67445b9b6b6939d8972abf5331dd29e10b25cefea06f3d96bd853eb69643a42e

Sharing

Copy URL Twitter E-mail

General

Target
Brute Force SEO EVO2.rar
Size 4.9MB
Sample260812-p15ansvvaz
SHA256 67445b9b6b6939d8972abf5331dd29e10b25cefea06f3d96bd853eb69643a42e
MD5 24afde1fd0558192cdcfe8308b677f2b
SHA1 e6bf1af088e23a67f6a0b6dec7904819af56eaf4
SHA512 75a5a6696b595f1e581e2f28cb51c34810309053bb955bb274a2a6d51e8654f28193ca3535565070333d837b532aae5a0748f6b6e7d7e94ffd67f185bd4d8a70
SSDEEP 98304:G6Jdf5ET2iaS1I1VL2z+EX+PmP4Kvp5ssmnez5tAbclQ:Gn2iTIyCiQKRiez5NQ
TLSH
T1FB3633CB79B57B1F745E08DD8A883D037AB9A084F0D07E55CB0EE8E0FD7846549E4269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Brute Force SEO EVO2/EVO2.exe
- Size 146KB
- SHA256 4fccc754e19102242a982e1aa025fd4c1457cb6b277c3bab33ed1d7ea1dcd330
- MD5 f765db7bb988f0e2fd314d52adc39ea0
- SHA1 eb315f0b2579e802be2cebda4ae89938d3c47685
- SHA512 fdacc0cb87bbd80599746363ade50d3f47c44a27300b4d8bac8bc1763a9f59d274e80e5c4f56545efd397f162586371d1d01ac92276c2953fdb896312ac34a29
- SSDEEP 1536:UX4l5eP5VXdLXrnu2lAK/8n7cJCrHj899WZoZfKZKqK3YWPTnsxn0uIPE:UX4l50LPlroHj8XWZ0fmK5IHxn8M
- TLSH
  T17CE35BAAA7087C91DD1A57B28032D6792670BC72A7F1211D36F9FF3FA1B32065407326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral1 behavioral2
- Target
  Brute Force SEO EVO2/evo2softwaredocumentation.pdf
- Size 1.8MB
- SHA256 1d14934ccefea2a081f3faaa4194846c9e64d796a96f0ec5491fa932dcb30009
- MD5 bcc82eeac15158b0141df33d5ce6180d
- SHA1 ddb91ded00c005ac671e2b7ba5e39bf8158be5ab
- SHA512 9ac904a051f47392f3cb5daf78c911040854f1c4eddca53cfb2dd3a97bf90998e49750c6d4d8ee2858ff0d2eaeb5d1834a30405392b1c25985c2c20e5a26a3d9
- SSDEEP 24576:PQU5DAuaykwEEVyIgTTTUamCEPW6dJpdg36kHGb4WD6+E+pWzGled7HV0FiWKMAJ:7LaGEEVdamp5QHOH/EqWzGlk0XK1L9
- TLSH
  T115852229B33658DBF84547719CA6AF3505EAFE3AF38AD987E0E84D53309D6340A506C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Brute Force SEO EVO2/library/Ionic.Zip.dll
- Size 480KB
- SHA256 17bb0c9be45289a2be56a5f5a68ec9891d7792b886e0054bc86d57fe84d01c89
- MD5 f6933bf7cee0fd6c80cdf207ff15a523
- SHA1 039eeb1169e1defe387c7d4ca4021bce9d11786d
- SHA512 88675512daa41e17ce4daf6ca764ccb17cd9633a7c2b7545875089cae60f6918909a947f3b1692d16ec5fa209e18e84bc0ff3594f72c3e677a6cca9f3a70b8d6
- SSDEEP 6144:OhagC/Mq25o9sXGtSV41OJDsTDDVUMle6ZjxLV/kHu4Bht79I9:iagxWS4msNUCe65fkHdBf9
- TLSH
  T183A4AD0427E90A55F4BE5BBAC0B69260C3B1B4166D6FD70F4EE020EE2D37790D9147AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Brute Force SEO EVO2/library/Launcher.exe
- Size 53KB
- SHA256 0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32
- MD5 c6d4c881112022eb30725978ecd7c6ec
- SHA1 ba4f96dc374195d873b3eebdb28b633d9a1c5bf5
- SHA512 3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981
- SSDEEP 768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5
- TLSH
  T11B332A489A4C9773C9ED46BE98E366904375C02B6B47E70FBC8982345E133EA194279F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral7 behavioral8
- Target
  Brute Force SEO EVO2/library/ev.msi
- Size 3.8MB
- SHA256 2819908d1ff9cf5d320114a84bd9eff6ff5675bf5feb99c5e3ea97486abb6b5b
- MD5 532133ff664e94e6db0d4024a81dd86d
- SHA1 05c6d5f0a9ce69e8a74080abcded45cdb2476e31
- SHA512 9904d0817ac2405c5b29d65e5a41bb1367cacaf68d969eb2e3f84f84ddb2c434421bbe2fe4e6db2ef7eac4d447fa35b664801fe9d777720703bb738599d87860
- SSDEEP 98304:5Yy4TGoooooEooooobLXB99239QKGzUYTkPS7rsgah2h3mIcMQbjDaKdlhlm3Kw:poooooEooooo/x992NtGzUYTJ072hiv9
- TLSH
  T130062303BD824776DA864630C8EB0BB29EBD6C214B10169BF7D87B5E2D73960D6B71C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

Adds Run key to start application

SmartAssembly .NET packer

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

Adds Run key to start application

SmartAssembly .NET packer

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10