e41681239238870476e94cf0b6e00ff57a66850a058a2049b5a544c2a7c6a6c2

General

Target
Adv(0d)-MetaBase-(Zer0-D4y).zip
Size 444KB
Sample260815-tskzaazxgz
SHA256 e41681239238870476e94cf0b6e00ff57a66850a058a2049b5a544c2a7c6a6c2
MD5 08fc160788c4ccc784d35bd416696fd6
SHA1 c7bafc987d480ab599f6c9ab703a6928728e17d2
SHA512 ca6072a90f3c8f3b99727e33d18288cb394a84e3cac314138fa261ceace27ecec0d567e59f816a2d9ca1c0cc0379b3ea97303641bc6da624874257b15b15c061
SSDEEP 6144:jP5G5hqt0QEENqywP9uUfrAxQaP+ov9pX1ZEwmVxZnQMo4+CiK3FStse3LSfCnur:jUhENfwuIyG+iJ7ZnXo4+/K3FSt742ur
TLSH
T158A4239D0BB9650CAA9F54726162EEFB80E5CCE7030AB917B1D49017C8A758D32D0FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Adv(0d)-MetaBase-(Zer0-D4y).zip
- Size 444KB
- SHA256 e41681239238870476e94cf0b6e00ff57a66850a058a2049b5a544c2a7c6a6c2
- MD5 08fc160788c4ccc784d35bd416696fd6
- SHA1 c7bafc987d480ab599f6c9ab703a6928728e17d2
- SHA512 ca6072a90f3c8f3b99727e33d18288cb394a84e3cac314138fa261ceace27ecec0d567e59f816a2d9ca1c0cc0379b3ea97303641bc6da624874257b15b15c061
- SSDEEP 6144:jP5G5hqt0QEENqywP9uUfrAxQaP+ov9pX1ZEwmVxZnQMo4+CiK3FStse3LSfCnur:jUhENfwuIyG+iJ7ZnXo4+/K3FSt742ur
- TLSH
  T158A4239D0BB9650CAA9F54726162EEFB80E5CCE7030AB917B1D49017C8A758D32D0FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Metabase-0day.py
- Size 39KB
- SHA256 a4a21f6949b9d5d02cd8de29ce7de24ba9a61134bf97ffca20fb8622a1aa4dfe
- MD5 faccc2ca1513e15d80212bc86e4ef6bb
- SHA1 aff6c69b1de16e7d71647c07b7589d2a0fab74d9
- SHA512 05fab3d16a35eb89228290a2293ef34433ac6ec16a3b0dd478269efc1050de00d45d47b367f3cdd35aa5c87c0152ab61643ebf8a9ca9bc6967fdd376833ceda2
- SSDEEP 768:0K0USZUryHZkwcBZL59GoDaNAoLTwMFORN09U+7vaUWQWIezvtDtf6eijXkXFoQa:D0LZbHZfcrGoONAYTwMFORNuUVUWQLyw
- TLSH
  T1B603B8C55221D16F578E8D072E467BCC2878D1AFD5C9A302E0D4AA4FA4BC26BD5E8FC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  pytransform/__init__.py
- Size 13KB
- SHA256 380c08b75906042d18e73b0d2654eb03043098984caa27ab454548fd93a3aa08
- MD5 58eb86eef7db4dd2a4e2ec8f52bd7521
- SHA1 858e8e7966a3c1756be1df24c81673b2c5e8e288
- SHA512 f0938d52fb19df5263302abba8ef9af1a4e0e80a40e7415ff82a5ab3c260eec251eeb890d0ececba7044b7d86c3b67da5b6499dce05ec8ddf591d162d29c6aa0
- SSDEEP 192:sIRqMEqbHCTMRNpyRW3T+3JbgDIFRuJFX9d1X2wiQvZh7kELPJdhGbc8/SHRl3RJ:sFwfIuXFXZNjlh8c
- TLSH
  T1CF525F414C52B0229713D71B68D38658D76EA9538A0568BDBDDC81A8BF8046CC3FDFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  pytransform/__init__.pyc
- Size 19KB
- SHA256 c3f61f3acc3a30bab418d0d22a1fcb1a601def43241d7ccff733efc7b264e07f
- MD5 7de5a4d69445eef12a92998dd3b30d68
- SHA1 c37f0930fd6a4005a16bf670ac460bc6f29d18ff
- SHA512 1a18d2c2bf4ea14112a671e87464f2e2d8db11190afe296515e8b7fa57c60633f129b041308045fdbf4ef87cf625bf4d35841cd7d4f51aa8f8d66d682c11c13b
- SSDEEP 192:jmufKf6kF5y+vtmmmi3G6NmHKJNcAcCajjbG+CRWluntWBVe/yLCiMkmnCT29Qzq:CRlF/d3TNLh4bGRWlutWQAwC0
- TLSH
  T17792FCC4A3A2C84BCCB0117955F1025A5E76FAB376D307022B7F98BB549C75CC4AD3A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  pytransform/_pytransform.dll
- Size 1.3MB
- SHA256 d66c934fa2d5769d13e13fa80a079460e37b111277557f50d0c7f6effc41939a
- MD5 b0ff582c5cfefb1b57fb10cc396e4229
- SHA1 7a47b833d6ae4243eaf39f9e107d81a4d35a6c62
- SHA512 2ab3213a411d783b7254d6c8a09bf00858699f8aa5e872a120e6da246faaf0c63708452189a015ff7dac5ad146b3f1faaf37728fc60252b4f5b4f8af43c2bd49
- SSDEEP 24576:4b3t63f54CGqLkHmJFZVyOFP6WH9AkhzWoJaJSOjblM8hjvZWipWAZj2MflLreuM:66rQHmKnLRhc
- TLSH
  T12D55D52AF7DB01F1C52E2C3560A6A33B1A3D31C1513F5E429B54AE9BE6DF20059E8772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5