eec627bedaa2e6e469e3ae23fb881ee9f9e8c2467c630a8405a0258711755730

Sharing

Copy URL Twitter E-mail

General

Target
99 - hamster_easy.zip
Size 15.0MB
Sample260819-pg6pdswshw
SHA256 eec627bedaa2e6e469e3ae23fb881ee9f9e8c2467c630a8405a0258711755730
MD5 3eab7f9e6c656030bece61153ff736bc
SHA1 19a94b6459e61c291b10ad70b6fb9089f4e0c21f
SHA512 f26fdee84a0ba7f6a5975c713e8080b0af8ff992d2d25ee046c5e13d6d8c3ee21c7aa16541470c73ec0726a0fcd190c03852f4cf2e096bae1bbf7d1d692e8a0a
SSDEEP 393216:z2JYIQq6tAFb/dJidTs6dUaWTm0oQbhh37Up+IOSnS:RIJTWsmUax/Qbhh3U+9
TLSH
T16EF63389306BFE89A236B97FE52E770245DFB7E33C5BA9E811E5C09430DEDA05201749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  EasyInstallation_v3.05/FDU/Hamster II_III/Drivers/x64/NGStar.dll
- Size 102KB
- SHA256 950a957c3a7d70b2635cc063f0ba105558ca4f832a12e31f31151a90940cfa75
- MD5 56bb23d9062b0375899dbb3a5fc304a7
- SHA1 e48ddd330a83a8da13cae0ce2493b2bfdd2c0e11
- SHA512 85f3bdb5647d4504e900c109a3a313075dee6c26630cf655efcbe1257294b76412ea890f54fcd52aa85dfce60ce5f4df673aa23fd0d8d43ff8d776b238b58a65
- SSDEEP 1536:QnNNPN7KGTdukhextIjCk1pqH5fGrtOkJ8PWNUGUMGmCsa6EMgvfHutXdniZiA0w:QVKGTddSDIyGrGoa6Jd20w
- TLSH
  T1A7A32A82F18442F5D06AC279C4966F67E772B0454714A3DB4391863A0F23BE8BF7E729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  EasyInstallation_v3.05/FDU/Hamster II_III/Drivers/x64/NGStar.sys
- Size 26KB
- SHA256 4542b20be7adceb61fa5f538fed8c395951e775dbd7c4a2f7c6aee477c4d924e
- MD5 297a9b187c6897749bc7bb92d02e95c0
- SHA1 3f102ab63f53869309443b5de9c9416a5e001284
- SHA512 9c2709169840762d1dd3fb9d71b4aa2111059885daf02cf13dc6f14866a8d569641366fbb0b64353213fced1ba52e69cf4d9a537bb4a76e3725146eedd18ae46
- SSDEEP 384:2/qXkU3YjbK7zAJENR4F0j+FHlYA7XXIW2lZ3H1ZyMgqjXKWGuv0K5TJZd/aYxMC:8oN/Mm+FlYA7XXolZ3HCav3PMrO
- TLSH
  T14DC20BAA866E559BD8A3C271EB304B67DBF1B414933827CF23D889165EA37E05D3C350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  EasyInstallation_v3.05/FDU/Hamster II_III/Drivers/x86/win2000xp/NGStar.dll
- Size 88KB
- SHA256 359d24a0c85a2a5bbec40a6c2a5a13a0dea1af3918d3959d27dbcc0bcdc7ebd8
- MD5 a99ee591017a621ec42f389f4b5a9f5c
- SHA1 ce06221c5b587233e40842ab1e14ab1258c7076c
- SHA512 d04f90b4310e03c13384fce55482dc892621ebd19391d3cecd2bc1c34b0c20e6ed35ec1660a6ca4ba98aee5d4e7ff33814f539eb58e4c2ca3b27aa1ecd654697
- SSDEEP 1536:XCpzV6U54JGi5eDcbjR1lBe8OUAVtCSEHXAtGomi2N7IhlnFDkNTyDfMwLrMM:0624kcbjHLe8OzVYSEHXpor2UFDkofM6
- TLSH
  T1C8936C41F0C601F1EED7AA74502F77329B359B0252A19A83EF64DE7D5423113FB262EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  EasyInstallation_v3.05/FDU/Hamster II_III/Drivers/x86/win2000xp/NGStar.sys
