a9e270217d12867c2609d9423d1b2ed83fcf7cd08aeeee3ab09a4afdf9e9418e

Sharing

Copy URL Twitter E-mail

General

Target
DOSBox0.74-3-win32-installer.exe
Size 1.4MB
Sample260910-qv3qbshb58
SHA256 a9e270217d12867c2609d9423d1b2ed83fcf7cd08aeeee3ab09a4afdf9e9418e
MD5 10f38d3d4b19c58c04d465bd1acd24f0
SHA1 c8c1f5a5d17336607c886444518e74e3d1a4e041
SHA512 c77310392eda80a98bbb6a5ac3446659b78ce85fdaaa2ef42b1d9b8ea1152722760c1af16696cf48cee43206c9da434fe191bc0b68e6fda99dfb33e479efaaf4
SSDEEP 24576:TA3AA3f646/58tQN2UR7l/TR8EalSxNhCkQTCE2wJnGl0uTskAs+giMbfJyDS:QAAS54K2UH/1xw2wJntunAGrjb
TLSH
T1B06533D9E3E20093DA1A1D34097A5EB7A2734D086F529B13E7863BE739F00C35636697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DOSBox0.74-3-win32-installer.exe
- Size 1.4MB
- SHA256 a9e270217d12867c2609d9423d1b2ed83fcf7cd08aeeee3ab09a4afdf9e9418e
- MD5 10f38d3d4b19c58c04d465bd1acd24f0
- SHA1 c8c1f5a5d17336607c886444518e74e3d1a4e041
- SHA512 c77310392eda80a98bbb6a5ac3446659b78ce85fdaaa2ef42b1d9b8ea1152722760c1af16696cf48cee43206c9da434fe191bc0b68e6fda99dfb33e479efaaf4
- SSDEEP 24576:TA3AA3f646/58tQN2UR7l/TR8EalSxNhCkQTCE2wJnGl0uTskAs+giMbfJyDS:QAAS54K2UH/1xw2wJntunAGrjb
- TLSH
  T1B06533D9E3E20093DA1A1D34097A5EB7A2734D086F529B13E7863BE739F00C35636697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1
- Target
  DOSBox 0.74-3 Manual.txt
- Size 62KB
- SHA256 63d0a0c6c2d3db9b070ce83c101ba06eb836f6a6bd187094e9fc6b78eed735d8
- MD5 f9f045ec1c5ffe00476599f50622de05
- SHA1 25dd09b4d9c3d8dbfa3f9928b5e408bcdd9eea61
- SHA512 9e9076940453e626f9e7d2bef410afd7f23dce09008f93983bb44ce7444134a911039bed208b1881eb994385a9071c4ed96d346f441612e73178175a8ef4ef3a
- SSDEEP 768:LHArrHava4FcgBHLjuKf+7f4p6dAWchiCxkhS3XxnO0jsUjhwh3V+6Ezje31:LWUju7fjdAWcu4BnO04AahREE1
- TLSH
  T1A653C74FAA4B177211320156F60FE1E1F32A81EF526A225535AC421C2F35BB683F79DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  DOSBox 0.74-3 Options.bat
- Size 107B
- SHA256 ff7605d991e0dda17221625b732cbad0c10c5a34f93957d148350a0ef4dc78d5
- MD5 f6513bd9176d025b1e0b713fdfa70fae
- SHA1 60cba55375fddc388bcb183cabb8b8786e45e6d1
- SHA512 8489ed50aac259f11494a9115191eab190d6bde248d99ec26f10288e6a4c79c0afab42dbcad559fec868a5c2f0a33ea83ab1b43c12a1462ccf2ee950227e309f
- TLSH
  T127B0921E920B481ED80CAE38794048993893B0E48808A08286C21842881A0A3AB30C32
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral3
- Target
  DOSBox.exe
- Size 3.6MB
- SHA256 dcfd46fa521f5ce89dce3bf026056f3a1d15533f80321ee887403e30d7949f5e
- MD5 90c338efc128025736084c05ae664a60
- SHA1 5c5c465b48d09c0586ee465dfe5df0cb0c1c1028
- SHA512 814d28162e68655088ff4b858274c3c33fe2b9c9dd654e7d0614ee5bad3c28a776ab7799efaea136a5cfbb93601fee5675b64eebee7722500324d896dc6f0ca8
- SSDEEP 98304:UOWQm9JBTsKEeiu9gByQUkIvTFRoLEYe:Ze9JIeiu9NZhvTo
- TLSH
  T110067D41E18742FAD01744F0807D7B7B5A389E189035C4E6DFC8DEE3FA63B82996B54A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  Documentation/AUTHORS.txt
- Size 276B
- SHA256 5a0d89da929c7241b2da13f2ae9407937f0a7e103698e179e443104e470dfa17
- MD5 5e2eab4329111ba8053f8c4ad04a04ce
- SHA1 a0b398462bcc1459e871a682b6b248e141ea75fa
- SHA512 aa7bc78418641ef1b23f543ac5f5703f0127e057da6905cecb3ed77484e8ec791d62a998fb6a07a933d468036d5e1d48673c2edba8869d0199837e1849bfa5eb
