a3590d946fd9826f9405d16f098c40ae72d270b97b323ecdf5a6b8a96bb9b859

General

Target
server_cloner-main.rar
Size 2KB
Sample260909-1fp6ssdh89
SHA256 a3590d946fd9826f9405d16f098c40ae72d270b97b323ecdf5a6b8a96bb9b859
MD5 2e5a5c59d4e82d4d551fd7224be6d8ce
SHA1 c27bff548e576cb69594cf50f4abdbb20f7e75c9
SHA512 a2687e7214394cc310ee97651e1773cfe63c76e8d54cbdba622f6ffac7f88ba7af2f110e73602885805e8ec1eacd3b6d0bc3d6b19ecfb2360805abb8b0d704e1
TLSH
T193413C8E1247A23F716C7EF4DDE6913C522827E66A50CB1CC39F3A3766416A14208D3F
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  server_cloner-main.rar
- Size 2KB
- SHA256 a3590d946fd9826f9405d16f098c40ae72d270b97b323ecdf5a6b8a96bb9b859
- MD5 2e5a5c59d4e82d4d551fd7224be6d8ce
- SHA1 c27bff548e576cb69594cf50f4abdbb20f7e75c9
- SHA512 a2687e7214394cc310ee97651e1773cfe63c76e8d54cbdba622f6ffac7f88ba7af2f110e73602885805e8ec1eacd3b6d0bc3d6b19ecfb2360805abb8b0d704e1
- TLSH
  T193413C8E1247A23F716C7EF4DDE6913C522827E66A50CB1CC39F3A3766416A14208D3F
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  server cloner/discord cloner.py
- Size 7KB
- SHA256 16e4c51b60fe06461323315a92a1faf1ceea221b9585de9ebf6c7442f52fb1f1
- MD5 6e5922a2414d3c40bce8d7b52ea19f24
- SHA1 061cc33692f11ea925506a410de49a089cf72623
- SHA512 eaf1d1355cd77c7f3aa2bc61116417b1e002dadc590c109873b3bc4278d3d40c54def0f0dd724154897c2bbf978efab7c6475a4ee72a8e323887d2ca061f0783
- SSDEEP 96:ODfFjWPbNjEtjWqMKSTlwbqFS5PeuX0WrMbRh5OZbcV4pjbmH6H+LjUw8t:ODFghjEtpjSieFU0W6R2tpjb7H+LLs
- TLSH
  T196F152AB845C3830C602B14C869119013B79B51FBD8A38AA7D6CC9CC9F59771B179FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  server cloner/requirements.txt
- Size 96B
- SHA256 6866da045f08de42e3ad48ad167a6d51304fd7e314ee7e84d65dce99c607a99b
- MD5 8f46a2b68423ec4e8a5e7fa5fd4c7e37
- SHA1 2e8ad8802fdd4283d6ceb477edf3527a089e9d02
- SHA512 29dbb0b5b09ec372240c78f71fe512d0197d347189fc3fc616ddb68354ae0d1c6db34cbe35006cc1662c51207e6782e3e13aeb4d93f43e36c2a5b6323b987b29
- TLSH
  T1E3B01227C1802E70A2090E345701016113016475F40A11547277C0D74002602D59163A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3