a2d2aa319f6ffd83c816e1d9fb2b0c7e2b3786dffde5fdfcc84fce7e4cddd702

Sharing

Copy URL Twitter E-mail

General

Target
win_2k3_2k8-14.4.8.4.zip
Size 8.2MB
Sample260809-wvsg9atbnb
SHA256 a2d2aa319f6ffd83c816e1d9fb2b0c7e2b3786dffde5fdfcc84fce7e4cddd702
MD5 955a409896a43b7a500bc1115c309328
SHA1 61ca44408c78ea4dcb088c01c6259be93f050605
SHA512 ccb88fe02242ac67d197383b012ee4af18b3a968af2f7e91a7d8f8f0f7a4ab63a604402c749cc0ed5c11b72612267ba773e7a5bd464529927e62fa9b2dac77a5
SSDEEP 196608:wxqp9u9aQd7JK6eo5yzjGEN7eqA441TkZBNxNc2P2eNY:wopSd746eo5yzjne5VJYBLNc2P2eNY
TLSH
T143863385F61E4E68273B1FD3A227669FBC8C354CE5742488EF850B2A472D5D50CA0EBD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Server/W2K3_W2K8/DrvInst/BDrv5706.msi
- Size 2.2MB
- SHA256 c93bf45510ebc3512320152d0608c4bddecd14dfc0da952f8ef4372875f9d75d
- MD5 20c1120f086918b8eb821cb01ef73a96
- SHA1 03f926e0eb8eca903fb3469141be27ee9ad4c76e
- SHA512 c8fabec5c7a82c9ceb394a52e8d0b9a4318298a89b28935889e01727933879c75d2ef0c0d0adc28f51454327803bd85b0ee154d3658a487ef4543409f15ba99b
- SSDEEP 24576:K3y6blFNjiH1QsQrGdvqFE7fombxrKwE7XCTmeFdYydp71:K3yClFNjiH1QxamKxWwgWYyZ
- TLSH
  T1F1A58D21F281CC71E1861AB4186A87F649347840AF7186D3B7DDEFEDAB7AD44923E704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  bxndcox.dll.F935445C_34D7_444E_8A17_CD3E66853B72
- Size 37KB
- SHA256 911f58d84958f306ee07e09ba1b53d940b274db4ff0ebf92225621f4fb0bd408
- MD5 20b5b8c94b64c960ac3738c015b13f70
- SHA1 b4799f77e515f4c7268d0f86fb7af873f99abb4a
- SHA512 b4c3fbabeb611396adc0a8765056e9faad05b0e76176ea0e796db2ec1e35b62bacdf391504b6e74b71062d6be38c49b2d398c6413dfe94f53489e751d5a68cc7
- SSDEEP 384:e4ey0d5ef1grXyXk/63NOWYf4h9P6MbSuh3larCw/ZOpJO74X4ey1fb6Bvm/KWqt:e4eReOUNPu4h5PLNsS4ey6vm/dn8QNk
- TLSH
  T1DB031B52ED9480B5C4D61A7518AE736523BD7A200B3784DF136237BEEC36BC199313DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  bxndcox.dll1.F935445C_34D7_444E_8A17_CD3E66853B72
- Size 37KB
- SHA256 911f58d84958f306ee07e09ba1b53d940b274db4ff0ebf92225621f4fb0bd408
- MD5 20b5b8c94b64c960ac3738c015b13f70
- SHA1 b4799f77e515f4c7268d0f86fb7af873f99abb4a
- SHA512 b4c3fbabeb611396adc0a8765056e9faad05b0e76176ea0e796db2ec1e35b62bacdf391504b6e74b71062d6be38c49b2d398c6413dfe94f53489e751d5a68cc7
- SSDEEP 384:e4ey0d5ef1grXyXk/63NOWYf4h9P6MbSuh3larCw/ZOpJO74X4ey1fb6Bvm/KWqt:e4eReOUNPu4h5PLNsS4ey6vm/dn8QNk
- TLSH