- TLSH
  T128D0EB4DAC72CA2045A2E90F480201A0F304EC23090A02828958213B7358D2A68FC26E
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5
- Target
  Documentation/COPYING.txt
- Size 17KB
- SHA256 da0eca0fb517ac939d167924c9d4b3f8750a6b7191932ef2cb145acfa624ac7e
- MD5 46aaf69a91703493b666f212a04f2d8d
- SHA1 b9e28040de9d8773c5b0cc8108869e8f3f287798
- SHA512 4338956981eded4d243272dd8b6f7d35b62ec3759609de1a94fde7aa427c8f976dd7ca838a818dc7286576c760a10b5a7d44bc343483a246f289099814472c88
- SSDEEP 384:lq2PmwEPb6k1iAVX/dUY2ZrEGMOZt7o0sDT2:lzuVLiY+rTZo0sDT2
- TLSH
  T17482A41E770543F20AD202916A4B68DEE32ED4B9723E11543459C1AD337FE3583BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral6
- Target
  Documentation/INSTALL.txt
- Size 3KB
- SHA256 49f4038a4e453abda45d480fc046bd86b6544fde5a32928ea8557e318a624e2c
- MD5 a1ce6ac808c21c12ce64509b07cc15a6
- SHA1 3874be987ba0327d0226e3a6f997e43bfca0a2cc
- SHA512 daf6ee6d7bd6b67cd43c6b1c7cd5c53b67e515b4aada2166fa9775a952678f79dc37a34c1bbf6181a580e8804294739986bc364732c834bbbae442bcb2b2c6ee
- TLSH
  T15B81855F020A62622971C64ABA1867C7D3194037155B2474B9DD4A5C1F3B44AF3EAFDC
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7
- Target
  Documentation/NEWS.txt
- Size 32KB
- SHA256 6a77a8b3ef189d5376854ff4ea9c6f060d676b7a81aaf8df74dc444ae5b867bd
- MD5 2be334fc63e831003bfffa872183ed18
- SHA1 419e55b00e6261d9da3c0cde693a3c9f572ec163
- SHA512 dee59271610beadca7ecbf7309c5abbea5241a76f8554dbbe63a4a000809eae7582a2abcf706e8f548f9d4f9f8bed8240297add4d1f78009063bdd67322bbfcb
- SSDEEP 768:xZ6LKAcHa7DRaMP8qZI0uVZMC+M5NAGmDuLI9hiJhOcpkvYn:xdrA8fNl92Ohck
- TLSH
  T115E293673525336620B302A2F3273092BE3C417AEB6766553CDD821C67158A9C3BF6BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral8
- Target
  Documentation/README.txt
- Size 62KB
- SHA256 63d0a0c6c2d3db9b070ce83c101ba06eb836f6a6bd187094e9fc6b78eed735d8
- MD5 f9f045ec1c5ffe00476599f50622de05
- SHA1 25dd09b4d9c3d8dbfa3f9928b5e408bcdd9eea61
- SHA512 9e9076940453e626f9e7d2bef410afd7f23dce09008f93983bb44ce7444134a911039bed208b1881eb994385a9071c4ed96d346f441612e73178175a8ef4ef3a
- SSDEEP 768:LHArrHava4FcgBHLjuKf+7f4p6dAWchiCxkhS3XxnO0jsUjhwh3V+6Ezje31:LWUju7fjdAWcu4BnO04AahREE1
- TLSH
  T1A653C74FAA4B177211320156F60FE1E1F32A81EF526A225535AC421C2F35BB683F79DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral9
- Target
  Documentation/THANKS.txt
- Size 1001B
- SHA256 acd9cbb904ebcea9ad6d0d871a1131c5262a0bb8bce94dfaf21ee4ed5140b45e
- MD5 366e90c5b46aca9e238b8590c11cdd24
- SHA1 4ac7b8ff0f7c1f95e040a6866be3d600bde72886
- SHA512 b3f9e28421d4ff89ea68ec3c00006ad6a3cc90aa92ab9c14ee47162a3e70b5ee630ac7bbe45592b70f353f9cfe94daa201f8855b149738978b7c2c7e3a4a9b3c
- TLSH
  T1BC11E55784A563B793073507714E35D071AD4621A32B7C0B7C98D37C5315D9F973D1A8
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10
- Target
  Reset KeyMapper.bat
- Size 23B
- SHA256 f494aa928a1d2e8846d1e911a51e90fd49149f612ba001cb5c5a144d5ec271ca
- MD5 723a54699e0bcfb1b7eebae7d89a78e2
- SHA1 3f99e284503365f3c177a58570beaa99595bc930
- SHA512 48de7717b32d078d58830629c7e2d7e200e31e767ab9136d5e05bb8085c17589a1b1c763f2288f84d6f9ded44234e2b7b2a33ea8865208a8ddeb30e5a7a0caa5
- MD5 SHA1 SHA512
Score

