a1e8f9c4136abb396c17b4a6ae2689c65b71fea602b17052bcc4a12c7fee35e0

General

Target
a1e8f9c4136abb396c17b4a6ae2689c65b71fea602b17052bcc4a12c7fee35e0
Size 375KB
Sample260816-e38qrszcmb
SHA256 a1e8f9c4136abb396c17b4a6ae2689c65b71fea602b17052bcc4a12c7fee35e0
MD5 e6751d295b62b716898c718feda0666d
SHA1 3cd6448f3f78d383cc01706b6c61ae09f3247dfc
SHA512 4e9f73dc34421947a749640412f1e9cd31ca75e73437c1089610b643d8eb3c5363b0925c91bd4e5a6cba0e7b8db189bd79e59b38315b25adc6c779a2c0cf66bf
SSDEEP 6144:Q7hINjyoHGQAYODMELcToW4ucftnRZh3/Tl1K2J/933ayKfjbsiHQ3xoBaRfel+0:QMjyomQAtLc0Whmvh/B5ZK7kh6aRGgb4
TLSH
T16F84237C853D6883435700BE1A7BD8B0F4E8FB5635551902026CE6BDACE5CA9ACCBCE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  setup_ramsaverpro.exe
- Size 609KB
- SHA256 f5503f8ff547963d44c82806d0de34f76181e158192a232dd073512604f3a798
- MD5 c73ae2526bb00708a6531a5b36cbb7e3
- SHA1 dba77e117fc1611bad3d906f1a501643b90d63b6
- SHA512 6e9dde2e7ec16cfb17391ed514bf8e621d8b468c08882b13d82429ff51c39b6f621c4fc65d05dc882749d87e6f40714487fa8ce9977dccfedf31c4024ba1dda9
- SSDEEP 12288:V3wVSX7vL3WvL3sLqGpzrLqc1f9mxD3dMuUvCl:l+SX7vSv3azSc1liTj
- TLSH
  T1CCD4AE90A989C8A3F5292F3049B37B348378FED47E6B731F7D007851CAB2BD45926496
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2
- Target
  去脚本之家看看.url
- Size 124B
- SHA256 c4965fa0cf71f391518797b3cc3b7ffef0ec991c5266f5f9cc90298a7da7e1da
- MD5 9d9c794d654383c012286b258556fe46
- SHA1 8266c2159f57859ff102df419a94157a2ccef61f
- SHA512 28b9a9519a0fb7e826adaf43e76dfd11df323f20ab3089ec53c6263a51c06635c9d0b0a325cb7d20f7db42734dc257666e77d63be620aca34cdb13b766da9bbe
- TLSH
  T126B012EC6A45C29BD372D80B71F0FD14A80F7DE088C2D5DC6680DD8A6C850C0D48AF66
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  服务器软件.url
- Size 112B
- SHA256 c85359e7af5e102716e42f659fd5c1931b553761898714ccbb261883a03f40e1
- MD5 db4aa2c6c4e0555b3968690756e24836
- SHA1 96933b815ecdcf2fd43bd2ef036260029a633801
- SHA512 6ca491f92f9990d706b75e7ff091f8c025de7d9dc438aa25cf6e8baa87e750f6f0490e9923d82aa00ac074b572468349ed52c2765ec1fd3183a9ea146a2ff5c3
- TLSH
  T133B012AC6D44C29ED152C80B70B0F844A80F7DE048C2D48CE590DD8A2C05080D487F56
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6