  T1DB031B52ED9480B5C4D61A7518AE736523BD7A200B3784DF136237BEEC36BC199313DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  bxndcox.dll2.F935445C_34D7_444E_8A17_CD3E66853B72
- Size 37KB
- SHA256 911f58d84958f306ee07e09ba1b53d940b274db4ff0ebf92225621f4fb0bd408
- MD5 20b5b8c94b64c960ac3738c015b13f70
- SHA1 b4799f77e515f4c7268d0f86fb7af873f99abb4a
- SHA512 b4c3fbabeb611396adc0a8765056e9faad05b0e76176ea0e796db2ec1e35b62bacdf391504b6e74b71062d6be38c49b2d398c6413dfe94f53489e751d5a68cc7
- SSDEEP 384:e4ey0d5ef1grXyXk/63NOWYf4h9P6MbSuh3larCw/ZOpJO74X4ey1fb6Bvm/KWqt:e4eReOUNPu4h5PLNsS4ey6vm/dn8QNk
- TLSH
  T1DB031B52ED9480B5C4D61A7518AE736523BD7A200B3784DF136237BEEC36BC199313DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  bxndcox.dll3.F935445C_34D7_444E_8A17_CD3E66853B72
- Size 37KB
- SHA256 911f58d84958f306ee07e09ba1b53d940b274db4ff0ebf92225621f4fb0bd408
- MD5 20b5b8c94b64c960ac3738c015b13f70
- SHA1 b4799f77e515f4c7268d0f86fb7af873f99abb4a
- SHA512 b4c3fbabeb611396adc0a8765056e9faad05b0e76176ea0e796db2ec1e35b62bacdf391504b6e74b71062d6be38c49b2d398c6413dfe94f53489e751d5a68cc7
- SSDEEP 384:e4ey0d5ef1grXyXk/63NOWYf4h9P6MbSuh3larCw/ZOpJO74X4ey1fb6Bvm/KWqt:e4eReOUNPu4h5PLNsS4ey6vm/dn8QNk
- TLSH
  T1DB031B52ED9480B5C4D61A7518AE736523BD7A200B3784DF136237BEEC36BC199313DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  bxoisco.dll.F935445C_34D7_444E_8A17_CD3E66853B72
- Size 69KB
- SHA256 5097a77340e15fd2d81061d9efce904fdd869da4b8fb9c0c8bdaf7ab606700e7
- MD5 33d9bd52a5ea4adaf0a4ab1e2c90b1cd
- SHA1 8cef1068b4dc34cc641aee733c59e4abd84bfe46
- SHA512 bb4a73e7aec368536ddab8541d30999e3329a377b9395b98305a22078c2f5a94b9a92c34832b02a03b21441d8450d203a8cfc1e65110dc3dc88324e929ed34e3
- SSDEEP 768:eifldZm7vAxhj31x3FJc+xtUsIRUO78RuJQREHnwZLGtSecI2vHXpAw6XsdbQOJ:eifNFWCOgAQR9ZytSemvF6XQQe
- TLSH
  T131633A3176D0E6B1C5D721B4A28EB77612BDD1B00BA065C7AB160BEDEE747C1AE30247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  wdfcoinstaller01007..F935445C_34D7_444E_8A17_CD3E66853B72
- Size 1.1MB
- SHA256 bcf6fbbdf1ad402dc761f87d79688c9b81aa70d63b835fc6618fc8e0686f39f4
- MD5 81d9bcceb78795cd0315b24960f2d130
- SHA1 a697a3d09e3f9d0ee69df229d14e7e9ae671829b
- SHA512 0107bab9c18d5227dfc8734f27b7f9ce4ada9e9c79f85ef85bcb80ebfae593b7d65a834ec3c3b50ef89a5f466eef98eb4ffddece907cb50f7261272b9482631c
- SSDEEP 24576:lqP9bArz7F+ET/IbCLvipNz0hOERdNhpjdESl/T:yArvbaN9E7Nz+4
- TLSH
