d8f7461bd7b3b3de53c908dd096ac1325876e17dd7624aaedae598599fb3f5b5

Sharing

Copy URL Twitter E-mail

General

Target
Syntex Hwid Spoofer.zip
Size 9.3MB
Sample260826-yqwp8aal2z
SHA256 d8f7461bd7b3b3de53c908dd096ac1325876e17dd7624aaedae598599fb3f5b5
MD5 9a51eb716bdf03bdee5db2c2d9c29020
SHA1 d1cb000743eb569adefa780e181e2d83956d464f
SHA512 ecda339884c95598b00a22a5527f6a7fbc16820b0c4fbaf889db695dee4c0c147e61d6e42c1928d03cc9fbb75c82589093916be4bef21842226578fd65de5786
SSDEEP 196608:7KOe1HP/ZEZu1JrEbGzs50a3sskbY3T++zYMH1i:7KBPxYu1BE6u0ac3AzFH1i
TLSH
T19BA633FD230DC9C3FBA54A1F6F19C9E6FB2149409925A529C7DCE2C4B7429DC7CA2188
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Syntex Hwid Spoofer.zip
- Size 9.3MB
- SHA256 d8f7461bd7b3b3de53c908dd096ac1325876e17dd7624aaedae598599fb3f5b5
- MD5 9a51eb716bdf03bdee5db2c2d9c29020
- SHA1 d1cb000743eb569adefa780e181e2d83956d464f
- SHA512 ecda339884c95598b00a22a5527f6a7fbc16820b0c4fbaf889db695dee4c0c147e61d6e42c1928d03cc9fbb75c82589093916be4bef21842226578fd65de5786
- SSDEEP 196608:7KOe1HP/ZEZu1JrEbGzs50a3sskbY3T++zYMH1i:7KBPxYu1BE6u0ac3AzFH1i
- TLSH
  T19BA633FD230DC9C3FBA54A1F6F19C9E6FB2149409925A529C7DCE2C4B7429DC7CA2188
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Syntex Hwid Spoofer/Instructions.txt
- Size 322B
- SHA256 2d934180978e693050c66d9a766f48d7461a201156ade9efeaabd80415f523f0
- MD5 132afd72c58fb51f2808de0b0bf40c46
- SHA1 24a632dfb5a1b609e3e35f174fbdd7682180510d
- SHA512 57f910e7c04002e9dca95a0e94a3eef2e39add2646242fd24010a7d213fc38cdc02f76ae3b38ab5bad58f4bfc90c9a44aa01a326b6e2097fc12e2580b8dc2b58
- TLSH
  T121E026A4637FB33814B4C615203F52536E13D826011F15685498502CABBAF83933EDB9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  Syntex Hwid Spoofer/Microsoft.Spark.Worker.dll
- Size 16KB
- SHA256 5cc987e3ecb7033bd6c40a880c73f2cae6c20aac4a70fe1a31bd3dcf8cf6b81a
- MD5 40888c729fad0a44a31825b9ae1be84a
- SHA1 640c7270c83a764511e24ef864f553da8c86e133
- SHA512 94f2a83173ea6e1175dc792237b53268bc90b2b5e86ed03d623548034bef21bf2d6168180f3132267160a480057d9e4952e8ad39c0608f7da56d67faefd9f8bd
- SSDEEP 384:eaCVR9lYpqTGt/2RwtKb7YUYSeflO3oVqvWVwx:eaCP9qcm2RwrUYSew6qxx
- TLSH
  T1E4729E1193944636E9722B7678F72B11173CF6288A638F5F5950801B0D367C88322B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Syntex Hwid Spoofer/Serial Checker.bat
- Size 1KB
- SHA256 a04a0483fa66cb028817488767271a192b5a4db033e43ccb4cd12a34b8ca72c3
- MD5 18ece2f833f5a58558232b8778035972
- SHA1 23d2b42179470d7d423436fd71c8c3cbb2d0f1ae
- SHA512 108351124e0eb37cf377c6b19f33299830c7be7b84f87a107de06df5051955050b18cabf3ee17c3abc10da55dfce6454867c76699f26c0c1d4520a7d55235599
- TLSH
  T10541F511B88409E836C9FB690E3246B330A1489BC5751C8D3A9F93384F413EC7A9BF5D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  Syntex Hwid Spoofer/Syntex Spoofer.exe
- Size 146KB
- SHA256 03e515e9cdd1250bee3c25e23d5efe95c9efca6abac057ac3628132c15e98547
- MD5 d19a23517f43e45508a441d58f7c63b1
- SHA1 a4a07748a51a0e0aaa15c7b23ab98a45691b185e
- SHA512 cc8ad848199af3e3fe2a45bed81f0e75bd21d85b62e88c56563969d90bf4f0e804b30f3745cf17f0dc4c6f8d85f707fbf903d8d45b47e980bf5616a0126429ae
- SSDEEP 3072:HhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuPCRL:HhK4XycqgpfCup5sVxuZ04uhAE
- TLSH
  T17AE34A03B2AC00FDE1BBA37889A25906F77678594B7197CF0390C56A1F67BD09E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

