0af39fe3fbd0ce7c90acf9505d5dfb29935e25ee197550de0a749a63fe9dc3f5

Sharing

Copy URL Twitter E-mail

General

Target
ьклзпаувмщтш324121488.zip
Size 11.6MB
Sample260909-mla26svclc
SHA256 0af39fe3fbd0ce7c90acf9505d5dfb29935e25ee197550de0a749a63fe9dc3f5
MD5 33ffe0cccbc71dc284eb72000a34fc29
SHA1 17ca40ebef583615f2950155cbe3e20d9fa45187
SHA512 4ad3ed9fbedc55486886f5788523cce2658c947d6b02e6f4248b04c7ffc3641b00a917ab3ddf115238a934ba17af0e8cff2fc609dfc85cfca4d783ba6c5eb8e4
SSDEEP 196608:iZMBZM9bI75vyUj3VFMZIV0SnYa5ZwQSIyEgc3pyJikCQSIyEgrj1MXUM8bI75v1:TwVap3zMZIVjmr9c2ixr9raNoap3zMZ8
TLSH
T154C6336AD9EC5ECBE83B7477C57CE5671B1E813648830930E72503DA0ACA3D477BAA05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Новая папка (2)/Stub/NET/My/Resources/Resources.cs
- Size 1KB
- SHA256 526dfc214fe3223f6f50f9b521d0d0d936ae53a7afcea95c2bdc1a5ba036379d
- MD5 b266c1a20dd2968cb3cefec2441a6b01
- SHA1 dcd65cf912cd5253d5d796f83c3ff2ef8db13274
- SHA512 6bc4199940d0bc564c66aac1582f8aa0dadbd88330ee313194d1cad187305ab635cf2e0433306af8976c4fd156e3388534db8857b5e7b5235c4e9731b9de271b
- TLSH
  T1DD31807773CD86AE5534144379306801879BB34682EAA0DEFC8609F8D6E33914B79D34
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  Новая папка (2)/Stub/bin/Release/Stub.exe
- Size 1.4MB
- SHA256 b13f6f03df9b92680f7a9e0a63643e6fea4d67b7f50b884fce36ab3a145378da
- MD5 8731301911bf1d7dbde266a09982c4b9
- SHA1 8403070357c359020e137ba05ca4c0c7c991de9d
- SHA512 48aefdccdbaaa4eead590db408d2a0da2ea9bb0584d6577f20166e422166bf9db6a242e87df606da0e4d090f433bddbe10bd79cae4dfc08c8c0739519d641a17
- SSDEEP 24576:7K8JJo2Rv6djeo806PAjntkt0LnvpgYQQpGzjrwoCgsXmC3PIlT8mGxet7qzeX51:7xhqyXRt0LiYQpzjrnJYNfIS226
- TLSH
  T120651218731A8AB3C8BCD3B5E51132424BF96336C667F78899A969BC4E07350F722717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion persistence ransomware
- Renames multiple (74) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral2
- Target
  Новая папка (2)/Stub/bin/Release/System.Core.dll
- Size 656KB
- SHA256 996bfed6014c63970192d7266ef63e034a2d33af64dbaee1676f1b7791fda414
- MD5 d92827a3c916d82d39851457af5a7a4b
- SHA1 e8370e8b6f0e9c0ffbce9280a65f05cdf077ea72
- SHA512 740eecee7705423024ec1582251511908fbc1fc0dd32fd87bb2679dfc268dd1cc9ff038eb9b408b8c88a20168fcebe7dcbe525612cc315d76c888f3ab3641cef
- SSDEEP 6144:16yMY1YyFX9naAsBdNd72yWgRlED1myuMHg9ZN9QYPVGXO1iD0ksaip2Ghc4:167qFX9naAsBdv7t99JEO9tF
- TLSH
  T1E7E4590177D8132BF6FF5379A470442897B2FD893B13D74E6455A2AE1CA2F418E623A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Новая папка (2)/Stub/bin/Release/mscorlib.dll
- Size 5.5MB
- SHA256 d53e867e4ca80dd75c3b548bba63911488c86000bbdfc78286b9e980a7f8899f
- MD5 fd73eae7ed37cb4650a3f5a5ce095cc8
- SHA1 2e20786bcac66a6f9e300f56997dd35a633f5126
- SHA512 5f436be0b6f0525438ab7e18bfc84c10d2b5ac7160dbf4d5bb1a33ae5792b2e12858a7ffe9d46f2d8f8edac54434cdfa64170906bc74d369561603d294164b0e
