b41e89be38f796a5e1f2a86892d4f5aa2a890439ff367e28f47c5b23bda29d0f

Sharing

Copy URL Twitter E-mail

General

Target
3D440231AFBA33573B89.rar
Size 2.9MB
Sample260908-m4kdkafa58
SHA256 b41e89be38f796a5e1f2a86892d4f5aa2a890439ff367e28f47c5b23bda29d0f
MD5 4e3b4f6d28c91aacc7e8367b35dd8e8c
SHA1 a2caca801e4dae0358fdf605ab787d5a036f1eac
SHA512 cadb91693a4d8d3f9a0f6f3368c419ee6b32ef19d22b541362fcc44b96e746d33d27bf136ce27d6a23e95c35d92ee3fa2b955604b237604a215f42c672d89c17
SSDEEP 49152:GSPQg3HeYnojO7UXYBUKpNXeyw54aZhksUM44ofjmeWkdbpmU3mSAoPpDlY/JfzJ:h8YMqUXYBzF5wfhksUMAKe8UWS1DlEUw
TLSH
T12ED53322B2513F400C668D73982417652A1F3A1DC756CFD718E71DBB6E87FBA4A7A20C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AngryVirus.exe
- Size 482KB
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
- MD5 85e11c1d67aec0150757e3255d8231b7
- SHA1 9167c5ea4a23d59f38e82f128f2b1a2dbbd88cea
- SHA512 a25fcf6c359a00e5671b08dbf91fde79fe14e9720d8d8b4980584fbb32f9bba78a8cc8760e5c504fad894e34df1d2693bd1d161539ad4597df3c50c84c1c5e51
- SSDEEP 12288:IJvK+727xaxunsCoFJse5vKNkuCCT3X7t8OP:IJKDAxuPondKNHj7hP
- TLSH
  T1E9A42382B21AE061E2CAF43727BD7A9273F6B0136352F91F51688A213D35FC0977525D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence adware discovery spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2
- Target
  Chernobyl.exe
- Size 1.2MB
- SHA256 2342b3d3120400baea76a500a710fc239ea8d1c587459c4c20bc070e44281c27
- MD5 07b111536b5f2e251b3db0cd83b2d1ee
- SHA1 2a1b9c115a5d703a8dbd75796544bc88cf0ae29e
- SHA512 b99b35fb10432fa70c233bf6acda5f06047332e5aa631446221284c6659bd9a1ac697c4123cbd4ddce603a4d8810ee4940574bcdef9d59189edb4433c18741f1
- SSDEEP 24576:EzYx3PgYWwocek/r2+AAYNh3tBULAkS7LeB:EkoA/qhlL3rmzS7
- TLSH
  T17C55A522A687D9A3C41E1270DDC7D32977B2E0F46B368B87BA4C87AF7D213A11CC5546
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral3 behavioral4
- Target
  Commandos.exe
- Size 79KB
- SHA256 e0c0bb0b89ded0bcad1a4fbd9d7d989cacffe9c2dd963a89e86e13582cdf8262
- MD5 fe571936aa4654825c1c5df9cfe49227
- SHA1 c1ffe14039561511724621bf385ddc4c4291b156
- SHA512 646a1b1e5b02973df005c084d3a70f65a1f572563aa971b0247fbd4c1877ed7cd58d77c507e4f44bf7ac85f78b779b355025259cba9e5aec728aaf09a9dbec42
- SSDEEP 768:4Kxnvyx9lZYS8tu7Qi4eyulHCuytnY9QRcgQorIbjWqor2hCaK:1nqx975EQQi4LaHC1Y9QR/rIbjUP
- TLSH
  T1BD83E40235736D85C7BC25F706974AE443E5EC8106F189876A7BA60EFDEC6A84C47E83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit execution persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral5 behavioral6
- Target
  HighHappy.exe
- Size 82KB
- SHA256 0f9617c86fd1a744a7185e1060b928cd05ddd63c70633dbe847d5582e60101fe
- MD5 788b0974f73acea93c7af807cbec1317
- SHA1 8a5482beb542396efef378d2556698ba4aebf363
- SHA512 487bab2035cef1a90f8c1f619af9b57784a4203b6291ef871db2340437f24184825ca931cb64f9fc58ebcc8b51e428f1261e8ff040cac2e919a285d00f8f1051