- Size 22KB
- SHA256 552f925efac9cfbba2dc398bf02e7769edb99db62052f09c5d1ae4829f3364a9
- MD5 78f36e27a3332d92241a4aac75799e27
- SHA1 fd10cc5305c76080e17c77adb39effb8a27e6ab4
- SHA512 27c6b9467062e84a2d719e3a30f09e99986e989b1888971204a580225be86f5cc6340343b6fb40dc37c72a1f630cd6171f0f7e0742a3e7d454928014129cc34c
- SSDEEP 384:rPnvUh+oOrwBaeDkAOzvvbpHRyKRT1sQE5pEksxO:rPnDrwBaeD9OzvZbRJVE5pE0
- TLSH
  T1CEA2D6CAA9E644AFCA76CFB1CA1B1777DD62513525278329AFEC65CD2AD13247C0C203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  EasyInstallation_v3.05/FDU/Hamster II_III/Drivers/x86/win9x/NGStar.dll
- Size 80KB
- SHA256 1930a1786768a40e38d5f383fa458ca7c11fc98aec7bf02c9cefb11a893660cd
- MD5 cad2cac6086d1bb3164c39b744329e93
- SHA1 9ebeb3f771c1d88ef2117518276283148ff834f9
- SHA512 c9574f33f9821773443acb2eed560961d01c2ab379158b59d86f69246f672d9b9155fc4c01d2d213f19db964b624e69a028ee038ec7edc5924db8277282393e1
- SSDEEP 1536:ZdOnGHZ4IGi5gdrfyQBe8fU4hnTa9gsj45ZdWNB9ShziLZgQ:mn4Z4PrKee8f7hTa9js5ZUShziLuQ
- TLSH
  T136835B01F1C200F6DF97AA71502BB7766B399B0606E09683CF65DEBE5C23153F62522B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  EasyInstallation_v3.05/FDU/Hamster II_III/Drivers/x86/win9x/NGStar.sys
- Size 33KB
- SHA256 4763f594be2faa9048a5dbee0aba8773ac6ff6d9cb2b76e408ffc6e094acae0f
- MD5 bcaf91e4717ae8e11ac111e4f173de98
- SHA1 f8571351831f6976d1d4e9becfb78be3e00c6963
- SHA512 ec73fde53484ba9de0f9a05a2d0bae3973b937cbcf8cc0442b50eb33fe4c02b3e5896b79b58f42e488bce7957b23302b96b0ba77378686ac39037a3e763ec8c6
- SSDEEP 768:l4/HhaOuoCTxAj2kOZqQuboSvurszXVHEmDNZ:lAHhptCTCazqQIoSuszXVHEEZ
- TLSH
  T1DFE2A4D217E16C4FC771C731AADB2766ED29DEB0D6139B367A9C14AF4EC17A47808A00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  DotNetInstaller.exe
- Size 5KB
- SHA256 201b7ac5dc35f03b051bf7b599eb35bce96b24b468d347854038d6a01b452725
- MD5 d186d961e211e4fd7f7c3a02a864cbe5
- SHA1 1957aa61dca0bee7369cca48be318189c7940332
- SHA512 516f593cd2042ae69739622f8a1ac17545d9905c31f4571d2d3bf9835cd5c245be6fce4d696fda96c0be6dbb1c0060780595a4f63224d419cbb7458a0c652074
- SSDEEP 48:6rvdiMX7JBqVKk5YCfpZBAO8GPTUc4gQ+fzK/4hotiuLV5ZYNunoC8iwegMbMN0e:gdiMX7J0VJyopZwUQ+u/4FGZYZzsC
- TLSH
  T153C16245D7E88336FDB78F3EBD7336924575BB108DA2E76F098E050A68365208921F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  IKernel.dll
- Size 736KB
- SHA256 8f137730eb7330b72ade6b67d6c4b3d6793280423a4e29c53973662a95fa24ba
- MD5 594678e8fc20d430eb7bd2de53f8f307
- SHA1 0fa3e19b6444847f840b53786d92f2847c07959d
