4030390c8df6502f5c7ca965a884f8c1c9a6fdacc3bb8c45f430a1205883f0fd

Sharing

Copy URL Twitter E-mail

General

Target
RogueKiller Premium 15.0.3.0.zip
Size 74.1MB
Sample260907-sra71scj41
SHA256 4030390c8df6502f5c7ca965a884f8c1c9a6fdacc3bb8c45f430a1205883f0fd
MD5 5f86fc1e5139e25b8f4400301e0aee0e
SHA1 bf1bcd1984538fa10ae8653629e2ea611c9a729c
SHA512 e554a0117a4b1fca86760b54e3af418f2384d8035363c2b2b64a90ac1f70d7c611e2e528f8a67d20648bc944bded3a989554d9dc170bc6d3c71561aea6bf8bf9
SSDEEP 1572864:9Yijzd/xNQUNlodZyqWrs5SKu6gqSoHti0gukvL/hW:9jP/FjQu+bgHvL/M
TLSH
T1580833DC398599D8A071B03DBF488BBC682A714070BD324BB15AED35EE4D78309D9C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RogueKiller Premium 15.0.3.0.zip
- Size 74.1MB
- SHA256 4030390c8df6502f5c7ca965a884f8c1c9a6fdacc3bb8c45f430a1205883f0fd
- MD5 5f86fc1e5139e25b8f4400301e0aee0e
- SHA1 bf1bcd1984538fa10ae8653629e2ea611c9a729c
- SHA512 e554a0117a4b1fca86760b54e3af418f2384d8035363c2b2b64a90ac1f70d7c611e2e528f8a67d20648bc944bded3a989554d9dc170bc6d3c71561aea6bf8bf9
- SSDEEP 1572864:9Yijzd/xNQUNlodZyqWrs5SKu6gqSoHti0gukvL/hW:9jP/FjQu+bgHvL/M
- TLSH
  T1580833DC398599D8A071B03DBF488BBC682A714070BD324BB15AED35EE4D78309D9C6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  A2z Flash File.url
- Size 115B
- SHA256 23cd67852af04fd6885d2763266f2765b5e03c6ae3a5c1c6c95f7e03e10ec10d
- MD5 39dbf807a41e5e4e63b59c9535c72eb7
- SHA1 5b406536b32ad45deb8219f80cabb02d88a1b91c
- SHA512 39c8ef9b28a0a103843a97f402ae3c35eb25425147375b0d5461dd327ea3a7bf7131f1d0bc656e51c0db203b111c63097dc5367f0647fae10d729822f59ab80c
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Gsm Atoz Tool.url
- Size 114B
- SHA256 802bbf1167e97e336bc7e1d1574466db744c7021efe0f0ff01ff7e352c44f56b
- MD5 301657e2669b4c76979a15f801cc2adf
- SHA1 f7430efc590e79b847ab97b6e429cd07ef886726
- SHA512 e94480d20b6665599c4ed1bc3fc6949c9be332fd91a14cef14b3e263ab1000666e706b51869bc93b4f479bb6389351674e707e79562020510c1b6dfe4b90cc51
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  Gsm Crack Tool.url
- Size 115B
- SHA256 23cd67852af04fd6885d2763266f2765b5e03c6ae3a5c1c6c95f7e03e10ec10d
- MD5 39dbf807a41e5e4e63b59c9535c72eb7
- SHA1 5b406536b32ad45deb8219f80cabb02d88a1b91c
- SHA512 39c8ef9b28a0a103843a97f402ae3c35eb25425147375b0d5461dd327ea3a7bf7131f1d0bc656e51c0db203b111c63097dc5367f0647fae10d729822f59ab80c
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  Read Me.txt
- Size 332B
- SHA256 67af113a3d488b8be061a7cfa2c62b37f674e5249d78426d8f6b7576b730a8eb
- MD5 00cb91ffa99ec657db757f0d88994745
- SHA1 65cc74eeec47c8903094a22c2255470e2a888c0e
- SHA512 efca160e00dcbd26623197cea82e1c75e0a7f734d76842920ec1a487243b2649f76d77a6347e347c4ce2545d4ab051435d50d8fc18c41ed864acff485f6eabc5
- TLSH
  T119E07DEE116350094E345CE0F42CD419D6F38C59CCC2D2C8B10601287522435B8C80FF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  RogueKiller Premium 15.0.3.0/A2z Flash File.url
- Size 115B
- SHA256 23cd67852af04fd6885d2763266f2765b5e03c6ae3a5c1c6c95f7e03e10ec10d
- MD5 39dbf807a41e5e4e63b59c9535c72eb7
- SHA1 5b406536b32ad45deb8219f80cabb02d88a1b91c
- SHA512 39c8ef9b28a0a103843a97f402ae3c35eb25425147375b0d5461dd327ea3a7bf7131f1d0bc656e51c0db203b111c63097dc5367f0647fae10d729822f59ab80c
- MD5 SHA1 SHA512
Score

