8e133a8f9b396f68609753e0d80c56ef9cab44b33349f26ec804c355ca7cfd40

General

Target
VMAX spoofer (CRACKED).zip
Size 7.7MB
Sample260809-g3w33ssckb
SHA256 8e133a8f9b396f68609753e0d80c56ef9cab44b33349f26ec804c355ca7cfd40
MD5 bb50ee3bf3e5a124437b86de6c6d42eb
SHA1 e428a2387869e949356162d7020abad0b4239408
SHA512 0b3a17326fb0a3626205612d2202cd9aa0f38c1f3b14a9a92c63748dd903d3ae3c9d356a25e36d5bd30596c143c231361b00aa64efac921f9dbee1f6a10a6aca
SSDEEP 196608:DTS/5PHV4hIGueCNjGXNWZF5TnDwV4ULHe/drqJcaOpIbGXNWZFk:S/5PmuZjGoZoigHK0JclpIbGoZC
TLSH
T1C8863303E0624C460E3FE0591CB2605696AE81795F9342A9CDA1FE6C8F72CD4617F6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VMAX spoofer (CRACKED)/Cracked.exe
- Size 5.3MB
- SHA256 365886ff3092bdd2348411178235acf99f3d8fd04b665f8897bc61daccd2d2d9
- MD5 5ef2d394e5ef37a67a63514cc7c93a77
- SHA1 34cf6b392950c8911979bbc73e54a90f2e00f9eb
- SHA512 a8cf3f7b33e248ff82b5cfd417df4746643aef8eafcd32a804fa6590c5f0c8072cfa4d19496f5c4cfc087196b661c776e54bbd14f4a7e817bc83b7c7043d55e2
- SSDEEP 98304:GMXvxYGLeo2GBwpa5u/ot9du0nzwWbPiE3G50KvfioaBOfdP:xxYGLeo2GBwsg2du0zwWbPi6S3ioaUf5
- TLSH
  T18846F10673A40598D2A39238C552D733E6753C449365C2CB17F0AEA3BF636E26E7A7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  VMAX spoofer (CRACKED)/Original.exe
- Size 5.3MB
- SHA256 8c361fd1870f3ab37be1229ca34d7f1d9d52049cf0a755f396dcc02de1a7009d
- MD5 a8ed04cac2748ad1daf74d9dd44dc099
- SHA1 ac7d0c25380bf6fa385cc7e13b023d808ec10517
- SHA512 1c210d5b05c9c247062481047889b05c58b2df453936f207e67518853206662acb9efd3690c93590485cd8065088bccb9db1359118dbb072368b3f015ca73b9f
- SSDEEP 98304:GHXvxYGLeo2GBwpa5u/ot9du0nzwWbPiE3G50KvfioaBOfdP:mxYGLeo2GBwsg2du0zwWbPi6S3ioaUf5
- TLSH
  T12B46F10673A40598D2A39238C552D733E6753C449365C2CB17F0AEA3BF636E26E7A7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

microsoft defense_evasion discovery persistence phishing privilege_escalation ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Detected potential entity reuse from brand MICROSOFT.
  phishing microsoft
- Drops file in System32 directory
behavioral3 behavioral4