db507b0f62545ade9d14b9f90d6b7eba5e612bfc49ee23cfc8c788dbb257f78c

Sharing

Copy URL Twitter E-mail

General

Target
Release.zip
Size 1.3MB
Sample260820-n7ne3awemb
SHA256 db507b0f62545ade9d14b9f90d6b7eba5e612bfc49ee23cfc8c788dbb257f78c
MD5 d35eadd3ee2c96dcac780cbb776c2983
SHA1 0d5832bd44e827b603875feeca9d99752bdb2f16
SHA512 4ab7fd446337cb665826b22e9091047790c62122ee9fd238645861a5e42c25154e2d611d3d3e62d95e6e94eee370f669e57657fc116cced25e3a5b33cf07ab3f
SSDEEP 24576:Jl2qnL+74Mg9oDjNzL4iWVAoongYZQQIGWkl2Pk1rDh+1l6qRXwj3C6kMWNTOZw:JNyUMusJL3WVZonPZQQIS102/OMWpOZw
TLSH
T1865533EC84C92407F84C6A321C98CD592702F6DB9CF5ED8FFA77E696E5A78710201A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Release.zip
- Size 1.3MB
- SHA256 db507b0f62545ade9d14b9f90d6b7eba5e612bfc49ee23cfc8c788dbb257f78c
- MD5 d35eadd3ee2c96dcac780cbb776c2983
- SHA1 0d5832bd44e827b603875feeca9d99752bdb2f16
- SHA512 4ab7fd446337cb665826b22e9091047790c62122ee9fd238645861a5e42c25154e2d611d3d3e62d95e6e94eee370f669e57657fc116cced25e3a5b33cf07ab3f
- SSDEEP 24576:Jl2qnL+74Mg9oDjNzL4iWVAoongYZQQIGWkl2Pk1rDh+1l6qRXwj3C6kMWNTOZw:JNyUMusJL3WVZonPZQQIS102/OMWpOZw
- TLSH
  T1865533EC84C92407F84C6A321C98CD592702F6DB9CF5ED8FFA77E696E5A78710201A1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence
- Executes dropped EXE
behavioral1
- Target
  Release/gay.log
- Size 662B
- SHA256 b301cae71d7fcedf446377084617a32162df016ee2bb01c6a76a9842da57fa71
- MD5 200a7b95ecb197c9b06a895c453dfe6e
- SHA1 a684b40a00cb96018ba8a64fd2fe2ab82c9c0472
- SHA512 ea6a36b84d53de77b7030e6bc0e4bb37bfc2674c8e49e878e7a070412fac67db6c50658e2e9278bad194d917db7abba784faf668bf63c226544375557b57fbfa
- TLSH
  T15301993107B328E4310D31F8616320D769679162CEC4F8A3D07DF51D6335406D39E07A
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral2
- Target
  Release/hesap87.txt
- Size 17B
- SHA256 85deeac75812d7af334dcbff0fd0b51e959f2a9e9c2a650e82a042b80dff9b2d
- MD5 0edbee677bb2e5da7f6e3d81a456163c
- SHA1 e239afbcc4f9ffa01e1c49763f21c2d18eb91bed
- SHA512 f313a1af1367f3ea6f6bc2b0c5f77c156afb7c64e7c5ce553e32e8b89fd396212d93651dc8f9f58b9a73862b9c551822855f104a0b45b1b43c580a07174f7111
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral3
- Target
  Release/output.txt
- Size 92KB
- SHA256 1e2905caf89ffee1ab9f949497d62bf5ec769771f8bfb6ede2673e5575e05838
- MD5 e1be2dbb0ae31917caac200017a6eabd
- SHA1 75efecd91e3131fdd3b3095bb2504028d95f5dc7
- SHA512 f6ead51a063d47f679ee2c2eddf3b1196ff3a387a6972840d41f161bdc98f35299d8d2bd196ab1df7da7af00f9b54d6b0ce9b769fef7613db6435b41e1054677
- SSDEEP 1536:SX15T4XikLqBc5dfMzwYcoyrv/I/oc1kgtFw4Kh2kj7QmfxnA2XTtS3EnV8BSfHV:SX15T4XFLqBc5dkzwlPrv/I/oc1kgtF+
- TLSH
  T1F59383740BBCB1A6D7454403BE5BEA3A3F1ADD07E54E5E42952837402B2FB0F1A26753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral4
- Target
  Release/server.pfx
- Size 85B
- SHA256 04b036831b3d7576b7be5d591ef1089276857bbdf26898cb65e290f5c42d1c17
- MD5 c50841220aa6db70ae6ab0cdc1786995
- SHA1 7885d68712b3c9472493bb009ca326ad13b6e975
- SHA512 cc195b186ac49c900124121e2438d67ed19ad33d37aadf4cc2075113c812556a53ab99ddd3d5cde1cc10d27a26bf96d648814782d672d9ea82b2ea997c31bcbd
- TLSH
  T122A011020A280880088ACA8A8AE80AE00BA3E282CE23800EBE3802C008E00023208028
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral5
- Target
  Release/server.txt
- Size 330B
- SHA256 295dbc41647b521ee9444c8d09e58e83d954ea682effe210986b8d377e84ca31
- MD5 adb7e2f77281d84c76a7a5ef7cbb8f4c
- SHA1 f1a206a0666656500a839e04aee8bc0ab5f6ca78
- SHA512 32ac592ca31a1e10147637359c820cb4f119018095fa821a661705c5bf831d64af7fef9d7cdb7508dafe6c6b272f9a17bae3508f4f2e9cc3928423d2135c719b
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral6
- Target
  Release/test.exe
- Size 389KB
- SHA256 4d90fbc5f6233beb78b564df57fa5400d4116fd7e025afde75a67c4e3fe6d504
- MD5 c6a6b6bb873630e997f14bbcdac572c2
- SHA1 d309146e7de146984292bf7f026d45b7194c42c5
- SHA512 e7403dd1ed534d38c5e4bcdfc99668d1a3ae77f00ffa485ed6976184a25c52bbdface7a25487bee64a37ec29b770f07e6921c01f87b880c945154490a034f509
- SSDEEP 12288:wX9X2+aVcbphoiDZlLeGXM853qlWJFj2c/xF:cl2f4/NPeGXM856lWJFj2c/x
- TLSH
  T13E847D29DA5404B8E077D178CF678803F7727C8D03759AF757D19AA21F1B9E0AA3EA04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Release/test.pdb
- Size 4.6MB
- SHA256 0fede23f6f0d738dfceb9d46abf4f9c93aa72025747b5a57fe45d324b05fadb2
- MD5 0cc800815afec54f341beebf0c48af8d
- SHA1 1562cc02c46d72c75afcdda967bbcff88e20f042
- SHA512 bf0c2b373bf7e862cfde09cd948ceafc4554363f07624adceebfcf53e5c2575fe0eae6e5d2f97426c638ea9b7331fe69656c7831e875bd79cbfe57e1cfd118b1
- SSDEEP 98304:+OHBeo/BkBckBRnQUJkBT3Z0uo0az8cEWqUHvqCZq6mbBUSDygp4Ns/wQjTdRWmm:iq8
- TLSH
  T15A262862B6448E23C87F173690AF175C23559E13EFEF3BCBA94EA2108CD53689E1E550
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8