fcd70f81453a5a4803954e60575b5324df21ef155d7d0cfcb2ccd64b7b400f15

General

Target
occt_17.0.17.zip
Size 202.2MB
Sample260825-ae7rcavfld
SHA256 fcd70f81453a5a4803954e60575b5324df21ef155d7d0cfcb2ccd64b7b400f15
MD5 dd0345f37a5eaba6eec48371fe4376d1
SHA1 e26568b4100ce018e755905aa14e0f8157c0dd1d
SHA512 fd45faa1fc86d2966d6179327bda7cf025ffaf13c667d8f47956b6ec3087755bcf2815952395c90bbf13e32196b11f4dbb76eddcbacc59651fd0bd110987bc98
SSDEEP 6291456:MaqrZ5R60pYtJ6IiCp2c5lcNizPDhec7V5w:MXr40pM6wo1SDv7Vq
TLSH
T160A833E66A248683E453E86B75A06305107F6020F56ADDCEED39E95D3343EE3D0B7A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  OCCT 17.0.17.exe
- Size 202.2MB
- SHA256 1c67b7ba6d40555554afaebca02c31d8258ecd93e6e078c12a2634913a5b7611
- MD5 92ea35257f1b17f22c57490ff019b8ca
- SHA1 1b154fb7a3870405c9cc07cb17fc1a2f45b7ad75
- SHA512 fe477924c807da4fd08bcab4af5421954983878cd3a2b9a83e704ca749fc3d4defd82f9c3cecf260d95ab5e9dd75416d5ac3e1468dea1dfa193648b84b4030bb
- SSDEEP 6291456:ZENpHqFjw1WCE+PCGc8DI0pPMcwphU3Tl92Jf:iXHKGWC1Ci0IwLCTmZ
- TLSH
  T12CA833924544C643E403E83B7755678916AF7C20B8B9EECE4D35B92533B3CB3E0BAA15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer persistence privilege_escalation ransomware upx
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  _Silent Install.cmd
- Size 1KB
- SHA256 247c212eaf760f94582ff1c0454c20ba5ac3f9eb624300e45c1b3ab2a892914f
- MD5 4e7e919872ae8b004221acda375ba10d
- SHA1 20ec3d5169b802316d237228c53187099cab3ad5
- SHA512 400cee329970d876086f7ad9cbf94de264eba2c87d1f9a532eafea0f27511427ae49d949b9aaafd52c4a5dd0fb72bd261570a80cbbc43776f9c7a23f27b91ad7
- TLSH
  T11A115A773670E94C93B00F882D748522B42122DB2DB20D50B47F403B83A06C8386CF5F
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution installer persistence privilege_escalation ransomware upx
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  _Unpack Portable.cmd
- Size 1KB
- SHA256 ad4c98b4ed5ea731581a9cda0c483d7527571c4a2bf3eea18ccc4d80b009c3b5
- MD5 4dae2ebec5d1398dd8dfeac57f8e6216
- SHA1 11fd3c799c7d0757a29b497920db790fe6886b2c
- SHA512 4f1a1864b3d290e340d0485d44a8096f9d488563e4b74753728622fbdff2c813b64b3e79afedeff729be34f0c1b453b4c0a872adfa9ce8e3118bbe3c07681190
- TLSH
  T19011532B3670E94C93B01F882C788522B47122DB2CB20D10B07F403B83A16C9386CB9F
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution installer
- Executes dropped EXE
- Loads dropped DLL
behavioral5 behavioral6