f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa

Sharing

Copy URL Twitter E-mail

General

Target
Velocity.7z
Size 19.7MB
Sample260905-rbfl5aszbv
SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
MD5 34be7067f85591003987566f89d44875
SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
TLSH
T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Velocity.7z
- Size 19.7MB
- SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
- MD5 34be7067f85591003987566f89d44875
- SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
- SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
- SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
- TLSH
  T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
- MD5 225af3c55fbb7376a11dbc4648a2b582
- SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
- SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
- SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
- TLSH
  T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Microsoft.Web.WebView2.Core.xml
- Size 566KB
- SHA256 d2e44139c2e8e30fecb99112516964143be130c58960a2c65cabc6a2a7c35ca0
- MD5 d1757131496940abcc30af78d34598a3
- SHA1 446944afcdfaee9c22320e1f80e9ff43de92e6fc
- SHA512 c779c90b4e6b6d54bd745954185659e9eb5c76e72cb2222f373a3b0d3ad3de4307a5b306e6832a4d721b2da3836851b05655c6e90f944488674cddbc5cb66ae6
- SSDEEP 12288:rWynTLhgqUDx4OfmwT2DRG3Vt5InEvs//BKoeUvSRyGOtQ/AgJSeLdLGz40cS+jw:CNcoUCF2
- TLSH
  T1FDC43F01668CD6310DF50ACA69B8B6D8FF2D666731D3AA21348C0F570F739A2E1BF591
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral3
- Target
  Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 08c7014d311979c3e37ea56ae8233f3bdf363013498b11b1c7ee2bcfb29cf08a
- MD5 b76acca7a4248b6a6472915a0dfd5c79
- SHA1 ab44abcf54f42211d64fd219a94df06573191a7d
- SHA512 064fb0e7a366d26fb83ced4bca1edb2b39653d75bb0c4c4b9dfd545e2b1fb8e77fe021535478d2a57ed4a0fdcd4b39a952f320ae8fdaa2e213962732a6016ec1
- SSDEEP 768:1caNb2/itGt3JrbYbKQzZDgcEST3p4Jjrjh2je+SG2au8vxJKia5/Zi/wGQSxKFp:zb2/D8+QzZDgcEST3p4Jjrjae+SG2auF
- TLSH
  T198034B4083ECC517E6EB1E78A9B486620B7ABEC33DA1D79D1D88F1D90C7379055113AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Microsoft.Web.WebView2.WinForms.xml
- Size 40KB
- SHA256 96e468637ee3322db9851e38c0a3d7c32f0d11f60566b47ace2c91ec66179ac8
- MD5 8b30e596b9d8ec30b3f82c03941b23a4
- SHA1 c74d93633c1d669a60372f003368963a68981692
- SHA512 22419fc31380173cde3a66509db763254eebb211ea3923dc8f504fb4204d6db649e63ae6809eb84c4214576410e69f5bfe166658439890df6ac63310dceadc5b
- SSDEEP 768:3OsdyK4aSPgPxW3uyCG4yCGdryCG/L+GZiyCGRL+P1xb9zU4QPgcRJFXCfPgKehN:3OsdyTaSPg5W3uyf4yfdryf/LzZiyfR/
- TLSH
  T114130C01A28DC72249E21ACE19B0E4D4FF2D677775D6EE11384C4B560F73EB0E2AB291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  Microsoft.Web.WebView2.Wpf.dll
- Size 81KB
- SHA256 b6a200f3dfcf2cb6c3b6e6179da0590e01525b111e8f85b94c6060456102972f
- MD5 57c8c00f0b851a4c8e6cf39a44351adf
- SHA1 bbf68f3d6e9ba8fc7dfc24a0b38e453853a1cab3
- SHA512 c51149361d5c8eae121a42694d28d087fe5a515c0aceaf7ba4c9c44bee5d6b2b397e9370cf5296729702f0c31dbd82be0c08167aac936d0cc10bbc26da4c1649
- SSDEEP 1536:mh/Ha+etdl9Zk3DcLoSJVgCthp8dYNUDHfF7yEW30bpc4Jjr4YeUq7HhvU0sdndR:mh/6+etdlWDGo/Ap8yUDHfFy30bpc4Jf
- TLSH
