679cd987564d68e56b64c603e5d15269c3c00864535305c7025022751d77703b

Sharing

Copy URL Twitter E-mail

General

Target
AssaultCube_v1.2.0.2.exe
Size 43.4MB
Sample260822-dccd7sen3w
SHA256 679cd987564d68e56b64c603e5d15269c3c00864535305c7025022751d77703b
MD5 1ad60ed6e702ce7ea78b9bfb5370f739
SHA1 91de3526daa12a139f051dee9f865f84be79aeed
SHA512 1c379b27dabcf57dcddac0a5ed03694c028761fae23a8971e55e52ec24129c89c366ece02b4af2dc123c981098ffbd85f588d83baae0edad555df355bdd89e53
SSDEEP 786432:z3aVwBhl51ccCxh5dec33usnFfuUKsR3E/wdO84oin5dgSMDjWXCtFzGKZSNEukT:zbV51ccgje+lLZO/wImmgSEjWX0nukqi
TLSH
T1C1A733331104C6E9FF216DBCE2112270EB6A4C1C06587BED6ACCE651F5B2D8A75C94FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AssaultCube_v1.2.0.2.exe
- Size 43.4MB
- SHA256 679cd987564d68e56b64c603e5d15269c3c00864535305c7025022751d77703b
- MD5 1ad60ed6e702ce7ea78b9bfb5370f739
- SHA1 91de3526daa12a139f051dee9f865f84be79aeed
- SHA512 1c379b27dabcf57dcddac0a5ed03694c028761fae23a8971e55e52ec24129c89c366ece02b4af2dc123c981098ffbd85f588d83baae0edad555df355bdd89e53
- SSDEEP 786432:z3aVwBhl51ccCxh5dec33usnFfuUKsR3E/wdO84oin5dgSMDjWXCtFzGKZSNEukT:zbV51ccgje+lLZO/wImmgSEjWX0nukqi
- TLSH
  T1C1A733331104C6E9FF216DBCE2112270EB6A4C1C06587BED6ACCE651F5B2D8A75C94FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1
- Target
  packages/textures/zastrow/2wood_crate_10.jpg
- Size 2KB
- SHA256 25998c7c551257dffe319094667fb4c003ecb1065341f1e186a89eb48ee457b3
- MD5 c5c08c8b6fcac210b8ea672ba8e51823
- SHA1 3deb314ee2935436a227d074433965297aac4577
- SHA512 86f2721f26108b2703b1b9a1546d0982d24d3a1de79f12b06a6cf19f71de8e99521293cac1a0a989671be00eb4c77a2634fcbb5e4a6e53e0263d159252cea2b4
- TLSH
  T199410A26D4004D5BEC77FF7401FD9A0C4B15B603CD6A116B02985914D0F60E8073686A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral2
- Target
  packages/textures/zastrow/2wood_crate_12.jpg
- Size 1KB
- SHA256 88f46f8e2a79a41038e30d6024464e09911610ebb5c1e967451c20335bb72311
- MD5 7e82b79ecbbe600b0cc42136fcd59a48
- SHA1 5f239e8f6856ac6cbcf7d74b019306c491ea786f
- SHA512 a3eb3db46e93f304160f1243baa77acead323f544332587fdb486dcad3205c5ac7ec8aa4e271312ac0ebb7df84f1297a54cb63e354f29c1de95013577b256535
- TLSH
  T1D821DB12D4171677EF726B76CCBCE35813216B21EA2328ABBD1D769195F21448C707A1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3
- Target
  packages/textures/zastrow/3wood_crate_02.jpg
- Size 3KB
- SHA256 b222d1aa9a095ec1b681b4bcc8528f345c7b1aba7668b8a4a373a4bf99c28e01
- MD5 a33f54267c614517ea8698f3de7d2608
- SHA1 b12222cbdc5b2afb54cf14a9d7393ca97425b01c
