70f41978b37bbf91b7c262a41f6c52449b81c19fb5e8e07e07bc0693ca3c304e

Sharing

Copy URL Twitter E-mail

General

Target
Tools_Unlock_Pro (extract.me).zip
Size 60.7MB
Sample260809-a9mpna1xbs
SHA256 70f41978b37bbf91b7c262a41f6c52449b81c19fb5e8e07e07bc0693ca3c304e
MD5 b5acc8793a475f3060422408e2e058b1
SHA1 47e6c027372e20793e7a9e1e79e1d007fb8dd37c
SHA512 34c0cd12daa6c19759457815b3e4f9729b00555bfdbf9f6e406132bf3a7fa84d02c351b0da9fbae1f158a11798474d0e52deefc2b5b437b408e1d4fcffb29e08
SSDEEP 786432:5i/wasjVeBjZ9w2/w1QY117GF9FmwrF13B9JtM0zMA2q5nwOSZQXBX30bvw2PTci:5i/ycJwaMWFm83BVMTUnYQXB+vw2bZ
TLSH
T160D7335BEC0E83E7FC942617FDDEA25E425F783CCFCA2AE357598006726A8274974109
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Tools_Unlock_Pro (extract.me).zip
- Size 60.7MB
- SHA256 70f41978b37bbf91b7c262a41f6c52449b81c19fb5e8e07e07bc0693ca3c304e
- MD5 b5acc8793a475f3060422408e2e058b1
- SHA1 47e6c027372e20793e7a9e1e79e1d007fb8dd37c
- SHA512 34c0cd12daa6c19759457815b3e4f9729b00555bfdbf9f6e406132bf3a7fa84d02c351b0da9fbae1f158a11798474d0e52deefc2b5b437b408e1d4fcffb29e08
- SSDEEP 786432:5i/wasjVeBjZ9w2/w1QY117GF9FmwrF13B9JtM0zMA2q5nwOSZQXBX30bvw2PTci:5i/ycJwaMWFm83BVMTUnYQXB+vw2bZ
- TLSH
  T160D7335BEC0E83E7FC942617FDDEA25E425F783CCFCA2AE357598006726A8274974109
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  MEIPreload/CPFilters.dll
- Size 862KB
- SHA256 f558343f4693c151f9416b20cded176e1da4e6ebc133eb526d1dd5f5fdf596f0
- MD5 6b9d1597fd7c350d3cc9e86c76a204ce
- SHA1 a1213a4a4b875572f5ff2d4787cea50e3d350eec
- SHA512 9d83e3e9c3e90d363efa61b7803a607982fd74045f5ddb1fcdbf7af70f4901b3dc6e861fe9d88a867d4c53c220423d9ff09feae8c58bc3852ea4b38cc72efff4
- SSDEEP 24576:prij+VQYnP8DzPZSw1kPAxhN+u2L7KOy4:AjAQYnP8hD1BSJn0
- TLSH
  T1A8156B56EAEC81A4C06AD13DE6E69216FBB23C07170646FB42604B5E7F37AF45A3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3
- Target
  MEIPreload/CredProvDataModel.dll
- Size 573KB
- SHA256 5eb2abd74b415c4f0df6a20358045873c437a146427095493790a431606cc8bd
- MD5 28d0ab27c32de0fc9607e9b7d10b9f45
- SHA1 6c23366a148260f2f80838843dcac7755df9590c
- SHA512 6075602149e08f1926944dbbd53125e8e6fe570e35115c0960733a6aa88ea6583740f6277bc546e82e4bd92e3da712461c65594eba991fd69803f6136bed84a2
- SSDEEP 6144:afmrkwZ3nFLN2zAm8LaJ6zki6wn36qKmurFfO+gt+tjdKMvekjH4J4AINe02EGz:wwZnFhesgiNXn36jBfOZ+tjFbjY4c
- TLSH
  T11FC43B1A5BDC43A2D93AD13CC2A34A49F2B278011B7296CB5252421EDF7FBE55E3D360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  MEIPreload/Qt5Core.dll
- Size 5.1MB
- SHA256 4f8dc460162407cfccb1be6ef9cce45c4449de838aeffa3fd33378f01a3f9cc4