- SSDEEP 98304:rnryUMr8ZhSq8iCjSb8eRUJXHU3bIaB0z:ruUMYZ8q8iCjSb8eRUJk34z
- TLSH
  T1AE466A01BBEC5E36E1BF8B379473A91166F6FC486303E38F1545A12A5853758AF02B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Новая папка (2)/Stub/bin/Release/ru/mscorlib.resources.dll
- Size 1.1MB
- SHA256 6fbfbf1ffda69a2a71e0953a62e5e7b31bcd269e72441b572ae8c6d8ea456f1d
- MD5 b541d890d9551ead15a356fce61661a9
- SHA1 3848a8ce2aa79003fa9c1a1f9719bc6d612134a0
- SHA512 36f2340205a3dd772d3b41ccdfefb7c104886c89227b4f525f8d96c4a50d3b15b210f822d5447e6879c4c52a5719ddd669586a41049377de84cd6c96a1733604
- SSDEEP 12288:g7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rWBeTaB47+Da4vyYEi8A8e/MZO:C9km6k/IwRYbiBeKGC9eT2
- TLSH
  T14135085263FDA049F1B3FA32D93478056CBB7CFD3F06822E25542A6E64F256047A4B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Новая папка (2)/Stub/ns0/Class1.cs
- Size 10KB
- SHA256 168294c7ce97805e3adc16641f13dc505d8fb4102d2b6f5351d5c48b3271d6e4
- MD5 ebcb6cfdfa2141d4145ea1af076f4a88
- SHA1 e5ce1da541480d532e30fe5a8ccb80e3d3eea210
- SHA512 eef819a12bdf4eee0191665a0da1a53ce69aefa09733269dd3bf7e1dd1bee8098fb279b6f5f2f94d27adca984c16afee6bcfeba31f7686c77d1e6c0a3e766c5d
- SSDEEP 192:9GpMYzRYAyATFCDxPECFbveAcaIhxRsGSa1qN+OZKa1QN+OXwa1VN+OVsx5FhOYs:9GpM2SEsda0JAa+JgaTJVsxJOJ1Sd2k0
- TLSH
  T10E32FFA233CFD58FD9422685753AB844CB9FF13502CDA5EBB4565CA0E5880510F2EABF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral6
- Target
  Новая папка (2)/Stub/ns0/Class6.cs
- Size 78KB
- SHA256 4ef4f0dada109158d1fffe0b715b540ce9f052a3ccd3e31b4f21e9216eb7bcd7
- MD5 865362fe071ebfd2c6978f18600d6333
- SHA1 473cdc012e2c9442f68f9ae188d8f2aeb156e318
- SHA512 e4df9eb04577ab891198f3ad903236b222caa88e211b85210653feb2e562779431513aea04ea314b2bbd0860a76bfff0d4863e34d9a5dd922b4b5b5a381c4ed6
- SSDEEP 1536:hSxStowdwHCWrSQXEB13wgC3pNkrqDgTnaXC/yue0O7d2:hSYtrQXEB13wgC3pNXEDoI
- TLSH
  T1B1838840374FC16D19AF62AAE0BCF545D65EF93142ED58ABB8774EA0D0C20098F7D29E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Новая папка (2)/Stub/ns0/Form0.cs
- Size 2KB
- SHA256 916d593891bf5788be9a2fd60e66a378e5b4cf703c98ee1fefec96eb918e159f
- MD5 218dbf86ed0c28063c6c596aafdfd5ad
- SHA1 fb7affc68a79886b2e54a45cac64b85b43ef119b
- SHA512 d43768fb5c1b61f0850b8608fb53569d664c89734464ba8b51f7a5a4e7f71e8046de3a35d99e8438ed4ea38d0bce10360e33d31d56fa7fb406755be9863e56a4
- TLSH
  T1D3518352730ED56B01A21182A935E6C0CDBFE72506BA44F3F08B44B9F1E5448937EBB9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  Новая папка (2)/Stub/ns0/GForm1.cs
- Size 9KB
- SHA256 7563c853466b5ce06bff3c68e766f805d02ab251d3186c7b3f747f9b26cbdfcc
- MD5 e1ce9c73b7c1e33e66bd2c08438a4d88
- SHA1 48d88efc15a2b4110359fdecf5910a1b7c6c5e9d
- SHA512 c9a62a8502b076ed2e4cc81e8a80aee8c28dcbb13819e99e98594f726af8b18b9159774be61410243a4cb4073f7c3cd256a33831b5cce573bcea0a0db4abae04
