88e386b468f27c88a1c077ce3fb97ea082c4417db370f83540cc8aa377f77eaf

Sharing

Copy URL Twitter E-mail

General

Target
Movavi Video Editor 26.18.1 (x64).zip
Size 139.6MB
Sample260813-nzeg7aae58
SHA256 88e386b468f27c88a1c077ce3fb97ea082c4417db370f83540cc8aa377f77eaf
MD5 9f04d3e0ff79dfba9132326bc4d7c3c6
SHA1 8a40dde3bf596d8c443e4d2a288729211b8a41dd
SHA512 743902c94f21ee94dafc4773af0ca5b584601b236933350677100791e3fb9301a35b3332385262423037072d0e8b45e3733725361e4c907adf74e0b9cd5a5fb4
SSDEEP 3145728:p4WHEgN0RYULPTxrrKFUGz3TKUn6p3+1ik:2WHEk0PPTt7Gz3fny3+1f
TLSH
T12668337E001838E933C55BD4925D9967E4EC3E87B225C3752769B0FE05DEFA2E8E0192
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Movavi Video Editor 26.18.1 (x64).zip
- Size 139.6MB
- SHA256 88e386b468f27c88a1c077ce3fb97ea082c4417db370f83540cc8aa377f77eaf
- MD5 9f04d3e0ff79dfba9132326bc4d7c3c6
- SHA1 8a40dde3bf596d8c443e4d2a288729211b8a41dd
- SHA512 743902c94f21ee94dafc4773af0ca5b584601b236933350677100791e3fb9301a35b3332385262423037072d0e8b45e3733725361e4c907adf74e0b9cd5a5fb4
- SSDEEP 3145728:p4WHEgN0RYULPTxrrKFUGz3TKUn6p3+1ik:2WHEk0PPTt7Gz3fny3+1f
- TLSH
  T12668337E001838E933C55BD4925D9967E4EC3E87B225C3752769B0FE05DEFA2E8E0192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery bootkit installer persistence ransomware upx
- Renames multiple (461) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  HaxNode.Net.url
- Size 120B
- SHA256 cb92547dbacfb6d6c102c2c0ed1d280c6aea32210f280a85ce01bceac765c91e
- MD5 d2dbdd8cc5165ff6e4122b9f15b82ee9
- SHA1 48b0cd5ef1568974fc4dc725ae83e3a7f8e36c41
- SHA512 fdd7c0f948841817f3e389243df4d365cff89f2113a7045717d40ae0ab3dfdfed1b5e1203d18c89ca52d9b114bfd3d6e3b3dac44c89b056d3c8eef1b1951e2f8
- TLSH
  T19DB09B5E4105424AD241544660B0F4085D0E755408D1D05C6244DE874C440D1C589735
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral3 behavioral4
- Target
  Read Me.txt
- Size 689B
- SHA256 421dff8974a1cb1b714af7b13cc52dc98f7b1e48fc3ed2264fd8dcbf94399012
- MD5 c124e0b5747f24b5c28f3c3816974faf
- SHA1 0df9bff92eccc317c477709bb772d9a5a5e8ead0
- SHA512 d1372ead47783dc2869e3c96e3d3504e9977acbb5648b86459bf78ce16eb3c23e0c5ad535bd45ac34c6474776ad245174d46ac548f3fe0bf8870b9ba55b5d54c
- TLSH
  T1DC01997B1B2E83525B570ACA338A751DFF16D80439A3B4C073568EA09001360FBEF60E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Setup/Setup Cracked.exe
- Size 140.4MB
- SHA256 76a58b3daee5a3543ee94115275d1dc1666c45f452fe55a5d64fbd7939f52e8e
- MD5 4d5e155b581f88304448083927abad3e
- SHA1 a32f72d18ecb33680690dfa42530dccaa39245c9
- SHA512 0f5cbb188641affa9fac922b6d8ada364733822424bbdfacb41c7161c0fc91f8ed38207008b714f10e68bc733f12807f35c9acc86cfc85a1a9f1a83cb1ba0651
- SSDEEP 3145728:3WWYxGAJ7DfvQTPsgtrwR4BecAoHS4sm/Yhp8Apg3S:5YxGc7DGPsaxBecAoom/op8sB
- TLSH
  T11B68332B105839FDF2D985F0523A4811E4FF3B42E519852E13F9A4FC0BA9EF11CB6666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit discovery installer persistence ransomware upx
- Renames multiple (526) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Renames multiple (461) files with added filename extension

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Writes to the Master Boot Record (MBR)

UPX packed file

Loads dropped DLL

Renames multiple (526) files with added filename extension

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Writes to the Master Boot Record (MBR)

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8