- MD5 7d180286e9c071c7bc3a6bc2ace792ac
- SHA1 f5947d69aeaacc8a378721f3750b049cc41dddef
- SHA512 9b30d5dd48e736da770e71622b79da294829621565cfc4d995ca31c8cfbbbe2d577677f4240e0ff2d995deeeb5f894018412596c141e8360dd77bf12596ce167
- SSDEEP 49152:q1AH+7g4QrRpvOK8Bbl+Gy+/LZsxRFNHlZTlJsv6tWKFdu9C/cPk4VHEYI9CV4eO:E5gje5lCjzJsv6tWKFdu9CtvDhgwcY
- TLSH
  T18746AFA17B57857AE5A2D270C8BA632F0539AD124B1385C7D39C370A4A746E23F3B707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  MEIPreload/Qt5Gui.dll
- Size 5.6MB
- SHA256 80016776efea2b2a838c3ffa4c82e5f146baff68c36073c0c34668809d1c4297
- MD5 5b0f3d5b1b29b5e650375093c7afa243
- SHA1 1920cbc98bd46a3a72bcfb45caefcfa2649a92e6
- SHA512 9db9a90ab5a1a768e079cf9b10f1da868ac7dae774e90e139ee047c9c8fb43cc5b3e01ae3724ea74efd64409eeeafbcda4f04da3e86265575a3831a4fc69cc8c
- SSDEEP 49152:FKUDGaBVW3sDAPNaiCZPcSnt8KQ6oOtA/tiG7WwjrAxLXwQ98vd+hc0WM66fL5cQ:wUKssPdOy/tZWnXThVc5tnB6NDrd
- TLSH
  T15B562BD1F18671B3C962D2BB270F623FA076A956C30483C3C6996E9558743FA0F7B906
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  MEIPreload/Qt5Network.dll
- Size 1.0MB
- SHA256 37275f3ea79d15a2792bf21f71f1df825f201cf8b33aa1f94ca93d62d76b216c
- MD5 2e3db1cd1ec59d08706438258e86ea30
- SHA1 bc20b1e40049386e6bea3f448a6852bc879a8821
- SHA512 0c0e0e02ccadc3f2b3f6c8cbf2c162fb73734b0b244c80048968a6fe268450a270a3f92b155daf6268fef246d26ad417e6cec224133fd66e6ffb3a5394b04358
- SSDEEP 24576:Aul0ktv339DOBVXaIFP698DWk7PVmr0qwjb:A8sJVWAcwnH
- TLSH
  T1BD256C92B786C0B2E84481F5455EEB67E53DB1388B0666E3E34C6FE2D151ED21E3F182
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  MEIPreload/Qt5Qml.dll
- Size 2.8MB
- SHA256 e45f26ebbc2b0499e0e90f1666fd13f1bb2bed1073e828d30b6a3a70599d4bc9
- MD5 7cda5037206a57cadd50b5f032876a8e
- SHA1 314b671b27e9602a66396ec37bdd6e70bb180d92
- SHA512 1450a79b017b4809c83c2fc4ef53df926e3a725959b6e378c5a55c853d2151a2ba70272848962931c58596fb4174601e3defedb120fd0a211d57be9d1908ee3e
- SSDEEP 49152:grHpbRcgtgEgnLDYZeQok3e3QiBMKbjcbKYI1YLTFXrwWGw6cTWptNrSdSG779LZ:ARcgOnLDYZeQokwuT5E7NrSdSG779LL9
- TLSH
  T1BBD58D83F2C304FBDC429274589E6B379932B51903659BD3E788FA8EB6316E1593F181
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  MEIPreload/Qt5Quick.dll
- Size 3.3MB
- SHA256 5f246016691ff883243ee9b3c9215eb16b859b12aefc5f4bbd2fbda3911883de
- MD5 07266e7d049ac4499f34ce281f3a50d7
- SHA1 257968090b95fae67f92f82db9cab1f7613d75e3
- SHA512 d7f9ce2fb11de178d6d38a5580c503c21fed6777067b8a8259f9fe35b44047040b705903db4ed3fbac821806cbd5ca1db0f5fcbec68cdc49282dc0e63a3257c3