costura discovery execution packer persistence ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  Syntex Hwid Spoofer/System.Console.dll
- Size 170KB
- SHA256 8469deb8c7d532e8857f5c68deb291035103dee3698bf5005f4e08c5bd05775a
- MD5 e58a5726978b1dfd94b6b4cb38102340
- SHA1 d1a561662830fd01351341ca862bb93191095338
- SHA512 2d7b698720d7ab2e8535a68afa3aba41d39a888d05e59454cb7e35ee04e9e3caef52ea9be46bcd8e28c7ef4e4098f168d7d0580347a9f980893198995301a388
- SSDEEP 3072:zqPlmXCzdfd6+Vfz5mDVV9evshARZvgL4OUgZjZXR1BB1GlKi7:uPoXifd6qwV9eEh2ZvgmQ9bB2KG
- TLSH
  T1EF047D2AAFE8252BE77F857444930301D637A9C70302D6EB61C585892F43BC6FB726E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Syntex Hwid Spoofer/System.Private.CoreLib.dll
- Size 12.6MB
- SHA256 4cd6810b4ebe8d6e1f5928f2026d257c112380d33b557a60bcfa9c7f2bb012e8
- MD5 8b5ee62abdb7b72f418d797fe73f2521
- SHA1 77582007964cbb215278267691a255b63abe5ffd
- SHA512 870ef275e1e8d1607e2b22eb25f1f05f99346b54651bc119d809bf21f1a6f041eff801b3b5e1ffbb1897975feb2c3aa47b3699cc4c63eca8e3e6a60387ab4bd9
- SSDEEP 98304:FdVXzmQ6u2Pf1F1HpwajX4p92QKxV36FChEqiPVGK5+k+uiCi:9WuuT1HSajXgJgV36FDqM5+tuxi
- TLSH
  T15BD6AE21A3C45F16E56EC739C6638292E2B0F492535295CBC05DEFDA3F13BC15A3B262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Syntex Hwid Spoofer/System.Runtime.InteropServices.dll
- Size 94KB
- SHA256 127ea3f2ff47cea14c082b2ed22066554d22c9d8f97dc0d403b17042fac62a5b
- MD5 1df866f691def4290407f5cf01b996ad
- SHA1 b2ba5af3f80aab63ef2fecf6341b44deae201ac1
- SHA512 6f96aec2abf7f6e96b7699f67cc8547334277c8e502e6ed357713c54b68faf264b1843ea42e6ab0f7c6ad7dcc1098b9042e1d5f15e93db6f8d346f613d1f6a1d
- SSDEEP 1536:4o6MupEelCtJfKS6+67NspnSPM+l5+CkmVhKWHOiOyzUizB:4o6R3lCto+dSPM+rJkm7NOxMUil
- TLSH
  T1D2935A2037C84666CA2A473C9C775D50C9B2F6C613A2E6DF5781895E1D9B7C0C3B23E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Syntex Hwid Spoofer/System.Runtime.dll
- Size 42KB
- SHA256 9c506c9347f872c3375255f744dcf83b71a96ff71cbf4a19b39873fa22f73c22
- MD5 dac7d72763e59a64c0d706325b747d92
- SHA1 5890f0ee30b86e01ab55d6017261554d16f6c916
- SHA512 4218ca96d6d2d4e24e3b6a70a87890a9035156d522d217f48999870f644548a7bc5c09b78b23de41c5974c375f9d03ed49054a173b4230ae835ff808469ce50a
- SSDEEP 768:2+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLu:KB/LuYdy50b4b7RSHTSkingzIh
- TLSH
  T16D13D5A0AE485333CD8B6B72DC73AC810DF233C4047A597ED88EE51A13867748236B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Syntex Hwid Spoofer/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 a875d0785cae18ee30db531303c166ba1a1d30c0ca4ab8edd38fe04056f91eaa
- MD5 7b3bded48604bacf38173a19cb38f269
- SHA1 9d15d2ad99f7437c9ae1775898c739712f8e5f93
- SHA512 a34cad7dc195b6c5b8a5c89e3a93083b1d401b5f772807524cede69210b04bf8fe746d9925c2fdb18b8d0f7636cfdfe48cf26fb0095500739cdc48e141bf344a
- SSDEEP 192:h7mXhp/SxgZW6sJWDWWxNzx95jmHnhWgN7agWP3zzccADB6ZX01k9z3AqRrimR:h6xiUW6sJWDdX6HRN7azzccTR9zlRrT
- TLSH
