eae7b70131a7607137bad2bc
SHA1 9de4ff897164e8caf1bf7f8ef15451f44a897789
SHA512 dab6d71f00c1e956cc7a98ee69ebade1b993b763d0b1bf34711a623cc0310fd90c92e5f8cc6a1c118bfc3f427509086ad130994102bf5c714685f3cf3d124cef
SSDEEP 1572864:iCOCgdIDSYCDFXj/Mq5FNRxcYKoJJbvGVMry4advlWvWSVm:udFxV7NRjJpJry99xL
TLSH
T1AAF7338AE9708ACFAC7B182006B0AAB3C6D5807B55C39D76A48DD3D754DBFF53792048
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  R2R/XLN_KeyGen.exe
- Size 800KB
- SHA256 0c10769b277cf217dae2877ecd476e70413907f4eb7a70de55c2fba4edc947ea
- MD5 952d893926df7a8d5879f2ffeb96e96e
- SHA1 2a2f3faa2c7670a52e27b838c81737e6c9b4f965
- SHA512 4e456fdfac6ea38d0746b2a516c04fd797f75def9dfe3b2fd7a2c1f934f14f1f644e61809d660c542ffbce9e2198651a8376f5c92a2afe5455e286e051a34a56
- SSDEEP 24576:UcLjNw85Iyerj0xe41VExk6DVPiFeoMkPr4Q:UAemLEj0xeuqifPr4Q
- TLSH
  T13B052326BAA444D3EDF30BB114FFD964B1BBAE678B02158F62C5BF395532742600B243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
behavioral1
- Target
  $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $TEMP/R2RXLNKG.dll
- Size 6KB
- SHA256 76d9ffeeb89773c56d58fd8935c2d310aacdae3b590f3cc7aa24ed267339a735
- MD5 edc9d719c3bdb5702e28abf9df8359b6
- SHA1 d433026c1a8c51552d1ad657a8fccf81cc73ac76
- SHA512 a7f866c2bce0e73d893bc07d5a298f5905ea3cddd11e111e5c1195959a9e5f2a0607670b6506860cadd1fa88eef05bf23063128c0d806184ec35d9daa0327197
- SSDEEP 96:MuPsNE+ByIO4EOkkIrZjr1LTReB55H7bl01tzDAQ2bJJ:M39BLEOqjr9TGD2TDAQ2
- TLSH
  T1CBC1E63753E148C3E1B686B03B75EF4D15ADF4212120B6A8CB21C8493DE8696FE17766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $TEMP/bgm.mod
- Size 606KB
- SHA256 7aa1e2789c5222a5cdd09125cb268a28569a482e7ced85b150b27e0c57ad1e9a
- MD5 179949db15dc96c6f242c1969a033543
- SHA1 73046a24a10bc8475a20c31f4cdb7b27d7ffc055
- SHA512 14dc62014671092c20c7a36357a62c6bfa98fb5ec97a394419dc7437faff3d20ff015e9ef4b7b5d31250c5730933836629f47ac329f5055b350c022f5a61e3b5
- SSDEEP 12288:rt1WorOFjL0Ikkf5vlQ9HVbvWSiiafw19q9XiVlXknibpcwluf/I:rjWorvQf5vW91iSii/l9/pcyu4
- TLSH
  T13CD4D033FF86B84AE0982F3545AD5A1A6334FA491F7216CF3B4A6D755A7B3822C30711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  $TEMP/keygen.exe
- Size 443KB
- SHA256 5c9509349f39b2fcade22eb219126d45831920fcb4f319191f2f4a9e7643371a
- MD5 2cf51f0737ff7c3b804f5c9646b627c7
- SHA1 d37ec75aca03b01e7f79d760a9ba02ec2b03eff4
- SHA512 ebd931371967f129aa2dd2051c89fd15d6f615a55edfb5f25dc7d518254c8b9625fec9f35e76f72e532337aeefd89bd5ff713df85a6904c483d37f41a133aad7
- SSDEEP 6144:bcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOYyFGn4eg6QKxE1aal/i:bc/kEPDonR6Y436vRjFGnJEFi
- TLSH
  T171A46A419382CE78F2DA82B98DFB7B2BE12062245712A5F7C2573E379DE42DD1C74219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery ransomware
behavioral5
- Target
  Setup Addictive Keys v1.6.3.2.exe
- Size 180.8MB
- SHA256 a82e021e64988e5d4355e8c76c3b6f06889d44fce4615dc9e9bb37deab978866
- MD5 36436eb8be7814e318a0f327bcc88ce8
- SHA1 e43c66882116c124aca171cfc5dfa3300363ac03
- SHA512 210c0025692b4a443f28e395088b8cf2a1ad0694d33d5ed4f50a2887ba17a122c0e40428cad31278d81d779b83eeee82e7e903ba8a8e14a6d0ecf75cebd7110f
- SSDEEP 786432:dD7n6VTu8LmrYPZEfcZH5mrYPZPNDNBQSmrYPZQprcymrYPZTbZXMo:dD76VTu8s8efcZHq8tJnQ38WprcX8N
- TLSH
  T1FC98384666EB09C4FDFBDE3099F656679633BC056F30848F02441B3A2D736E09A72762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral6