eda006204cf2ce98278ff399ce4f6da3b90209a5d7c9047c6382d8a9c7ad3bff

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_eda006204cf2ce98278ff399ce4f6da3b90209a5d7c9047c6382d8a9c7ad3bff.bin
Size 16.4MB
Sample260912-l735eahe55
SHA256 eda006204cf2ce98278ff399ce4f6da3b90209a5d7c9047c6382d8a9c7ad3bff
MD5 6c83755220296dc6317df06069fa076b
SHA1 a00fdf92cb7558dc5309334b4210fbf7461b8262
SHA512 9926bf4c4f805cc2edbaf0bd43c1811eaa60f76ba693533e6d0479059861234517d3ce8cdd6041cf69dd0cfc127c645d8e51c98fcea90c46abf6a0df84052db8
SSDEEP 393216:l28EbeYpOYDoRcYE+VgKGpKS5n3nCftpkTuGYu2VgKNbwW:JCeYUwoRTVmpDeIuGz2VtwW
TLSH
T11B0733118298ED16E7350DFB3CABA7824286E518DF405585B582F9CD903FA06FDB7C2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Rus_Games_And_Sites_Unlocker_1-main/Cleaner for Zapret v1.3/Cleaner for Zapret.exe
- Size 134KB
- SHA256 9300bd01ffe01b26f17f93ac7646ba2326ace4241584cf86149b40a885126fed
- MD5 5c20762f9453cab203f56895ae3c4dce
- SHA1 7ef5285efb4c5bdc3458f674c920f103ace348dd
- SHA512 2bfc21554da1dfb77af61c86265b949bac4d078d1b4d041225b79fbe095990581aeb92ac3160c7bc610591dbffd3d7dd85b20714c7f27fcff8c3c206103a1d56
- SSDEEP 3072:bTy2OorwAESLMHE/9TkvMuMjBMkIpAmhWbBK9YTP48i+r2kvUgJ35PVKhTFFe2C/:bT7rLESLMHE/9TkEtj6kIStFJ35tKX/e
- TLSH
  T111D3CA4FB9D29009F0C050B8BE3AA6B7E59C4C7992445D35FB293A8810F9FA764F435B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Discord.pdf
- Size 883KB
- SHA256 4f07a9792fc8aaa6db5ffeee3f7d4f83e71419794b61e940c75b559383b24bcd
- MD5 1853484c8abb66ec3481bfba1a1d8fd4
- SHA1 6f0d4c3ff19212056d1c4243d59654947439326f
- SHA512 9aa5a23a6d73475ee1b79e2b71e7c45c93a07f04d0e0377c98ccdf50cdbdac2aea952138e6219c2b3a8f55780737a7898008a0153b7e72ded549b0e9c579c534
- SSDEEP 12288:+lJ+e5lXTCL4e/YPDTdcjQOuLBW4XanAFWgu6rJ+tIiBuBZAQ9DrfhyJQgS6:++e5Rle/Y64LBWsJxotQZAQVbhyl
- TLSH
  T13815139A7189DAEED88C453FABE88BF050E90030B95D77AE7B9D07B16B036C5D4434C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck.cmd
- Size 186B
- SHA256 fa28cdc592b2d1cff9318a3e4efca01a6af52d6184e3c37b72ff314c3afb6329
- MD5 d668971f4e066c234d5a541eb2f0ce24
- SHA1 73abd0a9e1528e65b94498111317e1ee83d3b1e5
- SHA512 585556fcca813417027cc4c95833df54d486b61a5dd2451292f92ec52408e29f152f52f998fe3f849220ce9b99cddb83eaefdff0a1864cf9ba7707610b7b0522
- TLSH
  T1F3C0123084618638E7A2DE851572B278518578D1A9408522614AB12DA82DE918A4EDE7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/blockcheck.cmd
- Size 191B
- SHA256 9371b0ebb3c8dca75549a229c33d27e7045f0a5ba6f530a719a4e4b4183ff032
- MD5 64211d2221551516178d63ba56556755
- SHA1 68d47265b83b81632ff084d282758def0bbb2f3a
- SHA512 6e45c3ba797d151cc6e47b876cf63e006e49d5c19798850e5da88deef76a152eb5156882e4c073a03b06b447c4642b4fd77b26252c122e46c6d12910df7fc905
- TLSH
  T1D8C0123458308A78D7A2DE441577F27C90857491AC418522618AB12DA86DA918E4BDE7
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral11
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blockcheck.sh
- Size 53KB
- SHA256 bb38faab791e0b79697860e1a1bc8530f97b6c64e22a1b29e617f64e228710a9
- MD5 1d4793171a5beb6d5bb24aa06a167958
- SHA1 0c4d71fb0c34e2413538b44c8c4a2fff946b5b55
- SHA512 6a4aa215219820aadd93b7afc8e57c08c0fa125902098d20afca87028906877cf72351e6d754b0c4c93597c83983b35ec611e566f58cf5fc0fba666ebd8e4980
- SSDEEP 1536:VQ3Ds3LshycxUpercI4wi1uwmvdHfrtwWLlQLMnxXi1vIbIksApwmBx:GycOwi1uw4d/rjBx
- TLSH
  T115332CECF62F94AD3BA4616CDE09B45E371FDF27490C199DF1AE9A64002493B823EC45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral12 behavioral13 behavioral14 behavioral15
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh
- Size 220B
- SHA256 66f32fa4470cd63a4014da8fa10af11a25862f564e53016d1b790f82c2d83760
- MD5 47fcc2f9d199486b64e3f5c37e0b3920
- SHA1 4a79609abab1a5837dbcf32f80655b54828f55f6
- SHA512 9c82d52c0a4389bb4c9a7b055c8ca01f3c2a3cba7942c8e76abafa58e7338059f8e07a40bf04f1086b2a340e8e0736abd76707133f119490b0edd13d54171fb4
