1ab69447a576f35f75d193ede411cc139c82a3e85574f377f3207bbf7386a6b6

Sharing

Copy URL Twitter E-mail

General

Target
idman.6.rar
Size 23.9MB
Sample260826-cfgyes1erc
SHA256 1ab69447a576f35f75d193ede411cc139c82a3e85574f377f3207bbf7386a6b6
MD5 cc9d52dfc24841419a904d8adb34c460
SHA1 8ec26d27ea23083d95ac0d6350fe34609d668862
SHA512 6c762617c1d06f5e7caedbf7f395f200e588b2d8784eb5fe01972408d631fbdb11d4c067623999724f5cf04037cef23fbecb7a32e605be3646aa0952a03d7b85
SSDEEP 393216:15TKnz5me3SexYVsDCC0/4Z4fkKpwz9wQ/+VD0yxyevSexYVsDCC0/4Z4fkKpwzy:jEmees21QZuwGN2aUees21QZuwO
TLSH
T1D64733CBB5619A5AF66918B8CC71D1F9D8293D43EE0813437BBD3DEE36B508248144BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  idman.6.rar
- Size 23.9MB
- SHA256 1ab69447a576f35f75d193ede411cc139c82a3e85574f377f3207bbf7386a6b6
- MD5 cc9d52dfc24841419a904d8adb34c460
- SHA1 8ec26d27ea23083d95ac0d6350fe34609d668862
- SHA512 6c762617c1d06f5e7caedbf7f395f200e588b2d8784eb5fe01972408d631fbdb11d4c067623999724f5cf04037cef23fbecb7a32e605be3646aa0952a03d7b85
- SSDEEP 393216:15TKnz5me3SexYVsDCC0/4Z4fkKpwz9wQ/+VD0yxyevSexYVsDCC0/4Z4fkKpwzy:jEmees21QZuwGN2aUees21QZuwO
- TLSH
  T1D64733CBB5619A5AF66918B8CC71D1F9D8293D43EE0813437BBD3DEE36B508248144BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  Fullprogramlarindir Menzil (1).url
- Size 62B
- SHA256 b2823b511435ee9f346242337699b781ef997cfeb9f131dfb99e50f147c1819b
- MD5 3ba004e0a58fb1fa92962abd32789711
- SHA1 ae7ba9291de96f80bdb5bb8477f8b05c89f342a9
- SHA512 b47ae715b09d59499856b83d958f791cdb2b2d508e377e5e2e6820db7dd9f81b92e0cce093d62125d77342dddf22df66c88a24a8b8e9e1758771a070a430d921
- TLSH
  T1DEA00267C149C4D992434E4CD830D9158913A8A49866C8F5E7508B5B9DC695059C8304
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Oyun indir Vip.url
- Size 52B
- SHA256 f2509c1980ce573d45aa69368267d4c0c80e5c3b6ea8b1cd926f14516bd90dbd
- MD5 7745d1ad2d781d93608e33280de443de
- SHA1 fef8e3347e094a17fd5b84bf6a40d4ad52452f47
- SHA512 a6105f599203e1d1299b298cc0559bb3094edef8efe308869a194703a4b86ec074c4ccf3ca73b6797c40649c9dd275105f5f598ebfb7b603a52cf21e74d560c4
- TLSH
  T150900267410AD855C242444CD533D914A8032BA5C456C59491449A095C4A07455C5604
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Oyunindir.Cafe.url
- Size 49B
- SHA256 51acf293ff46e30a4bcf4531655ef55462c80dd575c0fcf4b4b4d7d65563cd1c
- MD5 ab722db8a4b5abfa10baa592c16a94c0
- SHA1 cc19b78d4c5dc3c05cb17fabe21e9a814feb6e2c
- SHA512 9d7cb70067a25a87a1cd54e7f28582bf95e0e28ea3c7a761a988d974f0057051b9298a94a75a22d794aaefe7f9b233eeb432af639d1ab230b60ba46acc5dd1f6
- MD5 SHA1 SHA512
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  Patch.zip
- Size 73KB
- SHA256 4583d3857a05e84009a49d5f6d544ae3bd92788e0f5b8a560c78afea9ce510f5
- MD5 10a8efd4f2116d44d0b8840be5eaf328
- SHA1 1f98875fb95a35231f0eedbc6a2dce802727e4cd
- SHA512 ee66e5e6fae25b107c67e498ae445358ab9949ded7533aac850fa63a3de1e83081115a0a1df942af59d54cd9af7f3e0ff98f396649d9979bf8595b29ebac2b5c
- SSDEEP 1536:ZMARGKmid3B3HHF49xGwwjE/kzOhB0a4oPkcTLaO:SAAhC3tHHF4kjYkzOB0a4NcfaO
- TLSH
  T18773D03AA5D57823F3FA0171A387BA71D63C5CE8FE46C1223269660C1FE58D443ADC99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Changelog.txt
- Size 7KB
- SHA256 879e9704dde39b8827b99422c0494c7bcc50f91cc621e9504ce3d894079d64b3
- MD5 57771249a68936829638f23d0c00d9d7
- SHA1 da711d567116ddee586fea6f13b9e15dd0865672
- SHA512 9f0cdd480d3ff38966555d2b3be7b096bdc7cdec1b9afb63744e3440adb534bc39bbe4cf1b6ca37cac775e87a803335c728e23a2c8f2287cadcb5314a1c53ddf
- SSDEEP 96:DuGROLUG3E3QqGqiiYmEDfE3jCVxE/+86p3xiOn1Zucp3pn09bDGuUO8vJY1h4Lx:hE+QdviYzDfI+8W3bZvpZnq3GuUUj4t
- TLSH
  T1A2F1BE7E7893B41233BA8646B7973571CE3C5DDCFF66C06536A063491FE08D8826C4AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral11 behavioral12
- Target
  IDM_6.4x_Crack_v20.6.exe
- Size 66KB
- SHA256 bcb21f1b4b14892370d2e935bcdb20feae7ff36d8d7eab8bf24a72ef43b01f89
- MD5 99e93f400964b6c8bab5a18e0e216500
- SHA1 2cfa756887ba67240c73791782386bd389a83454
- SHA512 da8e355bd93692cec82ac59cd899f25112be270fc69b7aac49d4abe7e95428b3ffd9f18ebdc5cfbc196c2fb8290ff5051ebeb639ac56e4cad4762ea437f43af1
- SSDEEP 1536:/RGKmid3B3HHF49xGwwjE/kzOhB0a4oPkcTLa:/AhC3tHHF4kjYkzOB0a4Ncfa
- TLSH
  T1FA63F151C3E85D23F7FA0471839AEF91E2469DF690854623312FAD0E17BF4D00BAAD58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  idman643build3.exe
- Size 11.9MB
- SHA256 bb32a3db73be1d33bcdb77504d0d024fa38b75ce8ee869c2ba5bea9cff3f5df8
- MD5 83f5eac87448858e1d75d3864f6e8e2d
- SHA1 3d80e64ff608b76b43ad7cb5d8e6ef0629ac2f07
- SHA512 3e5f50bce18ba381104ccba40cd0bad4cb47c9e36d86f19fef072f4a6ccf9976ffc74882b80b21d7355fe60c39fa3d94a899375c7b052f20ff9691c9bfb5020c
- SSDEEP 196608:MDb5p/QbkRE9um3b/r5meJIQWJNey3UtUzVslfJrCcfNr4/9OZqtSZ0FkD2peSn1:M5TKnz5me3SexYVsDCC0/4Z4fkKpwzW
- TLSH
  T12EC63387A6619A59F1681CBCCC78E1B8C8253C03EF181353BBAD3DFE76B508189545BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence phishing privilege_escalation spyware stealer
- Drops file in Drivers directory
- A potential corporate email address has been identified in the URL
  phishing
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral15 behavioral16
- Target
  idman643build3f.exe
- Size 11.9MB
- SHA256 f1188c37264b71433ffa125eed985912714bd90de67032bf557b099c02af11df
- MD5 b0c81788b1b664c07ae55dfe43baf6ce
- SHA1 69505728570ee12877baa68c96921630ec3438e9
- SHA512 02a007d2c8ed5423c600e81d5db813f031f040936421857da1d39938cb86e7c89aec7c6b75a1a3245e68969223d465b3c69ff69642cf00b48c707c1f86ca26be
- SSDEEP 196608:o6b5pdEh0q+VD06pxxVEOB79IQWJNey3UtUzVslfJrCcfNr4/9OZqtSZ0FkD2peq:owQ/+VD0yxyevSexYVsDCC0/4Z4fkKp3
- TLSH
  T1CAC633CBF4619E9BE9295878C9B1D1FE98283D46EE1813437BBE3DDE31B508704058B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence privilege_escalation spyware stealer
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral17 behavioral18