572dd00f056c42e3755aea1a1a23e6355b910e2a2b9e3feb03e0886395d1c755

Sharing

Copy URL Twitter E-mail

General

Target
BobLimt-v1.0.5.zip
Size 767KB
Sample260816-ykm6wsff26
SHA256 572dd00f056c42e3755aea1a1a23e6355b910e2a2b9e3feb03e0886395d1c755
MD5 48e854a3c110a35d7f53062009a8d276
SHA1 b6261705b011be8ab5ad0234b3cbe7802a169f79
SHA512 de17dcd6cbd83110b6614b3faec5e08bdeea0da52a245a45d191c6ba1f3673619e7d51858a5ec15b4c1bdaae7efad07273916b4452eb6819699f00c8c6b0908f
SSDEEP 12288:IGF4dlznhUnRTa354uyZKLYp1oO2m2+1cMcgOTFN/pp73lL3NZ6E3ZQgi6NSmHI1:IHwR+35SKMgO2scMcgOTFB73lxZx3DiJ
TLSH
T1ADF4237FD7A8BFF1D2D2CF3F685C81427516262B98DE5A4A353CB8258BE2091314A5B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BobLimt-v1.0.5.zip
- Size 767KB
- SHA256 572dd00f056c42e3755aea1a1a23e6355b910e2a2b9e3feb03e0886395d1c755
- MD5 48e854a3c110a35d7f53062009a8d276
- SHA1 b6261705b011be8ab5ad0234b3cbe7802a169f79
- SHA512 de17dcd6cbd83110b6614b3faec5e08bdeea0da52a245a45d191c6ba1f3673619e7d51858a5ec15b4c1bdaae7efad07273916b4452eb6819699f00c8c6b0908f
- SSDEEP 12288:IGF4dlznhUnRTa354uyZKLYp1oO2m2+1cMcgOTFN/pp73lL3NZ6E3ZQgi6NSmHI1:IHwR+35SKMgO2scMcgOTFB73lxZx3DiJ
- TLSH
  T1ADF4237FD7A8BFF1D2D2CF3F685C81427516262B98DE5A4A353CB8258BE2091314A5B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  BobLimt.cfg
- Size 4KB
- SHA256 3de0fec3245d6895211cf13fd3b8e2fd5dbdd0728364cdfad673273e46860846
- MD5 70666dfdc28b5fa0f2dd4e3008f7b6b9
- SHA1 bc3a50da3302c99f1d3a0acb149e2149f561d953
- SHA512 45c9c728e2870e612386213e9047b238d103fd4a97b22d9a9cfddf95c4c8395184589e2c4c5c57e31bd2376ef97db1f9ca94120e1e21189e08fca8709b5ab115
- SSDEEP 96:5yZBZnaKON91b7EBNsv5vMHc9DqiTBmjSpz7zqzBzwzD9:58vnaKON91b7EBNsv5vWc9DqKmjSpz7J
- TLSH
  T1DCA18840EF20ACBD327E603907652B5B8B7013A35626685BB5BD4C0FAF7E3172056E83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  BobLimt.exe
- Size 956KB
- SHA256 9ac56b35cdec7af4a511b3bd17f21145c277bc0b9f6817e718aa5a7d570111c2
- MD5 99cab5722a7d01e580a10cbafd4a881f
- SHA1 7176f3a1a5c27d58aa7780694af7a00849250ba5
- SHA512 4ce0229df3305b64870a3519318f18074943316b8293c344e8c451142fc09702d0a001e20ebf6144ab5e60de92722ead614abef3777731512faf6141b646d774
- SSDEEP 12288:T5oS0xAFMK1UmOD7TvXQYKfBgxvVYr1bYBeJinYgLlWVFqzLgZcggFH0p7Jz:2S0xaODfQ7BYurQeYYgUVFqzLgxgFHe
- TLSH
  T1FC259F26B6A801FDD177D2B889565906EB73744A0334AACF03D0CAAB2F176E45E3F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  MapleMono-Bold.ttf
- Size 259KB
- SHA256 e0623db6219886ce8906f440b9668acc7fab96b94e4036ac7a27809cd4bb72d7
- MD5 9c4551d50b0ed46770fc4ca1d13e6fbd
- SHA1 b2aa8cfa9c754f910cce384061064eea7a400208
- SHA512 7d21c65e55576c6c71f05302d9f6e2d55f0b8368014ef00d037e00695c14a43207eeccee3be1afc7459a5a1cd41aec220725d3c6be361b6131cbbe6b19a7ef23
- SSDEEP 6144:N7bDlsteaff8Q9Hz7JEIG86XNeKWxpGj9r797kTl3cI0lxVF3HjHJsI4b4:N7bDateM8Q9HzlEIG86X4KWxpGj9nFlx
- TLSH
  T14444F70BE3E1DBA1D7175DBA4B51BB72911A2E3B4375930E804E0436DC9ACCABC4D5CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  README.txt
- Size 5KB
- SHA256 c8e8e2b16fa75b0a83b8aab33fe088989191d4364bff3d2fadb574b50a647622
- MD5 0c478c74abf954474ccc239445983634
- SHA1 078366962dad104fc815ab7b715e04baac254697
- SHA512 9d37395f7edfde7597818c8f5aaddfe0e09980c2421b4e9afba31fa1e7277c3b4382740150b8077ceb14139af709979c2e622c1e72c07abd6906e929c9099991
- SSDEEP 96:5S4HVhTUILQa/Hc8edCVr4bhDao3iRTNxGry/f:7T/Hc7CVr4bpao0f
- TLSH
  T1C0B172836E6113760627C022758EA1F8FF06A8AE52321975549E8148C3843FA97FF2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  qbtxr54.xaml
- Size 141KB
- SHA256 a3f840f26bca7397be06cc94591ac1edc508720d0d9a619ec45692e7d12d4cfc
- MD5 7d0708fc46564ff77fb4a91fb41c7928
- SHA1 496bde651a2230ff8543deff29678c5b8ccc6764
- SHA512 fbf7ef4ebb2da6297ca85f70773b95a097c3471f0906857b37a11c2bcdb223800ae74c07934f15428875ffbeafb8e9a6ab0c0a4c7bc38a91a6576c0c8b8ac8b6
- SSDEEP 1536:Nqhgejz/WrH0F4cmj3zODbSOBkYLni1ZVdqy9Zsefj5h5z8cDgWHZ31w:Nei9u
- TLSH
  T12EE3D7FE6B8C8DF8ED0FE7D5CC530495790D24BF29419779C2999A0376230ACE889C96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware persistence ransomware
behavioral14 behavioral15

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15