1bc5307edd98df38a4bf57c76cac67b899643fce672b48e368bbe2482afb718f

Sharing

Copy URL Twitter E-mail

General

Target
111.zip
Size 1.7MB
Sample260903-1mtskafr9s
SHA256 1bc5307edd98df38a4bf57c76cac67b899643fce672b48e368bbe2482afb718f
MD5 8561d3dcab8e1e02905ae5f4a4d53029
SHA1 d64120398f553b5577906db5420ed929eb572e65
SHA512 b81706cb5b4edc49cc194f7d56397e9a6bb3a5dc175aeda31d8aeb6b86db3ecb6a9a2005bd3ad693ad746bbd90cf3fc6dbd1d0609a583608442c6fce70730656
SSDEEP 49152:ARFM3dMT5yU1OkJUiOGAgVI2DtuEcsIoMfRd6Z/:0MtMbfJyGFVfL2oQP6F
TLSH
T1CD853316C7B9F13CCC0B2DFC4696E648B6554F80E2913C7E4AC573582A7ED8663B68C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  111.zip
- Size 1.7MB
- SHA256 1bc5307edd98df38a4bf57c76cac67b899643fce672b48e368bbe2482afb718f
- MD5 8561d3dcab8e1e02905ae5f4a4d53029
- SHA1 d64120398f553b5577906db5420ed929eb572e65
- SHA512 b81706cb5b4edc49cc194f7d56397e9a6bb3a5dc175aeda31d8aeb6b86db3ecb6a9a2005bd3ad693ad746bbd90cf3fc6dbd1d0609a583608442c6fce70730656
- SSDEEP 49152:ARFM3dMT5yU1OkJUiOGAgVI2DtuEcsIoMfRd6Z/:0MtMbfJyGFVfL2oQP6F
- TLSH
  T1CD853316C7B9F13CCC0B2DFC4696E648B6554F80E2913C7E4AC573582A7ED8663B68C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution exploit persistence ransomware
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Modifies file permissions
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1
- Target
  111/compile.bat
- Size 4KB
- SHA256 82455d4516fd16d3f805160330be0e90693fc283d106065af0740d4438a184bf
- MD5 91f685f11b02db56333a620cc9c22b79
- SHA1 6c9c04714c8f4ad1be3ed6d6da7db18c620d83f2
- SHA512 94d1e077aec70c04ce77660bbefa6bf5451239469462d8b3d8d83b913106852387733f1ec61160978361aeba28831d48006797813a456c9af4b62939c25b9f4c
- SSDEEP 48:+D8P9P6eh6WXysBvqsehgHajdfho1yc5V/WdwUChcpS1d+tw0p7qQdMSfHs9MyDs:+oP9yefpqFhgIZIx5XAS1d+O07xiMq+
- TLSH
  T1F2917253B81E4C32C499548E4F00978EB7A5435F0EAD8F6830D1239AE624BCD36ED9F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  111/compile_loader.bat
- Size 343B
- SHA256 6eecec0a991eb4884cc8769d2ee3c4738f8458ea38f6d70b9ce41d7a26817915
- MD5 67db68c06dd5525d71baa103b197ef4a
- SHA1 4d666d5a386584979880bc03fd0375346eb1ca0e
- SHA512 e58e681cb8f1f4279749d5a5c522a81f4a4e21e6fcef23fb0c08c29706570ba756257ad952545572b865f1762d7c138390bbb6c2cc0e1a16e899263cc3fb7c93
- TLSH
  T170E0C003B005CAF1E007AC48A0055D85708981870D599DAE33A485EFB1F5784B5DD4D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  111/kdmapper-source/kdmapper-master/DbgHelp/dbghelp.dll
- Size 2.1MB
- SHA256 2ed18fdb0bfea3c3297230ee57ba7e05a23c09bc929bf1aaf23dcd2d83bf5024
- MD5 21454155086ee542ca313157a4aba0f7
- SHA1 bd8bc1f4905308c8db664449545ea004cf55070b
- SHA512 ac48c0e05219f2a77b5eda8a5086f8dd08ed36dea4d4f8d6158a343274336be7922aa2f8c96940254ada5acb24aad5e2c5fce914d7628ccde48e0d4d1ec59479
- SSDEEP 24576:UC5peoantYTNCFNgmYrrDaPFmWzbuNtI2dFDwDJonMFt6TmFHpgw73JfhQf:UC5koantYTUzgmYX0mWiIKDwDaD0awZO
- TLSH
