7d7c4d43e9935a68c47dd8ebf08940c0e8f08d3a1e239c1db7db6f5e2ee1a193

Sharing

Copy URL Twitter E-mail

General

Target
Topaz2.zip
Size 83KB
Sample260820-1ckf5sar51
SHA256 7d7c4d43e9935a68c47dd8ebf08940c0e8f08d3a1e239c1db7db6f5e2ee1a193
MD5 baf600ee6cd2d729cae62d826397658a
SHA1 882c5d56856c0b8dad577c22c05d7a8c9407aa1b
SHA512 d1bb2b61834b295de8bfb56a3f9a6f6ef63f6bf6126c36a250f884f551ab8c9fa62882daeed8bec9195425efb5d0274edb1c066d55439764d40bb83dc71a406b
SSDEEP 1536:JGe7+bwJMNCegkdN56Btt1haqH1AmIAmMp2Mg7RcIbut9XHrFA6BI7y0/2JqpC:Jf1MNBgkdNs7tlHW3pcKuLbu6Bked
TLSH
T1508302B3DC26CFD6DEB1A5F15882799503A10D59CFF68D35B9EC2059703F76052422AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Topaz2.zip
- Size 83KB
- SHA256 7d7c4d43e9935a68c47dd8ebf08940c0e8f08d3a1e239c1db7db6f5e2ee1a193
- MD5 baf600ee6cd2d729cae62d826397658a
- SHA1 882c5d56856c0b8dad577c22c05d7a8c9407aa1b
- SHA512 d1bb2b61834b295de8bfb56a3f9a6f6ef63f6bf6126c36a250f884f551ab8c9fa62882daeed8bec9195425efb5d0274edb1c066d55439764d40bb83dc71a406b
- SSDEEP 1536:JGe7+bwJMNCegkdN56Btt1haqH1AmIAmMp2Mg7RcIbut9XHrFA6BI7y0/2JqpC:Jf1MNBgkdNs7tlHW3pcKuLbu6Bked
- TLSH
  T1508302B3DC26CFD6DEB1A5F15882799503A10D59CFF68D35B9EC2059703F76052422AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Topaz2/CC/4K CC.ffx
- Size 194KB
- SHA256 267c0c086b9c0defab9fe5cb01090709146ffbe2b019842b674fd08aad391a02
- MD5 85f65711b6ca570a33caed668a106800
- SHA1 e3b4a8bf09e479bde553d2418e32d7d60a7e47cc
- SHA512 5c7105a51f5af8f2fcb50636e6ad2789fbb388970bf4e498bf743715cb9308e37173ca5e15b3e66c60c60dd9901761601a135edad3e9e08df87b6a3a1b62c523
- SSDEEP 3072:VfM4m9gqskf2H6oNUEm+Pgp0vSEzVgBO0VWcZaaqbkVyG1dxSpviMF:YBw
- TLSH
  T11E14E0E177C5E09BC1B6837F440BB377A204761256721F3A3A9E8A2F1F8869C7C451E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Topaz2/CC/Cold CC.ffx
- Size 175KB
- SHA256 7c35031fb2019faf955d91af98b7b00e7b08668efa5d497b8de1d4e7e818fe32
- MD5 4d9d3220c352650775c216c794c4bbef
- SHA1 98873abf6f43093d00d2d3726fe967dea53ca09f
- SHA512 63cf037220882568e7d486ca42e468f068b3ae93c5337f6939bdfa86752d250c199e0b8297be14cc78b3fdd13edd0099cb7f15d14e52a807d6d4149269ee699b
- SSDEEP 768:k82IlgAgpDKbxiGu/Ov03jCz/g+TV6x4lJnkt10FBPwes:k82IlgJMJxs24x4stqFBPwB
- TLSH
  T13704C9E0E285900BD564717A81C9E3BAA3243AD4E23F9B0779CD1A1BFF5A7C73C48156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Topaz2/Download.txt
- Size 99B
- SHA256 e7e9614943274d723217280482dd793f62bba5a807c08bb7276d06443d9478eb
- MD5 762d55584039da7cae85279327192602
- SHA1 a6d9cafdc29d3ec3beb9b199507915165651884a
- SHA512 893942059579af129ff19af8901d763bb8dfe259f1311775029e4063b89ea898dacff4ac5bfa16f482e77027f92763fdca7053bcd5660d9140dcd1ca9de7a63f