  T160724A918BA84207EDB75EB0A6FDEA823C3C67C25C11A66B16C9F6541C633C1DB3063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Syntex Hwid Spoofer/System.Threading.dll
- Size 82KB
- SHA256 15cc9db291b87042f1ab4319f8d04f4cd226f15bf88bf0810b31dcd50fb0bb7e
- MD5 932a0c2978b649703c40b260b1955d26
- SHA1 e9a4c055bc14b3a2db5bc5d0cf838e79838ce8e0
- SHA512 51d6d767425fa1afa0acd5a149b99d4c62bab174ecd7485211e9b9635eb876319e8ad2a96d9a7cef26beb855da3661b26912f05014f6dc22cffe33306d9988e4
- SSDEEP 1536:AWgoICPLdImrmODZcUBeZ8j0GEH9wd633GRm3LGgLWz9zu:AWgo9PL6FtZ8j0GEH9wd6GR4GgLaS
- TLSH
  T1FB836B197BE80416FA3B47F9EAB69906C472FCD20710C6DF5049910C2E67BC1DAB227B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Syntex Hwid Spoofer/clrjit.dll
- Size 1.7MB
- SHA256 0dfe34be78144cad7db5b66a7fca3d86178ec0f353aafba6c81eb72e797e383b
- MD5 cafab1ff05ff429bd46cb78b2ff8e9e8
- SHA1 e02b3b243b6993c0add46cab15bbb6549c602700
- SHA512 f19b60d26d784b2000e67a8698f8915ef623eee074dab9b853ba927a20ff11ab267c4ba385971620470987240263f917199e1424f3d23d263382163d66435639
- SSDEEP 49152:OkM51Lv2FQJioLYRa19wEvKugOQY5iW4WGGzgdZO3Ebz8d:OBioLQi9w/5ONiVGzgdZO3P
- TLSH
  T1AB85AE46A6F805FCD0AF9534C6574A1FEBB2B81A13209BCF43F409A56F237E2261E355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Syntex Hwid Spoofer/coreclr.dll
- Size 4.8MB
- SHA256 b4375494bb10be11db6134d361df2f39a7a2c7f6696ca8d239a3ed424ce66de7
- MD5 389f964635cb95c6696744f56cbc092d
- SHA1 f133da56b7ad65d162656e052c358328877db1b1
- SHA512 49dbab9c3d1e9fe506ea7e0942d431559dcaf406c8e8233afdd234bd8337f735e1d9510861c1de00b7295d5956ee166d0ad55afce2142fd75a876f506f4dc661
- SSDEEP 49152:jh3nYAkdW1bIowGlFCJvETHWzaK6YL/XPSpRdUWPfeSk5GjyuQS7bPdB15i9FqeV:jkdW1bIowcrW6p0qnWHn+2OSn
- TLSH
  T14C368D56B2BD01E8D4BAC078C9D70A17FBB1B8590738DBEF02654A651F23BE16A3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Syntex Hwid Spoofer/hostfxr.dll
- Size 342KB
- SHA256 130a3656b07a317f859d542c0f11339f3d0ba4198169853781a3fc04ed64c907
- MD5 00f6fc45937b885439cc6c1a34dc96c1
- SHA1 5df3efd8a49b91e5af676d35c02e75a640f4755f
- SHA512 75f088c244271142c58a7ca8f42ee68b910332ac2a23c44f7e6f6c38ff2334f96b8f28ef312a79461f5c631b07110403523b67245be8d3c7b6d0368913438085
- SSDEEP 3072:zoo0qOJezezqrPeYvCuV10J3keQRJysmFTHABK/o3BCLNzWNxEvf5NCnFeotrcRw:0o0qOqqYvCuV1jyFTuKA2zGxuIeotdt
- TLSH
  T1E3741906A2F801BCF1F7A7789AA64901E77B78454B70D6CF0390846A2F67BD0DE79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Syntex Hwid Spoofer/hostpolicy.dll
- Size 384KB
- SHA256 65d61078b6b97884ad09aa12da97d96f50f7d98e6d163c926ae199f9bb58a3ce
- MD5 25fd4181ab8b572a1bbfba2f4a9ec239
- SHA1 b834dfc4c908b3cb8d3fc40771e6d0e900c7de64
- SHA512 38b708595e5a91194fdb089ae56e4051841c27406f8e770bb720ee9a5d66e6fb1ce8599f224071c2c23d30d832315c2a51a532677f121b383547f149385d1246
- SSDEEP 6144:Ux0Ke3VmzsnHpYHkGWqTRDERqBwT5eQC0+1Bs2u7FksfEXk0Pzfw:k0KWVmzsnKHkgTWkBDQq1K2vk+4
- TLSH
  T19D843956E2EC01ACE1BBB2785AB34901E7777C49077196CF13A0946A1F77BD09E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15