01a59c3b95fae20abe2ad7b39b60bde2d66dcdc7a955b3db2972aa9f33e26b9a

Sharing

Copy URL Twitter E-mail

General

Target
Yeni WinRAR arşivi.rar
Size 939KB
Sample260820-jvbhhssdra
SHA256 01a59c3b95fae20abe2ad7b39b60bde2d66dcdc7a955b3db2972aa9f33e26b9a
MD5 ae7e2119857db64515939cd7f98c9322
SHA1 0dfbc89b9c54301fa92d96f985b64e3159e39ba0
SHA512 2af779d1d5cad441ef7a500fb0aa99b55897ba7e383e78b9747753c0f52df6438789a107ae0c32d6d5c5f7618fee16593453a9fa4356a8b095b21318ce4cb08e
SSDEEP 24576:qCq+7OUgLbPTeUYBhM329Th0nK7yQxxoGGdi:qC7PIrtYC+Z7GU
TLSH
T1EE2523C690B0E9CB709577A1691DA4DD9EB5F1383F74A69FB1F088CD6A04C2230BD2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Yeni WinRAR arşivi.rar
- Size 939KB
- SHA256 01a59c3b95fae20abe2ad7b39b60bde2d66dcdc7a955b3db2972aa9f33e26b9a
- MD5 ae7e2119857db64515939cd7f98c9322
- SHA1 0dfbc89b9c54301fa92d96f985b64e3159e39ba0
- SHA512 2af779d1d5cad441ef7a500fb0aa99b55897ba7e383e78b9747753c0f52df6438789a107ae0c32d6d5c5f7618fee16593453a9fa4356a8b095b21318ce4cb08e
- SSDEEP 24576:qCq+7OUgLbPTeUYBhM329Th0nK7yQxxoGGdi:qC7PIrtYC+Z7GU
- TLSH
  T1EE2523C690B0E9CB709577A1691DA4DD9EB5F1383F74A69FB1F088CD6A04C2230BD2D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution persistence spyware trojan
- UAC bypass
  defense_evasion trojan
- Disables taskbar notifications via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  Risxn Cracked Tweak/ExtremeUI.exe
- Size 1.9MB
- SHA256 d44e26f4215875b701cec76a0cbd31fc3ccbfcf070a32a443560d26d036f9dff
- MD5 03016b2151cce83897e058185a2d52a6
- SHA1 5065caa4595905b161a2582a27a8efa64964b716
- SHA512 3f182c6801b049db513988848c2702314c9780e176db4d90b6af5c059054b49c8a52d3f8fb018992f9a088a5efb6364f8d2eda1e31a2ccd926e3cb177b46cae7
- SSDEEP 12288:CG+54Bfw3lvyWgN2HJ4oc55XttlQ/Do+FIIHD+lL+9BdA/RKRxkLmREJI2YfP8sN:c4BSESXi5Wo+sw9BdAkRxkLIeW
- TLSH
  T1B4950EA1F69158F0FBBD20B0D3DDBE64172DB80A1BB19507288775074AA1A47394F2EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  costura.pdb
- Size 2KB
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
- MD5 34b42a5776a3ad022b429124d55e576d
- SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
- SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
- TLSH
  T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  robustdreamworks.dll
- Size 36KB
- SHA256 64aff8eff0a741d0299ca8bf2362096d2958d7a7e061cd48788937bbaa4a448c
- MD5 afd4aa5b058eab0ebd781e2b04a8d6ee
- SHA1 bb1ba7446ad3de79a17c4507811593b989e15ab3
- SHA512 237ddeb302a62f850b0dee63976f2a9911a8d5520c1aed42a82458ba733f6f09fe5888fb3815cb0810d057d5fa86a9506ecc7133ea07cdf7c1c7475bd0e97295
- SSDEEP 768:RqQfF8DoIFfL+449HgSfNM1OA3n8pBwnQeY6:eDoIFz+R9pfNM15Znf
