505a66f50f6467e14220215140e1e7ddbe8e015f9a08f5e6bd291175bb61cc0b

Sharing

Copy URL Twitter E-mail

General

Target
Sweb Macro.zip
Size 1.1MB
Sample260813-m2sbdsac66
SHA256 505a66f50f6467e14220215140e1e7ddbe8e015f9a08f5e6bd291175bb61cc0b
MD5 da7e5bfa90fa7b819c786f136b55ff78
SHA1 4f3f7fde164651443e8a78cc926017129cd06648
SHA512 95846ab3fda3f1a69677e96d5bd2537f464f5d29871b86891c1b80e16de19e9b770a0b467db38b7932a9a68ecc33756c346b3c10e41c1e953f96202fadc831dc
SSDEEP 24576:0VDxWqThwBFF1q0Fr29YMWOAqcfkWFYNsmED4sjX80YORGq5:0VNHhwRZ9Mm7f9TUyAs
TLSH
T17E35334193720174078B28F1C2DE8FD6B4DD0DB29270B366E858AF19E5F38C9836E75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Sweb Macro.zip
- Size 1.1MB
- SHA256 505a66f50f6467e14220215140e1e7ddbe8e015f9a08f5e6bd291175bb61cc0b
- MD5 da7e5bfa90fa7b819c786f136b55ff78
- SHA1 4f3f7fde164651443e8a78cc926017129cd06648
- SHA512 95846ab3fda3f1a69677e96d5bd2537f464f5d29871b86891c1b80e16de19e9b770a0b467db38b7932a9a68ecc33756c346b3c10e41c1e953f96202fadc831dc
- SSDEEP 24576:0VDxWqThwBFF1q0Fr29YMWOAqcfkWFYNsmED4sjX80YORGq5:0VNHhwRZ9Mm7f9TUyAs
- TLSH
  T17E35334193720174078B28F1C2DE8FD6B4DD0DB29270B366E858AF19E5F38C9836E75A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Newtonsoft.Json.dll
- Size 706KB
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH
  T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  SharpDX.XInput.dll
- Size 13KB
- SHA256 350195201205840b38aee094bcead4c78b1661f3570a7caa5c36b86ce6d03ff3
- MD5 b16aaf6fa2e6432e0c342a166e98a372
- SHA1 27cc51549ba116d51865ab71177b10a278a1c692
- SHA512 58ccc2bd6502b25e7973721d9e4051d8250a9882f47170f4f43c096ee550f483b9fbce4c690a35294425e559456a48054c3a541ef234894efeca8b1dfa74fc1b
- SSDEEP 192:TqgXfBgFL9ssWdkVrguQg7klOjWVAyLt0y5RoID1sgPpffk6bZ3RkiuZM:TqGBcL3CjlGWp2y5RQefk6ONZ
- TLSH
  T18252F7548FC84127ED5E2637E9B343407B34EA281757D37B178841A27E1F3918BA036B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SharpDX.dll
- Size 269KB
- SHA256 518d45a5aaec84cb37e83ee2cf58c503ab6a25febb8c48b53316340c967e84bd
- MD5 6c00b8be8fb6ff838c79c9de405db1f5
- SHA1 faf1f8f0d2d56eb2377063906432cce29d9f1839
- SHA512 e092aaa1bac82337bda113cb88a4990a9615c9cad8757af650caf1a327ada6ed83e4c6cf2b77073c028d986554b82ad16bc3e1e7a8b4466324201d8daa425ec5
- SSDEEP 6144:jG9J7gpDfCvbW2HHWUwQ9N/+bydXB33XbEOERabANrG:jG37gpjCjrH2UldXJbkRa6
- TLSH
  T1B8444B22F70C0A53DD9E47BABCB546D213B095002516D64EBB8CA5ADEDCB7807E263D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Sweb Macro.exe
- Size 458KB
- SHA256 59cb5b5dd8e09092837c838784e79e693dcb5d7c4981ff79271c72923df20107
- MD5 430000046dfb2c69bed99d0c99e09a85
- SHA1 4fdad317eabaaa319031e6de53d72909f1cc3021
- SHA512 47d1c1e38af57ce35ae9455dba0a406607deec103eb036440cacf842d76fbbe2fc8af43533a845f7597305fef2472ce0087018d49a5204393eb7e19d31e803ad