- SHA512 b7817f7adbea658d81b301e75ffb1b32b86e4465b603529b47a08b3c4201c1e2edd1f786b1b947b0bf5a6d9bd39c17ac32abf26c30683cb176def66e54eeb235
- TLSH
  T1EA714B16EECA4332CA97CEF33D04251D67097F3BD292DB66BDA5834C129D18560D4E0A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral4
- Target
  packages/textures/zastrow/3wood_crate_03.jpg
- Size 3KB
- SHA256 d43930be99fcd9183a27a14fa501257553da78dba878f7e46afa8327fa894890
- MD5 0f606b8e030a96c6d7200e20eb5c8ad0
- SHA1 8e3ca4dc6eb862cb669e87d4932e10d95e4fbac5
- SHA512 444cf8572e2ff4691c9da6a4ce6bb118e681dbe41c87837e8c79fee8420104f0505ed369e56e167df3d794d7e697fd60109946608eda2354c611b7165c640ff2
- TLSH
  T123614ED7D880046EC4780BB102F2923F2706D58BD11F835BAE545A16B9AE88F6E482B3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5
- Target
  packages/textures/zastrow/3wood_crate_10.jpg
- Size 4KB
- SHA256 01a580c7fcc37c5ada3550385a46a368d1b6b6e73b8c1796aac694261f67c841
- MD5 94e734adbb131cb9faeba5f28021e755
- SHA1 ac55789162dc41cff79495aab792586b60d757f8
- SHA512 0e2218f687e0b28ce6905f2ff2ffd9bf056be883eb8f477bd80337254fdd66631165c628ae4944fe95e3ec14814fbda088b8a1d8f1093b0ef28ebd6d682a3ed4
- SSDEEP 96:R4E8b/weH60qQrsBngIOHq7PxGqVyLn7dVdex:R58bZH6RQrBI1JGy4Ax
- TLSH
  T14F816E82DBD2DB67E20AFF32406D133A1DEA5DB9CDA2486A14D6FFD822780576B01950
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  packages/textures/zastrow/3wood_crate_12.jpg
- Size 2KB
- SHA256 5a8aeed1bf55297e93f3b3852cc87e030bc936b85bbe450eb4d3091cf7041399
- MD5 997b19b6530424e6eaf76deef32af946
- SHA1 1c3ea09f6844b0124ecb25cf174ea5255c19e351
- SHA512 8c7a73ab369506c6976ca7b9e4e546e6b33dceaa4a410c8a5301ed77693552d4f2716a4fb7d1a7c5e8697c86d5b87ba09359b22dcc9eb1b0b555dbb7048ebe97
- TLSH
  T116511B9AD6D78054E016DF3A4663037C8F0EF82EDECF0B8858EDA16576CD173E942652
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  packages/textures/zastrow/brick_wall_08.jpg
- Size 34KB
- SHA256 7f4c4c2ac0d8360b681e5ecce85903efcc6fad45038f46da55d50311812d2ca5
- MD5 740416a1d74d6f9038e96a30410f63fd
- SHA1 d34082ed291a85bef9b14b33682a6fd59d258cb1
- SHA512 389c12c2f1d05799611ecb3d4fb6e5e76dbdfbbf1e20eb6d608b2aad0470f1b7815bf61353924e0f1a8f3f571f7a4a130d6d18641f5026dad28c06f80a3d05dc
- SSDEEP 768:n0jg6YYd0xnxmlyf5Wh7mvRMy7K2CNbXerWkOh+5JPFVam:nl6YYCmioQMy7K2CNbXelOoMm
- TLSH
  T18EF2F102FF4074D1A40AA99F9AFD1E16B9D5F9E787D4DBC649CD0248D3E2CAA1CF8610
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  packages/textures/zastrow/brick_wall_09.jpg
- Size 31KB
- SHA256 f8c8c438edc90cc856a3a341e702ac4559f52dce6bfbd942967f6659aa820620
- MD5 896dd1b509a36f700bc5097d8bc69ce5
- SHA1 2a23a3c4b0757f97fb833c4e24d2256ca7c40630
