484e4a6b37f0516dc94209ccd60d6a6bc1dc075c1acb17a2f81d21e57762706c

Sharing

Copy URL Twitter E-mail

General

Target
Clannect-Setup.exe
Size 79.6MB
Sample260819-2hzzfsvdnd
SHA256 484e4a6b37f0516dc94209ccd60d6a6bc1dc075c1acb17a2f81d21e57762706c
MD5 5b0246d0e3256b9eb739f99587f0a21f
SHA1 3e6d37855b26d73f2057732588514e7149b37ad4
SHA512 a9f4aadbbf97123076302222cec627f398154b01c46daab68f5630cef720b1a86617a698a09f16cc9126a586f94247bfe59987c4961252c553ff0beb0024ef1d
SSDEEP 1572864:DEkSyS1pRYMAYUcHLllF2blpzDZvmTZoes/p9cj+yDKRDYym:DEkSySuYUYLlqb7fhmTZnj+yD4Eym
TLSH
T1E70833C6509FA0F0CE5A2DB156147172C09B6CBA96E0B5A41C49327FF0BF496F5BCB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Clannect-Setup.exe
- Size 79.6MB
- SHA256 484e4a6b37f0516dc94209ccd60d6a6bc1dc075c1acb17a2f81d21e57762706c
- MD5 5b0246d0e3256b9eb739f99587f0a21f
- SHA1 3e6d37855b26d73f2057732588514e7149b37ad4
- SHA512 a9f4aadbbf97123076302222cec627f398154b01c46daab68f5630cef720b1a86617a698a09f16cc9126a586f94247bfe59987c4961252c553ff0beb0024ef1d
- SSDEEP 1572864:DEkSyS1pRYMAYUcHLllF2blpzDZvmTZoes/p9cj+yDKRDYym:DEkSySuYUYLlqb7fhmTZnj+yD4Eym
- TLSH
  T1E70833C6509FA0F0CE5A2DB156147172C09B6CBA96E0B5A41C49327FF0BF496F5BCB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  Clannect.exe
- Size 182.0MB
- SHA256 c448d849e1a03fc036211d177624c22837b6041537978b95a60c7593e19475a2
- MD5 8185ef22a6847049a749a4a23894b931
- SHA1 43d94d95e6cfa28a3980dd01355957903886abca
- SHA512 ec185169c140f7f30505cc9154a75a753e5d1898578eca152daad015abf411ab355258bbcf5575383f341a7c106408384c69da15c0a6202ef3137019a8c2f4dc
- SSDEEP 1572864:ANKPIpfjC6kkZAC2TjEtxhyd5j14HbD6OaFSxqVUeu9Rq29EmoH7SesWVYpap+4Z:LY65t4TV
- TLSH
  T177988B03F39A40D9E01DD1758B8B9633EAB1B8854724A2DF275407562FB7EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral3
- Target
  resources/app-update.yml
- Size 101B
- SHA256 b0360a2554d8805b9a57363c3c2e8af5d935bfa8d16f7112fc6368cf37552639
- MD5 c2eb245b1f8cfe8ad7572d024b22313e
- SHA1 a8df2c8f9421d592118f19fc6becd5ec88a20cae
- SHA512 5b33552f3f080d49c8ba54bd2d1d66c41c4fc105dc8847f95701a6bf72f8dbe5e1eac518d55ae40aed1ee9ffa4d9e4534525ac7064ad36481d4055a89b8b2b68
- TLSH
  T163B0123DA32EC0320337481CB4018820A1BC3C51E0C1011040D900F881B2A0008844CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4 behavioral5
- Target
  resources/app.asar
- Size 2.4MB
- SHA256 c1bde4f647fcd8fd3c8419c8884c21b4236e6e5410a09fa030b67ebc7e6f94b2
- MD5 d9cedac2067597816bb532f60be0bc26
- SHA1 5f3440e9fb8fcc096b61bc00dfbb64f4c2bf8872
- SHA512 ab1f6a27b1e16aa78a5d8a57a0fe0c8fdd3cdb235d87bb46ab7da946c8bcd51d0855a7863c17babf1b56282dd1fc7c5b086caee0d76a0f2a9a1fa96a9a16f299
- SSDEEP 49152:vvMZFlnhbYE7IgsiUVUuInkaNI8QFThAVFhzA9p:elnhTUjIW
- TLSH
  T113C5D74111EFD0728B5722F6198F1062A926A41B1945B8507C4CA25CF7BBF39F1BEFB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6 behavioral7
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  $R0/Uninstall Clannect.exe
- Size 516KB
- SHA256 a4e2ae8279f42c2906d35f97aea4c455c49c8217e705447f71a89a674580ffc2
- MD5 b952f41559d4c9afaaee16c5cbf3cadc
- SHA1 1d1de8fde9e71d7b7c9cb4b96415922189ae9286
- SHA512 2e4523f76f76b0ea93f4e574b82477a5ac34c39368ca8291a2e566ff9ad5b2609ce4aad2be94dfde76bb37b505540e8a55f79f64af2df2c8b2d9325fa9c15283
- SSDEEP 12288:QGw6Ln0X473IGfBUYgQXfozXsn7CLRKJj:QR+0X473IGfOYgsfozXsnoMl
- TLSH
  T161B499D6419FA1F1DE5B2AF152107532C09B6C3A99E0B8A45C49317EF0BF84AF47DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral10 behavioral11