b79bbcbdf89bfd3b3e3f6c0685af0de5e5d0370ec5f7fb854b865e2da7bc7b9a

Sharing

Copy URL Twitter E-mail

General

Target
unknownzip.zip
Size 47.6MB
Sample260809-w168latcpg
SHA256 b79bbcbdf89bfd3b3e3f6c0685af0de5e5d0370ec5f7fb854b865e2da7bc7b9a
MD5 e88b06b7115913fdc712363c8d65b630
SHA1 2e7c832f6a94cee8e1092c1fa5ad259b15103a3e
SHA512 57465c477bf7bec41e02f0406244a7f2ae35d9a716d41f9ad8fe71b9d85d46e1f56558f375002afb52cb6d510d5371a1de4ee3d4a8b9333f443d10045e7a85de
SSDEEP 786432:R+2e8AZsBOq4QCN9jgnXHCrCHpbpw6c4Ieii/MG5BFOQbbK7UmlO3OkHp8aT:R+25A+OZQCN9kIC/w6crt0MG5HHwqT
TLSH
T14FB7331158289AF725E64DFD02C50C0CE8CEBD69379E07856398B73BA99313855C3EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  unknownzip.zip
- Size 47.6MB
- SHA256 b79bbcbdf89bfd3b3e3f6c0685af0de5e5d0370ec5f7fb854b865e2da7bc7b9a
- MD5 e88b06b7115913fdc712363c8d65b630
- SHA1 2e7c832f6a94cee8e1092c1fa5ad259b15103a3e
- SHA512 57465c477bf7bec41e02f0406244a7f2ae35d9a716d41f9ad8fe71b9d85d46e1f56558f375002afb52cb6d510d5371a1de4ee3d4a8b9333f443d10045e7a85de
- SSDEEP 786432:R+2e8AZsBOq4QCN9jgnXHCrCHpbpw6c4Ieii/MG5BFOQbbK7UmlO3OkHp8aT:R+25A+OZQCN9kIC/w6crt0MG5HHwqT
- TLSH
  T14FB7331158289AF725E64DFD02C50C0CE8CEBD69379E07856398B73BA99313855C3EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  AllServices_module_v2.0.1.exe
- Size 34.1MB
- SHA256 1d2fb3885e22a2852b8e18a9337bb1f7de986c19f6f2c5b5067c4ce5023fb041
- MD5 87ed2118ce7591847c9fe270ad690add
- SHA1 3ee345ee8230170aecd66861d44d34344b336f72
- SHA512 0a19f6284142f250dc17d623c01c68598cb0a2800aeeddce9f1a7ef96de9aafbcd20e956411e29ec733ffb1cd588d76920e9c278b6fc798e66b0d235a5495d7d
- SSDEEP 786432:pFqyuMARGZWEGSwRHrSpMbxsRqE4y6fSUxGqB:3qyDAgWvSwRHeCE6fSUxG
- TLSH
  T10D77239364D453E8C6C34900928E13DA52D1A57E8DDF591D2BC73C026A31EF39A89FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  Emulator.exe
- Size 15.5MB
- SHA256 0540e3b345734176401465ab3fa2dd7667d6e623beaf8925204a4fca94738f36
- MD5 1fce56726e1677d4912b98ab2ad98a31
- SHA1 1adae7b411e79b25bf1cf839692e1d830a651d63
- SHA512 1e463ce33c11254fa3c0fbd5c8ee2b3e184a14e9b782a856f6d57a277fb184de4fdaaa7e026ed1fe747063f37d3c3e80f43f1d6640dc8b31d4ea1d0cc5fa94c2
- SSDEEP 393216:RRfm+I/yr76hdZ+XMCHWUj5zOrPwyLLvkXEyu0Om7A4sC:3mfa7KZ+XMb85zivVml
- TLSH
  T1AEF6330532B150F2E9F7183941DAC528E67A7C6027A1CACB86EC5B327D674F09F39762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral5 behavioral6
- Target
  Emulator.pyc
- Size 8KB
- SHA256 b88b44dfcc911afa844722a2593387b53e1ae65fe6ec18a93d2d422855e3ab03
- MD5 06b2113e57a3d9171d1aeac4c8f1d60d