- SSDEEP 6144:hlxnlRLfyQXN42DCDS5S0Pm6prVaLJ0TDNKuA+H0foe/C1k42/mbfx41LPlk:hphfjDzuG2+NK8y0OsqD
- TLSH
  T1B4A4D022968D50BDD1E3D5B9CAA24945FBB6B81447B1B2CB47504E7E4F3ABD0EE38301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  System.Management.dll
- Size 304KB
- SHA256 b2d6e7e991dc9ef154b29f4966f04fd8ed4ebb2c1d1242ea1d5f3e90f8ae5143
- MD5 e1422b4c04b923dcfe00a55290dc18a6
- SHA1 0609ecde6bc8a87f88bc32b98d19800ff19529b6
- SHA512 297f54fceeb0cde17745323e7c41fea830a376fe9c3cf92a692c48199c0a05f1533a3045fd9c6d21352d084aa9ccec7b6cf630c7df49b52ed4025ae156509a7c
- SSDEEP 6144:9q4+FutZbJcMFEG3LbPhmlmsUwHdYhJkXUXewcn:j+FutZbJcMFEG3/KmFwHdKIUXmn
- TLSH
  T19764386033F84645E1BF4BB6A0711491CFB2B72B6A0EDB6C0D617CAD18B175186A733B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  WpfApp3.deps.json
- Size 2KB
- SHA256 b4d69187bd1c450c399ebd5318cd9a49e8492935cd868bb3d523576032ac0e72
- MD5 44d1fcaf0c19d6aa4a3bf517977c780a
- SHA1 3f9caf4e7ed657564f63864ae8ac5ca1c0854d01
- SHA512 2a2b90ce8d7db999cb6649343962f84bdb284bfe2aafc5a4b4d0d77beab76b240d96acfcb19219972b86a548ae0830bd6829324947650e0fe1c5b7518d7f0e59
- TLSH
  T172517C25D9A45DB714B66BBA643A4242F631933F90041A8F78FC509C8F73E9B7051F3A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  WpfApp3.dll
- Size 360KB
- SHA256 ea49b67fe53b5f47e7473db43e35cb8f9bd1a068811a48bace373e567ad021e0
- MD5 b22989ba33df435e94e5ea7d2fbd13c1
- SHA1 0d74fcc1fef5730007aea0f448834527a39863bd
- SHA512 7e70917bfec79ac69fd763e0b7a2ecbc1b30e1409a799ba21373313ffee2124c6e6c9779665b24bebee9e783273d3c78cedc003737bb2aa058d236382ccf7379
- SSDEEP 6144:4Ou0EJtHShDPY4zJvPmkprVaLJ0WDNKuA+HQfoe/C1k42/mbfx41LPlk:s9JtHShDPYau02HNK0y0OsqD
- TLSH
  T10074F170228D8812C3CA89FE55A24286D9FDC21616A7F3578C9B0E7EDD7D3C06F5478A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  WpfApp3.dll.config
- Size 189B
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- TLSH
  T17CC080454054BD274D334B1357518539EFB073A36424140CF42FA7560F3114D4657377
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  WpfApp3.pdb
- Size 24KB
- SHA256 f455dbcdc6a41775e376178c8745ac6f729ef35181a39a78a4f866d6b7d92d09
- MD5 526a3312ae7f1ddba7bf647aba23c404
- SHA1 69a57ff03b429611f23b889f4fbc6e8b7a01592d
- SHA512 fdbc725287ff4bbca7b8291816901b0113c919192b435e6e436dcc3c7677ef6b88fab3b7d74198d6c97e314a8f40fa468f0edd1303f52421e223347fa47795de
- SSDEEP 768:gjhkoZnKalmHhzyYreV0PVRqrK7JPA7u9+:WLKa0zy8eV0NRqrmPAC9+
- TLSH
  T10EB2907393D9C561C102A57B90A1C34C7B31C3246209DFBAF1D8A7A4EEEF74927B6264
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  WpfApp3.runtimeconfig.json
- Size 519B
- SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
- MD5 7e4444b5a3e3cea574693f055f944011
- SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
- SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
- TLSH
  T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22