1a41079635003a3c6894cc9995f258d08e09c68324b82a3809a2e7f5ea2d5cde

Sharing

Copy URL Twitter E-mail

General

Target
nevosoft-activator.zip
Size 51.4MB
Sample260813-gcc8aasgkc
SHA256 1a41079635003a3c6894cc9995f258d08e09c68324b82a3809a2e7f5ea2d5cde
MD5 57f9d0657c3bae19a0b710936ef71198
SHA1 7f75a215b6b46dd8b614a307d769ea87c97d7b9a
SHA512 3cb013582e036487bf41502de3bac50148a4e5e375f807cd457472d19ae47b3cacf64f85c6cd1c28599c93ab61b976debd2de195f216c749e340a31da4aeb98b
SSDEEP 1572864:3BGnWwoITGcxsdbGwttlOrBHJMEgRqsaE+B5gQ:RGZTGOsdb+rNKRzi5P
TLSH
T113C7332146F14110F04DDEDDF6FE2F9839A8AA6E319047689DA25E63F7C598CF012F68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  nevosoft-activator/Activator/keygen.dll
- Size 9.3MB
- SHA256 d72335f83c704b8efe764891381dd99f7816c9482373eba9748050736e95a362
- MD5 dbecb0bfa22bb1905647d524ddf5c34a
- SHA1 aa420b44b41fdbcc3594d3a43073296b5de7fd4a
- SHA512 ab4aac91427a4fd35de5e8456e4a7afda9ac717de3aa6bda4f4d1bc289d3eb19e21134b79a3e32b19201b3fa01bf5e008da1765026a538e968f0666377b833a6
- SSDEEP 196608:+Q1kokC4r68cmJscesW9wMIh0+soRJlovfhniF:j1kc268cmfFMwXs5niF
- TLSH
  T16BA63350833BCC11F15F5AB4C95BEBD6BB176EEB584860D0AE76F689A37234CC602744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  nevosoft-activator/Activator/keygen.exe
- Size 240KB
- SHA256 5d047ceb83b4ca6ebb560626b3519d4dddb9b873b60a61805b2499a0f982f60e
- MD5 a33f26c6c0ba607ca3f6e5ff8c07a688
- SHA1 409351d90b84b1a374861518834e2d5b7fec9352
- SHA512 3447656d0e5812202cc7403a2c2d631eb1ccf0d19710bc4c6e5a33ebb9b744706e038b10ceff2be01094170fcf538382a2ed61a5e96eda741296ca4c12bbdb27
- SSDEEP 6144:GYCqxVJbNpQSMTowVC616t19zJvmtv0E17Vq/0:GYhxZ2SVwYZMtMm7VC0
- TLSH
  T1383412877A55A80CCC07DBF611919EB9B228AC171B486543799C77CFAE7220838FBD5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  out.upx
- Size 626KB
- SHA256 8aaae29bb13f461c1bee16e243521837aa3a58aa9504ccfad7fc5ec56d4a153d
- MD5 ede3bc8229f203659eed69324cd6dc58
- SHA1 48ef104095b47ed7b8a70877e89b392061d183e6
- SHA512 83539979a9d7594213d1719880739e620fed3f223a002adabbd84a8df126fce74d1d6c77a57a1494f37424eaef952ffe0537900905a3ce30f792d71a46fb4fb1
- SSDEEP 12288:PfQsLAaEimKnwc5PHWpWpn+TqN1De5y4ASvka5Xp0c888888888888W888888880:3QWAzVKx5P2pWpn+TqWQ7aRp
- TLSH
  T1CAD46D21B3D1843BD1336A759D6B8594BC26BD202EE4A44E2EF8EE0D0F397913D35293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  nevosoft-activator/Activator/sqlite3.dll
- Size 533KB
- SHA256 1ca02cf19ca9728127674132823947ae8f60ea417e4b1173ef2278987c06c258
- MD5 0a764b1e2ae70d5223b095cb9e7cc5d7
- SHA1 327d73848f2a8378cd94f4aa9a91d9620e378ce9
- SHA512 1d7a66b5f843a237b71f4ab14527993423a526ca65e4ffb464b048904d6a94c7b24ea7a108d5a1b151f0fe074fb9228378590180334cef8a68c5051062af5269
- SSDEEP 6144:g2YXPFsclAKSPAoqQdpDbuLFBvIqKrcmzvdiULvBz8yV2dMmCDE6fwnJXeE/kxJt:g2YZre/DbuLFKqKrccdiU9bLDXYIV/Z