- SHA512 e1cab65c4a0ad150dcf2797527995e5b9af865da4f9cc9501908482ab40b52ae5c2a84b998d472e4479a5f8aa93a7f274e4a1a22ba67fa9d4d744674f220ce96
- SSDEEP 768:mbNxJZa7fGen33SD1iFi1rqKYcAOu+3KbSgA2:o7073CDN1rVBTt3Kem
- TLSH
  T1CEE2F2E3695545C5FC2E8331D83A1E248AEAED8A769C91FC6758B00477864E3CDE3C85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  packages/textures/zastrow/license.txt
- Size 809B
- SHA256 8ec44825d8b8485a959477b60c160bc5e9b79512208e692b3d84c1500f8e37f6
- MD5 d7907758754fce46f78541338b479b16
- SHA1 a8050f2afc01fb318771be243c42b99fd07ef52e
- SHA512 04d5fa9460859fbb743fb815a78f5a58a955f20ecd1aa73c852f51104cf2035654e1e483d9f8405785da741cb85704793e186ed6207e34edc545f94e3a7eaf78
- TLSH
  T10C011E0FBB53C35B18629499FB254A02F90310B8729F43467868609C20AB22660B2538
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10
- Target
  packages/textures/zastrow/metal_overlaps.jpg
- Size 35KB
- SHA256 cfa1f70aa59519c924fee20ea2133cb33eb1f03e08e35e49069bf66e3490dfb7
- MD5 0fabcb092675b9cf2cff17f608c0f227
- SHA1 ea43dbbe8056ca08ac13741d37a0daedc8986f41
- SHA512 ecbd0571a6185b3c014df0c876491448b41929808b25c27b1ee75f73c8a612912411ffa2867d4d856a54259ef90664ccd2fd17a34b07a32073e301be931a40c5
- SSDEEP 768:Q0T9m6iz5bIz83iaYlK8wSC7sUdVm0enh+SOE9f:Z9m6wBI43JFR7fdV0uw
- TLSH
  T1BFF2E171802E8193F42767D41061FD07BBE74E324FEEA2C9A1D7C86C19653E27BE6254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  packages/textures/zastrow/metal_plate_fill.jpg
- Size 20KB
- SHA256 c17f8caf4140c9a1cdbcac77c43791165ef25db02a1996b1b4398e8e25e49427
- MD5 1740403e74e2504500d1b0233a75f60e
- SHA1 00e1ad874a29fcd082229ebd725198637de3ffc9
- SHA512 a60e81bccaf24720d8c04a42c6aa49e83e5a85acfb1cbfc3c8484de210a8203476ecbfc43a01caf3bfbed3e9e87e461e318c1834d3e2ec562ab5ce7bf8b53e05
- SSDEEP 384:ftwJ9MMrgZ9H3DK5pPz5iVhzuQSGAAps8ZhmTtDLtFO0Hq+iDTDNOuvSiMlCnXgQ:g9zrgXG5F5iVhzuN0rZhmZDLtFO0pi7R
- TLSH
  T16992D0476B661DE2F17D16742429FB553EC28B5B680C3ACB0AE87D8D218334698F68C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  packages/textures/zastrow/metal_siding_kinks.jpg
- Size 39KB
- SHA256 565d1807512523a878056b3146280244d6690546f5d8c02f5ec14999dd29293e
- MD5 cb4916e592234965e49142619aa01f47
- SHA1 36f38ef0433b0612a60543cda347bb974ac2ad87
- SHA512 c83dc96c30d322d9b17f0c4e29843b9812a8f03026b4caa9a15ec2720d69961a230c2b6f7fdbb4422668b7d3a099b5412714774ea3064f90e1f0fa8738a478c2
- SSDEEP 768:tYr+DEHoXXEbna348g635xKXv2pN+z3MsNcg3/9D3/z79tTPnE+i+JL0+L4:tWsIwXI8K2xfpN+jMYcgP9vHH8cBy
- TLSH
  T1BA03F182955934E3F8A3613DBDBDFD9916ED682A5F43404CB0C4FC036D0972DBA63A85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  packages/textures/zastrow/metal_siding_kinksb.jpg