- SSDEEP 1536:KahfyS/+TAODerDpbuEpPEUwsbuUrVzBq05j9aJggFSoHdduVm0A9SBwwVcl:KahfyS/+TAODer9bFpPEobbxN5M2gFSM
- TLSH
  T1F283A1557394E65AC4231735D991D3F4A730DD85EA46C34B36E8BE2B3EBD2E28E412C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery execution persistence privilege_escalation
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Modifies system executable filetype association
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral7 behavioral8
- Target
  Knuckles.exe
- Size 289KB
- SHA256 1f98a3f8852d28ed3b2f64e529c1ae1eafc5ef942a962ec89163f3db2744c8a4
- MD5 7e9d3109b138c0a67be983159fbbde98
- SHA1 012308407fada7ecb5edfe4e067fa4d18acba424
- SHA512 ac6a5a4ec87fe8770c1903f62d181f94366b2f9b3d3a4e8a04ec7f25b9e9d026762efc96ba5883474b9d1c2d0cca4a99e12f0343f6eac51af12d628a926a5e12
- SSDEEP 3072:Fxv5UYlnaArTD3FzIO4vphViwmtSEGsvXRUeMlyXxUpT1OXfqY:FxvaYlnaArvF8bzVi1SQPuluxWqq
- TLSH
  T1E5546B3A79788F95C60C0AB1BA61C1B3EB2F5D3D3481931F22DB77B9AEB5D4A1D01106
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral10 behavioral9
- Target
  Magellan.exe
- Size 167KB
- SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
- MD5 dcea41cf1d8e08ba9cf571fdb21f1db4
- SHA1 da14f6d77d84da5e4290a28ce04e215d7cbfb937
- SHA512 d094aad5cd856683e551a519039c183ba440052639f82c0fc9e9124714f4bd843f83fa5a400386add08ed30b1dfb51c095e0055c96f601bca0c18acff5bcaf2f
- SSDEEP 3072:ia6Q7bFVzmHQg9Ug644RrO4gGBGhFxwzhk24UoobktbVZ:pz7bFVzvgP4O4bBG/qzhk+abV
- TLSH
  T138F3F26872FC6272E2BFC27645A6BE44572111B72B26FB6B0CC5E3F938137C54B20419
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution persistence
behavioral11 behavioral12
- Target
  MasonChess.exe
- Size 1.3MB
- SHA256 9be0c047cea06ab24bdb1711ca7d4608e179826d079206ed36a1aea830cc5149
- MD5 10956f1eceb4c919805661a5bf59bbe9
- SHA1 51bda4e573711789db96a1755563246e39623af3
- SHA512 001b6eb588a6ac9d41abfe1a7fe001734fc9edb9db0502564532e029f1c30bf317261f63634527deb37ea9e1bb064818c57ec0a94194b23e4a6159039b02514d
- SSDEEP 24576:gfCzYx3PgYWwocek/r2+AAYNh3tBULAkS7LeS:gfCkoA/qhlL3rmzS7
- TLSH
  T1A455C622A687D993C40E1270DDD7D32977B2E0B46B368B87BA4C9BEF7D213A11CC5146
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit discovery execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral13 behavioral14
- Target
  MasonExln9.exe
- Size 77KB
- SHA256 622cce1035f8cdb86e362c430557e5c30f39a27bc53f7ccf201f51ba1bb3a965
- MD5 c30245645d088e11e6b57851f0e3b5c5
- SHA1 95853546db82c20be611714eaec91ab6a1e32bde
- SHA512 9979c6f19c7d48abc8eba634d5c4eb923b4c4c22882c78e6e7d77e633da8bbf1913a78ee02d4fcf64fb4a744c862d14b9c8ff08f23165187516c31b6d241f009
- SSDEEP 1536:14onCorR67Q3SaRO7IPqi/rhxdhsCJjmGasWhQcdQk/hO2o:v/RsQRIMPqizhxUqreRQk/hXo
- TLSH
  T1A0734B43B5D29CB2E5B21D311871CAA19A2FB9210E248E6B7794137E5F340D0AE35FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral15 behavioral16
