26f6f557f5687d7f7429cf0030d52ad15e1c629a11f32de465603d8b2a9f5227

General

Target
Minecraft_Bedrock_Edition_--_fitgirl-repacks.site_--_.rar
Size 639.1MB
Sample260908-xcc6aaxbkb
SHA256 26f6f557f5687d7f7429cf0030d52ad15e1c629a11f32de465603d8b2a9f5227
MD5 d3a8032bf56a38bf76aa41150f8bfb9d
SHA1 10028dfacf652d1c1ae5d1c77039c6347b902d1e
SHA512 8d0b661d516ca3b264d97fe31172760642d24f4a4d557d17ffa25ed8e8d581fd486c640ce7d9c4a8f3d45730e144650fefb1c9810630ead2d673ca490096597d
SSDEEP 12582912:JPZ766qOx53xDUtWyEnxkjS1ys2sE+XDjfzgvhoIgcIuprM0:ZZ7gIPDUt2xRyskCDjMZgcVN
TLSH
T1B86933179222BABBC07EA5B10D0F3D709B565F6DE5E625035DADE38C080E47874DBAB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  MD5/QuickSFV.EXE
- Size 101KB
- SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
- MD5 4b1d5ec11b2b5db046233a28dba73b83
- SHA1 3a4e464d3602957f3527727ea62876902b451511
- SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
- SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
- TLSH
  T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Verify BIN files before installation.bat
- Size 69B
- SHA256 95ff8038ebfcdbdbf8fbfd047447b0418e960c2a2dcb20515ee3c5e8349a5540
- MD5 a3a1d3f8400dbcefeed01fc6293644ff
- SHA1 d6445e7814729612aca5952b3c0bd6b5328b6a20
- SHA512 e50706a605f53eb4534cc699454d5f8552617d7dcf87f970debb44d1cafb41a42d132188452cb0d41f0ce55762ee8aea332a9b5b9410aa99a265473595cc8a67
- TLSH
  T1F6A002C16BE41500585E8D60E2AF32CDF88E70676145BAD0B0A2B1B5589FD8863676F6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral3 behavioral4
- Target
  setup.exe
- Size 6.4MB
- SHA256 172677f376d727b05ff4e7d46730c7b505e783bc79e16e116f00f587b531f0e6
- MD5 713d47ac686302795a0b00c67eeb77e0
- SHA1 50e4c3576d2542193ce37e3840e657c98c76d160
- SHA512 90be180ce8901e5b3bfb34a940043812d8a2d81752239af0278672fe093e2f063367bff30827c03f4e60c6b4ed65c5f0fb041baca959ad053e7725f8a513c79f
- SSDEEP 98304:/f7wCQInrje/CAVMJy1WGsF3z+tE59fu4xM/Xzxlg/FeBSOYvExYN:/fn6/VSlGC3zcEiz/jxlgXTExa
- TLSH
  T1EC663301A7C31A3AE45004741D62A5A82D27F7F569E6616C2FFCDF8F0BB52C2B4B7660
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution installer ransomware upx
- Renames multiple (171) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6