1d840cc9e0b1b1b15df688c26aec24c0cec7032426a83bfed7eb73e2fa00aafb

Sharing

Copy URL Twitter E-mail

General

Target
crystaldiskinfo-8.15.2.zip
Size 5.2MB
Sample260909-k4cydavaja
SHA256 1d840cc9e0b1b1b15df688c26aec24c0cec7032426a83bfed7eb73e2fa00aafb
MD5 a465999e9d829ed283a3ef7a74ebd039
SHA1 775f41e45cb2153a566860ad4fd13f2eb7bfb831
SHA512 e74bdcddf957a51d2e377139ae11000f439db8efff1d0a5e17238bacd71c6a2797b6bced99529b5f60a98650aacadc946f3f2cd880c4fbc3d12ab42767084bd1
SSDEEP 98304:35ZYcB7EYZSnqyCDP32+/45ASi9syD5RB642/XOYVUJZI/p+gv5Or22JWI:XB7SqfDl/45AZZDt4/hUw/p+K5OFWI
TLSH
T14546337B916A15F8CC7FC2BB52509212DE7E6B86E0E5213DCA40951DCBFBA720604F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  CdiResource/AlertMail.exe
- Size 71KB
- SHA256 a9b8a51a99b4c63038c948c5bda54750ea85e0d9b4db7d78fb4dac9d8854feea
- MD5 46a29dab77e0c3ff5b7e0ea2f1e5b7c8
- SHA1 c7fd8c54e66c298f2b4638efe9450b150ea53823
- SHA512 a1f2cea331b1e8ed0ed13646c063059d011433da2777b90620ec841a88b630716942ced606197842bcb9bbdcae85017363a404f13ed859f7c353ce3eaff5b6b8
- SSDEEP 768:vLrh+SL3sfZKHKWJ3ZuqYqDTZFHTgSCaUGGoEyfoday8Qn0eo2mvoEz1Gz3SkIEu:HpKg0UzQ0ehmwCcLG2EX2A
- TLSH
  T10273C93036B7520AD9694F711D7DF1C227B67B59BF54CB0E245A020CAE627234B21FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