3^/10

discovery execution
behavioral11
- Target
  Reset Options.bat
- Size 21B
- SHA256 4b340c08696aab9b06742c763b332f43a4de9930177a4c9d240b2ea1a0e5e75d
- MD5 029a3bef661b34c3f7c4713544a28da5
- SHA1 b33c6d18defe468bb70b0ed7ad46223303cd7be9
- SHA512 3bc6d801be82303d60d761deb878cfcaf7d209b216acfb9ec355c420f98711d157f73d1aaf35a00783435d3d9940a780d76802cb128c9be576a03dc523ee7752
- MD5 SHA1 SHA512
Score

3^/10

discovery execution
behavioral12
- Target
  SDL.dll
- Size 437KB
- SHA256 69037ebc43755296c0cc292d57d560028d7f2265f7b86ca84e714835c19bbd58
- MD5 52726f9e11c4f2af64033ee17dae1fce
- SHA1 a6f2589a6878e7c3384d9592077900c747232b0d
- SHA512 e075c07d8dfbe027fc9fa9f8874ec117e2f17ab7683fc8941e4fe5a0b4ed0ee26bc0a8b8ccb0f0a79a1a200220d39b6820a480be720b68091a5550798f93a1ad
- SSDEEP 6144:AEH2f6Zb8uDLeq0vRBaQiiPOFG5dCHiKudo0KmzHSgwhyZwCM:AEH+6ZbhN0ramP7yHLuIoCn
- TLSH
  T164946DC0F6D70CD9EA06063849E2E33B5A7C39908317C755F694EF3AAD13BA1359660E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  SDL_net.dll
- Size 13KB
- SHA256 2f39dc04acbecf47efa45034891602b6ea7bf6fd2f27b5c0a5ca8d7fb155c929
- MD5 7db830b9fb29781f86cec2a1bbfe050c
- SHA1 e8adb7e4821d98bd26062c793288dbf7754f6978
- SHA512 e2934aac58377d8a5adf96633b55eea63bf689872409270bbcf98097a36ca772194fa12c2b287bba0a76109ae62c575beac3b1192375c4e06b61640cb9e4a14f
- SSDEEP 192:E8UQFh8UMKd7gvpK3mmg7xluXquc8miU1ebHML0ow1w0c7xGf+u6QmeMqmf/7JCz:E8B/MmJhguaGmioebdoELSdm
- TLSH
  T13F52D7037621C47FD22286B610834BE37E60A37684591E3FEB885C74B779825925833F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  Screenshots & Recordings.bat
- Size 37B
- SHA256 9b235d133481e85bf12e2ba5bea2aab5e87b54404de1a06c58ff4de1e5ad9560
- MD5 49c28d6953fb810692795a8f93e894c5
- SHA1 7051a5d0551303d87e175e44ae84e02d19bcd82a
- SHA512 c7b4220ff7e5529b3108d61c83356ba12d67c65b7707bf259dbf25a0edf76a595bd6e4270dce41353f2938b1058e0cf6b78f92dde7bf4be5ce51e8bc7a16486e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral15
- Target
  Video Codec/Video Instructions.txt
- Size 1KB
