434895f7b13945d2f781d4357fd5e931f61167781d6ed2c17f8e306c20e4c2bd

General

Target
2.5-beta.3.7z
Size 381KB
Sample260907-aarvbsvejf
SHA256 434895f7b13945d2f781d4357fd5e931f61167781d6ed2c17f8e306c20e4c2bd
MD5 b47e8fe4228895cf0612685514a9ac2f
SHA1 2f50b100c8e99b51f9498227e1e28cd12516cbb8
SHA512 263195275666d7508e514d2c29a559da9cdc4ea53cbe6611c45db77076cd6c45c6103b989da5333326ceda96d417ea8bc5d020e031111b8955ea15f70e92b282
SSDEEP 6144:ViYWD77ZWZigJdb8XvZ6x5SJrfEYCnqiLRYMAw6kH4UrthAsjvmQUJDlIzbN0cLD:Y77ZWFok+fEYCnawrH4UrEsj2XcALS9
TLSH
T1DD8423F9EE7AAFE4460D4FD138BE0E5740B0AFC19C231D43CD6695182AD7C16B916AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2.5-beta.3.7z
- Size 381KB
- SHA256 434895f7b13945d2f781d4357fd5e931f61167781d6ed2c17f8e306c20e4c2bd
- MD5 b47e8fe4228895cf0612685514a9ac2f
- SHA1 2f50b100c8e99b51f9498227e1e28cd12516cbb8
- SHA512 263195275666d7508e514d2c29a559da9cdc4ea53cbe6611c45db77076cd6c45c6103b989da5333326ceda96d417ea8bc5d020e031111b8955ea15f70e92b282
- SSDEEP 6144:ViYWD77ZWZigJdb8XvZ6x5SJrfEYCnqiLRYMAw6kH4UrthAsjvmQUJDlIzbN0cLD:Y77ZWFok+fEYCnawrH4UrEsj2XcALS9
- TLSH
  T1DD8423F9EE7AAFE4460D4FD138BE0E5740B0AFC19C231D43CD6695182AD7C16B916AC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  2.5-beta.3/Application.bat
- Size 23B
- SHA256 f4b650190b3f58c234df08e505bd956565105f647101c3c7c84f80563840187b
- MD5 99b03fefda112b2baad970414e82c5a5
- SHA1 af1531593a37f020316740180dd224977a667c20
- SHA512 b161a6ff7ca9094783d8399fc458f570ec173ad343ca99021bd3b63cdf7b22e6508ba8b53dddf59041862d95c05233585fdd9a26a10e413cf37ffbd46387cad5
- MD5 SHA1 SHA512
Score

6^/10

discovery execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral2
- Target
  2.5-beta.3/key.txt
- Size 179KB
- SHA256 d958a71d84cb4b3c3ccc020b6a7ec968a933e64fb2371f77308d5e933b04d462
- MD5 b3dbed189cb45c871ee5a4d7c442bace
- SHA1 72c3911d8c99b727ce72097815dc07f2075d4455
- SHA512 fe6f8bfc77c8595cee77bb40b1e658e311df4011fb0ef586d9ef2b1431aeac2bf3288553659afdc23ab89de67057b88c2eea3137f9ee0bcc151e6bb3d70bd287
- SSDEEP 1536:sJbJ5HhX6KYxybuguRzOdAmbbwXYSdJfghVYydMn8va4S27wdG4QowBsVuXjuEpf:nxqf8NohV9MnYGfbwBtXjuScu
- TLSH
  T19F04438451892CB9E9D781D0EC5F689B35B781F64B0D5E4A0F74F0A53EE02A4DBCD83A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  2.5-beta.3/zen.exe
- Size 742KB
- SHA256 c434ce8620057d9dd9073b4af8382bf27e85729d152164909f1052775e7ddc70
- MD5 e18a0f07a55738e880b46d4a22deca5d
- SHA1 e73ee451f2e97e0802b2ab00115539ecf24fd76d
- SHA512 6fd3fe5e1db110d3af055919f9935fa4e6cdbc6e46c0cdb2fbd4779d8e8328338788fe28e11201172f609a03cbd5468b48a35bef6559739c52c0cfdb1d54de17
- SSDEEP 12288:qFsr3uNFZnKsXrLdiu7c7nu86VDfU/+tZxMUJ4EBiSxsyYA:qFs4FZnKsrLdiCUMs/KiesyYA
- TLSH
  T1DCF4BF81B6D381F3D992117148B9A77A0E3D6D1007259CEB83D43AF68D346C0AF776AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4