9576a34df3a68f9016e65b3d8ff8b3bdd8de97977ecb9fa0574252707c04d5e1

Sharing

Copy URL Twitter E-mail

General

Target
Sentinel 1.0.5.zip
Size 45.4MB
Sample260818-3agctaaq4y
SHA256 9576a34df3a68f9016e65b3d8ff8b3bdd8de97977ecb9fa0574252707c04d5e1
MD5 bd0973bf5410c4ec861b52ed7ce073e8
SHA1 1d3d932cf4b039c408a204d681dff96c39641911
SHA512 23e1e8698e9f39c81d1b1b654db5cd9be119c0a93327438ce3da8ea4aa262a2956233c600c5680f78741d3fc23e0fd8f7daafe028ef285d5dd7e00d2592ae2ee
SSDEEP 786432:JO4V/C9R3Nm8gE6gKwp5E1ixzvxHQz46H4mFDgMNI4GVMPfaI:D5cr/yi04BmxDNIWPyI
TLSH
T1D7A733032D8A5BDBE4ABC92635CF7803DA316487AF3DC3607E1756CAEC5EC612C6A544
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SentinelServer.dll
- Size 20.4MB
- SHA256 fda82cbb29dc2e35675a14e44bfa7757ba673a5312d88f984ab6cd47c3821368
- MD5 dfd0c2f4aec714c9974356afa2cc5925
- SHA1 cdfbbadc9f59e85aff1d1637708a629acee20eb0
- SHA512 4223457e0b7bf8221ffd3b301b6231302567d8e19fb009d7401ea3b29ffa1475e4ea6207f8a8dbde986752fd099b5d24cce98002f5be9d963dcd12b7271c14ad
- SSDEEP 393216:w+iBhiIA7p9k6sFMES5FkW14xPcT/r7d4xsDLDnIAMJQCq4R21oUEOHe/SjEGM3o:wIIW9k6IhUki4xET/r7d4xcXIAMJQCqH
- TLSH
  T1FD27AE425129B788D479ABB400B8475816FA0D05AEE1DA23538C3DCB36EEFD57B1B12F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  SentinelServer.exe
- Size 163KB
- SHA256 4205834622e111578874e707d1cbedce04ed4bd7cfc2d7ef5d9e239dbcaf0ad3
- MD5 9d4a15c52aa04eb84bf361affa095281
- SHA1 f10aa93e5c509f723117314c83648bbefe04de29
- SHA512 95e95e4af13cb8eb1e251edf9c38c383f0739c006854be029bc66a31cd425f2ecccc8c9156334d3c77970488b6fe2e5e85f69317a6a96d0aa62b8e853fa4aa4f
- SSDEEP 3072:5XwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZ82jT6MboX6bR:BlxnlRLfyQXN42D7JFb
- TLSH
  T1B1F33B03A6AC51FEE1B7D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3 behavioral4
- Target
  Server/SentinelStandaloneServer.exe
- Size 148KB
- SHA256 9bb1cdc905a75b0ba3018f7372911f1b700ff0fda1e4a52da7e84bbfe90ff14a
- MD5 ac1885293b72ff4c4480cc08e3df3a3f
- SHA1 e31b3e11c77f14d9be578da8dc09074f946e8b5e
- SHA512 718238513284648d2d8a1722bd2643f8aa9ea5e798b93cd24818e45bc6dfab179c9edbbb61980e503949ddf3b071253d6ac40829561fcf1823bde3e64543a624
- SSDEEP 1536:29YXnq9YamgiYSoGR6+k84vKqIzjiCBs86Q6LRwqzm4XqIY01NTJZ2bo+W26m9Ih:5qvmgiYSo4k8uIPzlSRwa/5B26m9Ige
- TLSH
  T1D4E33B07E6A851BEE1B7C679CD924C41FB7278594B71A7CF07504AB60E73AD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Server/StartWindows.bat
- Size 55B
- SHA256 47ba2d2d861f77de14faa3d90aee70bcbbec21669f97eaa1608ca63c80af2e37
- MD5 1d1799776629b0c119afea9118541150
- SHA1 b0e738bc2f2c2ce5a166601e4b4ec13110439e0c
- SHA512 3cd696167af7367609cd0fa3850ee85423ca5a3e8e88175ab185dd0106953bba386b8ff5b4f541e7902fa10bbca3a12e68794012ce8ee565563460de4e8ffb0a
- TLSH
  T10790024C91CE30535080811D566031C4160734D36A7821A61D4093127C545E32226019
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Utils/SentinelDownloaderApplication.exe
- Size 12KB
- SHA256 37a8b3a12ff6cf5e991365d3e84222f0d6e041cd426f99e0a65828676523e330
- MD5 e589ffa40fd5ec5f9e65bcaa0b25e1c1
- SHA1 18516c23b448d1495e54bd79d05aea9d2d96bec9
- SHA512 cbc2002721c4b1757a4fb2fed159fec32c90ee42afe2b791184c66c88a1845ffcfeacc5d37fb0e2d4556e925305f3fa8c5fd75992208f201e77d89528ba084b3
- SSDEEP 192:noDS/pl369fUf615YhPadC2dQHnHPiRksZAkWeDfjVvJLsgYVJ+KhGaHG:aKx69fUf6jYhic2saRLAkfBvJwRT+YGk
- TLSH
  T11F42F845BBCC8326C9BE4378B8F287804337F6155803EF6EB8D9745A6C577AA8312253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9