1^/10
behavioral11 behavioral12
- Target
  RogueKiller Premium 15.0.3.0/Gsm Atoz Tool.url
- Size 114B
- SHA256 802bbf1167e97e336bc7e1d1574466db744c7021efe0f0ff01ff7e352c44f56b
- MD5 301657e2669b4c76979a15f801cc2adf
- SHA1 f7430efc590e79b847ab97b6e429cd07ef886726
- SHA512 e94480d20b6665599c4ed1bc3fc6949c9be332fd91a14cef14b3e263ab1000666e706b51869bc93b4f479bb6389351674e707e79562020510c1b6dfe4b90cc51
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14
- Target
  RogueKiller Premium 15.0.3.0/Gsm Crack Tool.url
- Size 115B
- SHA256 23cd67852af04fd6885d2763266f2765b5e03c6ae3a5c1c6c95f7e03e10ec10d
- MD5 39dbf807a41e5e4e63b59c9535c72eb7
- SHA1 5b406536b32ad45deb8219f80cabb02d88a1b91c
- SHA512 39c8ef9b28a0a103843a97f402ae3c35eb25425147375b0d5461dd327ea3a7bf7131f1d0bc656e51c0db203b111c63097dc5367f0647fae10d729822f59ab80c
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  RogueKiller Premium 15.0.3.0/Read Me.txt
- Size 332B
- SHA256 67af113a3d488b8be061a7cfa2c62b37f674e5249d78426d8f6b7576b730a8eb
- MD5 00cb91ffa99ec657db757f0d88994745
- SHA1 65cc74eeec47c8903094a22c2255470e2a888c0e
- SHA512 efca160e00dcbd26623197cea82e1c75e0a7f734d76842920ec1a487243b2649f76d77a6347e347c4ce2545d4ab051435d50d8fc18c41ed864acff485f6eabc5
- TLSH
  T119E07DEE116350094E345CE0F42CD419D6F38C59CCC2D2C8B10601287522435B8C80FF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  RogueKiller Premium 15.0.3.0/Setup.exe
- Size 39.9MB
- SHA256 05aa1469f6fa0cab4f61661f3e59564bd9597a51e06142ddb421192db1927802
- MD5 49c4a8a3cb839b3524741129b887a7e6
- SHA1 d3e51438ff869239c5d130335555d0630e727e18
- SHA512 9284da7e4b57c573dd4b5a9185a0987b972e14ca23bce650d2c536aae8b98ae9ea671042fa03ffeba270a19eaeb51e0a77ef72f11650ede7effd072b96f74cd6
- SSDEEP 786432:/ivWHWmk7/QLk3cKeMgeKUMYn0K7oCo6wpTK6UadZIxB0tu:KhmCQLk3aMgeKUMYnP86UUadZTtu
- TLSH
  T18D97335E20045FE8E2FAD07E7E858B7C2A4A9241A0E6704A37AFFD225F167C2055CD77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit discovery installer persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral19 behavioral20
- Target
  RogueKiller Premium 15.0.3.0/fix/A2z Flash File.url
- Size 115B
- SHA256 23cd67852af04fd6885d2763266f2765b5e03c6ae3a5c1c6c95f7e03e10ec10d
- MD5 39dbf807a41e5e4e63b59c9535c72eb7
- SHA1 5b406536b32ad45deb8219f80cabb02d88a1b91c
- SHA512 39c8ef9b28a0a103843a97f402ae3c35eb25425147375b0d5461dd327ea3a7bf7131f1d0bc656e51c0db203b111c63097dc5367f0647fae10d729822f59ab80c
- MD5 SHA1 SHA512
Score

