700f145a6c544b310bf2590c8d78dde5e7dfe59b54cf2b124b83f06e94168f53

Sharing

Copy URL Twitter E-mail

General

Target
staffbesting dih 11.rar
Size 36.3MB
Sample260907-ssksvaxyes
SHA256 700f145a6c544b310bf2590c8d78dde5e7dfe59b54cf2b124b83f06e94168f53
MD5 d509bef97a51f021dc502d31bea1f0c8
SHA1 38a70b3cb835ace520b2cf732503a70b49e64039
SHA512 3fc122f370bc48af155d815104973608b329d2f633302b6e0d4c31441fb60ee2a0330258c6a91d1bc36b94172648585a4342401ef2557eec7370105ff5ddddc9
SSDEEP 786432:w7JMKEnT5boahdmF3Z2x7MXenMU4u8TelF90k0Q86K7rEn8hKeOU:w7uNNbbXhwod4NelM4MsyKzU
TLSH
T1448733E3B08A5AA9600C7159F22C752DB5A62FEA38DECB9C81CC105F4585B77CF61933
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  staffbesting dih 11.rar
- Size 36.3MB
- SHA256 700f145a6c544b310bf2590c8d78dde5e7dfe59b54cf2b124b83f06e94168f53
- MD5 d509bef97a51f021dc502d31bea1f0c8
- SHA1 38a70b3cb835ace520b2cf732503a70b49e64039
- SHA512 3fc122f370bc48af155d815104973608b329d2f633302b6e0d4c31441fb60ee2a0330258c6a91d1bc36b94172648585a4342401ef2557eec7370105ff5ddddc9
- SSDEEP 786432:w7JMKEnT5boahdmF3Z2x7MXenMU4u8TelF90k0Q86K7rEn8hKeOU:w7uNNbbXhwod4NelM4MsyKzU
- TLSH
  T1448733E3B08A5AA9600C7159F22C752DB5A62FEA38DECB9C81CC105F4585B77CF61933
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1
- Target
  staffbesting dih 11/How To Use.txt
- Size 1KB
- SHA256 97ab190c674175f90ced9b5675522328bb2dee0beec8bd4425993f718e4f5e9c
- MD5 28392848cf9cd31fe09d2f2365030760
- SHA1 3805cc0211312db18369b74bed0261689cddf603
- SHA512 62fd3541c00998a8d0d7f0d9516fffb2cdc0c9d2c9cc12138919a261d18815e6f00e3c664f5ac43a9ffd5ca35dca7eae7ecfd0412414f0839ef2ba339ce6239d
- TLSH
  T1C22141A5BA0757750132102A322D7BD9FB235079661BFC21707C02B812BC526867CEDA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  staffbesting dih 11/Kılavuz.txt
- Size 455B
- SHA256 8f2457cef073de3c09bc4be2cd6ac812db7b07a7c5840db04464128541cc6ef0
- MD5 48017cd8d9bdaddbea9a8ca359eec56e
- SHA1 248f2349ad1a6fb42ff90bc8f59ddcccb3e72af3
- SHA512 36f8ebd33d150d99bb5b30d3feb7c462d67181b3c7143f6290c8522a8c9995288aadbac42a1c4e280df0cfa37e612acd7710c2cd5a4bac82916df61493f1eb0a
- TLSH
  T14DF027246B9882200E6B678FE1AEE576135B8A173910F8533C270559A868F1692F4869
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  staffbesting dih 11/Private Bypass.exe
- Size 24.2MB
- SHA256 077b207cccf289c5b069713a959d17ae24a7b5a3971565b40ac41084cb567d5c
- MD5 252ab4b288060d0d29b001c2cb9a3dbd
- SHA1 479d2831d9a9f9fa50b30fd2afd4e4415574bcb5
- SHA512 6480beb47c7353a952e583c4b99d77188f743471041af51a9bf7c517d73aae43ac5af13904413b0a9800e0bcffb1bf7ef779b08711f04cf932245d99ef1e0236
- SSDEEP 786432:J9EzshRuiQh+hCwPNR2tNkBOL0ZPk9wiN:fE4EOtFR24qN
- TLSH
  T178473306206120EBDBAF86735413D6FA8296AD9E0751839F47C0BC77BD726C1CD297A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral4
- Target
  staffbesting dih 11/SpiritX_tools.exe
- Size 12.6MB
- SHA256 086809caa3f9a5d76d68053395bf6cfd725fb26da61c85cbc963337a2a095c88
- MD5 48641b69500502d2c887b4d132f610b6
- SHA1 db42f0b03f6705a55fe2871c5bf911d038952225
- SHA512 65c0523062784feb24b73ded7eb0e2a82f1a794760154a8bd81da46384cd009013c8aefce0fac3d41c2f307e6454baeef30ce26242a99ad3042eddc27611bc68
- SSDEEP 393216:RDMgIfUKOcR1idq1B7/zCQsHsoqybpin:O58KPR1ig1dzGnnbp