defense_evasion spyware trojan
behavioral1 behavioral2
- Target
  CdiResource/AlertMail4.exe
- Size 72KB
- SHA256 cfb06b92a0483aad4d653db58121417b776d41c80db5cab1b4465c172f4168a9
- MD5 7e919b00aee429607ff663a6511f179f
- SHA1 4a199041cdf26449ac0bc55fb1a07ff4009498a8
- SHA512 65b2da114af6b11099ec08d7156f71a52de48375f5aa15cd181fd37a5d4beb2961f94b6b15c2f9fb3117044cb1c66c3c91da5406af0de243829b4d8cbd4c54cb
- SSDEEP 768:xD8w7OTXZKHOIXpTUWewBZ7TRZk8IsSIi2e+MXZi8xl0eh/v2uz1GzavkIEgTaki:7Egkjxaeh/OIcOXn2P
- TLSH
  T1A073DA3036B6520AD8194F751D7DE1C227B67B99BF58CB4F245A020C9E627234B21FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  CdiResource/dialog/Graph.html
- Size 8KB
- SHA256 00ceba3cca57b7ae140f077d6aebb88e172f69b4cc0c8879c5be7f2734a989f8
- MD5 1f2f281f50cdefb6794c9c87133b89fb
- SHA1 6aaf495b5eba156f3b6d69395a022251f54e8460
- SHA512 c1d8d99104f0dfc0f3417c6c0a2519ab9508aadecc573b6c338614237d6d91ce03825b4b978a3a9a03272759d7d566d1bc7c60b7742b4f83a8ad1b9d943e906b
- SSDEEP 96:7KkOs1PJEpKltJtAZ29wi7/3j/Rj5LNscioCIq9Xr9MDoevklwew+K:7CMEpKltJw29wi7t1LNsBojvklwew+K
- TLSH
  T100024861E4EE0A2E2775274C7DE4AB2AE833909F930AAF41745D187B6F357008C6365F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  CdiResource/dialog/Graph8.html
- Size 8KB
- SHA256 715663ab9ac4f2b0de86ea36c90436550b648e8d79f35b2099b904071ff3608c
- MD5 95e946a56eaa284e0167d5669861315e
- SHA1 80c69fb76714856274183d72da863b65f63dcede
- SHA512 75fa148c3a38ab07751100d23e574d94ab9073a4a6611f3262a6ebe9e33e509a6e0152c44f87d73448c751c31047fce7f8fbef1bd3eb2c99e340866bbdd8b066
- SSDEEP 96:7fkOs1PJEpKltJtAZ29Ni7/3j/Rj5LNscioCIq9Xr9MDoevklwew+K:7BMEpKltJw29Ni7t1LNsBojvklwew+K
- TLSH
  T146024861E4EE0A2E2775274C7DE4AB2AE833909F930AAF41745D187B6F357008C6365F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  CdiResource/dialog/Option.html
- Size 17KB
- SHA256 1c33000a9201ab7f6fb76a35adecd1a3b4a0ab7e21d4adca9b7ce47eb0438eb9
- MD5 1639dc3afebcb77a24f2b76c060681be
- SHA1 4d5be3e3eab978f344602c9e7f8a5cf981ae7fb2
- SHA512 badeefa30d01331fc8a0ccbd1478ffb265c602737c341ccb3acd33484bf4e622c27cf4d0896550e3077313b19abe4c127002b30cd8ab57c30cd1d84fd9cb798e
- SSDEEP 192:u6/T7J+jh5BOfalBZOlVSY7SM+UJBRyHyl:uw7J+jhfOfXp+u
- TLSH
  T16382F732A0D5A01713734AACF5B17F5DA9C3822A83234B44396F64CF8F9391DC997676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  CdiResource/dialog/flot/excanvas.min.js
- Size 10KB
- SHA256 5f94b032a110504b7b261eaf71392fa3e8d82cdc6455c0cba5c9f03cd34ed122
- MD5 08182065d2093c978a9bfa16b0829173
- SHA1 b72f4f5b78513de55e61ae0f8804757b7be97d9f
- SHA512 73edb75f889493c40765f8c34ae02746afab14f98585639279ead7f87232c98122adf9eaeb8d4e585ca45fda9a9b272f126c239a9acf50cf02a77c3e889e6112
- SSDEEP 192:f0nOGBoKSDDfL8SZy/RJVfGPSfJq2sq2iq23UdFm2lx0fRun7faSpWM35Rfz5wyC:snOhT8Sk/RPePeJq2sq2iq2b2lx0fRu+
- TLSH
  T123220964B21A186D8201D02D60AF725E1537A427B712EF7E3915F7FA44FCC01647BBB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  CdiResource/dialog/flot/jquery.flot.min.js
- Size 43KB
- SHA256 8a0f1dd79995a9308cffdcae12445d9f727d66a450ef5158280e0724de55c32f
- MD5 f1843acdb53f2c88903f89e4e175cd32
- SHA1 6fe88ea552177f7117dc4cffecc5cdd53a250234
