f7665ee9a9c2bce37fb76163076bcba7ff33d921c4fab569aca8a6bf0d16d6c2

Sharing

Copy URL Twitter E-mail

General

Target
spoofer-main.zip
Size 457KB
Sample260813-dn8lsaal8s
SHA256 f7665ee9a9c2bce37fb76163076bcba7ff33d921c4fab569aca8a6bf0d16d6c2
MD5 6d4292720e0467b8a431ec1bd7d3fbee
SHA1 a260aac6fd358ca7aa45803008b050fc34725040
SHA512 bdfac2ab93d9c24854552ecb084490e064e1aa003e256f3fd800f14910a8447584f2173f12d9fcd735dfcfe2a2a902bb5c43561f2816b8840ffa59103cb85cb2
SSDEEP 12288:3tDsVmhKtKaCi9nz6aA3SrEp7YGzxosvo8NAn:RGE8KK7I7boyoh
TLSH
T118A4234FA1AFC462F34F9226E16B615467E1132C5825ADBFC023706A36ABE15DE6313C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Anti-Ban/Anti-Ban.exe
- Size 148KB
- SHA256 862a1baa582adcd68b4020a8be64c3b29593594c0cdacd32db6825a654cec61a
- MD5 17359f764da2b418d8d2b454c7be06a6
- SHA1 0b2897ffdc036e1c69fb08f8e9501840ea5c5124
- SHA512 a1b9b62d91363c54646697565c15b965501ccbbb1e1851452c3613c92f147f3eb256bf927fa2ed3a99f0b6ce0127fd58c1c06d311cc6cc0d7b41495346373f72
- SSDEEP 1536:lS9YXnq9YamgiYSoGR6+k84vKqIzjiCBs86Q6LRwqzm4XNZY01NTDZ2bo+W26dux:LqvmgiYSo4k8uIPzlSRwa/dB26duIgX
- TLSH
  T1B9E33B07E6A851BEE1B7C679CD924C41FB7378594B71A7CF07504AB60E63AD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2
- Target
  Anti-Ban/ReflexGuard.dll
- Size 571KB
- SHA256 428e0fb9f932d5f56aec4d5d6a14b2797eab41cbcf6ce4a53f94953eb2f7f559
- MD5 05cdbff07125fc6e9901a46365cbccf4
- SHA1 c38e1557885a9eb00a30bfdccb5e967dbb2ed6b7
- SHA512 6c9ca643a9b8ec1fcdd2ddbcbc348f1a5ac18609cb2ca076f3c2c28e65f08bb5207f048c4a767495740744c18e514dcf6131fc3c40545aed0de336d993ad4830
- SSDEEP 12288:ziRiOUXg4LDzXghopq7g3STFLxn7okTFRNBf:zqHUXvjbYg3SRLxn75TFRN
- TLSH
  T1B0C45C0573E904A9F5B796BD89714601EA73BC561B70EADF03A0456D0E33BD0AE3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Anti-Ban/System.CodeDom.dll
- Size 179KB
- SHA256 763c881ee2b87c7254d6f61c303b5de3b59282fcf1448eab7c797bff4e0ea989
- MD5 315855f752b7a173d1d5ac5eedecd679
- SHA1 bc81727d8f828a673c1eea4666b5976b5190a297
- SHA512 d157af5286bb2ccaac04f7d57bccb9f845f7c8feb0109e7ff0ca1979f0f3c5fbee91a2771faa394544bad6f28d0a979091b31a91c7b01aba3d56121e1c3ccef6
- SSDEEP 3072:PMKminLBDcR+s0sK1eW0d5PIlwbrebRYSH+l8Uh1P3QoH8:zLBk0szhebCSKLTQF
- TLSH
  T13B042A6437FC8376D7AE6274F028092146FCE44E7283DB5A8D8955F55E23B40EE20B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Anti-Ban/System.Diagnostics.EventLog.dll
- Size 51KB
- SHA256 1b3ac8b7d5b48ab5014a16e597479ac7c6c8958f73b2b0f3548ca186e6ace504
- MD5 0a88eb9041198e1fe9a26236a5f9567e
- SHA1 76a6449f29ce70f784acf36cfa4717144a8c6042
- SHA512 d3136c203910250f9404f6f5b72f148cd0e89698931facade1f37c80a6be2e145c579d9491efd4f693a3aaf952dc6a5d81a15101b1178edbafd6f758d7169c9f
- SSDEEP 768:sDQ3nDeK8ZHS9R9cMmaHlfir0DqgTGfmAXOaYcjCp9XI/D+9zcSz:sDQt8VS9RKb4iNgTLSC3XI/Wzca
- TLSH
  T19A3309D15FA4432CD9E6BA33B67382A9063496F62D12C60E3A0B750D3A1EFC847F1759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Anti-Ban/System.Management.dll
- Size 71KB
- SHA256 45bddc7a2aefc98d8d7c5a54b9066230cc21b39c5722af1f05e9fabc54b376e2
- MD5 3479453f64579b8783c30e1dc7542432
- SHA1 a595ded088dc161accfe066b47fa3ffa8a1dcd78
- SHA512 2d0aacfdbd06dfee942d7f9e54ac856bb060cf2298aa3565024fcff4aad46ceff5c95ddc455b05109df1faca54968481255408317a055e615492c01768296e3f
- SSDEEP 768:EV/2DXm3gh3nb3Wm/InTVExthoQDKkiSLJKdbq4Xe9zq3:O/UXmEnb3OTM2QDKxS9yO4Xazw
- TLSH
  T1E773A411EBE88779CBE70670B47083746F74B6C72D22DA0F291B221D197AFC04B65E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Anti-Ban/System.ServiceProcess.ServiceController.dll
- Size 33KB
- SHA256 0c2bda66bcbf1dfb7caf06bacd7ce87e3858bfa1e07a9bc7dca78b12fb630317
- MD5 84430acf7bfbc5fcdc28b708e59dbf1b
- SHA1 b81d86cf415fec1040643925427afb19b335586d
- SHA512 a0daca2b12b65538caf56cd31f923f9755bf9870c13979b531c86396649e2cf8eda3d8cee827519b80e096f626d6ec99dcfe7b49736c7cf8081d7d3cdf10985f
- SSDEEP 768:s+ikccW/ENTb7VNmN92D1NlzK2X1/9z0L:s0c9Elb7VNmN0PnX1Fz0L
- TLSH
  T1E9E22B5197F807A9DEF70EB0A9B2C3250E3677CB0E05971F29A9B00919D7FD443B2629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12