- SHA256 cca5a0516b2bebfd8089b1426762b641382dea9c42e50356007188a9eae6ea24
- MD5 d1b77c6c4eee3bbac911cb6614695f9e
- SHA1 01c59a5b81a5ecf387b596caac858bd0aeae9c5c
- SHA512 58fd35c19071845832f8ad0b0a1bd16a3148ee1ac87315a8a8a3bc83ae207ccda68d19305243123a313cf20646f4d99e50a675acec647fb2c298480efd39cbad
- TLSH
  T1913178DF9B0F021F16114A57921855F6D3151079027452A4B45C91EC323DFF9D3BB1D4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral16
- Target
  Video Codec/zmbv.dll
- Size 210KB
- SHA256 71ab9fc1fb533eeefd656d621912cbe381f6cafb84a87593f731514f01e8513b
- MD5 16454a4e99ab40925b5bec533a9013a4
- SHA1 554aea271dd28f6e677ac0277625578aa763a957
- SHA512 6202af833a40b321f82ac9ea7ff9d0e19254d863631263358fd395f28b5cfe69d2dd0d046e2baf29249fd273bc23e0c0b73ba29f3ec759ab5b39ec060b3b4acc
- SSDEEP 3072:q8vxFGRXqk/JwHd4u1X8mTpGOx4qaYlTBf7UQwHNwrwz:q8k/JwHd40fGjYlTBTUQo
- TLSH
  T1D2243954FA4369F1E3B30576858FD77B52657901443AFBF3EB8BEA5A7833513080828A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  Video Codec/zmbv.inf
- Size 3KB
- SHA256 94ce9d889b16da383185c40de25d5fd57d25a7b608c2ff87ab5998b4191ce4db
- MD5 d7128e50659cf55483c971b5d4805a6a
- SHA1 0c1d24614e80b351763eba7569de098da6a2a471
- SHA512 c66547af88c866085b8bbbb8fca32129650a153ae93092d65aacca8bbb0652fd24bab69cc6dd978eb9d6f4236860d3bcf0d5b01b4d7c838fedd0c293f8292969
- TLSH
  T146819C454934C132FBB27700AD975E2A2B2A578B3195D34A6CC6D640AF3368FD0552FA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral18
- Target
  uninstall.exe
- Size 36KB
- SHA256 a3df234c142dba1389b3efa0407449c2ef3b0406a363765151b95c53042ac412
- MD5 502919789d5e283a23a3fc84637015e3
- SHA1 19311d8241a5f60c56cbdfe286398ad7c648e490
- SHA512 7ff2bd4e377ff199c1db4006cdf2d8c49e0d600602f7b4d63454872e6d470208122320db360e5ecc7901a3f573682d249caa84863f2694cf792e7f24a29e12ef
- SSDEEP 768:x1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJTJRnqNCokhB:fQpQ5EP0ijnRTXJmNCbr
- TLSH
  T1F8F26D1636F5C4BBE45A06711AB3DB7AFBB6F7011711061B6B601FBE2C21183DE1628E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19