20e5aa7a12c6b67f829959d1ca8c5f13b4c19c6e9a631c5bd6bb05314d95dfae

Sharing

Copy URL Twitter E-mail

General

Target
Update.7z
Size 114.4MB
Sample260901-yzdk1axanf
SHA256 20e5aa7a12c6b67f829959d1ca8c5f13b4c19c6e9a631c5bd6bb05314d95dfae
MD5 ebadecf171bbd83082ca5850ca9e5980
SHA1 b274c30853beb3af661edfb14445854d706b0f06
SHA512 50f86b04fc82c981e1145576792b38905550c777334e4944f9d28a40c380f361debe2187c6f0ae5786c267590332d1435de9ec1cb70c0318576974dd1cd9315b
SSDEEP 3145728:/LtTNVzUllvv/H4UMczLHN4yl2Hl2csmyhQ:/LtTvzUz34UMkLH1eMhQ
TLSH
T13148337BB3A3469B8566970FB8C11E2DB18364CDA59F8BA1E173D2C608D3101F616CF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Update.7z
- Size 114.4MB
- SHA256 20e5aa7a12c6b67f829959d1ca8c5f13b4c19c6e9a631c5bd6bb05314d95dfae
- MD5 ebadecf171bbd83082ca5850ca9e5980
- SHA1 b274c30853beb3af661edfb14445854d706b0f06
- SHA512 50f86b04fc82c981e1145576792b38905550c777334e4944f9d28a40c380f361debe2187c6f0ae5786c267590332d1435de9ec1cb70c0318576974dd1cd9315b
- SSDEEP 3145728:/LtTNVzUllvv/H4UMczLHN4yl2Hl2csmyhQ:/LtTvzUz34UMkLH1eMhQ
- TLSH
  T13148337BB3A3469B8566970FB8C11E2DB18364CDA59F8BA1E173D2C608D3101F616CF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  cоnfig/library32/libswscale-5.dll
- Size 1.0MB
- SHA256 8f79af2a36683b9756c2858bd386f3f392f261a187aaa524ab4fce2dc0a11b69
- MD5 32b637c6e70b25d042544402b55a68dc
- SHA1 e52347fbd55f8aeb11bcac9ebbb5a8b45deee4dc
- SHA512 7cc849935ac86729308b640b5b993f181ae403b98117429618e23103c160eecb09fa95f6b70663239c1e023f2b5dc531f32b3f5e1e0be24f3e5a3f66482513a8
- SSDEEP 12288:7povbC/T9Q+BDMKo4v7ukSc0fJS1ajImEvEBTqiCQtUN1tSg2zj1jcuKUJEFyB/+:Tluke6ajIm/MQS1LuKsLPvImcUy
- TLSH
  T15E25BED14440422A2DF125CAC3FE9E11AA5D5A9A071FF8D7B48D2ED0D3094E2B9B3F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  cоnfig/librаry64/addgamepage.txt
- Size 17B
- SHA256 0e164581679e59b6ae9daf224051ed5215664a9708bd0855b731c5ef53369836
- MD5 42e4e254dd06d9ebf1d82e258b904531
- SHA1 ba7160695febb3232f7b93635c3aed73a1c44a64
- SHA512 e5615e22c777839f38aa8109b8d9aff2935f62da1d542ab560753f77d1ca77f0df2e73ec27a8f9604d57c00286240a150a9a2695a3aceffc7698f8b0a67d1c29
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  cоnfig/librаry64/i2j9S2Mrl3BV
- Size 50.0MB
- SHA256 2ca07f0b2cb05017e5c30caafb4f02cfe980bd74f97a08650a82848993e7acd8
- MD5 5537abdac8496e4b656d8b71ce02ca48
- SHA1 09a4e7e8bcca937358b2beb0fc522f694940f6a8
- SHA512 fdab8eae2e4bc425a01a37d9688afa64bf61f1a7b0d9d251dea7cfca53a23948674af73a826aa378185bc0c43cefecd35717d594414639289d993a55dc033420
- SSDEEP 1572864:x/7mIoRDo+n+Fu1oi54wb3KZNA+Q8xiEcr:MM++FGzb3KfQuw
- TLSH
  T18EB7337FB3A346AAC175570FBDD1292DB08264CDA59F8BB5E1B3C28608D3100F659CB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  cоnfig/librаry64/libavif-16.dll
- Size 691KB
- SHA256 4bf9ca1c1a3e7a9a3d2bef9c4216dbebdc05adad80c31a2176b8758552b3dcf8