  T17E352251A7EC4964F5F32FB19A7EA6922A7DBDD12E75C08E6248895C1830F84CC70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  wdfcoinstaller01007.1.F935445C_34D7_444E_8A17_CD3E66853B72
- Size 1.1MB
- SHA256 bcf6fbbdf1ad402dc761f87d79688c9b81aa70d63b835fc6618fc8e0686f39f4
- MD5 81d9bcceb78795cd0315b24960f2d130
- SHA1 a697a3d09e3f9d0ee69df229d14e7e9ae671829b
- SHA512 0107bab9c18d5227dfc8734f27b7f9ce4ada9e9c79f85ef85bcb80ebfae593b7d65a834ec3c3b50ef89a5f466eef98eb4ffddece907cb50f7261272b9482631c
- SSDEEP 24576:lqP9bArz7F+ET/IbCLvipNz0hOERdNhpjdESl/T:yArvbaN9E7Nz+4
- TLSH
  T17E352251A7EC4964F5F32FB19A7EA6922A7DBDD12E75C08E6248895C1830F84CC70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Server/W2K3_W2K8/DrvInst/instmsia.exe
- Size 1.6MB
- SHA256 267304efcc831e35927c1f25d610d36fb64121d108a6f4ff0168c53df01e2b16
- MD5 43f7305c2e5dd4a8f3c5abeb2ffe4833
- SHA1 03bda624ab7f0d7cb9ada41a960c35c0152f98fd
- SHA512 e24072f1b5b102fbd52126396854463ff07d8d0efce1d922ed99acd0369cff163e415abc1faeaf559ef7898e5f82945db544a0f425db0db42696282d0acd7c7c
- SSDEEP 49152:Ru0LSVHASxN9aD7sOP93ZPaZRNsa95ZN5T:o0mVgSxa872av9
- TLSH
  T16D852382DBE94632F0351B7558F6232B3B347DA95D36EB2EAE43008518735C4A5B4B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral17 behavioral18
- Target
  Server/W2K3_W2K8/DrvInst/instmsiw.exe
- Size 1.7MB
- SHA256 b93fdcd1136faa9a8cb73a329b2f1f5f430a150ddcec35de916e3a1539f09351
- MD5 61a5fb191ae2ae876db31dcce75e4183
- SHA1 751669c38b666c7435b2a65a5c6fe40435d59aaa
- SHA512 76ed473ff370255e7b09a931c10e1aea7d9d84b4655d85e9ad28faa5f143bb9063c363829a28614fb89cd00c4755e825268123e5f6f4849a0db9328297811ffc
- SSDEEP 49152:OFxErb1F2gqQF6d8RrycC51DtuoIwgpXIfWzbnoP2qDAV:2Gb1FLqQF6dWry//DthQiooP2qDAV
- TLSH
  T121853342A7DE453BD0BA1BB0B5F91A637BBA38D0ADB6F76C3302494408316D14D7936B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral19 behavioral20
- Target
  Server/W2K3_W2K8/DrvInst/setup.exe
- Size 621KB
- SHA256 4c60d55da2e93c0fedbc991cf97e3b912628de359afd06d3347c30cb0791f846
- MD5 64c8de941312ab23b904026500a2982c
- SHA1 628f439ad8830294fb9ebc1db953015e59635490
- SHA512 b660f49aec09954e82ba47ad515d46dd9a9fe12e9a870588b06021a3ce416bc4a9d6a2e8ad788fecdd5d3afbe93ccf8c86b34e0232bba580e56056319260fde9
- SSDEEP 12288:nGRDU5ervjUo9BEgfYoIpKYSc53an9lpGN4VGtTRIMFYtmxGF9jB:nGRmervjUoDEgfnImcJaBhotTRTFFxG9
- TLSH
  T123D48D123DB0C133E56280B0D99E9B78E6F99C714C25888777C8A91D6DB2993D72372F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22