- TLSH
  T1C3C45C93A452DC39EC9203B481620737966CD9A0DD63EB43A5D1F93B6EF35C1B62930B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  nevosoft-activator/Activator/super_cow.exe
- Size 41.8MB
- SHA256 b687b331197bc77ea24c559c75232372e3ae87ff5fae4292967c437cf23bc8ce
- MD5 a02a0c08cad7f0b80fcd77aa678df53a
- SHA1 f9ed2a532cca12040913ee647a34d3cb4240cd92
- SHA512 c5d120efa18b00af24bb061bf92194400165201379f8b0ca2c021f8a130996e678186f2c28ac621855e1f48939278a4136786a9639fbef4747709757e92e8ace
- SSDEEP 786432:a/bJShvLO40FgVOJJ59rHE8MXghoQNI8rMDd5phI9lstyRh9W+fVXmSuhu2:a+LO4CcOzQ8R+65QZ7anFRh9tV29hu
- TLSH
  T1D4A7330224E4C621E0128A7BF7EA2E1C0E657A1D278E4F5E005717B2FF9544DB6A1F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral10 behavioral9
- Target
  $0/games.dll
- Size 9.6MB
- SHA256 07e780b20dfaec4891045654dfdf5f472894474c14a5ce653a1a15ef0573631c
- MD5 8051b415e1e1b96134a35a86e910f643
- SHA1 1143ccee536e19f0307ff1743db09f7a2b7e9646
- SHA512 72b0031292c2ef9f0a554963a94525afef2a8db2456166dc3ae618fbf872b0f4d4fb52b8c1bed7741f3a7706aba4fb27f220830c66c30f941fe4dcac46fc2023
- SSDEEP 98304:ITiZq7Y1VW+qJTCRqqHXf7BzzCV4qCkSa4lHK0xv3ji/kb281OV9MQ4SErYqURTj:aisKRqqHP71CfCqUd3KkbFIZ9ErmRX
- TLSH
  T1E1A6CF29B7528E21EBD2D17454D6E393A3639E82BA63277539DC5650FF30EF08C4C24A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
- MD5 67d8f4d5acdb722e9cb7a99570b3ded1
- SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
- SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
- SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
- TLSH
  T15862192077C650B3EF6226722AFF77179BA5B11414D29C0B4E732D472D39641EF392A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- TLSH
  T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
- MD5 f7b92b78f1a00a872c8a38f40afa7d65
- SHA1 872522498f69ad49270190c74cf3af28862057f2
- SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
- SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
- TLSH
  T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $_17_/drm.exe
- Size 1.6MB
- SHA256 e8208264a591d871a58fea0691e55fb9f83c8c9517b65d11395c1eead4cee5c3
- MD5 65601d8664605f523897feb10c935ca0
- SHA1 c0db1c6e4d4da2c1ac2c7afe67ef12e929c204d8
- SHA512 48ad2330a2365f4f076ef4afac2162eb0d8dddea1ca649c48457bf100d736ea4df241a03a510348b3e415bc092345332fe3593003d217a3bc6150577aeab0e8d
- SSDEEP 49152:Ts//jvEvPTb2p/7gcmVTaV+mzJyy75N8ALT6n2s:TY/7EXOp/9V+mzJyy7X8Ao
- TLSH
  T1D2759E21FA41C033E9D2107085BDE6F7597DAA20672595EB93C82D7D1E305E33B3AA1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
behavioral19 behavioral20
- Target
  $_17_/dxwebsetup.exe
- Size 285KB
- SHA256 34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4
- MD5 bcbb7c0cd9696068988953990ec5bd11
- SHA1 3c8243734cf43dd7bb2332ba05b58ccacfa4377c