- TLSH
  T10DD0A9B41A240C401F2C8D320F025F82AC88042F6A260F32E0E1F902C1BCACAA04BE8B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral16 behavioral17 behavioral18 behavioral19
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/base.sh
- Size 8KB
- SHA256 34fe6c275dd4c6548717b35e1fe86e548003e9bed476d7fa49c836bfdab715ed
- MD5 b19fbe96b4cf5d817158c1dfc4d0ef5f
- SHA1 7189dcd245972c48088cd7d01f4ee96217f499b9
- SHA512 5536a2b220a7203aee2390b7f9f0e67b945c935c2c3332f655ce8f8fecca5ef53b9172478d53aac68da98cff1f603a32fad2657d5ddeba819d40650c838f08c1
- SSDEEP 192:Kgt3kUeq6+HoqyECECFMxXhJ+708+8NYMfdg4WPeyLYoyrqNLdDL/Wu2:KgdkU6+HcECE0MxXb+70cfdnWXY2dDTo
- TLSH
  T104020918FE539EA73996903D8E5B60143E17A519CD6D3223F06DB284B33CEBF701A846
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/dialog.sh
- Size 1KB
- SHA256 ccaf7f160b50060ca3a4044f43c30018c156636c3f4a8ad2e00e60518905a5e9
- MD5 6fd5b6525dfdd5fdff0a4919fd1a5105
- SHA1 29dbdca361638b242c8bb36bb4f6b37d34494eae
- SHA512 92bcdee7f8ca1ab6e3d330e918ced08d3c26d8b192c0f62a95daf3d4994a196509f019ada6f22760941aa18660dbfe39368af3eae81ffcdb3fd6adf379225fee
- TLSH
  T1BD21B415F91B8F113FF110D68D35C8E3271AE7985A043017B0AA57DC68BCE7B3191876
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/elevate.sh
- Size 530B
- SHA256 077dd6dfe7cbd686b84788260686d9d971546e67c7734a5e42f6b42af0adf886
- MD5 6a2f4103dc14704a6db57a4468d8acfe
- SHA1 f1ebca0f2b3c3830e75fd0e28111b1975f025f6c
- SHA512 b2029907320a4d6a903fc1672a185168c706077c9f60b31475b17647238ff8e71cc94faa6bdb46a10773b572e6a428796d582551ffc85acf8799338ef22d4699
- TLSH
  T19AF0C9B8DF1C7AFE426830CD4D1A88D0350FC12B07BC885F2ED1A8B02D81474336D928
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/fwtype.sh
- Size 929B
- SHA256 8a21e8f8fb1878bef256a467540a9fae42f9135201cbad06c1118c1f2bf69b50
- MD5 870dcc207c4808cc6934d204a1f2311a
- SHA1 d8444d08ced2172c645ddd346cac378df8cda0b8
- SHA512 aa49a818a484f1be79bad9af6dc99cf171e940ea03b8bf7d961a9cdac2268f5066f224ee45a22c7632a522af7046c8fa8165aa994267b38a123a6e178230ac55
- TLSH
  T1111104B52A19F109ED95A07CC539B505FF8E96F3C6D8026082FE9820B030D19A3F9CC5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/virt.sh
- Size 966B
- SHA256 b0afe9439e4a56be386e6dbf9c78cf16197997ec13dd30d57e6ceb2c473a661b
- MD5 c161da3593f20e9920b48c5525ce141b
- SHA1 9d27ab0bcc1193d1c2338619b7c6a1c053949a3d
- SHA512 a1468684c920245294452a9b493a4c0adb1c01ed26e65b3fafd507b6f231580dfbb78b495dceed30d8c71453a932742b2cfe927ceb900098c573571a865ab278
- TLSH
  T15511888EF71CC6E8540540DC4E1952815F3D816316701D61B8FFD521719CDBB817B924
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/ip2net/ip2net.exe
- Size 90KB
- SHA256 1af7ac166fe891ac7a7debf4340bb354bc1d3984dbbadb752e1b3cfab7424bd9
- MD5 91091e06beb0e93426b75a536e14974d
- SHA1 bde0c8dbd280e10c6f15f673ebbfd8bb28669eb0
- SHA512 795f083f0abf86879baf0dfaf58b45370d390f13deae7c2e78940f4a0635dd51d29d9fd2510725f274236ba10fdcfc387bc98de956d5fbf30c994dd320579e05
- SSDEEP 1536:Sqkk0SH245fEcdL5Yr5xJJSc43jwXf9cm1r8wTXuKjOwGhYlW:SqR0SdDIMcvP9cm1r8+lPGhYo
- TLSH
  T159930757F39360F8C64BD274859A5772EA32BC260130BF7EAB44E7312D20E50AE6D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/mdig/mdig.exe
- Size 124KB
- SHA256 e211916b946f6f2f151d20a1efbd1b86596eaac60f48e0c511d0382620c5d532
- MD5 2e51c1dfef399feea6c6fbe77333be3f
- SHA1 0100d1b63349822242221206eb7431249ca63c79
- SHA512 d515b55d2b658c9c0a73ddb1189da5f6542c72823e62b5e80fcf7549f87494b197b1d6451a5723ef3bc654f4d33df4b5d2f1b684ddbdbd684bf57177eebfd2c4
- SSDEEP 3072:68jsKqKANv6/tflqcT1r8d6OR0NoIdoqPB:68a/qNl2dLqNoGoqPB
- TLSH
  T102C3181BF39320FDC25BC134859B9772F832B8220235BE7F6754D7312E24E51AA6D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Discovers running processes

Executes a VBScript file via the Windows Script Host.

Enumerates running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32