- Target
  MatrixVirus.exe
- Size 14KB
- SHA256 5906dc7c3cd938b874cfb12cd9a14a6e72116c31385f4584f997f1544e3da492
- MD5 13e1f4bc5b116e4ec87f055715563193
- SHA1 9eea7e9fce555b6c35730ec3dba29a13921f53f1
- SHA512 a53f446a2063684e401ad8c7da70ea7be4d23a2043341d9ab280dd36a1e91ef43b11ff510405125b957d88f5d9c7c00edb35977d8fe512e6fd0236f6447a030f
- SSDEEP 384:PX//sbBzFbtTLqr/tS2Ab9FhV0beOrptYcFwVc03K:PXCbgSn1IeAtYcFwVc6K
- TLSH
  T143620A4AE7944275D5BA027319B3A745CB32E22B8D47DB6A3CCCA05E7FA32064733395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Modifies system executable filetype association
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral17 behavioral18
- Target
  PEEKABOO.COM
- Size 921KB
- SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
- MD5 d0ae6aea701de9f127f91e7efdb50252
- SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
- SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
- SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
- TLSH
  T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery persistence
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  Smil.exe
- Size 365KB
- SHA256 f534bb9d7cc4c0f8abf8adcc592a328a64a902211ab66bafd9a0c7a333e86a20
- MD5 ea210a16c2cd0f7d84d3961bccbfe73a
- SHA1 598a97e9c7aef20ccc65ed04aa9449564b53f48f
- SHA512 baad73a63e0e4c56bea3283f0072ff7682e37afa96403c99e714373ab49b20e990044f6a221a89d27fd8c763af06e7418886880d41cc557be9892daeb3877c65
- SSDEEP 6144:iT+DPxVn9PvkYyeryYpaVexc6dJ1QYsjHf6EnJrNlT9Fb+3jqSd6A5n6n9TCX+Ct:iT+rxV93k4HpaVexd/FuHfFLEjdnC9At
- TLSH
  T18A84135561BDF193EAF9917318FFA004961A972FA3056BAF1C84D937AF0AF84320791C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit discovery execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral21 behavioral22
- Target
  Squidward.exe
- Size 535KB
- SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
- MD5 82bf26203c5d76dfa3a591f1cb60d7b5
- SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
- SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
- SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
- TLSH
  T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery execution persistence adware spyware
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral23 behavioral24
- Target
  Stalin.exe
- Size 30KB
- SHA256 4f50bb2cd893f1f225e02f66ecf0765830f078265e81096dbf551589cc641d43
- MD5 65f583c1c4322f11c7f947948d9c70fd
- SHA1 b570e11c47d64af6b00a3b6f362e067144a692ab
- SHA512 da14e6ffc9ebb593f0f5fcf199cfe3db48fb16683ad617fddac27b49e2b911e35fbbde271ab7d82d702b80d3558c6ee25c3759d01dafa8c1229a1efee4f44fe5
- SSDEEP 384:aIyoju/Dgxy0hpT8embLGG/tT2f7VXMeQTj0HeRcQyyyWuptYcFwVc03K:aIFj7XoTi76Jvaem0atYcFwVc6K
- TLSH
  T14BD2191D6266C027C56832B9EC2796F2817DDD89E455AEA335ECBD0D3F7620780A12EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral25 behavioral26