- SHA512 f2a336d69ed17c3beb7ccbcfdae6a74a19a0faa9a9cc342a072aee5257d5ab2c2bf7cd69bab429f6c44449cbbd1763bdb72bcd50dd82b5df3e4276fdae406b84
- SSDEEP 12288:QSbslrau4wtUPDp/1N4h4MBw+j23YyiDKNDJK+Y99qKNLWFUfHRAlkwVJDRlUcvf:QSg9auyPl/1OhkbJK+YLqKw+Jx+DROSf
- TLSH
  T1DCF48E1279A8C025F29F0172EA2C6BB8E2FCD6214D709A473F484A6D6F75D86C127D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  ISBEW64.exe
- Size 121KB
- SHA256 adea1d354a2f12deff495e62efdcd7b61238835d122770262603222d361ea5e7
- MD5 f60b80ee71d018e8659f7715be13aba8
- SHA1 db8448e3ac372d01934a2ce0d38101a25e067bc0
- SHA512 cd5a8537860539ac2c0e5bb090f92cbca855d8a8b5e03b7e95d6baff05bc0103fe4e37874aa297178b23b70b28e8c555028d1349de0063435424feb751a7bf01
- SSDEEP 3072:R3IkF10QPhOCyUT02w3zlngDZtBo0iNO+sI1w87QIa:R3IW10QPhOCyo02uJngDZtBo2I+I
- TLSH
  T149C3C5417B82EA9BC50A033142E74F2D23E2E3D55B73CB2F9A6193792E4F7855B16720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ISBEW64A.exe
- Size 62KB
- SHA256 0500fed441b3c2eab4492b2774daa1db751cddda3ef9b4d881cbd025af9ea7fd
- MD5 bb0f3eb5117f6de265e6aff38c2afa9e
- SHA1 8bebbd64243faebfb166cc1e28cf4bc46551a884
- SHA512 98874f16ce63d157562f8faf6f5c78763b79945023378c48b60a16cb892ffa8eed5b3921f1907eb2998b8bd78692224ca3ec568438e427bd8f2912517f1f7225
- SSDEEP 768:JkdxFZZLIQnalVAG0PiG1zuMxgnVQH5G78rzfoEC8DKnvgvgXIwBMtxC:JIxFHbBlbz3fjCtQZwBMvC
- TLSH
  T1FD534A97B28880B4D067C278C5D26B46E6B3B0601BB157CF0B65822C1F37BD99E3D7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  IScript.dll
- Size 268KB
- SHA256 e554dfbd961b65bc95250a3be7f6829c42880a4d6e320720750fe9bb68b04321
- MD5 887e758f5267b616905f0168b39d16d5
- SHA1 af5e36264f96965805c90d6f79fb59982f2da25b
- SHA512 c7629eb4c217731b572c155ac0d1248d7f33ca4619a1139447224a2f0c4b168b53acd63ade2742df1b08087b108363dae75d2c9108074156819b8fc84555d6ef
- SSDEEP 3072:Q19erZb0pFtwqwqrDEyWxQxAsoTOfJCUApGG8xMyxieDWrCktcrwoNkwEEGt0BzV:QOuDz+ZOf9ApGvxMa6e93kEi6LyHbGX
- TLSH
  T162447C1238BCC475D7EE0B31FBAA6B79A2FDE2105DE2C8435F88095CDE37945C52252A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  IUser.dll
- Size 180KB
- SHA256 1624f26f935ba6def4b42642b1e93aa2688d9b5af7f13f593d68ebb33b8f4660
- MD5 f77a9df6057ef2998e656a236b08e768
- SHA1 d54eb3a96c72a53b71fbd0562324472c5226c9d9
- SHA512 c28768a2c8e4f51a82e1c0fb343e2e4d6a1ad93b9aa398d539b1ddc1f295fb6c7272b4c148a6ceb85c068dd0b31fda29c024cea400093ca2dd66b5f7d8ce564a
- SSDEEP 3072:yP5nNz7KXn8H2BkKczSyLCWzJCnTzXHwJjoc9Q82wc2un:kNtKg2riSyV8nn3U9QXv2u
- TLSH
  T16A049E137BF0C07AC28F02BF59651B37A7FBA6244FF059878B148D8EAE75A61C522153
