1e5d675e3ced0b31d01b3604473a4f244e47418a28ff3c983db6725165ed8bb5

Sharing

Copy URL Twitter E-mail

General

Target
UniversalTriggerTool v4.0.zip
Size 36.7MB
Sample260815-xa2qvssblc
SHA256 1e5d675e3ced0b31d01b3604473a4f244e47418a28ff3c983db6725165ed8bb5
MD5 346832249fea03921b6192c7c025c1aa
SHA1 21b31fe3525191307ed416990fcb0bccc14d6c00
SHA512 0a7d0f3a6ba50faea155a66e2f135e11dd42d7309fa64e57eb23b943c45d51329be206d833016ab2df36a8d8635146510701cc03b61ad164259683ee8a699073
SSDEEP 786432:qynXKhgHVCrhs/IpKxezwei4TQyL6pbQ5cdTCxqie7qfNVwE2fPPbKw7y:qOX51Crh3pLUejbGc5kCxwmDwvPPW
TLSH
T1C3873359808CA2F0B52BDB0C54047C1822C0FB6FE9157E68B658DB533F4BB9369AC776
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  UniversalTriggerTool v4.0.zip
- Size 36.7MB
- SHA256 1e5d675e3ced0b31d01b3604473a4f244e47418a28ff3c983db6725165ed8bb5
- MD5 346832249fea03921b6192c7c025c1aa
- SHA1 21b31fe3525191307ed416990fcb0bccc14d6c00
- SHA512 0a7d0f3a6ba50faea155a66e2f135e11dd42d7309fa64e57eb23b943c45d51329be206d833016ab2df36a8d8635146510701cc03b61ad164259683ee8a699073
- SSDEEP 786432:qynXKhgHVCrhs/IpKxezwei4TQyL6pbQ5cdTCxqie7qfNVwE2fPPbKw7y:qOX51Crh3pLUejbGc5kCxwmDwvPPW
- TLSH
  T1C3873359808CA2F0B52BDB0C54047C1822C0FB6FE9157E68B658DB533F4BB9369AC776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  LICENSE
- Size 1KB
- SHA256 3f272974699b49c2039314f1e149fae7c92e3f4bfae4322c9e40c88b5071ebb6
- MD5 4f672df30586ccab40a9a07a3d5cb077
- SHA1 c58f9f281dd2e03e4a016d36e996d9f3d5f4582e
- SHA512 74879753a3cd0d43f04521ff022153aeab1ca7725164438fe0d13326775af0613f8ab5e18473fbee1787ae85abd59e9e5eb0f69639c874a5909d8468c635d404
- TLSH
  T1A811861E72500762289A13A055786CD5F13BB25BBE6F2A84146DF345233B46CD5FF840
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  UniversalTrigger.msi
- Size 36.0MB
- SHA256 a30d5ac88dc03ce2b3711daddd5f535cd524f7a1ac9a18ea910883d67b46c343
- MD5 8cee98a1392c2da596d474458ef6ed31
- SHA1 cf9835067f3c4054365a3dc2acbc5cc710e15ebc
- SHA512 68c14e8864d4a4631dfb0778fbf7833e12a2685b13361655dece2d0dc322f7d38ece9b020892dfa814aef20419ee01f1a5e2fd7f0c9fe8e397746d4faa388c9f
- SSDEEP 786432:1Kc+9IRIsNFZjHIiqoIuyURxO0WmYVfZa31YkYGHdopLN4TCxmH8MqX0/K3:1KcbysNF9IkIuDw/xk3KGHmwWY8j0i
- TLSH
  T18E873369C08457F6E53FC43C89946E4856C0BE1AAD03AC6E7458BA4A3EF77B270FC194
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral5 behavioral6
- Target
  tests/basic.cpp
- Size 12KB
- SHA256 4bd0fd5fa6dc926e82274ada64a374e9501c5f46410135e6b6644f401bdefb62
- MD5 1d6c4b1a1e6d2289ac93e02d9d0e83df
- SHA1 e58168224b6489b43b279c9921c8a0e119aa4f90
- SHA512 a27fa22677509314f12f1f2ca8935291502fe22cdc83a1f4864d4e789bf5c9b48efdb987c66192b0bff04c60055ce0e6bdcace7dcba90f46a8cef2900cc2f222
- SSDEEP 384:S8szLljLcWBR829nVhysqkRe1ZBLszvIReRb:Vs5cWBR829nVikRe1ZBLszvIReRb
- TLSH
  T1EE421E29D8F66A008523626187771E4630429FD363D5DBF1F3BE92FCDF2A4B086A4572
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  tests/demo.cpp
- Size 3KB
- SHA256 6f305dc891a8f215dcfaa3ad7c730bc7393c5d28d05b6fd2204da0be9ae80913