- SSDEEP 24576:wLAgn4tj+U6JL9iji/2LzruK/bEdKUEAWzeauejEM5OmTi/bIi6+LPt1rt83FCbW:zT1HZEHr7OCsKbKzVZPXMC0FEUO71
- TLSH
  T172F57C54F2D381B2D881A279186ED7239539B0904F0956DBF3787F4A66322F21EFB385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Readme.txt
- Size 27B
- SHA256 28bf09a17763a4da642bbffa7b24c52f046375003e3d16921fcb6f2a5917108d
- MD5 feb7b672927ed91f05168f2091fe56a2
- SHA1 8801bcbd983228e63d86094016962672ae66f69d
- SHA512 65ef9000dc3f2bc0e6c51bb8a5f5866915bb71b035e0fcf621cf729c5cee23ec875c475130b2d6c7285a5700fa23954aa7f792650c8b44631e811aa7e251bf7f
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  locales/ca.pak
- Size 355KB
- SHA256 6ba3af1433ac46dd5a72eee46a315eeea2ad425b03f1a3b5f797a8a2991cd64f
- MD5 efbbfef96f93a084c8c7a55d5e286982
- SHA1 5eed6c9fa646a1a37cc4e34c741500225ee5f729
- SHA512 914eef7f21e81c06c992a4e13372ad627175704dbee40a0e31464aef998ba8b60d7799d759bc1bef96e64dca7b7bb86e417b9dbedb20f3acc5d23cef349a9e1f
- SSDEEP 6144:at/yu3Km6pZ+qs5PAk4N3Mw2juwYMezgIs3czlE48ao24KPQlqmwWrMWLb9u1RBU:a1P3Km6pZ+qs5PAk4N3Mw2juwYMezgIC
- TLSH
  T1C2740A239BC93B6744C2320ABB46C217F58CA9847B06D294F5AF0B1623CCADCD6776D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  locales/hi.pak
- Size 749KB
- SHA256 e12c0f1aae841103030e077c429db999d0ac47e862e39d43a042b67f232d3edc
- MD5 22459abf3f09d840da94ef312fa9e508
- SHA1 8d6462f9509c62d04ab332093f68f9216cd5da60
- SHA512 2c62d91835d9aa80b8e2c9d9c23164b5294cac028816159b7c042e5f940718d1eb12679e6695b57674691a5cf77581537d90782e18466176cda37a3f5551f594
- SSDEEP 3072:gT3ToHjqnmRhmYbe8P/5yEw3kw3db2v4REm5dmYswDyGR3JT0Ke2/u3+8AwndNTD:gTTcXRojY5+9YEG
- TLSH
  T190F4190CEBBEF3B55DEC3C8A32890D3BD59D3674A3E5521348D5B3DB9844CB4146A2A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/it.pak
- Size 346KB
- SHA256 6182276dbe1a101c27cd19222771636380f163b417f1841ab343351d24cb76e2
- MD5 e5c3755da2bdc72dc82abbfb943e51cb
- SHA1 c299ca20fc6f8df675fb861a0aa64b6512f90e2b
- SHA512 32ff6a4f296d3417cd85e1a6edda48df6eada5e7a3f83299122f5baac0ab6d95e101d3056d99c758e058d33e1b6010d43ea3942ef3c597c72c702b07f4ddcee8
- SSDEEP 6144:ClHnvtQ70j6SrqRRhsO1tGT9T+SGJwN/w3GqwKO+8YrJUmB8tZ9+2joZeYpLOv6k:ClH/ZEP8AU24QJB5RW
- TLSH
  T18F741B36A5D620151A866359E621B081FB6EB8CDFE41721C999B431C23CFE44F2EDB87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/ja.pak
- Size 426KB
- SHA256 38e959f5c548a9b139b46f6243f8baf919cc2951bbadb2d55080b86567830348
- MD5 f0e5da5f828351081d7f116196549030
- SHA1 b669e4ab35119bd735a57c749cd3d9bfee941fc9