- SSDEEP 192:9YxRVbERO/XufPmCMw2d/tTCYvO56Mpm32UQEw6NZO2OZTfBrMeHIICPshUvtr:9YxeO/XmPm9w2dlTJvM6MpuroLZTJrMl
- TLSH
  T1A822B393738E85EE459234069C38E489CAFFD1BD43E525F7B8968560F1A400C87BD77A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Новая папка (2)/Stub/ns0/GForm2.cs
- Size 56KB
- SHA256 512a71f81a0a7fe7029bca3a43d738571e145671f0842294b742098069718555
- MD5 19a6ad4428b5303d12f3f46536962470
- SHA1 fae7d1793d157d015f01111c99fa48c5ae455efa
- SHA512 c96fd5a94e387d5f31720a66428aa9e08150d868b5e0c307209a665f49b348d6009de0f6aa59b48a2b14e6a971891d669f193a6a9e0d2a50edff8ddbae0abccf
- SSDEEP 768:x4nRbOHp64zD974gjlU4SYQS0ggjPh4oKGTsukk0nRbJjrXTS0vKQLCldD0dYH7:qF+c
- TLSH
  T17543772A338EC54E698221C9B634E584DEBFE17581D850FFBC0F5ED1E2914088B7D17A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  Новая папка (2)/Stub/obj/Release/Stub.exe
- Size 1.4MB
- SHA256 b13f6f03df9b92680f7a9e0a63643e6fea4d67b7f50b884fce36ab3a145378da
- MD5 8731301911bf1d7dbde266a09982c4b9
- SHA1 8403070357c359020e137ba05ca4c0c7c991de9d
- SHA512 48aefdccdbaaa4eead590db408d2a0da2ea9bb0584d6577f20166e422166bf9db6a242e87df606da0e4d090f433bddbe10bd79cae4dfc08c8c0739519d641a17
- SSDEEP 24576:7K8JJo2Rv6djeo806PAjntkt0LnvpgYQQpGzjrwoCgsXmC3PIlT8mGxet7qzeX51:7xhqyXRt0LiYQpzjrnJYNfIS226
- TLSH
  T120651218731A8AB3C8BCD3B5E51132424BF96336C667F78899A969BC4E07350F722717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion persistence ransomware
- Renames multiple (65) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral11
- Target
  Новая папка (2)/build.bat
- Size 2KB
- SHA256 9be86d429b7677b64402a0ea9d368b4ed8a72749a0f25d718de9cc4148e3f33d
- MD5 1e5d3f65d3d1e6dad59d10b415301f69
- SHA1 d51377607dd60cf7ebdcc4afa9bd8f89d9115311
- SHA512 3327836a0ecd192752696e1ae7cb89bb6e4cddca9de7b0bcff8f9e737c543753b6745f6b2f99c589c7139e8a2abea304862dbf825a4e25b6966c22791a4efa4e
- TLSH
  T16341E03BB80DC1A5A596E2DD5E300BA0F502979B13849DBC718D9E2E173BF8694FC0D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12
- Target
  Новая папка (2)/сурсы/Stub/NET/My/Resources/Resources.cs
- Size 1KB
- SHA256 526dfc214fe3223f6f50f9b521d0d0d936ae53a7afcea95c2bdc1a5ba036379d
- MD5 b266c1a20dd2968cb3cefec2441a6b01
- SHA1 dcd65cf912cd5253d5d796f83c3ff2ef8db13274
- SHA512 6bc4199940d0bc564c66aac1582f8aa0dadbd88330ee313194d1cad187305ab635cf2e0433306af8976c4fd156e3388534db8857b5e7b5235c4e9731b9de271b
- TLSH
  T1DD31807773CD86AE5534144379306801879BB34682EAA0DEFC8609F8D6E33914B79D34
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13
- Target
  Новая папка (2)/сурсы/Stub/bin/Release/Stub.exe
- Size 78KB
- SHA256 46333a8454b700f26ca15f43cc4a12a9595409d3a9ab82ea7c83ecd4732a6cf3
- MD5 74fb6e72afa2df659dae4eb93df5b46f
- SHA1 a429b67f1661337ce02f91ab427deab54b936a3e
