716f5bc38980dbdad25ff050050e0c6e1491c57b841e959c068e9f8907e79d89

Sharing

Copy URL Twitter E-mail

General

Target
ARSCHFICKER67.zip
Size 46.3MB
Sample260828-py23jaxhnc
SHA256 716f5bc38980dbdad25ff050050e0c6e1491c57b841e959c068e9f8907e79d89
MD5 f40cfd8ad6e12a92990085f58c59fc04
SHA1 83e5a09614bc65baab01ac5db204b47db30ba7f3
SHA512 b5bfcb4b399b076bd57c16ab7caf56e6e7c9663d4613b755ae6935a38b51641eeb981c873e898c10b46809099ced455ae322418274fffdeb6d8c56d7df5eb874
SSDEEP 786432:sPawwFaXXahP3X5eGaRXN2yQhFr4HPSgaxJghyY0yy1nLt8Qx53eulyA+:sPawwWahP3peGaL25SeJayY0DZL3Z1+
TLSH
T17DB733179229F88DC46E6F6446A0CF4391D03FDB3A7284AEA4B74241BE7537312E9DC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ARSCHFICKER67.zip
- Size 46.3MB
- SHA256 716f5bc38980dbdad25ff050050e0c6e1491c57b841e959c068e9f8907e79d89
- MD5 f40cfd8ad6e12a92990085f58c59fc04
- SHA1 83e5a09614bc65baab01ac5db204b47db30ba7f3
- SHA512 b5bfcb4b399b076bd57c16ab7caf56e6e7c9663d4613b755ae6935a38b51641eeb981c873e898c10b46809099ced455ae322418274fffdeb6d8c56d7df5eb874
- SSDEEP 786432:sPawwFaXXahP3X5eGaRXN2yQhFr4HPSgaxJghyY0yy1nLt8Qx53eulyA+:sPawwWahP3peGaL25SeJayY0DZL3Z1+
- TLSH
  T17DB733179229F88DC46E6F6446A0CF4391D03FDB3A7284AEA4B74241BE7537312E9DC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  HorrorTrojan-main/Bat To Exe Converter.rar
- Size 419KB
- SHA256 180771c0c9a08aec09130dc669fba44a4e9f3b51ea0c916be8edcc8663667fc2
- MD5 fa608c076144062ebaee398c6afc41a3
- SHA1 929088fa55cb5031a19f9544c08066a57d24d235
- SHA512 475a8af26797d929fdb66abfa69eb6d94969f1e20d541210a2823ecf6e429500bfe33b3595e3fa4f3d5d55b2e1a6238e9bb755a83c5045fd0873229255806f63
- SSDEEP 12288:mA+NeF/BDSjb67KoWhGqNG1R0YS5zq8Jp2PxvP:v6c/NWAahGQG1uYS5qnZ
- TLSH
  T12D9423937B5A81FD053AED4162722AB30F0A3E2E73EA189905695044F131F24EF7B4B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Bat_To_Exe_Converter.exe
- Size 444KB
- SHA256 7adc1f7ff040628a600f99465bd70e71ad83fecfe60b0f1dadc84b5d262ff350
- MD5 76d5900a4adf4c1f2ab8dbfd0a450c4a
- SHA1 6177a27416519564ecb5d38093d61c9a81d3c290
- SHA512 286b05ff09d4e85856c251d56902486738d9b2457d9a56ea8a449195b349f2718816099f4602efba88dad592dd6cecefcd0748382888c3026dd585b3e46f0c6e
- SSDEEP 12288:iYicHMPMDp8WrZtzlqQMB/FS/CiUF7RAfoSBjF:viuMPMDp8mtzbMFFS/CzKF
- TLSH
  T1CCA41221E9F468AEDD162AB14CF1A575F469EC5E1277CA8E34CE335D9B31201BC1A32C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  help.chm
- Size 14KB
- SHA256 00037bfc41afacf262afda160e17d3cca33606276324e99bbd93ad1207e9a7c0
- MD5 ffa8c49b21b077b0dc4b51a1f6f9a753
- SHA1 5fe5b4d96b266b29bd7aaf41b32394f58e7416e2
- SHA512 751eeaef0828ec4416569291ebf3f434208ff43405221339688ec2535cd5947d58ad4d2fd8ea073aa0554f712783f5ec8d5f42dfc4ee935d2905bc541ccd0a9b
- SSDEEP 192:TQ3bVqwNUWqaGA9yb6OmVbelnchhvm2I2S1O:TQLbNJqHA9YYVbCahvm280
- TLSH
  T16E627E703640D304C0069E327B90BA4AA3A15DDE66A45E51311E77DAA9F9D1A9F088F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  settings.ini
- Size 242B
- SHA256 236d6136a9ea4241facb7c459bf0bad6d1fa572d436e6e73c44884d6126e5ab4
- MD5 d3be6c4edea45f5a9a766dd235e4c23a
- SHA1 bc3f164c51e8f9b223b2992688aae2d492a18353
- SHA512 bd2f5cb1316bcc64bbf30b2828d497157129e2013a529be591733a5c900f4d3450e97eed3ba75f057a49884cdb9c0a72dcc2ba5768db33fba7ce9236f5cea6bc
- TLSH
  T1ABD0C7F452674044805FF315ED3195C546F922D01D02A951F77419AB0C724655675927
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  HorrorTrojan-main/HorrorTrojan Ultimate Edition Sources.zip
- Size 23.0MB
- SHA256 7429aa031069da80e88d528310c8e1379745b1a5b3589bf3b11987cf85bb3600
- MD5 024187c3f6d944f699f4b4dd5a201d8e
- SHA1 1c30cd4976aa303dd3be9bb577744fd694d10833
- SHA512 86e2e22525704a4ba10989cf9fa926fe73cf003171f0fd13a8e2393184e48e4a96baaed9ce50edffe497d12dda671c689daeb26de0c01d6d8e7b2d312d07ae4a
- SSDEEP 393216:8Gubdn/O/ZglwFa4wXa6woq3X3X5efiG49aiQRWiN2d7JxvIQtHFaI4hMycA7aln:IawwFaXXahP3X5eGaRXN2yQhFr4HPSn
- TLSH
  T14A37332F812DFC9D84EF5A1897608B87D4C17FDABD75002AC8B34601ED987B31376AA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Aha-Soft-Desktop-Halloween-Ghost.ico
- Size 207KB
- SHA256 e520487909fa4d1ebfda878dbd396e657adb5955a88c7cba0cf0ba83b5ee9250
- MD5 29e1fa9273c07283e3fa486ccdcbb992
- SHA1 789de85eb4ac694f97886a59531fffc68c5a22fe
- SHA512 04e2197bab54abbd4230bfe37a8af7e198ef4236156061ca42db81e3ff4f2fa95d6d915d9f02a3c79fe10f182fdcc6580b55a3598439c66a09cf4e756f0c67a7
- SSDEEP 3072:Ycokzhz6NBvGQRp5UwgqpvW8/Co8F4thN3Q03RW:ZkB++EwjhN8Sj6MQ
- TLSH
  T16F248F467B409B62C469437098EB8B512334EC675B822B4F368CF26D2EF2375566B7CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  HorrorTrojan Ultimate Edition.vbs
- Size 5KB
- SHA256 5d4fc588cec28a76bc17b76d9096d6e2d57a9f41cccbd7885b55c97a07b8b824
- MD5 1758e33c57b1796579843941eec0ba0c
- SHA1 482e37beab6755b97f9176dd9c9ea14720385065
- SHA512 e3d69b5eef9adf4189a78b89d541b7303928fc529c3dac918eb0c30e75b83629e1131e6de33f57f11f07611019d1cf3b55c94c4ecfdbda14aed69e560122f403
- SSDEEP 96:NVYLyaLzxhldtNkPsLCQJQUQUgkv3hBQR9NQVrnSj+QR9NO:NVYLyoxhl3Nk6R6UlfhB7VrnSj+h
- TLSH
  T167C15D172AF6000C7473AE01AEF560E6CB3BB669693AD0AD40859A0E5BE3901CF5177F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit discovery execution persistence ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral15 behavioral16
- Target
  Vbs To Exe/Vbs_To_Exe.exe
- Size 1.3MB
- SHA256 f50d774a95901ee952e0f6a03b69ff3de9d92c5146a5f8bff49c7a666e8e7825
- MD5 27dd3186c5f51823aaf82b815a3abfd6
- SHA1 c6ab78825bbdd53df4da2fc9a92601659ce05cb5
- SHA512 44d36b4a68fad18ca73351c45e0d85a28011358782c23a8175847d41f4fed80578061cb5d63c63a657f788afa9d669e17d650dfb9f6cfcd4d4fa40c50fde403e
- SSDEEP 24576:kYZgW+HDix/HwuzsUUy1AEWwqYFOv13kpawnPOiDzw3b2yq:DN+HSwO+EWwTwd3kwePOuzw3Jq
- TLSH
  T118551219390CFF74EB2AC776248EF5023AE538ADD022D5CE548BF53E0E69351B652A4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  Vbs To Exe/Vbs_To_Exe_(x64).exe
- Size 1.4MB
- SHA256 f8b4428bdc41052de9b9e501eaff1248076f25386e6bd75d67daf30153305e19
- MD5 77adc429fe1e03c87a3904222f3d2de9
- SHA1 a128892c5d46cda3c82a784fe5d35bd33a0c879f
- SHA512 c475dd34ebcb03e5dc08e6463c90511e91f7363ba7d69e5c5431d6a534f19fe8bc92985e04957bf43e0f442e0c71a3a4e6997e421876564545e82260e9aacf57
- SSDEEP 24576:yZFGwBcFrb7d1pQkV3KW5G5rJQjs0OmshnUbiXTwwUw8r55dJC+Ulg9Hdyq:yzGpQklVG5dQ40RVbiXTwwAJxUysq
- TLSH
  T18765120AB20CFF74DB3AC3727C9DF1823DD1789DE046A58A4497F57C1EA82A47162A4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

