4d5e5650e420d671b32aecb959cc067a436c918db2d400b3614cbaeddfb96549

General

Target
99%20-%20ZKFinger%202.3.zip
Size 9.0MB
Sample260819-phrlvstere
SHA256 4d5e5650e420d671b32aecb959cc067a436c918db2d400b3614cbaeddfb96549
MD5 dcf7b9d94a97b61f765ee58260ddd34a
SHA1 654f6213555a0ab4019306d7fae431773b2bf4e3
SHA512 387c3e28728b525d65ea5aa59fa62ea2b4edc8d05fe60be2b8ea31147343a037eac46829ea2bc5a5cd6f756b94761a2e9c7d3190807212b1ca9713b1c99e1ff9
SSDEEP 196608:jwrORvHjyRCj7F/H6iX7es5/AdpMpOEeiLcJkYrtwZEpNUOrp:jLvJjxaiqYiiQJkYrmy
TLSH
T14B96338B3DF6191AC7A7D6FC36C8694F38EE2A6F9C0C49544B540128D1B7ACE7172A43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ZKFinger 2.3/Demo.exe
- Size 315KB
- SHA256 704b259006343a401b9ae330548b1c52f5e83e4526c9aa24a2f4a380973742e8
- MD5 cc708ad19c5a26aca8e796ce859e10a5
- SHA1 170d0e0fdbbb67723e972e8c5bc3d7d333a8a999
- SHA512 5d39502e12dcf292ec9040ebc9aa08833ac7ab8ce2c28b1efcf828beaa0c55bc77a676f9364371c0e23c812bac0d1b516ebef482df7a8c85a332d995b555de71
- SSDEEP 6144:g5kojmbNC281vCLVJ5bmgjowI7q/eInCn3gyk6WUyAjM6MKVlMHp:i28oLx+wIOWInC3j/hNIp
- TLSH
  T1A3646A1177D0D432C26231714B97D7B5A6AEAC316E25838B7BC03B3E5F741C29A39B4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  ZKFinger 2.3/Driver Digital Persona.msi
- Size 4.2MB
- SHA256 4eb750ab6def5c72cde2747b0e48a3301f3c54c13a62cea5399b815d5d86332d
- MD5 f50dbd2d567b2af55413b20937affe0b
- SHA1 9e949bf9e7f4a32256733a9ce5042f8e1c08d4ac
- SHA512 2d66c5c5f22e6f1688c3941bb4993c11eb8d13e39711b03b2fc374488dc43fbd10814ac0d8cb8dc6fb706c0e5d62c700a4171742df98a5b077de9715e171495f
- SSDEEP 98304:BhSx5YyGB8anyCoTk1Vbq3YjI6coPZP7q:BzkTk1TjIvoh
- TLSH
  T1BF266A11A7F98225F5FB1F30697C4256193ABC629F35D4CFA388395D88B1AC0D932B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  ZKFinger 2.3/Driver ZKfinger.exe
- Size 6.6MB
- SHA256 c790f5f6c08ee61935365cd1631a21e5261f03a04dcb361824573fb1268f5351
- MD5 7f6f0d9d53fe418f10c2c48e2bad909e
- SHA1 68fb2060a9176f750984931c10abd089182310c8
- SHA512 c0bfc09c7c6aa4bf21d53da93817eee4694ed884bfaba34e2a2f8a3494f3843c2b1f487f81db80be005dd6092b3dfcfd20e8018c72dd2e98c9edfd195c644209
- SSDEEP 98304:WHOAu7yRJTR5kbYgeCHLEdC7ywCpaAotFN2eFo4QOyQMdouRl1uJoOisxowFHdnV:Dv7yXR5Hd5wBAk2eFiFouRlgHi+FH64P
- TLSH
  T1B266339622F92A3AC3A6D6F83EC9794B19EE766B0C1C14085790882CCB776CF7531753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral5 behavioral6