e6928c86a523416eb374c5ed97b75a9aaf9c418c536aaf6c257aeafd33b4a063

Sharing

Copy URL Twitter E-mail

General

Target
vv.rar
Size 6.2MB
Sample260809-wvrkystbme
SHA256 e6928c86a523416eb374c5ed97b75a9aaf9c418c536aaf6c257aeafd33b4a063
MD5 007769935904aaa950f755776ee172d3
SHA1 b686407d14f5856b480758bbb2dded1cc5cbf801
SHA512 be6b32aebf4683db61f9b1ed6bfc91ad4387f919b1e237451d32999b6a752d2e311e54abc6aa794155df8434eb82c5f11c63e12f5f5e6441ca5bf1ecff608c16
SSDEEP 196608:/9BrmMmk/0ODFPEOR1I9pN9x6h8ysx5Gi:jmMf/0ODdBI9pQ0z
TLSH
T1E1663342FE137AC8BC142CA283AB1751651EB6A418F54714B7FE06F71A36E419892FCF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  vv/fonts/fontawesome-webfont.svg
- Size 433KB
- SHA256 ad6157926c1622ba4e1d03d478f1541368524bfc46f51e42fe0d945f7ef323e4
- MD5 912ec66d7572ff821749319396470bde
- SHA1 98a8aa5cf7d62c2eff5f07ede8d844b874ef06ed
- SHA512 4f575d52331de91a2e32cc3408dd0eaf0cf25b7244d34b226314e3647e85ce284f86e3b7238c6c8b9022dc4e2787bf51620849290cdcd5d4c4bc905f289d2156
- SSDEEP 3072:PLac0AVfCwGzG8LY4kh53s0eOnz8WjKAOvX7LYvglcD4ZME8xYWDQqJpFDBl4qjm:hCG7bFv9gSS
- TLSH
  T17594C96CE9910B79CBDD42D5957D0E90132D81EE28783E1846BEA8F05D06B2A0FDFBC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  vv/fonts/glyphicons-halflings-regular.svg
- Size 106KB
- SHA256 42f60659d265c1a3c30f9fa42abcbb56bd4a53af4d83d316d6dd7a36903c43e5
- MD5 89889688147bd7575d6327160d64e760
- SHA1 de51a8494180a6db074af2dee2383f0a363c5b08
- SHA512 c2e77eab327af1469097c31bc0daf820c066b0222059d8ff0ecebca974b62b7535e96f1f356643b2b62763a924d040e4ac9b2097e1de2c22226411fde8723743
- SSDEEP 3072:jY+spjSP0yD4zOPqGGUG0kSnouoxvKDHkPooe4Pqo0CjmFIudsqi/CWEI:kRjSP3D4wlG0kSnouoxvKQPooe4Pqo08
- TLSH
  T130B30F1CE9940B709BDDC3A25B75AE54231C418D72303CD04AB9E5E0B99BF694F8E9CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  vv/fonts/linea-arrows-10.svg
- Size 33KB
- SHA256 3022aeacbfb8f5fdb7ffd49fc2cfa47ea950fc8f6afc3a7fcea0784fb89ed173
- MD5 839102e05032bae37b076c3c44c951b7
- SHA1 a4495702842ef1999f8e68f9d92cb45bb249d07a
- SHA512 69e2a155d26f6edfa9cf12a2ee76c078a44e6554704a64b4cf095dc82c0765d6aa7fb833ca94db45e2b6d7f7172d39ac167809831e2748b91d39aba0c52a9fec
- SSDEEP 768:ThfhSbR90KcW0jWR5HWpUQ9fXk+I1BO9vXM+mAPcwf:BkH+TX9I1BO9vXM+mAPcwf
- TLSH
  T1D5E20053FA4975EC23CAE38949B9D09A0B2DD1B7303666565CECD9F4820F226CF87C94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  vv/fonts/linea-basic-10.svg
- Size 46KB
- SHA256 253997c73786a08e68f12d23ba17037c234558ec43230ce72a4f40fcbc7082e8
- MD5 177764eadf43efc393ebb98329a774b2
- SHA1 d0b185407c23e44284bbbe8d14cfcce88d9e3b76
- SHA512 e650e41ea66c5a1cbaabc88e3b5a6ee64fc7647ee091e611e82f9625fef6a068a7b674c7e475ccaca6d8b4efa19e3f38cd50e4dc1f733cf3e64e2ae24a502244
- SSDEEP 768:Td/R2xXk5TwaRHUMieqBUV4wrf9YVQ9OfKZ:p0Xk5saR0ZeqBUxC/CZ
- TLSH
  T113232421FE9D71ED2687A38C497880A60B1CE2D631365B57A95CD9F0D60F326DF8BC84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  vv/fonts/linea-ecommerce-10.svg
- Size 36KB
- SHA256 2af15c424b1ba8973fb4615f055bd081918851ffcf3cb97fb1d772a9b362411b
- MD5 86d8ba2ca6a7c6fe44422fe6a4ff5831
- SHA1 fdaef713a082c2eca5bbc21547e2b54a60541007
- SHA512 66827ad9ac51baa76870d0c5d90220414f049728c852f92fea3cbc507581ff0fe4a7863615986dce8cd7f0326b6f4f5567822061a927aee929c2e681990980ab
- SSDEEP 768:Twc/cmyOfOgO5OxOPOWOWOuOhOlfOGGIqRiBLN8ApF3kxLA14MK:krStr
- TLSH
  T1BFF20121EA5AB5DD338A538845B4909A0B1DE2D231252B1175ACEAB1EB0F717DFCFCC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  vv/fonts/linea-software-10.svg
- Size 31KB
- SHA256 9ca6f1b8bee8d190e2719469d8752fb3f8211aee571c95cefaa81acf2c670e9a
- MD5 6cfc5077a8ac9e581ef5073468740daa
- SHA1 7317cb55dbce4f063c2ac68a2fc976dfbf97eb0e
- SHA512 1beb65981d71bbe1927a106559f5b8e851201458fd00d962c05fbfa7d7f21e6083b3bd1b8bda7761f71d0ff22ebcedefa5294570b8c39748782cbada037eef93
- SSDEEP 384:TI4i7zrZHLaP05Gu/Y8y8b88IwQrcz1fWdOT89EXH3Tt:TIzVHh9/VIwxIOJXHjt
- TLSH
  T1A2E2AD70FFDD72ED168A624D49B8E0AA061DD2D7303D1F82A95CD5F4D60F6268F8B884
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  vv/home/index.html
- Size 4KB
- SHA256 ee278c85f5a8f5e223abafca5bd48cea4ff53e8e4d3818c6af931b4767cf8de9
- MD5 52c20a3402f23119ed6103485801b4dd
- SHA1 b9403bb8116b2b112033a2b5213a13ffe8a2d8e9
- SHA512 7abd7475e38f760cfa4cd6a805a15bb184a31b18b911dc0c6eb16fa106e6e84b3ecc18a169330796d576c95f167f8f2044527ebab57786bf1adec6a610c50d0c
- SSDEEP 96:iJVhuQFs7tO3ESVsUaF7to2AlSp6d7KdOShNUHF:iJVhFItO3ESV/aF7to2MSp6d7KlhSl
- TLSH
  T17991FF217D9DD0BB003382CB0136EB18D46FED75EA23D815F6F807771BD0E18A882166
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  vv/home/js/bootstrap.min.js
- Size 43KB
- SHA256 8fe5ebbe44388c9f7d1e3d2924a3ebea4d110a0c430d24ecdcf06a2eb5f610c7
- MD5 31bd1c00779daba3350e648fd9bb8d2a
- SHA1 85b1855486ca0b6dcf21204e79e202ae3c936c74
- SHA512 00aaa332f8fd59870cf2ba70b3203c8b3a841465e696bf91920802980d06af552406341664a0be36955c43a6183e094d4a92e4a356f896b35a045f2c03077564
- SSDEEP 768:5CfDbttZvWob/vERLV/4P/9U7tGd2L2GkUNLBpM4QhrpYLfyREXR+rL0zRdiWYy1:5Yn1WkueuLL2uNLBpaBp8fyqB+rYzRvl
- TLSH
  T12013A849725474A206DFA475923B420BB33A689ED60980BCF59988FD3D7CD883277F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  vv/home/js/dd_png_min.js
- Size 6KB
- SHA256 cc288114d2ccfcb8afa5f3ed703c200b68212abbd689fae2368c010b26c1d69d
- MD5 e20f6196959f6f7c5930651abb168a55
- SHA1 82ca2160867473e10201da9f8c8e18d9f4381a48
- SHA512 b15312e6b66332368d25060f169e3e37db4402b4de59786fcaf069e30317b5acba1b0691e872f97e52b3f2b77ddb8bb787cad0dbcdb22745f186819f0ad08502
- SSDEEP 192:owokIf2iY2MhU7SJSMhcU6GoT6krSwwZEdtLsMi2oph/FUKf:Gf2T2uU7SJSMSU3oGvwwKdtfHoz/CKf
- TLSH
  T1DBD1D8286980213F93D7A2D5347B51473E717468D1714BA4787EA6F2F228DA9303FB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  vv/home/js/index.js
- Size 21KB
- SHA256 682c69b73e8a104a101598ca0db3d3e7c3c20c8bbab3daf7410c62c071df589c
- MD5 73f69ba40c670b67b3cfaabe058bb2fa
- SHA1 7f084e1fa834e9de38cc0026ae3b132768731f5f
- SHA512 c22fafce3710ad4c3b4580fd266d14aaab2c0bddebd72a1ca1be1e47d6067be6642c000259fdc2dab00291d795328e86902c601c5f32ca7ee316b17d798d2ed8
- SSDEEP 384:+jHxWgYAcgiYGqKLnABph/HPf/7Xz5ARMZpYhS:ac+ZlO0
- TLSH
  T1A2A23188B3CC2436D186F26A6D2E4CCC533E747A2C894C5FBD8C84F45C6583A9679E35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  vv/home/js/jquery-3.1.0.min.js
- Size 84KB
- SHA256 702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