- SHA512 0dcf87344b17a9902503eba14a448635fa3943a11e74944f83fbdd0e785ccd82a21d8b60980dcd78a7719cb25420ea56032b6cfd10b55cc0b1d265ed06a64174
- SSDEEP 1536:GCc4W0oQngg+Jyoy0RJcxXRqeHbbaV7kp2JEUH5mIt:PcQoQngByWJoEybaV79EUHNt
- TLSH
  T1BF733901339B6BB7C1BE9A3A5623B14002FBB7050A3BDB9E3DDA118817E3B515B51B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral14
- Target
  Новая папка (2)/сурсы/Stub/bin/Release/System.Core.dll
- Size 656KB
- SHA256 35c13b139c239d82f4b37de8edb5a6ac31492c17a5439319c69f83446b65de1a
- MD5 329f633998fd3b0352bfd6c153603ca8
- SHA1 44641f64237e517163b3d17cfd938639f3a15d65
- SHA512 332e8a1f617e4f420be684a08e00034f352a46f7853147a3eaa9cfa04f78d38bf55c386ba53628dd513f9c570adc57378aabab245e4957eeee5b1e6002e2d7e6
- SSDEEP 6144:E6yMY1YyFX9naAsBdNd72yWgRlED1myuMHg9ZN9QYPVGXO1iD0ksaip2Gxc4:E67qFX9naAsBdv7t99JEO9tF
- TLSH
  T178E4590177D8132BF6FF5379A470442897B2FD893B13D74E6455A2AE1CA2F418E623A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Новая папка (2)/сурсы/Stub/bin/Release/mscorlib.dll
- Size 5.5MB
- SHA256 d53e867e4ca80dd75c3b548bba63911488c86000bbdfc78286b9e980a7f8899f
- MD5 fd73eae7ed37cb4650a3f5a5ce095cc8
- SHA1 2e20786bcac66a6f9e300f56997dd35a633f5126
- SHA512 5f436be0b6f0525438ab7e18bfc84c10d2b5ac7160dbf4d5bb1a33ae5792b2e12858a7ffe9d46f2d8f8edac54434cdfa64170906bc74d369561603d294164b0e
- SSDEEP 98304:rnryUMr8ZhSq8iCjSb8eRUJXHU3bIaB0z:ruUMYZ8q8iCjSb8eRUJk34z
- TLSH
  T1AE466A01BBEC5E36E1BF8B379473A91166F6FC486303E38F1545A12A5853758AF02B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  Новая папка (2)/сурсы/Stub/bin/Release/ru/mscorlib.resources.dll
- Size 1.1MB
- SHA256 6fbfbf1ffda69a2a71e0953a62e5e7b31bcd269e72441b572ae8c6d8ea456f1d
- MD5 b541d890d9551ead15a356fce61661a9
- SHA1 3848a8ce2aa79003fa9c1a1f9719bc6d612134a0
- SHA512 36f2340205a3dd772d3b41ccdfefb7c104886c89227b4f525f8d96c4a50d3b15b210f822d5447e6879c4c52a5719ddd669586a41049377de84cd6c96a1733604
- SSDEEP 12288:g7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rWBeTaB47+Da4vyYEi8A8e/MZO:C9km6k/IwRYbiBeKGC9eT2
- TLSH
  T14135085263FDA049F1B3FA32D93478056CBB7CFD3F06822E25542A6E64F256047A4B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Новая папка (2)/сурсы/Stub/ns0/Class1.cs
- Size 10KB
- SHA256 21cbf2850b2df1fcdcfef4a4e044b76918c4bd88a47b9083cfff865e6be7886d
- MD5 05e22aa67f122a74d828ef168b9e069a
- SHA1 b9209f83728fa1197e30c1d7680e54dcbeb56824
- SHA512 ee9e7e5c23c50d2c73c04b5bd8936bef5ddc5a88148b45f949245cd4c710eb7af4f2e56fdc3956d4d0502e447c99ffedd9cfa516bf6ef84e5200c778c3a8c3a2
- SSDEEP 192:9GpMYzRYAyATFCDxPECFbveAcaIhxRsGSa1qN+OZKa1QN+OXwa1VN+OVsx5FhO/s:9GpM2SEsda0JAa+JgaTJVsxJOQ1Sd2k0
- TLSH
  T14532F0A233CFD58FD9421685753AB444CB9FF13502CDA5EBB4565CA0E5880510F2EABF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral18
- Target
  Новая папка (2)/сурсы/Stub/ns0/Class6.cs
- Size 78KB