- Size 7KB
- SHA256 4c04f836b7e2fa383b893f81442d66ba025d4841cbe5f8516db940b8953f2d70
- MD5 9190e340b042b80c37b3cb09a1ada62c
- SHA1 1438775e577b10ff29321dd25ca9147b6d52d8fe
- SHA512 1bbc0603af19f07e4e96538c9d1f6c41f01331b33379fbcfd1d1d3e6f539b714ad06677adf9e3844fa2d0b0636bd18ccbfb58381f625c60bfc9d9ab895b48e97
- SSDEEP 192:RmBCHsDEdaokjWujXadFITPO1y4SHCs6kpbEAvxKxc:Rmkssa+vjkPWy4Sis6kWAvxKO
- TLSH
  T191F18D25C0E05B94BC6DCA71C631620AD2073D6FF1AEAB8146E62EDCD8CC6FCD958924
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  packages/textures/zastrow/rb_box_07.jpg
- Size 2KB
- SHA256 6b6831f7bdfa994276f9b5be0e963a48b4e988b21daad1739bb466884c65b0b5
- MD5 5013cf66fcba44cc2b6680be3646cd77
- SHA1 05966d231373869603f330e181e1bca77d3d9cfa
- SHA512 c510893f39299f8111b2c0879c05c39a51db73ed88b27f164a59af46186e51fe52522f32021f3aabe4f47ba879593c9e6a61bb6342b4e921fac8ea60536b1f02
- TLSH
  T1C8517D092FA387C0CF035DBE26323029C36B2795755821B223F20801CE0FDF9919AC49
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  packages/textures/zastrow/sub_doors256nf_01.jpg
- Size 25KB
- SHA256 26665379d673eee943d4d7adc167c7815865537a251ce3228ab6da8c17fe3f95
- MD5 4c1d1e3db315c15ef2fe82e052d0fa62
- SHA1 fa6e21e040a6d7420d696bdda4ee3cf25fc6121b
- SHA512 e994c9526f3a0905933e2591a0ec69522de774be757ec3e86ea73c294fa69a9fdf67fb2b92250838258ff44c82d2d5bf5e624393be0ad8aae4da7c72782f7b11
- SSDEEP 384:EO/vyEE/DtNNIA3b+Zhnkq9+Qr1g275VzrqudOB3iHtieZ0t3MTO4eQ/ZwMQEU1f:NypliZCqUQrlfbs0NiyemSwZ7+1WX+
- TLSH
  T1DCC2E14EFDC682D2E1621B7153687F12D7DBA4C61E54D81E61CC3AB19C2336683343B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  packages/textures/zastrow/sub_doors512A10.jpg
- Size 14KB
- SHA256 051cf5bdd7d00ad67c45ec98d6ca2ba05a735e957ac12294aa83b89fda75f39a
- MD5 1e053d1f24f7f7556e18d953dc19458c
- SHA1 792b1cff2a39d1fbe85ef8920b79eeb962f1b5d1
- SHA512 d456a7e36211790bd5d352d4eafa4a8ef1a17d01eba44a71fd57fb6f6e4128fb99d8dc9f830e6c05cfa550c4c74fbbfdc6978079ae65671f0f18b4ab475f324a
- SSDEEP 384:5q/HAKCeVc81H/DkKlW3WpIDkU/qhiWjHiSLW2X:QHAKR7DkKppezyjbiSLr
- TLSH
  T13962BF157FD9D1C3F99819377127CE32EBF8AF1FDA4263145EC282929D0A68D6C08711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  packages/textures/zastrow/sub_doors512A16.jpg
- Size 14KB
- SHA256 16f9b73f107ae772f71ded3a745c36424442e3456c5a8dd41177d8d9b8076188
- MD5 167a272003dd4b3566c067e20e1bc2b0
- SHA1 bb174cd6189574f9a6a052fe359797934db32729
- SHA512 2ab83fc04caf670b08841e32bca836a1634da220099a6ae2ac907d36907ff07a773148106448befc3ad99a7b15b908204a06487cfd019c78f024d2105daccb32
