e68c3ad831838c24b336b054f8e3f45d8f356a9200fa0549f30b08abfed07e5b

Sharing

Copy URL Twitter E-mail

General

Target
VeloSniper_Setup_v2.0.0.exe
Size 9.6MB
Sample260808-x3cmfafc22
SHA256 e68c3ad831838c24b336b054f8e3f45d8f356a9200fa0549f30b08abfed07e5b
MD5 16ad1fe58b564e7677524196765de748
SHA1 22ccab8d3e5f48818e87a3b78244fd8a974fbc48
SHA512 d0bd975d3c4c1705ff66b0f191f8b401a1ded94615d87526e63997f777330b2b770ba69f708229a88ef1da27861f06b24fec16f7bff9885bea5c21d52e974ffe
SSDEEP 196608:p0NPOZu0tTtkJhnG/bg2y5JRwcPEBVlAwnL/oeGBVR+YiVIUwk5L6tMGRCH:pGU9Ttku/bg2yJR9PiAS/MzR+YimC5L5
TLSH
T19BA6335594104F71D78E4232041C0E369A7690FA7B71E9BF7208AA73812759AFF1AEF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VeloSniper_Setup_v2.0.0.exe
- Size 9.6MB
- SHA256 e68c3ad831838c24b336b054f8e3f45d8f356a9200fa0549f30b08abfed07e5b
- MD5 16ad1fe58b564e7677524196765de748
- SHA1 22ccab8d3e5f48818e87a3b78244fd8a974fbc48
- SHA512 d0bd975d3c4c1705ff66b0f191f8b401a1ded94615d87526e63997f777330b2b770ba69f708229a88ef1da27861f06b24fec16f7bff9885bea5c21d52e974ffe
- SSDEEP 196608:p0NPOZu0tTtkJhnG/bg2y5JRwcPEBVlAwnL/oeGBVR+YiVIUwk5L6tMGRCH:pGU9Ttku/bg2yJR9PiAS/MzR+YimC5L5
- TLSH
  T19BA6335594104F71D78E4232041C0E369A7690FA7B71E9BF7208AA73812759AFF1AEF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/modern-header.bmp
- Size 25KB
- SHA256 e54356980652a9126656c4e976718faf230f43fbda15d824b0b1beed066f53e0
- MD5 e8644c95cab4621a6dc9d777fc8c9090
- SHA1 ab19a2205733e65b2671d8d0479f83f74f6a71f5
- SHA512 5dd8bbee702f21f3d26968071b965631f347d4564eabcddf2f67fb6c67d35b9de2873bfbbbbd2d227921b5a18cfd72ce087e6e074bea5bbb944d5631159ab2dd
- SSDEEP 768:hgQFpqgiPALVg/J91T+YTFzPzVdpSHMsKIaJD00:hgQFpqgiP6VMJ9V+mFjzVdpSHMS0
- TLSH
  T1B7C2DC72F663FCAB4BD161B55B10E031499A56FCC2F760E53E895838B9CD5009FAAF20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 dcd36e8e132fcca090372e728a1e8b0042116bea3a9777d4b84158eff3e3f5ff
- MD5 3ce0541521e310e3736579d3f94bb5f5
- SHA1 7b14a72f4f60e1a50b35494ee8bb7f19c801bf74
- SHA512 3e1af8db1aef330ccd6a6dfd9799999d31d82ace398466f81461ca1baf3bff801766d49e8955c0d16331522ac748025dc4be65a13794510d81fc3b544ca33abf
- SSDEEP 1536:QxdRt7JwCPmFehFWmn6CxlBOn7JyDAtkq90I/YAt:tCPmFa677Nt
- TLSH
  T12DE347ABF241ECBB23F194B2DA61DA7557B030BE8BF301BA3CA4559CF11D6206615F42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  $PLUGINSDIR/style.vsf
- Size 32KB
- SHA256 53564a28d1a00386b9536dfbf0371393d949b2bafd9292e8b80497d1e59e00bd
- MD5 66792a9c425c811b704f2f9f428672ac
- SHA1 47e0366a2c2c75361dc5c094faf1a109d2aa7db5
- SHA512 ece42f9d09583520416507cb24a62bb73633d41df8c2acfa21bc8d7fd4dffa51515f481e4a6d1eea6637d3dbfaffb390c5b84d106c93d7d0fcbd1052ac479177
- SSDEEP 768:GFYjg5V84tpppppn4Zs7jmtXvwPkJMSVK27JYnFpYEN0:GFYjgp4Ijm+Zq7JGdq
- TLSH
  T158E2D0B1968DDEAAE562127908B7FDAA913831732EC9F3B72371107D023A478D392447
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  velosniper.exe
- Size 18.0MB
- SHA256 94328a4d05c0c0a443b3e008f1f2a67dea677fdfbdbe651aad11954ee104d65a
- MD5 c4e88711f3fddc19cdfc6f36a1e91adc
- SHA1 b87de4e2abb5dbc1c3ff36029b88300156ca86a0
- SHA512 c2e98367e1ac767afce7e73a4642d4d4b826d1b079af4b9695ef1b93313ee4987c6e75ccd3f1fc24caa79e82e6e3d5d6e5c896c327852dc0d4f7810cc351c2bc
- SSDEEP 98304:6+FmRKkW5uv6sDoNMj/dyCkTuHHBIFNQaizMFyuhpZTFilnXj6tMePDfXpEH:6EZkpOWFp0IK1wlnXjerfXq
- TLSH
  T1E5172963E89216D4C4EEC5B0C672857BBB617C491B7813E712A0B3241F32BE0EEB6755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery trojan adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral13 behavioral14