- MD5 3afd94f4fd9ff6530f35d1df01882909
- SHA1 1f86b0c2b192a4518d61e9c5ef4345154ab43187
- SHA512 a461aa4b238c329821eddf300fa4d0b329bd58e60363706c84ef2fc27a47779858120e9d6ad74762013a910941fbffc05d647124684a352d459a82969ea0231c
- SSDEEP 12288:x6YLnwUjJTuW2RGt150N2HlaE2CY5FDcdmbkGOwr7mRjUmsyYBjeWUxw2VOlPeuy:MYT52R81W8Y5FDcdmbkGOwr7mRjUmsyb
- TLSH
  T1BCE47C12788041252CF231EE47FEBD35C98F50A4436AE5C73DEE26D9D38A4E266B7217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  cоnfig/librаry64/libswscale-5.dll
- Size 1.0MB
- SHA256 8f79af2a36683b9756c2858bd386f3f392f261a187aaa524ab4fce2dc0a11b69
- MD5 32b637c6e70b25d042544402b55a68dc
- SHA1 e52347fbd55f8aeb11bcac9ebbb5a8b45deee4dc
- SHA512 7cc849935ac86729308b640b5b993f181ae403b98117429618e23103c160eecb09fa95f6b70663239c1e023f2b5dc531f32b3f5e1e0be24f3e5a3f66482513a8
- SSDEEP 12288:7povbC/T9Q+BDMKo4v7ukSc0fJS1ajImEvEBTqiCQtUN1tSg2zj1jcuKUJEFyB/+:Tluke6ajIm/MQS1LuKsLPvImcUy
- TLSH
  T15E25BED14440422A2DF125CAC3FE9E11AA5D5A9A071FF8D7B48D2ED0D3094E2B9B3F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  cоnfig/librаry64/namesoftware.txt
- Size 13B
- SHA256 4ff4f5af1700502527d401936736feed2539c03b0a8a78f3bccdfef2689b0ca8
- MD5 2ff50bd8eb7496b9cb76e936efdfe621
- SHA1 06b7c2387463c905b0b110792dbe35a52640b01d
- SHA512 eec5d6c78ef8b80bc55a19da20c3e9a98c0b8ebec78f583243858d8ce28a9cdf4d325475c31a45378eec7693b4dbcc2b6d2d30c112f5d7bbd8e36fed6a7a725e
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14
- Target
  cоnfig/tartparyt/AcXtrnal.dll
- Size 553KB
- SHA256 2275f4f330d2d5299d4b83dbd972e7cd0f6183fc75b82c86b5ef601e81eb471f
- MD5 f3be9981cd41276a2c15a180857b3964
- SHA1 a5a10b5324656a5967568aa607fefeee6dc224f5
- SHA512 f3e29818b307fa0e1f71877d230ca1896e0b031a0cb3868dd2283e51e6c24469fe4a81e8058ff0c6ebad87a5f8d384e9b301d3f6c20c693936cea619ee1c775a
- SSDEEP 6144:H6XSVRJShY8/71HuqELdzMpqUN1XnV7W4nIlgtkWzsiiw4Q/Ht9BgPQsrh179yIb:0LPuqEKXXnV7WKIIkUUrhXyIn3c+pF
- TLSH
  T14DC44CEB1554C19562B6510CABEB9C0FE5B60CC9076289C7B8DD32C40B7BEDA94FF206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  cоnfig/tartparyt/i2j9S2Mrl3BV
- Size 50.0MB
- SHA256 2ca07f0b2cb05017e5c30caafb4f02cfe980bd74f97a08650a82848993e7acd8
- MD5 5537abdac8496e4b656d8b71ce02ca48
- SHA1 09a4e7e8bcca937358b2beb0fc522f694940f6a8
- SHA512 fdab8eae2e4bc425a01a37d9688afa64bf61f1a7b0d9d251dea7cfca53a23948674af73a826aa378185bc0c43cefecd35717d594414639289d993a55dc033420
- SSDEEP 1572864:x/7mIoRDo+n+Fu1oi54wb3KZNA+Q8xiEcr:MM++FGzb3KfQuw
- TLSH
  T18EB7337FB3A346AAC175570FBDD1292DB08264CDA59F8BB5E1B3C28608D3100F659CB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  cоnfig/tartparyt/libswscale-5.dll
- Size 1.0MB
- SHA256 8f79af2a36683b9756c2858bd386f3f392f261a187aaa524ab4fce2dc0a11b69
- MD5 32b637c6e70b25d042544402b55a68dc