- TLSH
  T1F8D6335C92E109B2F4ABA23D06A64557C1B171145712CEEF07E1836A2E9B3F34E36BF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Drops file in Drivers directory
- Loads dropped DLL
behavioral5
- Target
  spiritx_crack.pyc
- Size 13KB
- SHA256 e4e3493d0817b1ffd17e05ea5ec5fea64d6a79689efcf489e8a12cda2d541a8e
- MD5 835d5424f1ec55eff5f0054386822495
- SHA1 269a74e52251f9e0657c424d81aff3b87342bfcc
- SHA512 979327f4d6a3520d9f872a98759f6e9612466c80050c15e43d6cf827adbb6b174f874a8b90d76aa97d7ebcaf3a679c983c2b94bd46fa0ba924a85d364cd41613
- SSDEEP 192:6+q5l3ldy0eppd+0+xkEqFFUkKBJHT0dGYnrdq8yXIASQdrw2y:fo3JezMNjqF/6No1nrdqNftu2y
- TLSH
  T1AD52923448907757FEEDE53830F6E9995736A2CAB2368707F1941CF8AFCD20489606AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  staffbesting dih 11/hosts
- Size 305B
- SHA256 041daa803a6e510e6b2f757b97a2294f4147dc0c4ed0db01ab0e92fd798a3ade
- MD5 a12601934ac21051d2d8b01d59afae10
- SHA1 4f073a396c2e46de3f4801fff8c526fb845ef4d4
- SHA512 1fc4b9fb6b64a5092189720b5e252edbc21317c60f1fa542ce0634261a1550ded3ea06ef34b7360b69f38cb023191c47caf9cc1048e579b616ab456fd414869b
- TLSH
  T1A6E04224811F849E9CF2B592182FA32BD003D9620C877A467A6CD56D337D95E146005C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  staffbesting dih 11/server.crt
- Size 1KB
- SHA256 8cb3f4bcc393a96886cd62aad25f5b23749320aace89649e39d67d2b349870e8
- MD5 edf2e23777b4034bf047c893dcd473f7
- SHA1 7cff942c93f2f2b5d6ac112285f66660b7bae6bd
- SHA512 a80aa1690187814bee012a7dcd0f105c4dbd8f8c070e88e453fb6dd388dbef9203a4245ab15d8e7d8524fd0b14ba8b7cb9e6846b00bf09fe3f8fae4ad13030f8
- TLSH
  T19121B7215F79E086D5778D81D2EAA0AAD4BF51704C12F393143E149F4B86BB908BE124
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral8
- Target
  staffbesting dih 11/server.key
- Size 1KB
- SHA256 aaf607f81c28c91d6dad59ad665e85e6123631cec128b6e750106dc10ff1056a
- MD5 7ae39e7a78f9062eb1c0af6174c4a6f9
- SHA1 844912935f45d474cba370084eea0f714fa199f1
- SHA512 92b1403ff19e2e5cc9ffb53fd96d15ecd17ac3ca8847a0e205f43eba0f7aa689eacd30ed02e5d6240a2b120fd653bd734dadb72077f707ba8bfaef0867cfe4f9
- TLSH
  T14A31D6A89F869D7596E662CC4C52972F362945E404F2A47B654CC093BE48601CCEE932
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  staffbesting dih 11/steps.txt
- Size 810B
- SHA256 7dc59199612e5417f62f17eff329ab036f9d68dedea137d1b97e6f4f558a5ea1
- MD5 55603516d9769fa7bab7b467a94d6c8f
- SHA1 688b15cfc65d54b042cbcdde092b601be5dbd25f
- SHA512 0eca2d249a9ca8c29d4c10d052d3586ccb56e5ef7f9c8d6c562307c98647d96c8aa5fa3050f158ed9bcc2b09be0c0251c68f3b572a68498c80b10f3d7141c575
- TLSH
  T17D01F1B3A2E7233917134150501E46D12F925069C2A6E450346A14F8839BEB3A8BE7FE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  staffbesting dih 11/yonetici calistir sonra loaderi aç.bat
- Size 636B
- SHA256 17e98d92ccfdb23c3e14aa1e5aa55e8ffd71e31a395ac8f3c122c7436303bab5
- MD5 6de192f8e7f86649535e833623974a6b
- SHA1 4e2cdb3c243fe656884fe199e21e9e45c4ec567a
- SHA512 35e50867a9628d84cf43ed2ea79ecec38734dc1eac3011a13ac442fb998e31d31a965864bf6edee0d5bf9854725a312880582f39296737b303df9456c3ba69cc
- TLSH
  T198F0810A84EC85CF38D2FB3437D3A722471E75ADB963A2E91F91901D008828326ED48F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
behavioral11