ee128a1a304bb2e3110e77bef071451b9584c715ea86913f9d8139b662ea0b2e

General

Target
release.zip
Size 17.9MB
Sample260822-ppp2lsthpb
SHA256 ee128a1a304bb2e3110e77bef071451b9584c715ea86913f9d8139b662ea0b2e
MD5 c73fb6443955911ddb159f12335113a4
SHA1 4b25f8c98e1993e3cbdac2de167a210fdd0bbbef
SHA512 19c6a08d565688cbd945fdc4f1ab882eb505078ab367fd53ce3217aa0c6dc23eed874eed0d94d135ffb805630dd49267b9448a311cb9fc7b4a81ff3855e92d35
SSDEEP 393216:RvwAKxe/vfecrvkQZTAly+CLvzHMepGf7GfpAii+:RvSgneSkplyXLv3GDGBAii+
TLSH
T1E917338D1EB23773BE8AE8973106A54555950CB62CC53D0606728F762F8B1E92BF8D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  release/injector.exe
- Size 12.2MB
- SHA256 61eb676a685a1ed7049ec90d6d2981b8c1ae6144fd4576cc72930f4d2fca9968
- MD5 ceb1114b3df840ad5d39e395cf460b23
- SHA1 6e9b16e239da57acab565c3b081227f85dce70e3
- SHA512 b5c9fb14485b92fd75769b86b2eb293e5b4cd75f5bd9e35bfe40ca65eac8678918bab7cae4b461ad73fc741d6a9da84d63f01269d4a95c8d52fa2477d9341acb
- SSDEEP 196608:fp2kcp5PIzo7g1LBp5m2qq/UkfOMpAgojZZQOWUWwXG9C0AB5c:fp2kc/EdBpo2XTOMC1jZa+XaC0G
- TLSH
  T136D622ED51E163B191D34240328B83AAB1C1669D41FC5D193ED77D02271ECAE268EFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  release/module.dll
- Size 7.6MB
- SHA256 c3e87deaf9ceb639e2f742c23389f9618a4c961b2f8b2bd487c8ccf3063ded54
- MD5 f9c72e4513bbf6f4cbce3e4c764eb6f2
- SHA1 9be87aeeff01bbb4e4de9fff8d94d5e2f32d1915
- SHA512 8005f739928784c6aa293f350b7cf21b79a7f0441585894a70887a072f37947a2b2fe72702013f881ba091f84a58f0b3be1a7e9fe42cae5b1effb2d604824ad3
- SSDEEP 49152:H9G0cG1OMPTiNkqVr9tpwtnnZBFypeXz3p5QSrgYTcIe0X48+GrwYh8D9YVwP6Eu:VGN1+Py4XogrKyvAShanqfCP5
- TLSH
  T121865B0BB6C498B4C33AC6B4C647EAE3D571F425D3185AEB536481A90F216E37AFD603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  release/umi_0.1.0_x64_en-US.msi
- Size 4.1MB
- SHA256 8f62eb2cfebc88799e9ce3ba1a6a74f15ec5e24d6ec81ec2fe6db86d8f137dbd
- MD5 ac8a77b343ce348bab171bf45f0e5237
- SHA1 4f420bba81c89d63541dd548cbd4b4ce2806ae2d
- SHA512 2037282fc79b4a1cad4520b582e5a32d0cfb5c6ba22f9020a93db345c90f512e7f7347e10dcaaa9c4379f790433f678b948543782512fa7dbe2af3a5d060c5f8
- SSDEEP 98304:E9CdFarzYKn3tYdLZXa5OztSxsfnC1DOTm:iCWdORa568OkDO
- TLSH
  T12816331B7FD1A633CC562EBA143BE3A41A3C3C245F5861431290BA5ECCF22E15E75AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral5 behavioral6