00f4c537d8e84cff499bc102547d9c499c7d5ef0e59bbf52465073ee192d0f06

General

Target
crackproll.zip
Size 10.0MB
Sample260823-q77j2sstbs
SHA256 00f4c537d8e84cff499bc102547d9c499c7d5ef0e59bbf52465073ee192d0f06
MD5 b129d4ccde9927fea10ac7edb66b0d06
SHA1 55f990830e4b37253f59e4017beec4e267a59121
SHA512 9a157965373a79ecf91d5327dde63f6d9fb680a4bdc5cc8c6827bafb125c39e3bf7a318b8cc31a3a9d98e29c45821f446f3a1a98c8777a8e6add4a910e800700
SSDEEP 196608:g8ObqcoFPXY4F8pMS+nrjolkR0r7ymgGh08pUzU8bto:gBbqhFQ4ypX+wlko7y8hJ26
TLSH
T101B633521AB75712D1520DAF4E0F8FAF1DE164BDDF67B30884FB06AC88718F7205A266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  SnoozeBootstrapper.exe
- Size 3.5MB
- SHA256 cf2283d1080c90cc7c345dca2705b8051bcde3f175f83bea4aa6ca6a10dd50de
- MD5 8ce37d89ba02260e9b679ecca2588d38
- SHA1 90529edb2835189ccc14cb2e24ea403b2722ba32
- SHA512 9f62852e7407876240ed0fd678b8577b1a1bce154258ddcde67ce22733ad14297b9d21e9df791bfe8ce1b56e1377321fa08597864c830e2cd7450c729293fe88
- SSDEEP 98304:7QaV8uYs6uXvgHsouciVhoA8GkV2mHCig:seYs6uXvgHsouVho7JVBC
- TLSH
  T15C0633A85BE5F752DD1745B02A1F037E1A78D308A5A9339838725B57AE0793FB43223C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Twain_64.dll
- Size 4.9MB
- SHA256 8f2430eab55cfe11b9035c223f5d457e5c5bccc50a2ba38b852e2a0183ff204a
- MD5 8314096349b71c2690cb06f3d6a70287
- SHA1 5a63877e96d88953cc448dbc8ab2728373cc781a
- SHA512 208ffc1e65aefd82abbbb13e69d66cfc85392d27001f5ac750a4c6fd5715527ad4f64da4685e1a1859ed43fa97e62cd368baf7095e2ed95cc138dd09bb2ac423
- SSDEEP 98304:U4Z709nb/hP/DIv/fkgBLfvnR7660V69wZXQvGbGoN3kYI:nZ709nNERBLXdF0ioPZWYI
- TLSH
  T1383633FBED652F5DF1FBC8F93C6D470E93CAA06CA226E61880354DDEA08E0BD8945445
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  em/KeyAuthEmu1.3.exe
- Size 3.2MB
- SHA256 683e7a2fd8ed2887b268b7f3d9145b11772b7624c115d6eaf0cea5a4029be860
- MD5 f42ba9c2f43e75dca923912a735e264c
- SHA1 f8cb8baa9fd0cb0c94bb43131dc8af711d23f6a6
- SHA512 821137301b1561a5a18991b0959c57b0c44a6bde58a6d22c1c790b20ca060fcda8ba840b4b6d5349f7d1fb07f4c3cb28ca2caa1082f7400537d504edd65caca0
- SSDEEP 49152:6GzXEvR2uTSOILLjnOsDzNtI4VD94AC2Q:XaGtIJ
- TLSH
  T1A1F59D15A3E800B5D83BD638CA2A9333DAB07D926734D04F0698F6461F73A919B7F716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  em/libsodium.dll
- Size 337KB
- SHA256 597e80901f20bd742bb9102e17572278341cc77acd283dc47f172b9ca8fbda4f
- MD5 7462950478708e413d32c5421280c056
- SHA1 68a5fa3cf4be0ad8417a89b1efade07c4ca18757
- SHA512 2d422baab92d65e58a71c1bae5de4ce9e3738ab3b840e1e7f91e7fa39ab72d13865014e5c7b83f18f3c5b311d683159d0ede389fcc2a4e16767a61da1badbbca
- SSDEEP 6144:nqvR7IKDFtdOd3eoqe8FvexQcYz6WTCOMCBJluJuWV50DEr41DEl1wRAyO:nqOz0PcYz6WT7MOJluJSDREMAy
- TLSH
  T1B7746D5EF9EAA5E9CDB3E078C2BEC6A6FA55380C43E057F313C2495429537E14638B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  winhttp.dll
- Size 41KB
- SHA256 a7b2bb1bcfb9326f54fe12d1c512b587af41d97562587f5784423f6f46148f20
- MD5 f509c1a594bd14981a6974b7956cd50d
- SHA1 bc0d1f3582a5e9568698cf50979b593cac6805af
- SHA512 49f01a3c4169ea6b9735f35c04c4a16715d8b89cfaae3f802bbf694a1c622028cf11bdf3dc34696b8817d3e71b526c3e673e0b7a101c362aafb1d62bbc39fa44
- SSDEEP 384:pql15KapwRYuPMLJsv7grlh/OouURvOTphaHvPmew/ktAdVtKRuZoijtBKYkOlC9:0jWvv7grv/OwvMpoeaAZl64wILP3pP
- TLSH
  T16513E716DC16A12BDB2D8CB4C6134D46CD93BC868FE1B5CB67600DEA8DA1FD49B3E241
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5