- SSDEEP 384:gaT15nDwNUr0+l2D9JBWXwZ7Uh3FMsGgKT:gwnDPHl2D7BBZoh+sHW
- TLSH
  T16462C00C5B8B91F4FA3CA4B79D515FE194D8A837373B1B7969C8762483D32E046892C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  packages/textures/zastrow/sub_doors512B05.jpg
- Size 10KB
- SHA256 669ffb7934bdad347c264f9496ec79d1d1eba5e31023dd9d942f0659aa6f82db
- MD5 a2b58cbfcd570ade3537ae39284da5fc
- SHA1 3be3bf631b29ac1febd57c67ae2173bfd55aec9d
- SHA512 7c6db3a6345f153a1047381809353e47bb505ab660109bdc0ff98c29b3ee85ba1f0019716b2f22e3f60caba10306ff07e01c47b87c8cb7bd1fc3f39df3a213de
- SSDEEP 192:yHqQ8aBvCOypA3EmaDFzKtAop6Vnj+UEvZFA8+qqeLxv1y/Ipe0DiT53:DgBv7ypTrD1YAop6VniZO8EeL7wV
- TLSH
  T186229E723B2459DAFA60B27217A7CC2550D1ED1726E73E8174F0AD257A3D5E38658013
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  packages/textures/zastrow/sub_sand.jpg
- Size 26KB
- SHA256 9b1a05f9866822a6a4bdf748325baf78ec1e5c6f0a91922cbee84040109fbd7d
- MD5 0dbfaa2b50b947937ae6bc218199f175
- SHA1 d4117b39ed0b0258ca18a805d4b22573bfa93eae
- SHA512 39603a820411e46574b35ed2b6bad29a1a61d1c43bc5be8ecef3c11c1683117c08bc939659e52936bc50fb963f680899493b438a8aac1253344b4ffd03b52997
- SSDEEP 768:zSxJGeqUDn4tSPhHnMoU0q/L5/VNYr8r6rX:zSxMer4tSPxMJ0qZVtGrX
- TLSH
  T116C2D0409B2855F3FE8F663257802E5252F3D07A1F55819ED8C8FE59CC66E82930EF19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  packages/textures/zastrow/sub_window23.jpg
- Size 4KB
- SHA256 7ffddc5e4ad34ea319abf93795022e96524de2d0d31aca97ffe2814ff6a0bceb
- MD5 0eae238cf60360485a9279bce48abd37
- SHA1 efdcdf8e20f48a8935d48f5d9f90856b95e16b02
- SHA512 9046f6b9897373be1fba9ed8cf574bcf36e2a451abc271c459921ce25c89232b644dc4bd5a0cb53746bb7d8d695340530d067db3913a8d782f34bb531b47f052
- SSDEEP 96:RJ4XabogP+/TdtENQh2QkUblhq11tR8spYHoMB7kcUBJf:RJ4YN+7dCNekUxhq11tFEcZ
- TLSH
  T176917C27C6660644E3AE063BE2D8F29A4AE9AC8DF924EB5BC37A22DC09421CB5005148
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  packages/textures/zastrow/sub_window31.jpg
- Size 3KB
- SHA256 f9f6b0b206965470bc242fff4dfe7853a2b9e7db508fdd3337555b37ce5698b5
- MD5 a5f7ee9d44d23e5b86ad6141f052ec7a
- SHA1 30db781297ed63e8570c7ce38566cc84bb9f8712
- SHA512 7a58fea754e532c515edd2ad645c17407bf43dd0081efbf73487b3742464afdb3d5b26520cbe85fa5b6d3a7b0d1406cc4d1981a0cb7433e5f864d00ddc80cd48
- TLSH
  T1E4815B09C286FD15F29B4AF401E4D580C742070BD6E29598E859A88A81FF0B39B7B59C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  packages/textures/zastrow/sub_window33.jpg
- Size 5KB
- SHA256 e025ec5cc5817a268d35493884cee40c3a4b734d4e8248576845074f3ad6481c