  T10A837DA123BC8D23C6FE1EB9786540555F7AEB837E12D74F6584B1E80CE738121123AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Microsoft.Web.WebView2.Wpf.xml
- Size 139KB
- SHA256 8932fe759bb7afd1e0de73682a9577d782048a68b252408e127cf767fc348be4
- MD5 547ebbf40b254728354b371a5beb3ca4
- SHA1 730f1d32c4145739f5865c0bbef6c3e2fd91139b
- SHA512 ad7a8d85decd87a913b94a8cbd9651389f61a3090a5bc0fe06ff2445149de59e8fde911af729a6dd65b3f0f973a6dde6250528023c36f4bb2a39ef214c7feacb
- SSDEEP 3072:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJtLryDnLfryDYO/LPm8RLP9R3Ly1vb9QUXK:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJtJ
- TLSH
  T185D3EC10A28CD62248F657CE2AA8F4D0FF2C266735D3DA15304D5F161F77AB1F2AB291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  Microsoft.Windows.SDK.NET.dll
- Size 23.7MB
- SHA256 0ec371d93798852e36461c8adddbeadce0f963a04752f0b64e54fe19c1c834a7
- MD5 a00b91c2e00b89e387705af95b72bd6e
- SHA1 eb57d8d9b8c1e4434044c28b608113e49d53ccf9
- SHA512 93b88a2ef85206765144c7c082662da7a3ad57fb08af9f8bbc0355721c12cf52f6a6920adad08778c4d2054652636d24d095b998c282f9b1e92b9234808f3165
- SSDEEP 98304:POCu/R1ZTAk4bl5EUBMXyLImPbjAd+deA/tlCjvT7HiYyhILyV3K3CrLtHOpdGxD:POCu51ZTAFLzbjblIjvT7CThIPPBrYj
- TLSH
  T15D477E2297A44E3DC98F5773E4B603264335C60AAF4393EA581C979D2F833460B59AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  VelocityApi.dll
- Size 21KB
- SHA256 9945bf0b137c9f60e4fdd18e8d77b1e7c874936d6993d9e29b70820ba39a607c
- MD5 3d3059e39636ddd2ffcbddd4d162da54
- SHA1 c19b0f304637ea162799850d03617d021121e7cb
- SHA512 8756ec8ab8782ac734bb5cedc3b9ae2a6a87a167e2b23d59ede7e4b1b64eb3cb1d32b5fd62ced093e3dde9c164a1e26295e1b36818fd4b862a0337db832d999a
- SSDEEP 384:hBwpwnR3zxm2p6iThnjsL3BHsxxSIRtJa+hLuv266mNEQEQrzdaYU6Ud:n62R31BjOHcDRnryVVu
- TLSH
  T185A218087BF88265F5FF8F786CB082100677B9166432FB4D1CD251A92D7BB904A90B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  VelocityApi.pdb
- Size 15KB
- SHA256 66b9a07080e7024268a2139c4d97a683f54d9cad4935cecb8edaa22f58305b70
- MD5 c40df810762c1293eb6bf12992c8465c
- SHA1 ffc22afc0c7a7e92513764b1ef560d8d26cd1ee6
- SHA512 0900b42f0c3c858ef829f4c847801d221d3b1ae7eaa9a4f1c43b449a4799b9f115d9459666b18be7dd334632f408e9b0e1ed103874b95eef479c78b4041b11d3
- SSDEEP 384:6YCDCaaArmLoLFw2/sfaIvz1d+bShoDRnfUJoqiWNDKrpQHRfax7EsHS3U3Bucxi:6N/awmLUYoMhd3QZg
- TLSH
  T1F672C3379B5CE265C9952A325836C2CC77B1C3202716EF3AF0D86668EDAF74A07B1174
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  VelocityLite.deps.json
- Size 4KB
- SHA256 e28716662c6aa158eecf9dcb2171990abe0fb62e847c8949d11b181e0c9a3dd3
- MD5 cf140d04ea6cd51c541a5ed38177d6a9
- SHA1 e3dd3bdc07f509af18e4a3ea22c34dd9bbd2badb
- SHA512 d123fd4b6e5d64e1626da9d66ef5b1f8e8c2ac05d64a856daea81f270f42c50ee05bd217897a7786b48200bc2b20c1b85617ec02a3aaa4e087b13f2aa5c3caf2
- SSDEEP 96:tjn+smsGAcUb7PqZw3uwGhorDgZFTsqxGI6:tyQb78hffc
- TLSH
  T14191461BE8544D6744706BF6587646C1FA96136F60405E8B78FC162C8F73EE6A098F38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  VelocityLite.dll
- Size 18.6MB
- SHA256 3867a2b72d32cf68210086edf0c94305578c3dbadbeb3f2bdabb3f79888bd9f7
- MD5 69674db1e8505fc001ba1bb544ffdfcd
- SHA1 10b7d17291d38a6fc5280c5db2e071290a53c068
- SHA512 b3d9d78c3a4369f6b948ba7f49f2259c5d59fbfceed6c989345d8fae762e4b343e814cc1b424eccc82d75ee4b7cd892b0f6aa7819ea03425a1d609955341636d
