0d465e2dfc216d67a97f4fd19a535192574587e243822e2b831fe1730de603b8

General

Target
newuimatrixwithpatch_1786154719.zip
Size 20.9MB
Sample260809-a3s8vsfn3z
SHA256 0d465e2dfc216d67a97f4fd19a535192574587e243822e2b831fe1730de603b8
MD5 5552766a00126f9d5ebf7c680a7776f1
SHA1 92a40232c6b67f5964994720ef67435885f56cfe
SHA512 f564e40ddf5b4bba562b84cc1ef8eda68a10ffd0fdc630171a77c62e80f02502d1b984522cff513577bbe4165e45a47aa39edea9fa93a5f3d4152dd384d003b2
SSDEEP 393216:RZagCZ5Z7zJDd25FmjC9oH3hB6wzTvvCkGJhPPWvenSUQ7BPKq/bGOTdKco7Wm3x:wFzJZ2zPKHxgaTvv6LPPWaSLtKCbGOZQ
TLSH
T194273382DABA3BCD2166D9B3BA94BA13180EC1FD0367C140DB1BDD61B76E895873F141
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  newuimatrixwithpatch_1786154719.zip
- Size 20.9MB
- SHA256 0d465e2dfc216d67a97f4fd19a535192574587e243822e2b831fe1730de603b8
- MD5 5552766a00126f9d5ebf7c680a7776f1
- SHA1 92a40232c6b67f5964994720ef67435885f56cfe
- SHA512 f564e40ddf5b4bba562b84cc1ef8eda68a10ffd0fdc630171a77c62e80f02502d1b984522cff513577bbe4165e45a47aa39edea9fa93a5f3d4152dd384d003b2
- SSDEEP 393216:RZagCZ5Z7zJDd25FmjC9oH3hB6wzTvvCkGJhPPWvenSUQ7BPKq/bGOTdKco7Wm3x:wFzJZ2zPKHxgaTvv6LPPWaSLtKCbGOZQ
- TLSH
  T194273382DABA3BCD2166D9B3BA94BA13180EC1FD0367C140DB1BDD61B76E895873F141
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  newui.exe
- Size 36KB
- SHA256 74e704b51c1c1d2ffd2c58d2c10026d88c5a50134c9989b87c98db315f341400
- MD5 46825ef924ae3de614475e88c95a5e00
- SHA1 d7978d31ed5bf27f59fe7f9c0719e804151bbe0a
- SHA512 a82213a87bf0e025a882f799346565668616c3df9bc107d2f88d1d0beda79c1249a7865b0302066f4fac66d0620f815d51dd078059570006402de7c34d59fbf0
- SSDEEP 768:RAhzDCe/9wiwJcI/ds9wRulxph45IF271VPJRJRQSLA0Nuu+fR:RA5G9uI/dsyRulN+j7nPJnRQSLA0Eh
- TLSH
  T135F22A33879001B5C51AD5FCC7E97622E667B84557387ADB87E40A273B40BF0BE3AA41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion persistence
- Drops file in Drivers directory
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
behavioral3 behavioral4
- Target
  version.dat
- Size 24.0MB
- SHA256 aa870d11ef082b92da1f3a923626df9afb92bd64221c0f79f89b79effd2fe948
- MD5 ecb97f63ba2d4b8aac79e6646554a5a8
- SHA1 341d37622d01a1e10216d2b4e7958339903e923e
- SHA512 8f55a4a16fed2fae8c9a476b58d7ba700a07be6e6de98ee882a26b0262aac428e919f16a30f5d93c7cebd20bcf3be5f50cd12502d0c6399c82872e7954a0a8d1
- SSDEEP 393216:QGaH0QpRR2EQlZ+y9QfGQ/TvE6FSykDFbGuCRRTeoxPS7RyTmsq5+za0Tmh6hYiC:Ie49cUr3cUQcU8cUysi/DJkoJfBZ6fPg
- TLSH
  T11347225A9EBEB80810143ADBB75B9EBE3946ED3045E5C38411B1AA2DE35CE810377F35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6