- MD5 3de3e9609e6b89bf35a0a1955fdbe045
- SHA1 7bfdc6f38ee22619b328d30e061e6cc25b9f2f46
- SHA512 c44543c82489903306a2c120c94f4fe2fb612ddca7b1f9fe944deeb493238a5bc988e7931b5071d69ff76e7b96f7592c2825c43a877acafd2f68b03856abfdf4
- SSDEEP 96:RCnt8nUAu9k6g9FRZVBPHl6bd01m2CHAByLET+YJWYKXVX0HEZ+Iu+Cw6mdS:RCenzqkN9vZVB/lu01xIAILeRA10inKB
- TLSH
  T121C16F51D18B31EEC6301FFD98E3E940AB110698DCEEFC5B90C27900ED9B4D14927254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23
- Target
  packages/textures/zastrow/sub_window38.jpg
- Size 2KB
- SHA256 b3e932053fa6bb8e53956fc91e147a51e6f70882dfca0acc3aef3e239d695fd7
- MD5 b921399e024c5b7050292331bb79fad2
- SHA1 13f75f69cdeb773943348b6a4f16571324e8b430
- SHA512 ce2fe11876eec358eb824d6f7bf6c65ffbfa2527ef57f64d389012e408386ccc067bf16683fc482d1840c4521e9b262b72fe63f5383dfee8f8df5660795db140
- TLSH
  T10B513A6FE725B0F3E7423CF0E227629501455C0CF9600A02D222CFB7A6903FA09277AC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  packages/textures/zastrow/vent_cap.jpg
- Size 2KB
- SHA256 fa4640984827ea900628cefb9db0dd4e2695faf48790118ac48a63c4cba6d2da
- MD5 143fb7805fdc0fc96a1538914465172d
- SHA1 0b70f8970fb1a2834515b7dac5111560750c3f10
- SHA512 d759ce00e221990b8f51514655e0b810d79b3d06dda90862c86f20818d29e521ed71b1bcc1df1bb2aa768872013ac5d8d999c4c324b362a7757d99d1b2f8191f
- TLSH
  T1AF512B23EC5E468FE6BB5673A2A02C29421C0D03D0236E0B4CF81B74F39350211AA7AC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  packages/textures/zastrow/wood_crate_02.jpg
- Size 5KB
- SHA256 0db62c149238b01860ddd45848c1931a94d872b6a0ac45ba29e3854618dea3cc
- MD5 e099c60b1fa121610801cb56606debfa
- SHA1 9513af796872c7803dec41549dfa1beda5cb26fa
- SHA512 0afa7001f0a133a68af2225f5c6ceeb867a0987d566bed26df8061c7bf76d0380e9a7a060320443b32752b62173cefeb859e831a8d5e4269c223efcf1b349fea
- SSDEEP 96:RdcsVNiWrbXPEO/P6gu0FsDjVwPMifZazmCqwfOrwLkVZkbhIxtCRpD:RdvVNiWrbXpP6k+DiM0GmCH2rTZFxtCD
- TLSH
  T149C19F85C7CD60CEEA2625F9D8343B720A41B701F1D8712558627FD0853E4E54FE6360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  packages/textures/zastrow/wood_crate_03.jpg
- Size 5KB
- SHA256 d417945818da900a3f5635b02dd2d3877b820d8827fbd7f3b37e31cd99312455
- MD5 73c0913ae82ec900d2bd4588f82fda0c
- SHA1 c8c54553b86d9806b73519b9bb8604fdd5bdefbc
- SHA512 fda8eb4f8c847c7aeb202e98a6b2f92d5b3156ab29c0eb653ca46dea121986aaf79b4943867180a6c5f9e4c01289c37b809ba2f2d4bad73803949218f4353e7d
- SSDEEP 96:RwC8s8uvHG9PIJlEuWNLHGiocH7D9UGW7jnrF1ihXaYpXMiPB/QvrdTgN8:RvFRmuJCbmUH7DZunRtWbxQvrE8
- TLSH
  T1CDB18E62FE840522DD6AB43F4716BBE8556E7C5DC8BE8D08B3461620D00605A2E8AACB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  packages/textures/zastrow/wood_crate_10.jpg