- MD5 d3fa0c7cefa4bdb7868ea1f78bb78653
- SHA1 d18b4bc8566be7cb0140855864b891899b1c81b7
- SHA512 df9de368a2069115c2280935628af4db4356ce2e1122c5dbecbe9f5395e3c43fae6db7efabb71978c7283d4ed2a87c88f573a97898c2312ac7e15c55fffc14b0
- TLSH
  T1E781FB6083FF3CF7483345A2EB9F18414802D686A7E5C7E5D17BC098EEC10199AFBA85
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  tests/example.cpp
- Size 705B
- SHA256 1a118e9dadc7f97c000bbce642787fc0b788547d5e02373959c9963dd57ff46d
- MD5 9f4dc4cbea5d477fb6e6fdd8a7d58547
- SHA1 4ce3ad92a838bbc55f88ec14e38821c53466f43e
- SHA512 fffe10b6ee0aedeafcfd992f0c67526c31a206a5f9a5f88f63cc4b5e1dda21e04a8fce11026acb1e8cfa9e6d92a6d6e2f226810b954fd2f8e82c7de2807045fb
- TLSH
  T1D7019CA09AE83D261813185573EE943236902346D1DDD9ADF0FB71B92E800726FF62DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  tests/main.cpp
- Size 54B
- SHA256 a333fa1648b63c461f8bfb8c28fe2a351a247beadae1652cebe3203cd0720d1d
- MD5 a6587a6174d49a3402f6e83dbc9d1231
- SHA1 fd8f0416dc7c57df4600c1311d2641bb25c3ed9b
- SHA512 e17a601ef434d9370cf7a4af6f454b0d206bb88859e55608c18cb337a68fec144db75ee2937174e996fc746585d64906365beb57a163eb50e7b99c3b3aa58e62
- TLSH
  T1159002714D9C40475095027A23195744C247DE1B290509714431F854595DD84106B1C5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  x64/Debug/dll.extract.7z
- Size 835KB
- SHA256 9fbf9356ab4f909cffe9474c7e4f283ccd89fe70d47ada602553ee85de4d2387
- MD5 c7a6707e1cad785dc8c5004c984189d1
- SHA1 e99631da00a7e23e84a44bbe38a7f8905bd47385
- SHA512 b391b9d3218c1ac3ab0b8173e2d3f10232aa8bf15d6f1c74451381a2a1c8d82b7cd93f9c38ca9029c6d8f3ee34dce00bc538c272019e4d81cd0640bf2788a866
- SSDEEP 12288:Ja/WFLQVVJ9gT7DWvvXhwvOCVrwKLEIsj5UPLI0Md4LEE6PeKBPVvgDcjQfbr+5c:0QUVVJ9iPWRJCtwKOjGc0IdekPlgrUnc
- TLSH
  T1DE05337BF0B8E6626836CB63485494AB87613823302331B6D04DB73E5965D37CDB9726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  leechcore.dll
- Size 134KB
- SHA256 e57b294e68b71f399b4f9cc06dc7299dea5050c8b9dd2c356dda4d0888a91935
- MD5 8c5317185149b9723aa03d5f478045e9
- SHA1 ee93c9fde72e2dbdb27da6ad7df3be27a6c2f3eb
- SHA512 1dc0aeab09db04a6f76df92f63265f8aab52e6cd80da7c76573be4f9d7539e8e5f28d587f5008336eacdfa837431d6a352b940be6ef466a14fce5872135c0f53
- SSDEEP 1536:5zv4dHmnTVXnNju9Nfxe2SBFIeWqQh5Wq/qsqZn/UnYPUznwgIPs:dv1NS9Vxe7PbWlluZn/EYPUznwgI0
- TLSH
  T137D33A4BB79520FAC8268179DA17961BFB73B41813105BEF06708A762F536E1BE3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  vmm.dll
- Size 2.1MB
- SHA256 1202ddfa9c5be85b286d7d6bb23fe3db65ba00a62c871856ec62b14e2a57225b
- MD5 2c62bdd54d95976cfa90d4f7103baba0
- SHA1 49b2ec9fa96f196fb2745a10e7fb30b23843782e
- SHA512 cf8a1e6aa6979585def02d47a61d676856b9d67e36f35b832b66120c8ee0b63003fc20ea3e23b4d0c44d1aadf03b147f60c1831a5849cc5c3830bc3c7479033f
- SSDEEP 49152:UKosX0aq4YmMeJ9TODjQQUxt82WsW8QPeujwTMUiR5rgz:hXI4Yb89TOQ1xR9nQW6U9
- TLSH
  T120A56D47B7A800BDC46BC179C91A5F07E6B1740523249ADF76ACCAA52F13FE2127E319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20