- SHA512 b03ea27664d89e4c68e5c36697382abe13b477c137290f4bb79d9fce416b1a5301e6ee372fa7becc4b097ea2ff247833427d64cb729d366532f282a0fb9bb56e
- SSDEEP 3072:dfKEgpwclvFk6xowoHYVwomDDrUIC02DVYENnPkwoILgl9NH7UbeCF5OAgHbFE5Z:dfzjchlLCDrUIC02FNLp5IVO
- TLSH
  T198945F6CE3C969369D6193A22C0E36D17606AC5FFCA23A36442DC074BD70BCEE515AF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/lv.pak
- Size 377KB
- SHA256 9fb6cccd66a0cfe9268dd04771a196a5fc738daf1c2d900b62c3f317ae3cd2a3
- MD5 47976c120e8448f074e738f053487d6b
- SHA1 5919af9ff70004f2b9e6b0a71039f2821cffad1c
- SHA512 5df577bb2cfc817ad5d60b954a12f58637c0e6e0d8e32ac1a8d70c3b96ae088e61cd40099382d6483c93db5131d7c3791d8b6708b964cbccd372df5c66947c47
- SSDEEP 6144:/zJpFhhTtVFoHmjYNK4uCAkapCZ5akDyAh9AxlatuM3rc1V3C:NamYE4u3kRZ5uS+V3C
- TLSH
  T1FD842A659EC68FAA4E505DCB7327D122A9CCD740FE03E112ED7D4B2A510F52432B6EE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/ml.pak
- Size 876KB
- SHA256 32a7beddbf9cb89a71d8ae39a4775a6c4d0019b561c118d617b4f641ae19a7a3
- MD5 6f212da5692a21938bb69d2cbd62d225
- SHA1 f9e574372424ebb8afd2a9871526fb28bf0960ed
- SHA512 91cfcd9b8219916ee34e3f0ec3d4a7c33fe5602deeffe4b4001d4cc489158df7a1b34298dacbfcdfda448142cae1fe4ae00c4b89c29a148a119477419f6ecd61
- SSDEEP 12288:LljBbeIc++Ai7VIMASTKMmWcE+xwbbAujgDl25f2VJ35k++m:xlC++5in25fw3j
- TLSH
  T10415BF5BA035CD3B0FD102257B4E2FABCD5B8FE140AF668B5869B2628C59F7D0C99431
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/ms.pak
- Size 326KB
- SHA256 c1d942082af1be8af656bff280e6f21671f0c5536aee15b68670643c8baec8e9
- MD5 d888ecaf12476f1649dabe9004f1545b
- SHA1 01601799d74c315322bb7a090b1aa59b2b783bfe
- SHA512 c5a2311badd33db72bdfaaa9ca598ce38c8c9cb5389907d6ace963cba497ea74e295b7db9f5d2b37b3b15a86a1c89b85f952a0b054efa0491d7e1054209cc447
- SSDEEP 3072:aWN7kZP6QP1Lo3tvvW4xKn20EBiOrr55hOr4F4V2l+5bHV3ju6cvuBS0Sc60T8u5:amIP69v5xm2akr5ne4F435bHVzb0U
- TLSH
  T1E764C5029EDD3118096843D5D2DE6A1B3CDD3333B705AF268DA08FB016AE7A43756F89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/nl.pak
- Size 330KB
- SHA256 342ba48365b9eaa5cff9034b19568676e2214a16c3f782bcd98a7907e239b357
- MD5 d46b83eb65bc8cc0176813ad343dd95e
- SHA1 37b8d82adb8ab314a0287ec4fb5b084f92353544
- SHA512 1b0035fa4cd5afec64bf79a7ca8b2947cbea5d8db9b6cba7d131f4647f66e6804940ae2f94620609b5d8e87ac472b1496256041df59e54dfbd6e4877c61cd282
- SSDEEP 3072:Iy0Yc4MUiBqTEVpo4UHi4gvYjsCKXBZaK6zuv5OlqmK3OAH8a56Y/lHkB0ja+25h:Iy0B4JYj4gN5cqzxR/ab5eFjb/aEW
- TLSH
  T10874FA07B89E253E59C0B385F6084FBBBF2AD22CC26CEA7D94DDD1351843F5851AD889
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32