- Size 6KB
- SHA256 7380352950aad7715571d619bc391740f81e70ff2e8f392f5c094e4ef624dff7
- MD5 e8a5163d2223fe9be096cc951568b931
- SHA1 ed99a0bb6c1bd2e161bcfa6fa8528285ece055ca
- SHA512 238e2eb7515dfcb81f2a8a8fe34f474d3a683b4b61f9f248f6d52642e0e0ff43edb879e7df67258a6c527fedb0fd0015f125ce4ea5cf51fe92dcd9a5d2500980
- SSDEEP 192:RSK2KzVh3DV9B7nEdi4BG5DTM09dqZ5O3FKz8+92:RBdDlEwK2DYKdqi3cz12
- TLSH
  T1F4D18F2FFB82D02E8AE28675CB0F1E18AFDDFB44F0EE65C928D4587482605434557F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  packages/textures/zastrow/wood_crate_12.jpg
- Size 4KB
- SHA256 0638155f88c7e0cc18291c8f5bc847915190d3b467519900d277293c2fe2e0bd
- MD5 695657fb340fa561c3d99421724c59ec
- SHA1 df9791f03f3329a6335b99dc3941012cfa1fc265
- SHA512 313be9799ff571cc3e1d7195a3df618c86eb99f7041c9a0d60234d00f6b9dcd2988a070eb84e9e763b791cb69debe0a54572bafb1da7303b330cc3da34252280
- SSDEEP 96:R6rO/laW2WDp8Vkj5rvLEHsYVTdX4gxqCZaT1xJ64UtQPkFE73qelG:R6S/IW9D2Vkj5rvLMNNfD+VpWyKSar
- TLSH
  T16B915C1CE3BE8D6EEE2BBD38246041A2628D5982CFD8D039D720CD12F87E466468109B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  scripts/0.cfg
- Size 564B
- SHA256 20b514f5e33aa7b8799d2eaa793d31eb836a04be8cd9610445ab045d880ee8b0
- MD5 370bbfc5bf8b9f02284bd1a00bcbf0a5
- SHA1 bc313fb7d490641fb97798abba8bc11b9d52b20d
- SHA512 a3c97d2ba59710ee62774adc8372c328ae38f554d2abec57f2d806b205b41a61d2ea55ec0eaff390e653dd9c14217c91cf8970c6968d800a4bd6437d0fb83a0a
- TLSH
  T11EF08184368EA2301D8934517708F6DA6713A6BCF1385594B546D118A5013DE10F47F3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30
- Target
  server.bat
- Size 76B
- SHA256 050d6c606ad3347b3cd073c00aea0a051bf7addde299d34e36bd2c98bee88381
- MD5 73def118dc0d800fae6a87924724a2da
- SHA1 fd9adac4694ccbbefa83afed14a7dd54e734a4ae
- SHA512 6b0f58e21325f75e76d04de6a501308778566477873aa10778cdb271cd36cd75e7424cd6d4372e080585bc70cb794acfb386ba676c3c35829106b3e38256b641
- TLSH
  T196A012DE0C0F001F809405B9C0351907490B110300C45114A144A0A52C804211351525
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  server_wizard.bat
- Size 100B
- SHA256 202eff01aa8a0f12f9d71e14406a5a921a20ca3ff24b2a99860ab19e554bcdd2
- MD5 f04582a0db5bfcd2419e18eaa8caa085
- SHA1 ecaa6a7a378ec76659cf8faec9802492128d5a43
- SHA512 33b573ea96f4ce667ab9a4c39524720948ecd01696e66cc140902c59234aab80f97b81732d0d6aca4182272d5a5fdb523ecb4bc8373c975159c7fd134e699677
- TLSH
  T14AB01203400F045F44600DBC10F31580671E305902DC3321476ADCD37ED08A21300F12
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32