- SHA1 e52347fbd55f8aeb11bcac9ebbb5a8b45deee4dc
- SHA512 7cc849935ac86729308b640b5b993f181ae403b98117429618e23103c160eecb09fa95f6b70663239c1e023f2b5dc531f32b3f5e1e0be24f3e5a3f66482513a8
- SSDEEP 12288:7povbC/T9Q+BDMKo4v7ukSc0fJS1ajImEvEBTqiCQtUN1tSg2zj1jcuKUJEFyB/+:Tluke6ajIm/MQS1LuKsLPvImcUy
- TLSH
  T15E25BED14440422A2DF125CAC3FE9E11AA5D5A9A071FF8D7B48D2ED0D3094E2B9B3F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  dаtаlibs/acproxy.dll
- Size 2.5MB
- SHA256 0bd4bbe8a124ac3822bb3527547c80feae542190145d3e3b9e0517cb65885f44
- MD5 a9f82ba8aeb66762a4bc341a6e6a1ac1
- SHA1 6d6061a24d1035a35f2247c25b9877865c8a2a43
- SHA512 041b06bb052cb281be2f6304359a8851eb4ba3e9715277326db25e2b59449be04556c71a863eb6ef85efbdcb41f65116fd95f77c64150bd4ddd0f0e9938bfedc
- SSDEEP 49152:uVhFj5n9K8ulruHjhQEvMRWNvM1Tl//WXCV3tVeZaDyG:3p/iG
- TLSH
  T189C53B8B1954C04173B6811CA9BBCD0EF9F65289571389CBB4EE36C8177FEEB50BA211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  instaIIer_x32.msi
- Size 12.7MB
- SHA256 03889e69170edec39846cecd7ac90aec4d853a8dc5459b30a83cf64a8c2ed71d
- MD5 2915d73d77483818f478d7424b5b033e
- SHA1 9707aca44633895ad676ff44bb3ed114afa60ea0
- SHA512 a7b8ae231d394c8b6d4f743d1bde1a1bdbd0caa76b26ee6fd9b97bfc57e3c69f1ee1ac87305c4a02af10e25923a4a9b1660d3f6f568e8c8e191b38b0937f5987
- SSDEEP 393216:yVJtxHL/3DEx9G9uMWWN38yvC+JXHj68pbzT7I69P+pnx:iJtxrrGGYJyvC+B68NTcs+p
- TLSH
  T1E0D633008549131FFDEB867A520BAF99966FBC08A95CD9C3720EB97A1CF35F21133961
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence privilege_escalation ransomware
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  libavif-16.dll
- Size 691KB
- SHA256 4bf9ca1c1a3e7a9a3d2bef9c4216dbebdc05adad80c31a2176b8758552b3dcf8
- MD5 3afd94f4fd9ff6530f35d1df01882909
- SHA1 1f86b0c2b192a4518d61e9c5ef4345154ab43187
- SHA512 a461aa4b238c329821eddf300fa4d0b329bd58e60363706c84ef2fc27a47779858120e9d6ad74762013a910941fbffc05d647124684a352d459a82969ea0231c
- SSDEEP 12288:x6YLnwUjJTuW2RGt150N2HlaE2CY5FDcdmbkGOwr7mRjUmsyYBjeWUxw2VOlPeuy:MYT52R81W8Y5FDcdmbkGOwr7mRjUmsyb
- TLSH
  T1BCE47C12788041252CF231EE47FEBD35C98F50A4436AE5C73DEE26D9D38A4E266B7217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  libswscale-5.dll
- Size 1.0MB
- SHA256 8f79af2a36683b9756c2858bd386f3f392f261a187aaa524ab4fce2dc0a11b69
- MD5 32b637c6e70b25d042544402b55a68dc
- SHA1 e52347fbd55f8aeb11bcac9ebbb5a8b45deee4dc
- SHA512 7cc849935ac86729308b640b5b993f181ae403b98117429618e23103c160eecb09fa95f6b70663239c1e023f2b5dc531f32b3f5e1e0be24f3e5a3f66482513a8
- SSDEEP 12288:7povbC/T9Q+BDMKo4v7ukSc0fJS1ajImEvEBTqiCQtUN1tSg2zj1jcuKUJEFyB/+:Tluke6ajIm/MQS1LuKsLPvImcUy
- TLSH
  T15E25BED14440422A2DF125CAC3FE9E11AA5D5A9A071FF8D7B48D2ED0D3094E2B9B3F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes dropped EXE

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28