- TLSH
  T1ADF21851576CC237EAEE5AFDB072501227B0DA213386C7AEBECEA16C895371D12107DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  robustdreamworks.pdb
- Size 145KB
- SHA256 829a7f41402c1dd785d721c28f3ad659b0c25dd5b8d3b466679b1c5a31405ec5
- MD5 d29223ada19073352baf826458a0b6ec
- SHA1 844639535025829b825635a5583b21309a770e69
- SHA512 b29530d7747903b3145d7a53a4a3c7debfd1588a8533e3d082eca7896f888462075f41fb8c7d7c8e9ac8ee927ee24aab488be1dc47ca8e7aa16676822af5c30a
- SSDEEP 1536:lA/RYmHcJyCiaxAQUllAEbqw/wF/sllAAw:loH5ZIEbSb9
- TLSH
  T19CE3746BBB50C631D864C874799B4B5D0634E9C8D782578FA356F02C3EF33A92D8B264
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  system.diagnostics.diagnosticsource.dll
- Size 34KB
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- TLSH
  T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Risxn Cracked Tweak/emu/KeyAuthEmu1.3.deps.json
- Size 3KB
- SHA256 82321b4d9a99f5927004dbec3190611816c801cd80f9743686360361c9a49c0b
- MD5 b17f1b3e08d30439aea4700d08a064f4
- SHA1 61b4c4cd279f305f8c20a8d9991d5a96c35191a9
- SHA512 2a7088dd5c28849c4d52cafea3a4685d6b0c631088e176917551f418fbaf45adf0e3a3e13e5ccac34605fb4b418e78df46a964e5a9b83b898cad42aba0936699
- TLSH
  T1EC61A416F9804EA711B41BAA2E794781F230037FD504290FB8FC7A6E8F76E562204FB5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Risxn Cracked Tweak/emu/KeyAuthEmu1.3.dll
- Size 27KB
- SHA256 5ef7b10d5f62832fdfc2a5d9608027ad3ae5ab3a48bfd84d38ce2aaf66b5a5ea
- MD5 574a26e2757a5ff8875cc532ef877541
- SHA1 066f16ce003c0376dbe2269552b943031317f0e2
- SHA512 a76a798d78b6cb46c747452704ed9ae47354c3a5c865b17d3880e1658c942eaf9fa6d4b235ed53ef864db5169dbdf8e85947317356eb78cc0d8037d0c186ffe6
- SSDEEP 384:a8JawDaZLaXuqnw2ohqSttQDjWJ0VOqBz/maaIrMHT2iEqfxGKyky5baII1yfmax:a8M5LZtrJm6HT2iEgBbf1ShFKG
- TLSH
  T14FC2080C73CC4516C3FE43B7EC77444987B5B2132C21DABE8BC585652CE2B9A8562BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Risxn Cracked Tweak/emu/KeyAuthEmu1.3.exe
- Size 135KB
- SHA256 93482943e4b184bf53b7b19c460fd273d24c5faf0ec98b7c2e2e1e7eee9282ac
- MD5 6a1e370f2ea783fe05fc4e7e8f2bb0fe
- SHA1 1b974c9ed7ce6442ba1947c64d6f1ddaff75c775
- SHA512 ec6f585f81622bb6dacedbeda7ce37b4f4969c576a2b32402aa5228b8087e94a7dba570870698dadf40dab1db9b87c1a502fbc5a035edb4b037662903b929714
- SSDEEP 3072:zhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfx9RhBur:zhK4XycqgpfCup5sVxuZ041RhA
- TLSH
  T153D32903B2AC11FDE1BBA37C89A21A05F3767819477297CF0390856A1F67BD09E7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Risxn Cracked Tweak/emu/KeyAuthEmu1.3.runtimeconfig.json
- Size 268B