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  ctor.dll
- Size 68KB
- SHA256 027c07b861ed408c7bfe6cdd5c26c2440b1b8e9028bf28062257cd08bd2130b9
- MD5 34fc187d14c58d715804983399f5faad
- SHA1 cbac7b4ce6e08fda00243e3df51a3e055dadf3db
- SHA512 325efb47e9a86cabc9af228dcdde5613669fdd872d00430e9081ce7d07b0deea19beffdcc8fecb9c1c8d0a2e8f7e6d969b1b2cfd86e3edfed1aa4ff73a089ba3
- SSDEEP 768:4TM6wC3QMDXZKC+nZN8XTA1WMN6WvdTFliEyNVu5rnvjsyTw+GBPannbHjsC8bgC:0M633QE4ComWXgsHcEr4pbp
- TLSH
  T169634C1B23E385F0E3A73332BA593F5D11AA2F1522E193168F5349E73C32627C666947
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  objectps.dll
- Size 32KB
- SHA256 c641579c2686999689df03cd5b8e79c25ed11c0dceb2ecb4c5a03eaa7e25b52d
- MD5 b6d770559ec6b834bb2357fd5deaf218
- SHA1 3558009a7bba8ecc9aa5e7188efded352ffce329
- SHA512 2e953b1fd55358a4a6b10a548226fbadccddff494a8f90f34eccb75dbc85deae0b1346900f55c103cb80e4eb6ceae2e64240e83df1aa4df9df7e6ca899f5afde
- SSDEEP 192:KnlX6cRWMxG4RMG180GoxMOSkA7sMC7znkuAOt:o3B5Mcz6sMqgAt
- TLSH
  T1C1E28612EA7699B1F68A40343C761577663D2C3508E9E073ABC2DD4E287D2F3856EB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  EasyInstallation_v3.05/FDU/Hamster II_III/setup.exe
- Size 118KB
- SHA256 ba4771a2fb260d697f7dc4ca7603ec927e969287776bf1bafc28aa6693ca13c8
- MD5 bef1e6a9b97045ec3f2b9cf34acb6810
- SHA1 951681061079a820f02e4c62e4b9885f98da6d0d
- SHA512 b38f4d40627bdda7e56ade48298e378797ca36340861f6defab5eaaed1b41123eb8f6e5deb19411f39ccd202c54f5b311874e4f05775df4ff1768f01f2d5ffa9
- SSDEEP 3072:hDr7a0seyUpc3V0HzAhUkPiVpipJec/IMcK4i3JvGoXCno3:hf7YeyUpc3VizWUkzwm4E
- TLSH
  T1E0C3281277E1843AF2F31731BD7926B64ABBBC311A38C90F5364264D1E72AA5D664333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery ransomware
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral29 behavioral30
- Target
  EasyInstallation_v3.05/FDU/HamsterMouse/Drivers/x64/Venus.dll
- Size 259KB
- SHA256 e9c36347a5aacf1ff17351faaf41190ea676ceac8452af936eaa4c8c953d6b3c
- MD5 577c2fb04422a5b8be8ad8f68fa642e5
- SHA1 5482db46b919f4e770aaac6632f2ec217ca9fbe9
- SHA512 ddc311e67cf6882ccbc6c75c9cdeaef31652c391ca1b596d4c96d585d7828e951480520b5ab7bbf10ba299fcf6bebe370351ee5676a24d6215b7c8626f9055df
- SSDEEP 3072:nPZgnFdHKt0OxVQWZy5I4/ZgqOCtpv/H0pdGMl7fJRpp6nq77dGv3sLUFu4ctAtZ:nPTXZlMZgRQJUvG67Z77datuLtA
- TLSH
  T1BF443A9272944DF4DA7FC13AC9828B56F6B274100325D7CB93908E2A1F277E5AE3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Manipulates Digital Signatures

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32