9164f0c627338a7e9a01c05a29f83ec3a34d6b157d3a78d04e7e77c949ea3a67

General

Target
EnviroSim.BioWin.v6.0.rar
Size 226.5MB
Sample260811-stxtssvhng
SHA256 9164f0c627338a7e9a01c05a29f83ec3a34d6b157d3a78d04e7e77c949ea3a67
MD5 b9e2b8f9eccf7935fd0c64d9fb1d61e9
SHA1 098ac1e0f2d8239ed14d20500b75c6340f4a4d6d
SHA512 bd45ca434b5d8dcaf2f3a06283e6d662fffa8218fe6bf82f46f83083e3c47ab86df235f3c25e03f460241d710b220f5260ec2de748a5c623d2d3a12800bc928a
SSDEEP 3145728:XV2N9U/HBMO5Y/79HaJQm9dDeMOxX5/utbQWKZgsN8fE+iKv4kikXh:XV2nUCMY/7QAV5/m3NZgk/h
TLSH
T19CB80123F1649E71C0DE4B3B44CF5612A334015B8F97938311E8AB7ABC8A2955F76B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  install/bw60setup.exe
- Size 163.6MB
- SHA256 a5bd34e154d654c4a411127bbccc850fce845abeb421cc428a035949b355e0a1
- MD5 01aa66148f23ba033d45406d0d553ab2
- SHA1 cc85ed13dc5ef6e23c37972cd563b247cd48a680
- SHA512 5df72bb39a075a4b1e0d79e36883d50755c8e89c59f75755a29ca6ed94199f212610ee13d834952168d17f7b806072a7bb4c8304edeb8e3f2b259c1bcd0b295e
- SSDEEP 3145728:bHBMO5Y/79HaJQm9dDeMOxX5/utbQWKZgsN8fE+iKv4kikXA:WMY/7QAV5/m3NZgk/A
- TLSH
  T172883331613C6F3BEE7CAA339535362E2818362066256566F77AE84C5146043BBF38DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware upx
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  patched/BWController.exe
- Size 3.0MB
- SHA256 f8c9e176bd35ccd573c6b630ec71913e9ac9058e1295def5a97ab6ec175fb84e
- MD5 b1eb2abe0d9d90a0aec2f17181f6addd
- SHA1 d9cccee7a6e774de8ffa9616c4ee7cbd00cd5019
- SHA512 ae3c4d423600d6224a849a52656aa5155afc74a4b95aadc0a9886041368c0ac4e4cf65f05ce159e09c79ae45df4619628bd4dc37a9e4f3da5e9422bcaa4df55e
- SSDEEP 49152:p8rlnk7R9QqFE715rYuXkWQtPZYUFQxAVuxJVrChnzCmUd6I5OTIjG6dXy9aaFVH:Sxk7R9QqavjkWQtP6MiAVuRrCRzVgLb3
- TLSH
  T138E533AE4B75AD1DCF4B9AF9425C960E3CD4A347828DFA6B0B64A5072947D0C7022F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  patched/BioWin6.exe
- Size 11.8MB
- SHA256 0b104268a12bd6d35594db78bb30a9dc112df2e6229a99be2b8e534fba916293
- MD5 72594ad6a01518caf84e4e18436c70f3
- SHA1 edfdcf3361f8b35ed529ea85e404f6a881b97e1a
- SHA512 f5fe0eaa52fa46d520ff46c264e2ca63921f075d9845e904184f63b9f13295320f9341ecf054cb10ae065059376a60d22bace719cdb8150dc1c77aee11fc5d4e
- SSDEEP 196608:kzt+9NQ8vliSffM1ZJV86vdrpSJ9/sVaNL0doA+2baRyZGC6XxJ5bmG6+PzPkHla:QI9Cs3ORvd43sILgox2MJ3sG6++pRY7
- TLSH
  T112C6339273D0DD25E40B75F34A82D6695B13EA8B8E7B47AB4E9806BFBC14C3C1E051B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  patched/InfluentSpecifier.exe
- Size 46.2MB
- SHA256 768863751c61d93c44e35745c058fb1d316a48456f6fa57abf3ddc00511542cb
- MD5 8d098f481fc0ad96933f8290826fb2c8
- SHA1 3f66ad98b067d245349cb45ee77513aba47a9ecc
- SHA512 69b533394079eb470b079678fe4459ad3e4e11cbbdd14988fc889aecc600d8b254c39afe80ff35ba643ccca808699a4f831da70bf47d0b62418090de35bbe77b
- SSDEEP 786432:nwrb7EAnJZZ1lPmWbBhUl5ss1szzdvVV/WTI9KZbFl90o:wrbjE
- TLSH
  T195B72923F1649E71C0DE4B3B44CF4612A334015B8F97938711E8AB7ABC8A2955F76B4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  patched/hlvdd.dll
- Size 1.9MB
- SHA256 88923b12020820b3fc91a8cc2f92c16a777540d4dcda5f1fd6c10d1f72c39c10
- MD5 27fa4e0bba495606156f085ecf9a21cd
- SHA1 bb39854b5b448d088378b7a04f780e7f5676bdaf
- SHA512 487f298dcc8e09ce5b058b2160eb2ec46fead68a840189a2772d13d71b1ed1333f132bc9b92dc95cf3a240619f14c1d981001649acc83e650e1391bcebfefb7d
- SSDEEP 49152:lDIqswt3mhmQdRbRv60TvB+YxB6N3za6exdmzA7:9I0tQ3E6Z+3u6Am
- TLSH
  T15F953391DC28B539F84984F6234B5ACF6E40DE7C81CB6F85772B3925DC7AA01D0A6D38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5