- SHA512 1a0c7e84d6edd2678624c1b9bf4b4cf3bf2c897ae3c5d75a08199f96dd2c9d03b77a43851f033f2ae9cca197f6cba1d996730ceffbdbf5a78aa31ab7d2c5bf48
- SSDEEP 768:HyGrgyZo3Rf+fHfb0cQ+LObGcMMr6GQbDtvjQa+1w30007ASG:HyGrgymmDXL+Z2GQ/tvjQaWw30007ASG
- TLSH
  T1A2132A8753013367C2E701F91CEB4FC62135A6034944A665BDEDC6E13D38A9733ABA3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  CdiResource/dialog/flot/jquery.min.js
- Size 54KB
- SHA256 d548530775a6286f49ba66e0715876b4ec5985966b0291c21568fecfc4178e8d
- MD5 a9331828c517ac5d97f93b3cfdbcc9bc
- SHA1 1be9c3684054001f53fa7ff6d85ec3cb573a9cd2
- SHA512 403b7c0dc179ee12b85b76885ecb9a16e1e538572ad866a943f404f674dd3ca8c626b1cb2729fb720a6db3eba4e6ac1ac1de875a4d598f1b76337366d33bdba5
- SSDEEP 768:NcBsS2y/PUrTsLK88E1o2z33cThrtz00lU3+pSk+f1:NcBsyyT1R2T3Ahrt00lG+ck+t
- TLSH
  T1E443D68CB68671AE82F73167F43F572DB23A9A9658188085F0698CE47D70E458077FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  CdiResource/opus/opusdec.exe
- Size 174KB
- SHA256 d8d8d30847b200f2ce1059726d3874469887e452af3133518eafdf2b2692f260
- MD5 1f3cf9f2eda491e461a44d956033d7ff
- SHA1 9b5db2d3b252d9f4c434ecb05306b3f6a05f186f
- SHA512 eb5e6baeb6385fb1889bff131aa78f71a1235cf7468466bde3344e6b035c65e5d8dfdd18f0f75aa970758132d540009c7f5ba67cfe61a69061702144e7233b54
- SSDEEP 3072:74UvcpDZ6BNNglpMg4Ewjw60B8EDh7lR84YijJkPxZUOV3:7Cp1A+l8ElZX89P3UO
- TLSH
  T1D8047E46EB8780F1D86311706692F7FF0B207B2281B0CE6AFB589E41EE736C1515976B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  DiskInfo32.exe
- Size 2.5MB
- SHA256 a1493f16e2efa719ebea1f949318850d475a13a418f719a0b349f5fc2188c760
- MD5 1d69fbeb919ea71ba84a98fcc3050d1c
- SHA1 79b5a18d7dd97a1db943f305162bc132422c6d1a
- SHA512 a4e7644f998fc35ec7c1658d13489a962ce750e79c3b0c732bc42b48ec93a8d5f5a47226f38136b41a46e880c04886faa2d08d2be51edbdacedd1e4fb572b1d2
- SSDEEP 24576:45FoH/ztvgZVgsPYFuGq8zBNLXt9pBZabl65W2DuNlnmnMIlL2Yc4abIZdWFzE1H:WZV7O7LzBNL7MnmnM4atqZdd1v+0Krby
- TLSH
  T1C3C5AF6076B7A81BD3234532642DE73192A5B7616633421F72546F2CF9B13C32E28F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral19 behavioral20
- Target
  DiskInfo64.exe
- Size 2.7MB
- SHA256 082d0f9654e450e9489f0eab22bc1defd98d5a934937dd7318541a5af12b5ff9
- MD5 e85d0a6effd4f2f02855f81b35ecbe2d
- SHA1 e1793a0ba53aad38afd88e3fb11ea3dd0442f9c2
- SHA512 e33df556e189edcf5a953adcd6f86a15fe6b429a6bee1e105e00ae2f4909ec64f0517ab656caca63f25297966f03ababcd8aa9096b33d9d7c4ab98c151425b2c
- SSDEEP 49152:FHOlWwWO9evUMuJjTHEkad/nmnM4atqZdd1v+0Krbz:3yHtcnmnM4aqTPKrbz
- TLSH
  T13DD59D9073BB44CAD276C13495169B16C2B2B7816233821F3015AF59EF777832E2DF6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral21 behavioral22
- Target
  DiskInfoA64.exe
- Size 2.8MB
- SHA256 65080f7ad28245504290351150426fad9cf65510b31a1aa020d6621b0099ca72
- MD5 d8911e708b0f213533e24bc638726c63
- SHA1 6cfe4d91549142aa8e26a126d7473adcc3d89e35
- SHA512 1221135efaf5dc88d9cbfea5d8345b100186807689a404f70ea68b5277822f24334d7a60ac6fd334e1ede381a38aa19a0f06d5ca14b42c2a3fae244be5ed4934
- SSDEEP 49152:1Y8HtufMkrcFdSnH7eltIVV4Y7NUnsOKylnmnM4atqZdd1v+0Krb:CfMkrcFdSnH7eltIVV4Y7NUnspUnmnMN
- TLSH
  T1C8D5AF50A64F9CCAE2D2853CEA2697507237B3549133C25B70271E1DECFB7C21EA8B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24