1^/10
behavioral21 behavioral22
- Target
  RogueKiller Premium 15.0.3.0/fix/Gsm Atoz Tool.url
- Size 114B
- SHA256 802bbf1167e97e336bc7e1d1574466db744c7021efe0f0ff01ff7e352c44f56b
- MD5 301657e2669b4c76979a15f801cc2adf
- SHA1 f7430efc590e79b847ab97b6e429cd07ef886726
- SHA512 e94480d20b6665599c4ed1bc3fc6949c9be332fd91a14cef14b3e263ab1000666e706b51869bc93b4f479bb6389351674e707e79562020510c1b6dfe4b90cc51
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  RogueKiller Premium 15.0.3.0/fix/Gsm Crack Tool.url
- Size 115B
- SHA256 23cd67852af04fd6885d2763266f2765b5e03c6ae3a5c1c6c95f7e03e10ec10d
- MD5 39dbf807a41e5e4e63b59c9535c72eb7
- SHA1 5b406536b32ad45deb8219f80cabb02d88a1b91c
- SHA512 39c8ef9b28a0a103843a97f402ae3c35eb25425147375b0d5461dd327ea3a7bf7131f1d0bc656e51c0db203b111c63097dc5367f0647fae10d729822f59ab80c
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  RogueKiller Premium 15.0.3.0/fix/Read Me.txt
- Size 332B
- SHA256 67af113a3d488b8be061a7cfa2c62b37f674e5249d78426d8f6b7576b730a8eb
- MD5 00cb91ffa99ec657db757f0d88994745
- SHA1 65cc74eeec47c8903094a22c2255470e2a888c0e
- SHA512 efca160e00dcbd26623197cea82e1c75e0a7f734d76842920ec1a487243b2649f76d77a6347e347c4ce2545d4ab051435d50d8fc18c41ed864acff485f6eabc5
- TLSH
  T119E07DEE116350094E345CE0F42CD419D6F38C59CCC2D2C8B10601287522435B8C80FF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  RogueKiller Premium 15.0.3.0/fix/RogueKiller.exe
- Size 18.1MB
- SHA256 b0a872a84e672ff602449627e85dc672bbfa6f54f238d86059d5bb1ad483c67b
- MD5 40c4770cf15686c2d722a09745326d40
- SHA1 721f727b183b3d8f932d80e0f59a544ea720526d
- SHA512 1f11a3ff971cde14b5d4a73220443eeb8d146c9720930e8a2503a66be3f919487ae133dadea7f620ade3b940966ab3d21ee607d258e69d19431a36abe5f54768
- SSDEEP 393216:p5nhNkt/Y+2T0ljeSnc40qTtEzEo91m7OKAGIU+qpWKH:LknheSnco+F06sWKH
- TLSH
  T1E517337313560881D0D28836892FFEF871BF8BEB46015835FCD26DEB79327A6A552907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery vmprotect adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  RogueKiller Premium 15.0.3.0/fix/RogueKiller64.exe
- Size 17.3MB
- SHA256 38c93bdc8f3a86d492feeb7d31c32f95a953e2c1f58a683ab1e08bdca9700ed1
- MD5 e5c2b23e90fae3658661a05a4ffcf7dc
- SHA1 7ca1aff3848e7368b505ca92a8614e88230741c7
- SHA512 c8e3e7d69d2f50a5ad16544232f0c22d7cdb606e0d3596c5346262fd4c0bb0802f050d2058f14eca814a16dcf5e77dd7aba73e994829b6b55d1b8090d9e681f2
- SSDEEP 393216:w+iCUi+WpKI6LxyWlGQigPLXW+tu6xmNEzwWYif:MrUMpxKQFTDw6xmNcZYif
- TLSH
  T153072378A6747B79C01EC93508335E81627E561BFA848B17BACE9DA13F8F6095C9CD0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit discovery persistence spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral31 behavioral32