- SHA256 4ef4f0dada109158d1fffe0b715b540ce9f052a3ccd3e31b4f21e9216eb7bcd7
- MD5 865362fe071ebfd2c6978f18600d6333
- SHA1 473cdc012e2c9442f68f9ae188d8f2aeb156e318
- SHA512 e4df9eb04577ab891198f3ad903236b222caa88e211b85210653feb2e562779431513aea04ea314b2bbd0860a76bfff0d4863e34d9a5dd922b4b5b5a381c4ed6
- SSDEEP 1536:hSxStowdwHCWrSQXEB13wgC3pNkrqDgTnaXC/yue0O7d2:hSYtrQXEB13wgC3pNXEDoI
- TLSH
  T1B1838840374FC16D19AF62AAE0BCF545D65EF93142ED58ABB8774EA0D0C20098F7D29E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  Новая папка (2)/сурсы/Stub/ns0/Form0.cs
- Size 2KB
- SHA256 916d593891bf5788be9a2fd60e66a378e5b4cf703c98ee1fefec96eb918e159f
- MD5 218dbf86ed0c28063c6c596aafdfd5ad
- SHA1 fb7affc68a79886b2e54a45cac64b85b43ef119b
- SHA512 d43768fb5c1b61f0850b8608fb53569d664c89734464ba8b51f7a5a4e7f71e8046de3a35d99e8438ed4ea38d0bce10360e33d31d56fa7fb406755be9863e56a4
- TLSH
  T1D3518352730ED56B01A21182A935E6C0CDBFE72506BA44F3F08B44B9F1E5448937EBB9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20
- Target
  Новая папка (2)/сурсы/Stub/ns0/GForm1.cs
- Size 14KB
- SHA256 5031609c8442e4df4fa037de97a9393320f1ddd9d1fd19c5c7db48ed46fd10f8
- MD5 63f8c382354249dd78688b5f564ebc3c
- SHA1 897c8bda1df340122c50393800b064cff2e03771
- SHA512 b009d4f2295ae2a244ccf562e055e47b8295f45011e324203dcaa5f707282a72298d76a1f2ef59ec9893f400c19a28d5e8e17c29bc8e374995a2363121c65b71
- SSDEEP 384:9Y8eOcQXmPm9w2dlTJvM6Mpur0TpOcTJrMeHGP2SfiGQtHu:nPFbOpOcd5e1i9o
- TLSH
  T1AA628553738EC59F45E5301A9D34E089CEBFD27D22E625F6F49E9160E6A800843BCB75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  Новая папка (2)/сурсы/Stub/ns0/GForm1.resx
- Size 5KB
- SHA256 4363cd7d5b8671c72442ce1a1bfc10d64ebd24b2d718b54bd4fcd025e4967298
- MD5 4eb5913a0e5aa842250f7419538fa230
- SHA1 31fb76e5d9babe97a11fea041081f96ce426107a
- SHA512 846207f9db4c05d2070482c27af72c50b8f423ac1c7efb5266b059f6a41362704e9f5a590e428f4aefd791edd2e21c1b34473361911cbeea2cfcaf741b5bebff
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
- TLSH
  T149C11245B1C1DD260FB3482DE6523988FBA8923F02356C50B4DCA61F5F72985A6B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral22
- Target
  Новая папка (2)/сурсы/Stub/ns0/GForm2.cs
- Size 62KB
- SHA256 30822046cec7f6947be395226f874c5d233d15955913514468e07d0c3d2ef90b
- MD5 e26678e55cf2b145fd58cda517895a2c
- SHA1 a26eacb36ac17533a09e757d7f0a4b4d45076e1f
- SHA512 c649541c096c130b83380915786e9cebe6c49c29cffef7e77f5a6c4811c9dec3b50fbdddedc6eb1eeb19be7bdc24f7dca430107eaa0c530e8a8635d4f9f6c25c
- SSDEEP 768:F4nRbOHp64zD974gjlU4SYQStggjPh4lFA1A9jBH/J+SO0mRbJjvXTS0vKQLClde:xT6HaR
- TLSH
  T16A53852A338EC54E69926189B631E584DFAFE176C1D800BFBC1F4ED4E3914088B7D57A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  Новая папка (2)/сурсы/Stub/ns0/GForm2.resx
- Size 5KB
- SHA256 4363cd7d5b8671c72442ce1a1bfc10d64ebd24b2d718b54bd4fcd025e4967298
- MD5 4eb5913a0e5aa842250f7419538fa230
