938e06137b461ee95153e858c70fae2609611d30d6f9fbf9ed48cd74d4d6c378

Sharing

Copy URL Twitter E-mail

General

Target
bunnysense.zip
Size 110KB
Sample260809-xk4cfaca34
SHA256 938e06137b461ee95153e858c70fae2609611d30d6f9fbf9ed48cd74d4d6c378
MD5 0621ab26737986958ecca03985830d06
SHA1 bfbf9ba1f8c11206f1572b792085adc2d7dd07ba
SHA512 8053a991dde9b68554e6f64d76dde48f87f28013b38acb1bc79c120d275018945e0b627dd4cf45b730eca8f5d7fcb04d1457cd8b09f3ef9e04cafe8c98d675ee
SSDEEP 3072:XD0uN1h4yh8t+zahf3tUH5F87dMgJEuV2o:ouN1qyit+zufK87dMgJ3X
TLSH
T11FB312C41B9F5D8DE1B16C3091C4230FFBBA18D92A1700C341A27BE1D8A9BE09D9B7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  bunnysense.zip
- Size 110KB
- SHA256 938e06137b461ee95153e858c70fae2609611d30d6f9fbf9ed48cd74d4d6c378
- MD5 0621ab26737986958ecca03985830d06
- SHA1 bfbf9ba1f8c11206f1572b792085adc2d7dd07ba
- SHA512 8053a991dde9b68554e6f64d76dde48f87f28013b38acb1bc79c120d275018945e0b627dd4cf45b730eca8f5d7fcb04d1457cd8b09f3ef9e04cafe8c98d675ee
- SSDEEP 3072:XD0uN1h4yh8t+zahf3tUH5F87dMgJEuV2o:ouN1qyit+zufK87dMgJ3X
- TLSH
  T11FB312C41B9F5D8DE1B16C3091C4230FFBBA18D92A1700C341A27BE1D8A9BE09D9B7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FFlagTool.deps.json
- Size 421B
- SHA256 acdf1e1051eecd6463dca24660d2d5cb2d9ae4f5205b9b32940bfae584a2e4cd
- MD5 340ca610fdf9b543c98beb3677a72d53
- SHA1 ee6edb49c2ae81dd3079e23fbb043e78fbfdca9c
- SHA512 9c83b2d4f08dff18994b33e9801bf35cc1a616092dac010f1b77aa124dcb9ae0ee91b5088e49baa1a396abc01df0a827509bfb4c2b1fc2d9194a0184b0727930
- TLSH
  T1D3E0DF0DE1840CE300F623B254368393FB325637541A280A7AFED41C1FBA91B5450F66
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  FFlagTool.dll
- Size 94KB
- SHA256 2eeb2215a22666d319ea049fa6907285d1b623853ba41f37d059bd3bd0d5b896
- MD5 ae829a177138c5ed5d2cf0c978827dc4
- SHA1 d49b4ead2e81693d16a82db37bd8b4085afb28c5
- SHA512 d79c35fa463cca4e5573b325a0106363e774ca068e62cf1645a9604e603340705950a7270c3ada31fa1b27927860fd3fd5ec99ffc9a98580798ef00997e4492a
- SSDEEP 1536:DPA6BRBW4eNz3wOABzFj00aMaXqE5QoFyMHRJ/P/qs02nPv9ENuxo6Sd4EoMvbw7:DPA6Bbe5gOvto4C6Ojo+bwLN1
- TLSH
  T1BA935B8627AC4923D67F46FD44C212829B7D0317A153EB8939DE48E81DC73F29B162E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  FFlagTool.exe
- Size 158KB
- SHA256 e7867ea29e09c8ba5a71ba9c546b868c6484b5df809e9483b104f7bbc7d73701
- MD5 bc04bee9e81d0ebbfc84059be8cb0b8c
- SHA1 92df520079f77486b5cdf28fff6a6e834342d4f6
- SHA512 c536940d1c7944d5e21142074a8c31b098bdf88778a7729ffc956b711ea9d3343828cf54a7f84cdae9f764553e46fb6fb4cb55d5acc1a6ff54168bc215d9b989
- SSDEEP 3072:mXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmm82jT6nbu:clxnlRLfyQXN42DCG
- TLSH
  T1A1F33B13A6AC11FEE1B7D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  FFlagTool.pdb
- Size 380B
- SHA256 25b5883420a87c2dee79687c80e51ec2f4433a08503816d10a28c8cf8d702d9c
- MD5 992b792cd68485bb8e72bb18d9f9abd3
- SHA1 39defbacf8dbc29f2043ad3c5820c87a59b3f175
- SHA512 3f0df57e8a7f04fa0d0d3fa683542ecc8e2f42778461c546642ac333228bdfce31d6fadf50aa57c25259ac0f83b4c898900995867d502af8466a3f735509945c
- TLSH
  T12AE02B1643D01B8BE5AA03354FE76B0237A5D50A331B676E0181C1B2EDA9FC41C15E56
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  FFlagTool.runtimeconfig.json
- Size 519B
- SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
- MD5 7e4444b5a3e3cea574693f055f944011
- SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
- SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
- TLSH
  T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12