85fd7352a9ae89181d0b4cd0f957fe2e2ef6854b73f4ee9f1fc36e163913b2ed

Sharing

Copy URL Twitter E-mail

General

Target
SYG Utility.zip
Size 43.9MB
Sample260821-zhzycack7s
SHA256 85fd7352a9ae89181d0b4cd0f957fe2e2ef6854b73f4ee9f1fc36e163913b2ed
MD5 8049f05f614f1d1c8312d05120885c9a
SHA1 b226961625f1d3ed95756f5f9c466d643e895181
SHA512 c74a28d0ef313f555dae13524f3bcccf66d9bab51b9c45160c010d53396cea775ce91e01af87cb4952f4fc92ed58b5470802f41645317767ef1b4ef76051f6ff
SSDEEP 786432:BZHdFkjAI6jLyKxa1/Actj6VBxloeo1eo2UPr29OWiF6161o:BZHdGjAINKiActj6VBLLo1/jVWY6161o
TLSH
T12EA7332D50D2A46CE2707667C230AA903B2C200BDD5BC9CB7D66879D45D2BACDB3BD4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  SYG Utility/Decrease Ping.bat
- Size 3KB
- SHA256 3925361fe678a0ecf2ee3cf17365221846c9bbf0741f8f14e1c8e1986280e64f
- MD5 f560b226e910a5a99f3852d0042ee57b
- SHA1 7b45b0b99f1d5dd3a59dc32d4556403b25dd58bb
- SHA512 d1b67e1cb23278380ac16b77537b98ac20fa275a109940166b580ead54b3fa1493ab59bf465addffbe8ee94a05c9a9d4404764a74b82203560486030a44edd04
- TLSH
  T1906186633C7A996915B0CF928CB51012F22593EB1A0A3EA9F0BF42745B113C073FE94C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

defense_evasion discovery execution persistence privilege_escalation
behavioral1 behavioral2
- Target
  SYG Utility/Optimize SOT.bat
- Size 3KB
- SHA256 9bfb6fd7f945f05a3e7d7e6051bac126cdd95790949c61500038aa4b47991f22
- MD5 a1044a062080f9ee9223e714a942883e
- SHA1 09b54e18db39da4aa51ee4eddbe36f16635a4748
- SHA512 dbb81b3ce1e974ae3a7ee302a9547d564aa8a0383037ff9a22f90e489b8282ba1c68f08f992ed8903269ca165b549559e9b0974e803d9440d18f11bd24ab789b
- TLSH
  T16E71FC767C26995261B1EB614CBA1413FA5113C349102F96F0BF61785B6A3C073BDACD
- MD5 SHA1 SHA512 TLSH
Score

6^/10

defense_evasion execution persistence
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral3 behavioral4
- Target
  SYG Utility/SYG Utility.exe
- Size 49.2MB
- SHA256 3b773c5b249e2abcd6782db88f668232a4b22bfb10192e69c364d3e58c79cc0a
- MD5 0b6e19c8df6c23bdef635fcc80b0dbeb
- SHA1 8f0fa2239b5bde705ce01f36e0204e8764390934
- SHA512 577409273430ebb6f86ff16a18eba25508e70a15f3b020bbfa0e3ccb2505517b75b289b41d5e9abca852d5e5ddae066fda73df518e8a7a673a9028ae1d9b700c
- SSDEEP 1572864:esrmjegUm1Jhb49a0eavlL6z4KcpkCXuKG1S:esrmjHL69ZXWmjXZGA
- TLSH
  T100B71256E2FD00ECD47AC0B8C6574627EBB2345513309BEB16A48A692F37BE16E7D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SYG Utility/fov_unlocker_v1.2_final.bat
- Size 9KB
- SHA256 db25143ed2f9fa5a7e861df84d5486832164bb469f1841424fe735ef851e1055
- MD5 01c394fc7db1fd55b02040103b9005e8
- SHA1 ddbd66743b8f71b9571f8640a3c099ebc6648234
- SHA512 84bd75c38bb04ae9478bc1e1f4e37bad63b63c8398746a425b2f4c032007cf8cf30c0f3834b9421a95885de105cd27507ebc19d36b4424a0d6391d04cad91920
- SSDEEP 192:fPYDTNkN3C5Rikok6X/CXF+LEJnxgbSSp+O:HMTN43V9VXrCO
- TLSH
  T10B224F83356C922525D89772AD0265337B6B90CB53053CC9B2AF85F50B4A3C87BBE0ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral7 behavioral8