acd7c23c1fae8c15a7719aa575ae43e94fdb1ec6bced6f9318154417e0feff87

Target
delta-client-1.0.0 (2) (2) (2).jar
Size 8.3MB
Sample260910-wr4fcawvhy
SHA256 acd7c23c1fae8c15a7719aa575ae43e94fdb1ec6bced6f9318154417e0feff87
MD5 6e15ab109e09905b36668475c5b0be08
SHA1 136e9c8104d6af5faec8e5f0e3d91d1c9b2ac50d
SHA512 656337dbccccc06dee56c3c303f449c04e8b6ee0c4e6167da729728e5994d51d4070e8f189f2411dd96a9cccb1e670177efdc571c339393b4d898988377dadc6
SSDEEP 196608:vOdB+KhObNviaJKJ7D1wwkHX02cS9ZzIb7JlsgQsIMQDQ:CbhCN6aUJ9wwkE2cqZUbNpQds
TLSH
T18B963315BEA8C42ED01B58726101E1D3BE1CA3DE8501B42F46B4559F8AF2D9B072FBDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  delta-client-1.0.0 (2) (2) (2).jar
- Size 8.3MB
- SHA256 acd7c23c1fae8c15a7719aa575ae43e94fdb1ec6bced6f9318154417e0feff87
- MD5 6e15ab109e09905b36668475c5b0be08
- SHA1 136e9c8104d6af5faec8e5f0e3d91d1c9b2ac50d
- SHA512 656337dbccccc06dee56c3c303f449c04e8b6ee0c4e6167da729728e5994d51d4070e8f189f2411dd96a9cccb1e670177efdc571c339393b4d898988377dadc6
- SSDEEP 196608:vOdB+KhObNviaJKJ7D1wwkHX02cS9ZzIb7JlsgQsIMQDQ:CbhCN6aUJ9wwkE2cqZUbNpQds
- TLSH
  T18B963315BEA8C42ED01B58726101E1D3BE1CA3DE8501B42F46B4559F8AF2D9B072FBDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

aspackv2 bootkit defense_evasion discovery evasion execution exploit persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- Possible privilege escalation attempt
  exploit
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1