- MD5 05e51b1db558320f1939f9789ccf5c8f
- SHA1 c72c1735b4d903d90dd51225ebefb8c74ebbc51f
- SHA512 ab3ad9a98fe431508461ebbf8029bc536f34d16cfef8b4c62b8a62b56fe2b30a426e3c3186c994c2578bd585da1c89a9b421c6d2f27053b2f2ed13b0dd9428c3
- SSDEEP 1536:3dhEyijTikEJqRdXXe9J578goJsWXdLVhNLKz4DTAjnWotoZqwsRmKKH7UggYiTv:2Qcd5hNLxTwn3t0iUHiTDU8Cu5
- TLSH
  T14383E6D9B2C670529B7730B850BF450BB17A98DAB44C8DA0F068C5D47EB4A8D907BF2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  vv/home/js/vendors.js
- Size 96KB
- SHA256 0ffc9aa0938a4c709b76b288c2505c8e0fafa7b2b4803479918636c5b4be36db
- MD5 e8294e09c8597f9ca450c457cf4773b4
- SHA1 5e628837e706294b33c1eec90a10fd82ac1a0ef3
- SHA512 06fef61643ceb99b2c9e171ad4ac98551c49bb3d8a690f1d366fdf0c2eb33b8f247d24502a438bfdac94e0f309d593020ce05f7ce70d08ac966394ace5baaf2f
- SSDEEP 1536:fKFEkTfzJh6CiCQCZygdH+/1foZxdnVuqDHgNBr+WZi8U9caYXBoW5PilGXNjEP6:yXrvEM8rkeap2azYLTdH
- TLSH
  T126A319DD7AC5B02247BB30B900AF910BF276599D680C8510F124D8F9BC78A99927BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  vv/images/start.bat
- Size 226B
- SHA256 78c38dc2d027737d20e0779662a13705eac6c9e951df96a3707ad42627dc45e4
- MD5 07b35c0a9ce1f7c74ca1e5f5c92a75d7
- SHA1 dbe095fcfed9e78f45894e13712d97501db7ae5c
- SHA512 75908dc2091a3a756677ce3535e0159f63e73d01c884d0ebcaf73bc1813f86d8e422a366e4ac62dbfadaf9a2e6ad2a616f6bb171a7360847e10640f84072c07b
- TLSH
  T19AD0C9265E6244A72CE44C83D9517E5FF695B45CE0296258A2097E1E9C8FDE2F6C4004
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral25 behavioral26
- Target
  vv/index.html
- Size 14KB
- SHA256 d9b9c0865603e7942861164e0c835bac4efae891e9a20e32e04d46e441ff140f
- MD5 76ffb5df54a9f99744e9f62095e16148
- SHA1 b5efaa4e74c78be475c9f4e755c3306b092b0aa2
- SHA512 0219063a3cc4bc1ec9a960fd9f9e3600d0d9ba5e61100dd9177fc961818b01036f1f22bf53ce79bb74951f516f1a37c9d276afe81271e053e7815bf7c8a64e86
- SSDEEP 192:MLiN3/2mdQqxZm11TG/v3duLRWAbhBT99WV8KsFSsoujIwKQ:MF7WAbhBT99WVjujOQ
- TLSH
  T14562841598C19526413346DAE2F59F28EFF1520BE205489431EC1BBFAFF9F986803DA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  vv/js/1.js
- Size 140KB
- SHA256 648c2d3ba53961939b3f14dd6f56210d3d647dc68706a19cbf2dcdcdc2f6f667
- MD5 3dc80e816d69a1448754d42c3e178ee0
- SHA1 f193ee83083a4ee9ef4789588398a9b8d0570726
- SHA512 7e03a11fa276ceb34f46cf52832985d955aa4055c4899ad96d2941d4f79bcd864b25159fe22c315dee7980fd8d006d90ec83a85c3213aabf55b4fa582d12a525
- SSDEEP 3072:w/+cnfcgJN08iIfFDwlMHqa3aqRT1w1+enG0wAOmSnX:2nfcggIfBD1w1+enRwAOj
- TLSH
  T1E1E354D4F3CD64BFC686B326D57FC449F07EE87A92A484BAB4CCA45078A08048776DB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  vv/js/bootstrap.min.js
- Size 43KB
- SHA256 8fe5ebbe44388c9f7d1e3d2924a3ebea4d110a0c430d24ecdcf06a2eb5f610c7
- MD5 31bd1c00779daba3350e648fd9bb8d2a
- SHA1 85b1855486ca0b6dcf21204e79e202ae3c936c74
- SHA512 00aaa332f8fd59870cf2ba70b3203c8b3a841465e696bf91920802980d06af552406341664a0be36955c43a6183e094d4a92e4a356f896b35a045f2c03077564
- SSDEEP 768:5CfDbttZvWob/vERLV/4P/9U7tGd2L2GkUNLBpM4QhrpYLfyREXR+rL0zRdiWYy1:5Yn1WkueuLL2uNLBpaBp8fyqB+rYzRvl
- TLSH
  T12013A849725474A206DFA475923B420BB33A689ED60980BCF59988FD3D7CD883277F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32