upx
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19 behavioral20
- Target
  Vbs To Exe/license.txt
- Size 1KB
- SHA256 936f48b3d07861604842208428d200c5b1190186b892354ac073886efd88c61e
- MD5 a1924707b191714b7044c99ed4e6b57e
- SHA1 d53f801ce1350c386550634f1feaa94d03136a2c
- SHA512 ef8e16b3acdc9aa091ae1a127463dd5e291724e74fab38e20db8e0196e577cc6b87f796bc51c91da6ddc0134dc2c2819f93a4d53a1a3c0ccf74401c84dfc161d
- TLSH
  T1B111B91F729503631C96576145A9ECC5F12BF15E7FAF1A80342EF2490336018D9FBC54
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bg.bmp
- Size 6.6MB
- SHA256 77897f44096311ddb6d569c2a595eca3967c645f24c274318a51e5346816eb8e
- MD5 a605dbeda4f89c1569dd46221c5e85b5
- SHA1 5f28ce1e1788a083552b9ac760e57d278467a1f9
- SHA512 e4afa652f0133d51480f1d249c828600d02f024aa2cccfb58a0830a9d0c6ee56906736e6d87554ed25c4e69252536cb7379b60b2867b647966269c965b538610
- SSDEEP 24576:SZujh649BMJ0vzqylHry3e/J4u5s/GYN5OdFPqxviioZkIDqKHLmWoM7pIytWMK6:r649b9Jy3eB4KelqZOkaM7afC
- TLSH
  T1F2661927FFD86884F039053694FA0708F311E98D371B8B9B556936B4F8E53C96E231A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  bobcreep/Form1.frm
- Size 731B
- SHA256 6574dc36e212fb883d86b964aabe41f63cf00b6e10a8788741538ca1e1d2b26b
- MD5 9cdbdc1588508067df041dc815b23b7b
- SHA1 c1e5125f12eab690746aa21f7ebf3e959c50adfd
- SHA512 fc20f0bc0058eab4c807f1608705ee952348db509564b26c047bc842c951e901319b28db6e4134d4c8fe4e5f329a51d41955fab14e65dc8e65d5f53a86064754
- TLSH
  T1070149509CC5F2341C336294CC77B206F19024B2220B182AB60EE5CD6FF67B2433E759
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  bobcreep/bobcreep.exe
- Size 92KB
- SHA256 00c9fdc8b877c7fb8365709155ab28cb3dac282ae7ec9fc9d47a78b408e0d13f
- MD5 219cd85d93a4ed65a481f353a3de5376
- SHA1 a38ab77caf5417765d5595b2fcd859c6354bf079
- SHA512 367644e3bc3310207b5863b09688269c38a55540b8c87e71d66771c954d37d561ed09f3ee11b36c4c8f4a48b618b2e8debae3d93ff684d15305f93a3ade6b3d9
- SSDEEP 1536:/O5I1MSx56Hj2UItX85ljPQIe9RoSbGF4q2L6OBIyHwPSYt:eeMSMHj/rj1SbGFl2L6CIIw5t
- TLSH
  T11393011ABB4C6D3AE4DCE7704CB7CB20C958FD063659636E3410377A2CBE28B26B0564
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  gdifuncs/gdifuncs/MainForm.resx
- Size 9KB
- SHA256 2c010bf834abb902303eb0bf7d900870f1700c20e9e10fc99146c0fb1aa295d0
- MD5 d19bfe025a1e108c7f40726f7464c704
- SHA1 3c4e76bee0342f34b7b89558d5c8f70ecc5a8d16
- SHA512 042d9096bb7d05a60d3878f25da1beb56602a53d2a46ca7898f1876d5ee53bec81284556934a87f0256bf588ff2602b16d0679ee5f62faaaa124da6d8c3e0e70
- SSDEEP 192:KjrbLPD9sLvIzSvKgIqUyahFsbawbbawFbawkgwrvgjPMg55Bl:KjrbLPxsLvASvKgwyahFaawHawxawkgZ
- TLSH
  T1F612A735B1C1DD260EB24829D55669C8FF94923F02755C8474DCA61FAF72881A3B33B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  gdifuncs/gdifuncs/bin/Release/gdifuncs.exe
- Size 5.0MB
- SHA256 7c4f20624dd062a6c71d845d05c6328d5a903ca96398e2902506591b231ed585
- MD5 c47c6a5111193af2c9337634b773d2d3
- SHA1 036604921b67bbad60c7823482e5e6cb268ded14
- SHA512 56698b7b2edc0f94d0f7172c853cbe67ac682d132df768659ebca0c169091acb36ffd0a6874c26e2fb35117061c91c9eca4312532ba778312e3d63cc77ce1262
- SSDEEP 98304:+Qz+04D+i4DBz2NHlruSSDllNmd+5z/Le7q2:+QS04D+i4DZmLclKez/Lkq
- TLSH
  T1C936334A53B64C10F76E7DB4A8E823884E31BC657CF0967F7A913D931B2736C91908A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion persistence trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Disables Task Manager via registry modification
  defense_evasion
behavioral31 behavioral32