e80fef342f33c3a8eaddbb338500691c4d3c627a505cf26584b875cab4d159a3

General

Target
fg-04.zip
Size 867.5MB
Sample260908-r7c6waserf
SHA256 e80fef342f33c3a8eaddbb338500691c4d3c627a505cf26584b875cab4d159a3
MD5 6724453d389bab401c9de9ba7fd2f005
SHA1 c0e5573730275fb9b71cb36c2203c9587fd496c5
SHA512 f8f9468107a127806a2eada989384c27111b4cd8888ecee33a8b776dbe27bca55dd070d0c45bc75b35d507bded825d92dcc2001c1c47e3bc6d8089739575c3a0
SSDEEP 12582912:TV9vEkDewwtT6x//bQVra7bwSy262Q2ePh05FJ+uTnAx5InTrSxuBZ:B9wwDx3bQVrWlyYXUSADIT6c
TLSH
T14F9933399E975C12B130509F7A424E75928FCBCAF348C3A79009C78AEE9F1E9D98511F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MD5/QuickSFV.EXE
- Size 101KB
- SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
- MD5 4b1d5ec11b2b5db046233a28dba73b83
- SHA1 3a4e464d3602957f3527727ea62876902b451511
- SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
- SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
- TLSH
  T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware defense_evasion persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Verify BIN files before installation.bat
- Size 69B
- SHA256 95ff8038ebfcdbdbf8fbfd047447b0418e960c2a2dcb20515ee3c5e8349a5540
- MD5 a3a1d3f8400dbcefeed01fc6293644ff
- SHA1 d6445e7814729612aca5952b3c0bd6b5328b6a20
- SHA512 e50706a605f53eb4534cc699454d5f8552617d7dcf87f970debb44d1cafb41a42d132188452cb0d41f0ce55762ee8aea332a9b5b9410aa99a265473595cc8a67
- TLSH
  T1F6A002C16BE41500585E8D60E2AF32CDF88E70676145BAD0B0A2B1B5589FD8863676F6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral3 behavioral4
- Target
  setup.exe
- Size 4.1MB
- SHA256 f1604fd8d9c51f941c5f1ae3a094a5a89683589c2796dc465f75181f28e61d57
- MD5 31cdc7d953ebe4eff28e0ef1f1db8cba
- SHA1 0140098613923cc37bb6d91d1971c8191a0e0789
- SHA512 bb4382d1b41bf9e88336c4d08fdc51ca4379fb84f34c305105942b4958fbdc184b7369ccf9f14e62d524cf0279573cc6a21bbe11d4d8a773d4509875559d0b17
- SSDEEP 49152:vN0cAfn7wh0QIaUrjJcIAVUbUVPH12JxQHh3PW1Yy+MDAmnAtTGriL/Y32Fg+R2v:sf7wCQInrje/CAVMJy1Wey+4rLPN
- TLSH
  T176163342F3C31436E0240D752D56E4787E13BEA61AD9A0262EBCDB9F0BB50C7B9B6570
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution installer
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral5 behavioral6