- SHA512 551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786
- SSDEEP 6144:3WK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQ43:mcvgLARDI1KIOzOR3
- TLSH
  T13454F15197E4817BE4FA1B351DF2025327797DA8ACB9E33E938618881D70380BE75B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  $_17_/games.dll
- Size 9.6MB
- SHA256 07e780b20dfaec4891045654dfdf5f472894474c14a5ce653a1a15ef0573631c
- MD5 8051b415e1e1b96134a35a86e910f643
- SHA1 1143ccee536e19f0307ff1743db09f7a2b7e9646
- SHA512 72b0031292c2ef9f0a554963a94525afef2a8db2456166dc3ae618fbf872b0f4d4fb52b8c1bed7741f3a7706aba4fb27f220830c66c30f941fe4dcac46fc2023
- SSDEEP 98304:ITiZq7Y1VW+qJTCRqqHXf7BzzCV4qCkSa4lHK0xv3ji/kb281OV9MQ4SErYqURTj:aisKRqqHP71CfCqUd3KkbFIZ9ErmRX
- TLSH
  T1E1A6CF29B7528E21EBD2D17454D6E393A3639E82BA63277539DC5650FF30EF08C4C24A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $_17_/nevosoft.dll
- Size 877KB
- SHA256 701df03e8f3969b6521d5f92514e9521e6318efc3554cf8b2ba5136e8bcb955b
- MD5 7f1292e1b7a9999b30b29b78bab5e26d
- SHA1 505e121bc2dddada7b4a790f19865c6c7d7c73c3
- SHA512 8f763e7481886a6f13562fd3ab54920ccdb18d277f286e5987f5bd784006249df4acc04f2fd15140eca56c39d9ebc984c793fb6046647e3a2595f118139e87db
- SSDEEP 24576:DNoaSF24yA8BRZb5fYDI7iGC+X45573gnwp8b5fYDI7iGC+X45573gnwp8b5fYD9:5XgyA8Bbb5fYDI7iGC+X45p3P8b5fYDT
- TLSH
  T1FA157CA9B78A2543C811FA3330775A3422358C77F91091D7F16C73DA6AF2871683E9AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $_17_/vcredist_x862005.exe
- Size 2.6MB
- SHA256 3453e87aa523e54f07337abe75c047b1e827c02b105a92028dc55dede9f97ffb
- MD5 4e33c98627ea50d3e44cd62d323345d6
- SHA1 47fba37de95fa0e2328cf2e5c8ebb954c4b7b93c
- SHA512 006de135da712e09d48338f032de36c9005ecc01a97bf6aeef19b17ae81e849eeaab74764ab97c7e8c150c296dfa976aaf7dd55da8f0f2320dc43c73206865ef
- SSDEEP 49152:XFoHgEIXrjXfE44zAKveF+7YdOcYTBZEjUqxZgJGLfgqjJUDYWbXy:+HgNDfXQ1veFPk5FaoCRrgGUDxy
- TLSH
  T133C5333393D0D43AF4D12BB89AFD237712757C95A635A33BD2888085586D3D8BA7431B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  $_17_/vcredist_x862008.exe
- Size 3.9MB
- SHA256 155863f6b293d1d50edb814bb11a1a7a285f286cede36860da4aff9ed2bd8f49
- MD5 b93e5505f59cf6c5fd2fb1ca2a74a520
- SHA1 dfaa1803f806dd23d42294c72376f09555e21e02
- SHA512 85f80c651aaf20406d17931d8809631159b2b018c987939bb3885b88ea2fd3c590b0566b7623a73cb6e0a0e7b056837fa4e63b5fb2934bd36b4e74c7ce60cdb0
- SSDEEP 49152:wQ+D7i0AY9PE1UJYfcnKiJ/K7+RIaCSi3haenvUvwwZDfimxQ02BhoZGxaiBbtC:wLD7ilY9CQIcKz+kSixJvzwZeK2g6Bc
- TLSH
  T1AB1633B63AFF2765F1D1C3F0A4B9450229B0B7507C520B7190D6532A822AF5FB12B76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

Loads dropped DLL

Executes dropped EXE

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Badlisted process makes network request

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30