Extracted

• • Target
    setup.rar
  • Size 19.3MB
  • SHA256 4c766e41228e753ca2aac56fe5db8a2e2133692ebd13e6260a26b92bbbec7fd3
  • MD5 4f0fcb3d97cc7097f437e69944963b8f
  • SHA1 f5af74e31aebf172b0b1f01abd0c3bb33a47e45d
  • SHA512 9b42a77cf5d574da5b0325593da923b6ee8d878fa0acec209bc406269abc48b91b3e036edf494614b324d81a5d1557e77cf492b27d788b6a59d24f039b847c09
  • SSDEEP 393216:fT8DlcgJT/fZEY+GdOeafVp3gLxTuBN3ORNY4Z0VSzDa4Z1aT9dzOJmWs:fT8bJT/fZDaNpQ3nZgCnZovzOJs
  • TLSH
    T17A173369DE3CBC023F551B7A3D0A8E850C22DA33541AF1A995374D6EDE61938DCE1F0A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    bin/config_6696.bin
  • Size 13.0MB
  • SHA256 b7979a902440a70cb7504c92cc8d109538afdd949a410b4be67adb88c8bb6ace
  • MD5 9cfae0aa4a45eea822cb180c92c2bea3
  • SHA1 b152b3094200ba48893b5707757b9d3740c82eed
  • SHA512 a37b967cacb30dd57eb2f39af1098cd8aca6ca0e30d7b2f52b4d035928b69cda29988c310e671fb936ea0b23490c3313dfd3cee0fc1bf96a4b68437d39a45c9d
  • SSDEEP 393216:0NxVZIQLs6IKgTfXt9JYBxGkIYsZOuNPdtI8wnD:koQoK8ABuNvjs
  • TLSH
    T1FAD6C0F994203088E743C9D485E973C09C832554EB155465392B5A9AAC3AC3BE73BFBF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral2
• • Target
    demo/packs/content_8186.rpf
  • Size 2.2MB
  • SHA256 9bcb359ae04e7bbf184241c28829546fa6a42ae30d3dbdf29a98d26d28b08d40
  • MD5 c8db0458bc52035037ac28b0cc3069e7
  • SHA1 5195f036c1be6953ee63f696436f4c4a6de3d515
  • SHA512 5d2389c38bd03a672b0bde59e4f11644a4c6b2dafd8352d24f3050a32ce538e0275913ed53ef8b49e6d1d7457a33916005cda5b01b4254a7266fbebe26d86414
  • SSDEEP 49152:cXLaUYh/9eTKOyyc2B7nTaK7mpoA9nAsSPycqvUdB7suZI:YO1UTTV9TaK7So2x4x77Vm
  • TLSH
    T146B5CFA0A7B74DD7D2D2622DF46F3B6BB51628864E4D1469707F2FC34CB28161B37A80
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral3
• • Target
    demo/packs/content_8625.pak
  • Size 2.3MB
  • SHA256 c48c6045277fb97cb87e461f24e80817974c1c314dbb84e9942fdab2c69e0ea3
  • MD5 122c87a8b68b2e2baa1951916b6752df
  • SHA1 5828b000f0c8877ccffe0a0f59aa3a05e25782f9
  • SHA512 2a45b3d7cb377b705f7933f413b7ba4ed20dc0c8f1a968bc4ef872e4e90765d71d690c21e55fdd8af32dfd44df708ba43cc6f22a1af1f93fc18182ab4d4f2300
  • SSDEEP 49152:b4TpQkLFQ/py9YoiOMCs0nu6tQJedktTehinhRKJzN9kPaai:b4TDLF2py9nNnu6EDTWinhRKJz
  • TLSH
    T1EEB5D1137462230135397A6B1469A4B57C4BF8153C672C7EBF0ED423F4B8F1A584BAAE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwareexecutionpersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral4
• • Target
    demo/templates/info_7366.dat
  • Size 819KB
  • SHA256 9ef80bf60ec98a7e876f554343ab4382069c6ac61186ce77585bb4057e1e0a64
  • MD5 aaab4f8872c50a6495c94c746d3b74ab
  • SHA1 622926c2a7c1667086d6851aa813326a3ca47be5
  • SHA512 4fb8b6c0a9a96f65fc7f7208f45fe9d56696ff0555c99b2f712836ddf600b80734bc4e6127a9356d954bafa03691a5a95479b3530305976599b67edf7e6d05d4
  • SSDEEP 24576:AZ2YlnR5qvpWgNs1uHFdJr3ZlDF813JdislJ:AsYVRQ1CMHpzZtF81Ku
  • TLSH
    T1F105D04993281978B86F7EE340E35B72DE471AEB13CBB05EAF9C58D0BF449385E41642
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral5
• • Target
    plugins/module_2598.dll
  • Size 2.7MB
  • SHA256 72cc383ee039d2a5337c744268a6e49eb6c934d0705c39f3d6ea12b589310515
  • MD5 fb602952a514f6960feb784a2873c68c
  • SHA1 84fd40c25b353fb75813557914e89168ca279e98
  • SHA512 3ecce5b87f185ba390647d8d2720dc6c1e9358de71c43bc7d5aaded1e1369239335d5d91ab83fc7f3065f6f76cde638d096ece2a155604c940054de3ca7478bc
  • SSDEEP 49152:rADOW4PKx46aN6kvDv0wpQP62H9uL/M50XG8US1iET+Hr64BlVNwqYDY+sPnPcO9:rADT0848kvDrpQi2H9CU0bH+LjlVNwjk
  • TLSH
    T137D5CFFBD6081E89EBF48674E6C77290B1C3A492F3822414635D13D3E9B094A57CA7BD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral6
• • Target
    setup.exe
  • Size 983.0MB
  • SHA256 ab5049a84631f9e17a8cc640a594526b805948a11f959b81d68cef8faf0baa14
  • MD5 a1d487b5cc9fa6f8681df4121f08b38f
  • SHA1 d306cd755bd13c4f3dececeb05a90a2d759213a9
  • SHA512 39b97cc26fd2455a888468f72f9bcd53e3644b651a4d5d9100554fd8f3a5ddf06a1aed2745c3329d1b3b30c9831672a9dd141802a4cefb3af2749f59d80b5124
  • SSDEEP 49152:tNMIYw59DCBikqKuYPGZJjcAueci7V8uFzF8A:tNMIbeckqgPqcAuechup
  • TLSH
    T1DEB9232153D401A7D07E273689F591872A303C865B364ACF2AC4E9693F23EC9F57A71B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareremus_stealerpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral7