d296e4dc7d4bb5bf42a385f4ed74464f3609cb905f77bf4ac40551e01cbce942

Sharing

Copy URL Twitter E-mail

General

Target
Alkalmazások.zip
Size 6.8MB
Sample260826-rqv1cseq2t
SHA256 d296e4dc7d4bb5bf42a385f4ed74464f3609cb905f77bf4ac40551e01cbce942
MD5 a9b436676c0fa5af4ef36d3035cbf576
SHA1 bd113483fcd8a71dd3f4c75a9553116bbe7a54c4
SHA512 fcbe8d28700f48c1438ed33e7af4ce77f6511bcd1e0ac352cc6a5ad98340ddeef695147399bb256ffba58163c16517ce351407ef0e0d4ced6796c4b84a3eea0a
SSDEEP 196608:0NmsUD03SZJMjhByhAnM/+bu9Nn5d0rAuLTuYgM3JEkwREbGV:0N5UwtjrJMVn5SMufuYgM5EkRw
TLSH
T1157633F4F8C28E239C04C37F4B2542395CE2D26EA9DD7463267EEE5F980E11749AAD50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.chm
- Size 24KB
- SHA256 d5909ca92c389ab1c01909a6f07fd351e2a655be97931caaecc3307a9e8f26e1
- MD5 ef8d0a30da9ab8cdbbbd62d74bce1187
- SHA1 06441c5dfa4b9577afc989454216ea014a49b8d6
- SHA512 695faa16c29d0ca5bdb2afc5da3e05f25a6b17ce4dbee43aebc9ffdbe18d843273437bb0189bb1ef2a4ececbb236aefe634f38f94a179e593edaa6105fb2e789
- SSDEEP 384:ZaeGDZD/3k0Xb1/WN1iA73A8f2ZVDUDjGTa1Mu72:Za1ZtijuVDUHGO1j6
- TLSH
  T13CB2C03833810531E06F0E7A5E049BEF76475E9D7BB2634631AA96F51AA2D1C0735DCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.exe
- Size 135KB
- SHA256 63012ea9ce8ed335db7bdd33fa7bb449aa1ba31755c6845c1e79c11cb60dc908
- MD5 d0d19f2cccacf70bc84846076acc11c8
- SHA1 21154b5b479aaae4c56aec309bf6964eb52d1ce1
- SHA512 b45a024e3e22821c3a9fec56969fda164acab0f12a28a29a8c9263373004b57a246ff46f90a81b65714b09d788ed8c265de130eab059c546caae79b6d15b73d4
- SSDEEP 3072:xFRB1T0ABjInqx9sKJQ1jrD0ivz0ll27ENCP7g8g3OaAy:xFRBVnj0qxbJQp/0iolGENC6RL
- TLSH
  T1F7D34943B2E49072E1F72A301EB94B728DF5BC706974C65F93A0694F6CB0A81DD2536B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral3 behavioral4
- Target
  Alkalmazások/A1/A2/A3/A4/A5/A6/help.txt
- Size 122B
- SHA256 a98bf5fae4acdc9598e49640346d5fef832b50084073a21daf7f899d028a79e1
- MD5 b5ff8866103110a6e177aedf7d2a24b8
- SHA1 2aa15a11d71e4cab13cb01cd05abf818a50ff3d2
- SHA512 6dfd94adf81a7b14877a46e4d964cf50390171cf8d3bdfb16004ed5c75efd388bac4c5cb4a6862c4d451365f4b6af00050210a4bdc1a464f9f6316fb742a1e54
- TLSH
  T146B09B5471FFC56A74013B558B00C418E102534C00D537591BC75457F42017DDD864FD
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Alkalmazások/A1/A2/A3/A4/A5/Everything.lnk
- Size 609B
- SHA256 0d1ba5089494ed0384117da3592aea539b74af8adbe8cf823eada983a93fb0df
- MD5 1290f7650fb1b027780072e073411444
- SHA1 996e44a4fa348f5edf3923373c393abd562050aa
- SHA512 c591955d9b69f7b159953a06e6bcc150f54d8e3a667873a1a4f93f108881919b5b94eaf39fe745488c16d76323bc10ebc4384c6e12f5a14c795dd92f7c35f3e0
- TLSH
  T11AF09E230BC3587AF4E14275CD27DBA1EF4CF48942C8807F9746604819B72414888A7A
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Alkalmazások/A1/A2/A3/A4/A5/ExecutedProgramsList.exe
- Size 81KB
- SHA256 e3af98717bf1cda7dc4aacb5b34d111ac237604161cd96f7929ec33f2ff260b6
- MD5 7366668cc7eaa1068a38cc2761217fc4
- SHA1 a6790473129e7298185ef4ee4e0badbdecc50040
- SHA512 5af36447a1d29c2024b83cf08bb9cfc2c360e02d819eb7b238e1e9f774aef6e5930f5f33b9f64d62e4e958911493338a0d95b58b22b076c4e9025abe6f3f0b4a
- SSDEEP 1536:mnfPc3+xpqH7tTkloB7MYk34T8bbcw+BI2SNGOcJ74l8:mnf03+xpq71kl0QYk3Jbww+JSNGOcZ4q
- TLSH
  T1B8836B0363E44072FAB31A709AB36A664BFA7D225A74C50F8BA4B94E6CF0741D531397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Alkalmazások/A1/A2/A3/A4/A5/RecentFilesView.exe
- Size 46KB
- SHA256 80930766283e9575617cd03ea31e575c091fb2148e08c37874afe40371cfd5a3
- MD5 4d27a0ef39f71709510662519553b24d
- SHA1 35adea46f3fde61c14230c67b687086429fc8438
- SHA512 8f9fe1b9d0d93aa80520319de07e7a53fe2eb51020da207007ac0b74412bfe896ee664778d001709d29b6ce3e533d611de62734854bd8037979ee59f19a600d4
- SSDEEP 768:QxKVTfbKrhSUN53TiDNoG3+MUAkow8HMcZwS62qGFh7JzbiyiyO:ZfbWNomnMUhZKBsC5Jzbiv
- TLSH
  T12323D0D38D747A50EA850D34A5F7DB37AEB2FA825A54439674AED09DBCD03E07D1800B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  out.upx
- Size 63KB
- SHA256 b881e20c1189ca4ad34a4a8c275348eb05b97cc609333298e65585bb884e8647
- MD5 d00f5a79dc5294faef0fabbf1a3430a3
- SHA1 d4b0f888ba5d1511b1dc6e9a15384f109b799225
- SHA512 49cc41a675b4f851a27d39d22bff8b6da2665b25828af24bbf6c830bd4e0931ea64dc8935d211f40297377ea179b88b055595abc191e9d8d8acf06b55e9f666c
- SSDEEP 768:KEEFSGQ6oHcpU82vKJgrGeEdU0G2oy5+sGkopsmXsEhaTj4p+Ut9R:sRm82vKJmj2J58k+bXsEgYcULR
- TLSH
  T174533A0376F09075E5F31A702E3A5A114AFEBD305534CA0F8B946D0F6CB2656EE2A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Alkalmazások/A1/A2/A3/A4/A5/UserAssistView.exe
- Size 30KB
- SHA256 bc11c4150bbc6f8b2cf7bc96bedbb183c61d53ab8e4052b15d58bad6b6d1befa
- MD5 f36530f46a34516be38521ee9a134d28
- SHA1 47f0553e0a0febbef59fd9a32149497bbdd5229c
- SHA512 5c1a1282ffc25409d0044770c80e92f7a89fb40567dbb24f64f46750083bb30b842a63ef58b8b9433fa5a5903a5aa7bf71ee941709365c6bc17a9f4d85b1ad5d
- SSDEEP 384:IecsPHRggjhCnMgZas8+oAEqPm63AovtX625wWMPODVDSt/U/BEUxhUp5Erzrbqu:HhCWSrPlX62arODxS1U/Br9nrbqUo
- TLSH
  T103E2D04AEAE45536E0E16D3900A347275748F8124FB807D72B90CA4FBD20BA1AF237A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  out.upx
- Size 54KB
- SHA256 33b2fce3e8f8f62d4b73825289f855bdefe32c8c77a38886a1ca25523cb931ca
- MD5 36583477674dd4ad3c18a1fa9dcff4e7
- SHA1 27b693cc59e54f1132aacd26ce6e4cbd6fa17232
- SHA512 4689125013e574111ded9b148a9ace3c8e121cb96973851dbfe656756b283b442f82d03c3b3cbc84d03d1beb5f7186abf78fd4afe44adc69d0b507fe19f70864
- SSDEEP 768:Mgb2LcKcqcJ95WFyDLmnj7FhJfmazCcQISvxCQI2QGoY5tt:GcTWILYj7PJfmVHJtoM7
- TLSH
  T1D3432B0376F98071EDB31A305E376A159ABE79205A38CB4F8B946D0E6CF1790D936363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Alkalmazások/A1/A2/A3/A4/A5/help.txt
- Size 763B
- SHA256 a09c5d9fbe34aa75f695a89edace7bca953103fa7399fc9eb7eaf19f035a0877
- MD5 8d4fcd856f4b2af3ba2d42915d8ed1ac
- SHA1 91c64dc74d50c83231c4cd7be7e97d817d41c486
- SHA512 076d1e097eb5fcdcc14ba58e27f51a1b658630a8b25b9a55c06166ad33f696c02fceafbe188dbd2f73d21ea2a157f8e269dfdc4500bf2ce8d000dac5c31f1e9b
- TLSH
  T11601D094931FC3B4B4B61E2A9415AF096347EB9697C8363438C3405BF4093AD184E2FE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Alkalmazások/A1/A2/A3/A4/A5/journal-tool.exe
- Size 13.5MB
- SHA256 8226b5885ea94def0a895da5a98fdcbd826da231a0eaded5bfa380a84cf8d0d9
- MD5 445fbbeb5d7ab4cf029200c856b20d05
- SHA1 50023e87a4b53e23f5b3437aa13f99d7ec887020
- SHA512 83735ccd417acba82064391174587e4de7d53b546c7eb902d756ba068518d7ef4bf59ec47e54089d09cb58b702baf7f4fcbf79c25b1327c9db3d6e9e383a1176
- SSDEEP 196608:CcfvFlLGQXArrpgVutHN5cmhJxmzwmjUg35Z6:C8vhXiAutHvgwyUcq
- TLSH
  T10FE67D47F59254E8C1AAD170822AD2B3BA307C550B3467E72B50FB792F76BD05EBA310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral21 behavioral22
- Target
  Alkalmazások/A1/A2/A3/A4/LastActivityView.cfg
- Size 578B
- SHA256 0163c60e48ee8874dfc528a87781cf81ab04e9d881962111763ece783fc9a302
- MD5 0cc42dfa3eed5fb7d87c61a88b8a4892
- SHA1 b78e984d8ef36163485549d054f8bfd5a55078df
- SHA512 1e4c303942d6a39b98d7b900cbfa33ef2bda78c5120cd209d3472e925a459d6797931befccec8c1d7727f27327400825283d6d09a291f9a7a550b3ea50d56b39
- TLSH
  T137F0E90298CB086ED1C15FACF0F9392004F56E973CC408F0AF6F1708CFC659ADA86140
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Alkalmazások/A1/A2/A3/A4/LastActivityView.exe
- Size 130KB
- SHA256 b1b7a772c927b4d3e2e4d59ba69e3fe955506ff80cee0947d54c6b3fabef6860
- MD5 a19eb1487622a13402c0d63eede58f59
- SHA1 c662772fcd96c7d6decd629af28f26014c506a30
- SHA512 6b7b676ebac4e3127a63cc1fbde85144d551c7d38330c516ccb0aeaa7558155eefc1dfba3f3d7b18510f8e099c37fa2504f1ff00607f52187a03780fd7f75f94
- SSDEEP 3072:gnk4eDEnIUuBkxlXvVbZTK1TT4ik69L1X7Bom:gngdBeXvpZTK1P4Kp
- TLSH
  T1B8D37C4273E54071F5F31A726EB65A3ACAB6FD705B34DA0B97906C4E2CF1640D9223A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral25 behavioral26
- Target
  Alkalmazások/A1/A2/A3/A4/help.txt
- Size 331B
- SHA256 02a7244713b321fcbf19fb1e668f16a36d17ce991b12db71adbe9a844c6c4c8f
- MD5 e41f592d2ab01319cd10eccad14a3ce8
- SHA1 f5c52d405ecb8c5f1998927072e065b6523b4948
- SHA512 05a36ed37a5ee4e29d583cb9b85acbebf43631aba7e5867bd8a1c49368ae307ba27538b64ac8639edc44858e6787872b0efd69dc5ad88594bb4545dc756712b5
- TLSH
  T1DDE0C08C07CEF2C3E550254332412E05640BC986578985581AC38047B40624D9FE300F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Maps connected drives based on registry

Enumerates connected drives

Detected Nirsoft tools

UPX packed file

Detected Nirsoft tools

UPX packed file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28