  T1AAA57B1B56E800A8D67AE23DD267560BD7F274060321A7DF1260876E6F33FE51ABE311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  111/kdmapper-source/kdmapper-master/DbgHelp/symsrv.dll
- Size 413KB
- SHA256 fea493309d3d5640df85f4b5523ea0091d4705780df5ca471a75cba9f0bac232
- MD5 837eb266ee187c14160ed9918683380b
- SHA1 f5663762dd0f24435412531de59c52e1f1bd4d5e
- SHA512 a7dc96c992a1566a8954e817aadff42f92fb092c0d5a35ebf12c70f36ce37e8bcc22e9a790add7eb41198359dfb253136d1f23caf287d5b30767fd04138cc753
- SSDEEP 6144:vYvMwXLY++txRdoR1XlVaoQbvnei1uppJXxBVuiHqYs1QarNrFdkbB69RYxP0j:2pedoHXioQb/ei1upvXtuiHXeQj1mRDj
- TLSH
  T1D794182DE7E80465E1B2A5788AB3C605D7B278A81735D3CF1194C13E5E27FD4AA34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  111/kdmapper-source/kdmapper-master/HelloWorld.sys
- Size 3KB
- SHA256 4f7f5d4cf54079dbfac47d6bc08fc7c4d5ca03b4f5c09b3c998b8f6bd125d82a
- MD5 bf7fe8993701d97706fe258fa3ba69b1
- SHA1 e0240fd7ab9056bc95764621432f34857ed648dd
- SHA512 773e0bd04b3e9f9a33cee600b6c4f3d7117f04c80580ba2f96331dde1351d5fd76fe4217a40738f4240e67df3f12885d95638c367ec51843b08e41875212bc69
- TLSH
  T1F651478BB76619FAF528937D80C3E96163BE753003E34B085E40501A74C6E2E7E6EE42
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  111/loader_spoofer.exe
- Size 336KB
- SHA256 4502bfea0d3e3abeabdaeb693fd3f87cb4e94ca00946b97637b55d33c1777575
- MD5 7be808b06cb44adee9b9b36d16aa71b3
- SHA1 4eebf1f31a804b787b1d9a3123a62801cfea562e
- SHA512 1f48540fccab754c8576cea3b4d0fe80d9df7d517c839cb0caf2af6ffc663dc1f75eb8c8d5c29e01f88dba9fb5cc8d40b7b33ea2404e0542469863777f9ecb27
- SSDEEP 6144:PqptxxniN9/2nldg06Evo74Pv9hliG0FaPiC90/2LI:PqpNM2gHEAEPvj0FaPKaI
- TLSH
  T1E8747E29F7A414FDE177D178C9524906EB727C4A0371AACF23A00A961F376E49E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution exploit persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral7
- Target
  111/spoofer.sys
- Size 33KB
- SHA256 719e611b009468d99321432d98dcde33c71abbe9e3a7575b3d824c5552ca0d03
- MD5 dd753ec29e29e97cac6b436339c3663c
- SHA1 77272f46327c4ad14c689bfb1a9837722fdc8d4c
- SHA512 400bc8cd1423d06996f4b2971b8ffee941ab03c4588a7af4f02fd01a191f0b79ca3c93aca9d729bbb841bed95cc48f39f42025e516309a44b48134678110115b
- SSDEEP 768:Erh2oWy61tx/sgRiPm9RI91Cc2RAW2Rt:UsoWy6NhiO3m1h2R
- TLSH
  T197F2499982A110E4E577D1F8D7B61F69E5BB30912322AACF4710C5784F33EE12A3E365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  111/unload.exe
- Size 261KB
- SHA256 c8ca0ec9414ab5c677733264f811db59fe0949e22b100ae9abaccd1ef50d52cc
- MD5 06076d835d86c162c9cf3e63878a4286
- SHA1 df9bbbc2822b46ccc57971ec72047c6d7a066f1c
- SHA512 2cb7f1a53f601697ea1bd5136d905f96cca7886f2137bf5161a418fa13932941befa511e2396878bb8e2b2a2c0f4137a62d63b25e1f63a12ca3ad1c55752fc22
- SSDEEP 3072:5THS/oPSmrRSdcd6mETV8C2PVAqNvl0p8hqrJ3nC2Y70JPdo3hKKUMqp/8fEw:rCKC2PVAqN90iq93C6dBl
- TLSH
  T1EC448D55B7E50CFAE967857DCC524906EA72BC524760E6CF03A00AA71F23BE09D3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9