- SSDEEP 393216:pdtwpHrmXuabdwVorMb975j+ssedCCxr0DGfRJ9A8q:pTwpHrI1gowb975j+SCCxQJ8
- TLSH
  T100171247F389DE2EE25B1B3686730394A6359CA1BF5B030FA41A76B8AD733C01D146D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  VelocityLite.exe
- Size 232KB
- SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
- MD5 e4df8ee6e755c3da3088701eb1c05b76
- SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
- SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
- SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
- TLSH
  T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery
- Downloads MZ/PE file
- Loads dropped DLL
behavioral13
- Target
  VelocityLite.pdb
- Size 52KB
- SHA256 3b46654c9ca149d72163936380c307a6e2a1790abf3a930706228bc2ec1b61f7
- MD5 a29489988054906ab1df5fb0aeeff44f
- SHA1 decd089d57b822de66559f8313f416968741d859
- SHA512 fa35746c134fae793692ac051e814a04759479ff4a7bf4a51ae19121b3eb79be3e32331ad1386d5ebe436f022c7345f6c7bfc78c53c888b9f5404dd74a00a98d
- SSDEEP 768:5mHFPanigrSFK19f/kOHBHYuoGqd36DST5I5NHlhhm60Okx3eXOCG:5mlubuFKNBUB6DSFI5NHVzkxX
- TLSH
  T116331962D35CD306D759A97588F381483734C25CEE47DF2BE188A279FE667200EB32A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  VelocityLite.runtimeconfig.json
- Size 519B
- SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
- MD5 7e4444b5a3e3cea574693f055f944011
- SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
- SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
- TLSH
  T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  WinRT.Runtime.dll
- Size 516KB
- SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
- MD5 edb1f8d15fe41838cd449141187ae032
- SHA1 c7344afcdaced6911ab5288b0ade76f66dd41203
- SHA512 5756ccbafa1440d114f8d9b163ea0c2678300ba24c9979b837ba232cc6813f74a29fc0a23b9bc1d7f53c6ce5f15cdacd6804a755ac816116536c56cd9ca43c0e
- SSDEEP 12288:A4Yh4z+uZSlne+7/SQ2YaxhaNHav96iTtqen:HRSucPTx2YaxhaW
- TLSH
  T12CB44A80A7FD9A1AE7BE1334B03416144B71FC17AA13E39F674895B81D637998E40BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  XamlAnimatedGif.dll
- Size 98KB
- SHA256 557f3e03f38beeae6e2c6c554afe6c7a763843f3571e7ba4afce75dc70a182a9
- MD5 80a78bc47019df113af3b69bb19c1110
- SHA1 2f5968aee35e12dc89ced1aa2490fe8f45b04990
- SHA512 757ce5da02f8d565643f2e6122ae736b931bb3e7d5f5f7676e07c42ac86e8abc4521b759371883f6b326a3529e2916ce3eaed7642e15201e36161870e5d71ef1
- SSDEEP 1536:VHbNmCWH8u09u6kR7apGhHAL3kLvq7OY+hgbbZVoIl6cGGyd:V7HQ6iaghWwqyY+hgbboYyd
- TLSH
  T142A33B7483B98F96C79FB6FDE5B8939987358206681BFB4F690CA1DD24473E185002B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  runtimes/win-x64/native/WebView2Loader.dll
- Size 156KB
- SHA256 8427b1fc58ec707813e5c0a51eb5d69397bb333250a7b891be4d3b123f1e0f1c
- MD5 b7f10b8066ee96c628e09c439b8d0b9b
- SHA1 3a2fe02d9d43100056b7dd1ccd2dfb3f30ad0f55
- SHA512 4ce26a59faadfa0a20e098caf297f3403ac1542706f72879ed7248dee4026a5c7ffc3aa95912d8e3510ac7593082429ce0e83978a5843cfce52fb475cc975333
- SSDEEP 3072:1mJgy7/ph9euiDNQ6A93jJBC9JGv6T/MEtJ6mj4UrqhQ:w/NVZ6A93j//EtJnrX
- TLSH
  T173F35C5BB2E900BBE17BC278C5A34A15E772B8111760AAEF036447791F137D0AE3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  runtimes/win-x86/native/WebView2Loader.dll
- Size 118KB
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH
  T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19