- TLSH
  T1B4B012E31889A511AC114EA280016D18EC281A09D4F1C89C8114073B4109D64FE5C4A4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Topaz2/Lamine Yamal clips.txt
- Size 82B
- SHA256 c2c025ff215cb89ac7fa2f376a411d5408a1bdf211c798e722f4c6220b85b8d8
- MD5 68ef8702bcae947faf66cd90ebfd3dde
- SHA1 d732ec45bb21376ecf281316c5db66d934f5f35c
- SHA512 85b09961d4133643444c62db4d537496ac520fe1fe573c29d78f7004fb17e31f1f8825dcbdc1eff326f30b68dd2208e83e3174d4cea0453215a5ac176cc77415
- TLSH
  T184A012632614B5049A004C9111013C182C1C6205D8E4F251C110533182845044F004D4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Topaz2/Neymar clips.txt
- Size 82B
- SHA256 3df582b485aed717d18650617852e9b3922c91dc710f84f19e5a6e98c14d71f2
- MD5 834432373ac3b1dc741d9900c2eff49c
- SHA1 db44a8776ff79063d80f0baec09de1eb2c035306
- SHA512 b1554d564328cd7eb98283a91db4ccba4600bd8dc49a22ee579e4afef8c184a6ec1bb529ae5d9921beb0aed18888ca62c7f07f590f505ca35c4e886e7921635b
- TLSH
  T104A024733C04FD03CC540D431103FC0F7D151107C4F050C0400403375C44534C5005D5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Topaz2/Settings/Fps.png
- Size 11KB
- SHA256 691a0bf0eb333713f24359b77c06fa424ab175906d7eeed90426ab63c729a3b6
- MD5 d1cbfb509a2074712f565e33ee790b7b
- SHA1 9d7741d6192c824ab0089a2b4f2660aaed6dca96
- SHA512 68f35be2142805a0084e9522375265f66e0b1d62b80014819f01ae57b2cd6eb6dc64b6e3a4b39c28d12f9912a87fd59091c653d8329f06442821964575765be8
- SSDEEP 192:Dy8CWmC5mZiK3uuiJY7nDypK14NqCjho//Uskebt4wWVQSJGcApm9Dm2tjDCRdqt:DZzvwgY731ABFo/caiwMt8Cm2tjDCXYd
- TLSH
  T138427D406C39EC9DC8DA14608DFA722ECDE12E2D0457315DD2FBE85C85DB8850A6BBD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Topaz2/Settings/Quality.png
- Size 33KB
- SHA256 104890f3defce405559ac31fef309fc350874ba711781f22058bad9f23ffc34a
- MD5 53bd1237d41bf0590c577a6561352d4d
- SHA1 4897f18a1e3856ded3fe4f4a1e1ea39e8d24b313
- SHA512 862550e46f9c4c421460fae4c8f083cea4ff70d04cfd5159f66a7d511b64970893024b7dcdc95286d3a7983be824a4e1734725e1b8390b2d65f2c22c5a58041a
- SSDEEP 384:82KqWggggggCVN0mdyMwUQ9H3S58XDgFeCRLlfOJYOkNJggBILRL7rgggggggQR9:yqlNT8MOh1UewLN1CvFvleYtdLeGkVof
- TLSH
  T120E2CF10F37DE3978E49D2F148C8DA7048863C58EAD2D86EC1B7AA00ADA57ED0494FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Topaz2/Upload method.txt
- Size 26B
- SHA256 5c2b48052f8669f3a91642c0e50cf9e969f799e2eae367f6af0d1f8e3d12d3d4
- MD5 2da10cf3b386c446c35f37cf703c84a1
- SHA1 831d993134a57ce72d7093a2ebb404b591f1385a
- SHA512 04aa097507c2b8507a45c6cb7042b9b4a9e5f02168ce0bf6f2c2535a974ac573cafb907fb26bef06635459a7f3d8333e556f45bc4ff5124e69fcb4ca765fccdc
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18