- SHA1 917804ef18d4d921f881dc192c0566269dc884bd
- SHA512 8cb0be08e2a064aa6dde1e2a5a8b3a113d7df3e783538dd1084e538e1495499f80441a4ffac778832d94150a26f28741dfd191e35fa34a82a50bdb70d81342fb
- SSDEEP 192:CFYM6O9wGBP2dKiNM++UX6q0tfPGrfl3kYRS3wik73KCP1W8J:Cuw9w22dKiy++UKBsN3VUgik73KCt9J
- TLSH
  T141020782B59B82B9FC85F372A0772F686B5042D0B5D28748FEE65CD00CA37708EA515B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  How to use.txt
- Size 93B
- SHA256 db05915058ce0060d975268da3e87c4e45952ccecd016f0c42bdeb2406e125c4
- MD5 2de55eca84f69b7511e2095b75babff3
- SHA1 179c0ccf90f87e3725e2b124495420440d50de8a
- SHA512 c2283467bbaf09d5efaa8df411128be3d037667b81f8b3e7021f4f9bdb4c9ad9feb38cc7e105ceffac10acf98b392e28c9a73e24483830a075b9641fd5a2a95f
- TLSH
  T156B0126F16D123332C0006140ACF42668001110D0CD7631020428368700894AA5C00D5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  launcher.exe
- Size 237KB
- SHA256 14663e375d5e067e9ec18643926d9c9a38c4e9ec7abc7bde651c0d2a269cbbc4
- MD5 7b6dc47609df02c44422f05f5b0879ad
- SHA1 2454c8034c9ea6b0d8845e5ce71acdb91d610c8d
- SHA512 c7520512c7be7216f8db1f6a03c9496bfa48cf347affe3739af6d0cb8daf60799d0d9ce8c202aca93d273765dc2aed493638307d0ec1a9b720415b6e515bbaeb
- SSDEEP 3072:YiW9fG/DPZaWbtwEoKoEH5JmSKKxph0LR/hSMXlk4ZqKFya5XB67TTtz7RMFyLnu:hW9MsK/730Szph0lhSMXlBXBWnx7RMU
- TLSH
  T14A34AF12F7A6DCF9E60886B588570B44EB337C808382E7CF175499925F679D25F3BA02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12
- Target
  mkcert.exe
- Size 4.7MB
- SHA256 d2660b50a9ed59eada480750561c96abc2ed4c9a38c6a24d93e30e0977631398
- MD5 8ae03fb0741d036801add750b5528acd
- SHA1 4333e9a5b314f2395074ad16d76c30921902c60e
- SHA512 e7e17f3fd77daa704f88ff4dc6a22795ce0dc18b5db980bb2e5dbe823ca84f54ee8bd81e5e3d816668e4a841e53cb2bd487939e6ad805f5866926d6ddfdff086
- SSDEEP 49152:TGzxo43OrdQqXrb/TRvO90dL3BmAFd4A64nsfJnTTx5hFBL+bwmUZ5EygKZlbjIs:A3OO/JLxEclEk3nTsFk+Mm/MN
- TLSH
  T1DB368D03FC9590E4C5EAE1308A75D292BA717C884B3137D32B14BBBA2E76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  payload.dll
- Size 166KB
- SHA256 3623c9f52b5915747e31f3bae7b3480e764bd57cc26f42d4fbaf0f3b8b7b0a8f
- MD5 08217e9e638bc77f0c31dd231022f195
- SHA1 e7139169b21a6f6e3bfde97d20b38dd6aa71abbb
- SHA512 da3e4f78b45409b95a494e468d7dccb8ed2aa4addd7fe0b678b88eb4c8c2e92fdaeb85a6bf105c9cf0d71f72fcbc26e4a84cf68515de7d06c69bf499cd0a350a
- SSDEEP 3072:UR7C6goA5oF1fTh3Fg0gIGZuVtFPLKSCgcDea:CCb5onr000aFj3a
- TLSH
  T164F37D16F6BA407FE9678534C9530905EB727C835790AAEF53900AF65F2B7D08A3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16