- SHA1 31fb76e5d9babe97a11fea041081f96ce426107a
- SHA512 846207f9db4c05d2070482c27af72c50b8f423ac1c7efb5266b059f6a41362704e9f5a590e428f4aefd791edd2e21c1b34473361911cbeea2cfcaf741b5bebff
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
- TLSH
  T149C11245B1C1DD260FB3482DE6523988FBA8923F02356C50B4DCA61F5F72985A6B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral24
- Target
  Новая папка (2)/сурсы/Stub/ns0/HiddenAPI.cs
- Size 3KB
- SHA256 28710df9fe7c23cc41344cf7888f22ba3737d53fa738a37b5b37a976c238415e
- MD5 f9cd80f53026bfda3a1425b91f488d59
- SHA1 12287da717148475015ceee83b1f05c7e23ca0e3
- SHA512 b110dff8a14738fcf8a31871b38d978712c191fdd50797cfeb6001fb9ff318d472eb3cb1a0d030fbda7f9f542d90513b33087ab8dcc89a03a84f9b3aab645f93
- TLSH
  T16761DC04B796C59507A33038679A499D3339D213076ADC18FECD6580DF0203A4FBAFAD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral25
- Target
  Новая папка (2)/сурсы/Stub/obj/Release/Stub.exe
- Size 78KB
- SHA256 46333a8454b700f26ca15f43cc4a12a9595409d3a9ab82ea7c83ecd4732a6cf3
- MD5 74fb6e72afa2df659dae4eb93df5b46f
- SHA1 a429b67f1661337ce02f91ab427deab54b936a3e
- SHA512 0dcf87344b17a9902503eba14a448635fa3943a11e74944f83fbdd0e785ccd82a21d8b60980dcd78a7719cb25420ea56032b6cfd10b55cc0b1d265ed06a64174
- SSDEEP 1536:GCc4W0oQngg+Jyoy0RJcxXRqeHbbaV7kp2JEUH5mIt:PcQoQngByWJoEybaV79EUHNt
- TLSH
  T1BF733901339B6BB7C1BE9A3A5623B14002FBB7050A3BDB9E3DDA118817E3B515B51B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral26
- Target
  Новая папка (2)/сурсы/build.bat
- Size 2KB
- SHA256 9be86d429b7677b64402a0ea9d368b4ed8a72749a0f25d718de9cc4148e3f33d
- MD5 1e5d3f65d3d1e6dad59d10b415301f69
- SHA1 d51377607dd60cf7ebdcc4afa9bd8f89d9115311
- SHA512 3327836a0ecd192752696e1ae7cb89bb6e4cddca9de7b0bcff8f9e737c543753b6745f6b2f99c589c7139e8a2abea304862dbf825a4e25b6966c22791a4efa4e
- TLSH
  T16341E03BB80DC1A5A596E2DD5E300BA0F502979B13849DBC718D9E2E173BF8694FC0D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Renames multiple (74) files with added filename extension

Adds Run key to start application

Drops desktop.ini file(s)

Hide Artifacts: Hidden Files and Directories

Executes a VBScript file via the Windows Script Host.

Renames multiple (65) files with added filename extension

Adds Run key to start application

Drops desktop.ini file(s)

Hide Artifacts: Hidden Files and Directories

Executes a VBScript file via the Windows Script Host.

Adds Run key to start application

Drops desktop.ini file(s)

Looks up external IP address via web service

Hide Artifacts: Hidden Files and Directories

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Adds Run key to start application

Drops desktop.ini file(s)

Looks up external IP address via web service

Hide Artifacts: Hidden Files and Directories

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27