- SHA256 162d81f468bec570ec15e527433f4de5d5729ffe338ab79b22671f38760d34bd
- MD5 9fcdf880f73e74cf6347f8194b9f3509
- SHA1 ab571c7ed4920129c89c7e083f3c9f22597198bc
- SHA512 23ea2a78914aeec443bded1e6dddb1fce61f0445c53e0428e97353dcc25e9ee80a98603069de336d57c1d12b00eb14ad59847137387df330a3925bd763f4fde1
- TLSH
  T161D05E29CE405DA715FEB77FDA31C282FB34931B102418A5B4A8400C2FB7AA90201F9A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Risxn Cracked Tweak/emu/Sodium.Core.dll
- Size 48KB
- SHA256 2148beb7a50d1e3be306ae4d3abc2276696744e8c926e39be7834e1e6b714084
- MD5 b749cd8d4a51e0e16a8e135db8163890
- SHA1 dd509b9f26849a6c7152d779438e0c56eb693cd7
- SHA512 a3006246db11b291381a3ab46a874b724bee54b1a146aa5e4787077a9f273e82a7d6dc90dddd083dc1f252dfdcf57921bcff2385730e69e7c76edef54530612e
- SSDEEP 768:ulLHjiNU09oOk+5RXqvS0hw9bfWS0mIK++ggwjkDENhEg4EgRe5S+U4opU4zU44z:ulLHjiNU09oOk+5RXqvZhw9bfWZmIjDQ
- TLSH
  T1DA23F994E7E29B11D7FD4338B8BA53319F31F88E6432C78F538500E994527A98168FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Risxn Cracked Tweak/emu/runtimes/win-x64/native/libsodium.dll
- Size 337KB
- SHA256 597e80901f20bd742bb9102e17572278341cc77acd283dc47f172b9ca8fbda4f
- MD5 7462950478708e413d32c5421280c056
- SHA1 68a5fa3cf4be0ad8417a89b1efade07c4ca18757
- SHA512 2d422baab92d65e58a71c1bae5de4ce9e3738ab3b840e1e7f91e7fa39ab72d13865014e5c7b83f18f3c5b311d683159d0ede389fcc2a4e16767a61da1badbbca
- SSDEEP 6144:nqvR7IKDFtdOd3eoqe8FvexQcYz6WTCOMCBJluJuWV50DEr41DEl1wRAyO:nqOz0PcYz6WT7MOJluJSDREMAy
- TLSH
  T1B7746D5EF9EAA5E9CDB3E078C2BEC6A6FA55380C43E057F313C2495429537E14638B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Risxn Cracked Tweak/emu/runtimes/win-x86/native/libsodium.dll
- Size 325KB
- SHA256 37dac83fc735dca24ddaf9e5f454808d029a335c1055bf6a8d03cab7d0a245b0
- MD5 0ba2909787356c6172bfcc1fe75417db
- SHA1 9f99646fec3f8029891b906a93288a1f3205616e
- SHA512 1e7111f73de23f526d480daa779e6607bb3469d8e185208918cb19bcf3912fae6c814b5a51915c5f658a06dbd43db28cd6a79af2fd3bcd02355d8d00da725442
- SSDEEP 6144:8ltkw95OlpOAzqqrb40Wzs3WsX8PPDrAA5h1hRqc/SgUyJztOWDxV50DErGuN:8b95OlpOAzqqrb40WhsqMcxweJ9YWqD
- TLSH
  T18F644A21F960B157F5D21479D2AF86F769781A3063FC15F3EB92285920734E3A230B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Risxn Cracked Tweak/readme.txt
- Size 9B
- SHA256 9b7f5c7cd6ebcaed0a6789512464d440b5982e6a3a766723bf9d6b61e8fa76b5
- MD5 be5354cd1cc545a4e2a606e24bb3190b
- SHA1 e2f993dd3fc484765a97a50724c2ae0a1489acb0
- SHA512 8ee20b07d17eef70092c203d991fb997be85ba3c4ae4c43e0cd5a398535f6e561a03549ef3f5a2633293b5a81cf27da17476a15799c5c04a96fa7a26ddf839ab
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30