41f7f163d85a7f2e5ecb97babe00f7db6b53c7040c924df27fd77da434cd4c66

Sharing

Copy URL Twitter E-mail

General

Target
ZelloSetup.exe
Size 3.4MB
Sample260808-s6dlpahn5s
SHA256 41f7f163d85a7f2e5ecb97babe00f7db6b53c7040c924df27fd77da434cd4c66
MD5 4de61ce5de9af05d98f07499b7510df9
SHA1 05192f0cc51f54d6a7f64a4f8355971cb59d9a9b
SHA512 2fc0d47621295416631d211c236f0539a457c8804d1a9024d75a377d6ac593d13d35dc88166223d58aed1a991f19a9d290a4007925955c85713fbec4ca57c815
SSDEEP 98304:T2B7+SpqzbwrfjtMnzgZhz+gH/Kksxvc8:T2x+0qfWjqnkZhFH/KksV
TLSH
T17CF53302F199457FCC331B3A6BA7C4DB498B7EBF9614D4C72BD937443A26EC4291A221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ZelloSetup.exe
- Size 3.4MB
- SHA256 41f7f163d85a7f2e5ecb97babe00f7db6b53c7040c924df27fd77da434cd4c66
- MD5 4de61ce5de9af05d98f07499b7510df9
- SHA1 05192f0cc51f54d6a7f64a4f8355971cb59d9a9b
- SHA512 2fc0d47621295416631d211c236f0539a457c8804d1a9024d75a377d6ac593d13d35dc88166223d58aed1a991f19a9d290a4007925955c85713fbec4ca57c815
- SSDEEP 98304:T2B7+SpqzbwrfjtMnzgZhz+gH/Kksxvc8:T2x+0qfWjqnkZhFH/KksV
- TLSH
  T17CF53302F199457FCC331B3A6BA7C4DB498B7EBF9614D4C72BD937443A26EC4291A221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery spyware trojan persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7
- MD5 0a9fb96a7579b685ec36b17fc354e6a3
- SHA1 355754104dd47d5fcf8918dee0dc2e2ee53390a6
- SHA512 67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b
- SSDEEP 384:EFC43tPegZ3eBaRwCPOYY7nNYXCg/Yosa:EMTgZ3eBTCmrnNAo
- TLSH
  T183624D1137C558B3E2D62A797EE2B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/ltnsis.dll
- Size 78KB
- SHA256 082ecda048088ca888073637cd6628b37581816db9b999da7c70af38dd736bb3
- MD5 ac3ad7a7662fc4b51a5b107d22045941
- SHA1 bd88d4d23d4316668a17f2a77c2b919bef086d01
- SHA512 7ff02c3b38b512e8276ed8c7235579ea913704c2720ccf057b3c95d1f2248e1a4a680d3971f7ff59ed20db4cbcc18da2fbbc2d8f1f986b177f56765103cefee1
- SSDEEP 1536:Cw+lnkkQc/8CCLSDXOPWFI2X7+JZjaeabuvTJt7+pK+AUfC:CXR/fCYeIL4ZjaNuvTJt7zv
- TLSH
  T156738D12B690C473C96A993864A5CB319E7DB8109EF2848B7F5B07BD5F223C2573931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $TEMP/Zello.exe
- Size 7.7MB
- SHA256 48b0770ac9463b84be6508cb946edf03c9088fa01333c95182a76e065407b7fe
- MD5 4dcabf7d7a4f3dff7cc46eea6d1e7a4c
- SHA1 19ddb006148f3a4200fac73e6540ea2a8b744019
- SHA512 5c769636c2e769661233144c4824f41e44f2597e6add7c258c5334217bb1d76784870bebcb373ced5f2c3958b063efe43a5726c1a252824696971457ed53330b
- SSDEEP 98304:XDwY2pBXHqPDOBzorVUBZLbhzFuMnozB9TwvHHmxYQCgff3dXDedNqG4ROXPP+wf:kY2/9v8zB9TaHNQXAdoGtn+wf
- TLSH
  T11586BE02BBD4C0F5E5E21B7098669BA94AB2FB304B31C4C776C44A1D6E70ED18E39767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence spyware trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Zello.exe
- Size 7.7MB
- SHA256 48b0770ac9463b84be6508cb946edf03c9088fa01333c95182a76e065407b7fe
- MD5 4dcabf7d7a4f3dff7cc46eea6d1e7a4c
- SHA1 19ddb006148f3a4200fac73e6540ea2a8b744019
- SHA512 5c769636c2e769661233144c4824f41e44f2597e6add7c258c5334217bb1d76784870bebcb373ced5f2c3958b063efe43a5726c1a252824696971457ed53330b
- SSDEEP 98304:XDwY2pBXHqPDOBzorVUBZLbhzFuMnozB9TwvHHmxYQCgff3dXDedNqG4ROXPP+wf:kY2/9v8zB9TaHNQXAdoGtn+wf
- TLSH
  T11586BE02BBD4C0F5E5E21B7098669BA94AB2FB304B31C4C776C44A1D6E70ED18E39767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence spyware trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12