Extracted

Extracted

Extracted

Extracted

• • Target
    IMG001.scr
  • Size 3.4MB
  • SHA256 fb5c0e907acd205bc1b4f05ac62ecbfe2040fab539b8a520e3e0d42dd546e803
  • MD5 86f9684058f858abba198d777d5393d1
  • SHA1 34e2d55ea976a749c4ff9d514c8d7c1d822e6199
  • SHA512 c18cda174b1b33c0b3183eecbd6f36913aa0585bfc795a2c535cf32e9f53c259b192147779c745a54a0c36282c19c5f7d333f6e34a3bbe6140af3829b082531d
  • SSDEEP 98304:M5VPnq1y5tQOM33ZNqCtByxHl54Oyjes1Ro6:2VPq1yLanrqDr43eON
  • TLSH
    T1D9F533259387902DC0498230788B2B66D37ACC173D0A17225F4277ADFE374EB7E8E656
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral1behavioral2
• • Target
    $PLUGINSDIR/ExecDos.dll
  • Size 6KB
  • SHA256 42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
  • MD5 d7b975049ec3aba50e4b7cc654a28214
  • SHA1 25f2578945ebc9ac037fef7b7f94c5d48e42388b
  • SHA512 f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
  • SSDEEP 96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW
  • TLSH
    T18DD1B5797BE040B3D2B647303D72526793BDFC200B25E2AA4B571ACD2C90D54FD21BAA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/inetc.dll
  • Size 21KB
  • SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
  • MD5 d7a3fa6a6c738b4a3c40d5602af20b08
  • SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
  • SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
  • SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
  • TLSH
    T12DA207425B414AF3D3B60634707A33630769FE72246655DB86F32AC97878393EE36722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    $R9/NsCpuCNMiner32.exe
  • Size 1.4MB
  • SHA256 a0eba3fda0d7b22a5d694105ec700df7c7012ddc4ae611c3071ef858e2c69f08
  • MD5 3afeb8e9af02a33ff71bf2f6751cae3a
  • SHA1 fd358cfe41c7aa3aa9e4cf62f832d8ae6baa8107
  • SHA512 11a2c12d7384d2743d25b9e28fc4ea0c3e2771aca92875fd3350f457df66c66827d175f67108f1a56d958f3b1163f3a89eedb8919bf7973d037241a1e59231d5
  • SSDEEP 24576:gWKqa4hnzP3w7L3rmZmpk7FSQFW2iJ+N07/TwYV1CdZdQ+4lT+iFgiGTtswAtdz:gSrwf3aZmpOFU2iQNIUc1LxGTtswgd
  • TLSH
    T1C66523D22F67A174D08A073C732DF3BD117D60988A935EB0A68157EAF41F841399B36B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoveryvmprotect

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral7behavioral8
• • Target
    $R9/NsCpuCNMiner64.exe
  • Size 1.5MB
  • SHA256 a0535d5d0920e2ebdfd76a324cb40c318083f740f3bd5e17d5ba5e2b6830fc94
  • MD5 6296d247d3d3f34d12fc294030a7016f
  • SHA1 f3ad9fd44d56c5c02edefa26023e8a78c993d699
  • SHA512 e3599945c2685c57c5a5f2d9e4348a9586129f94c2d28f4cef4f4e115666299ad6bcd3fe4274dba13af08097c468c9115fdb538ffec43d67a21a7b88b63a6d9b
  • SSDEEP 24576:fjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjwzKJo23bvH5xh8R:fjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjE
  • TLSH
    T1527502A43896DD6DECAFEA31ECC2F6FC2BC90ABC25CE09765A85FF34140F1949489445
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    $R9/Plugins/ExecDos.dll
  • Size 6KB
  • SHA256 42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
  • MD5 d7b975049ec3aba50e4b7cc654a28214
  • SHA1 25f2578945ebc9ac037fef7b7f94c5d48e42388b
  • SHA512 f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
  • SSDEEP 96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW
  • TLSH
    T18DD1B5797BE040B3D2B647303D72526793BDFC200B25E2AA4B571ACD2C90D54FD21BAA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral11behavioral12
• • Target
    $R9/Plugins/inetc.dll
  • Size 21KB
  • SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
  • MD5 d7a3fa6a6c738b4a3c40d5602af20b08
  • SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
  • SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
  • SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
  • TLSH
    T12DA207425B414AF3D3B60634707A33630769FE72246655DB86F32AC97878393EE36722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral13behavioral14
• • Target
    $R9/Plugins/tftp.exe
  • Size 95KB
  • SHA256 73ddf0df4e9e3866511ef9eae421b11615b81491d0db1d4a7ed19441e368ecef
  • MD5 21e42b4fdb800644335dd8cc95826c7b
  • SHA1 23ec304fab33af1cacf0a167aeb7465631286128
  • SHA512 7fe97cc38afea51b8b8776c860d49d3cac92df63f6acd4f647056a6210288ac387d499e8f6f281cdd31d73e6f1218bc08baa696b0c7c8d33d55543875c1be7b6
  • SSDEEP 1536:NW7lchydMBUxt/lP8KB1R88EKaoLQWAmcTGI7Unt:MChye+x38KrRLMUnt
  • TLSH
    T123931B95FF4700F0EE1706F014ABE76E6632E501983A9DEED7C95E439CE1E92044C6AA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discovery

  • Contacts a large (1047) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery
  behavioral15behavioral16
• • Target
    $R9/Stubs/bzip2
  • Size 34KB
  • SHA256 a32a41c520aa1d08d8e5cbc18c1994f92d47bede5cb8d3aca761579d242d249d
  • MD5 7ac2315d458a6c78f81f7167b164ef37
  • SHA1 f501956f346fe7ac49454f5eae54907eeb247f1d
  • SHA512 00802299e1161ac3a3849678a0515e2ed4548a9c1397635fb546683a525f2dbaab8b90875d81821bc66b76c6669a309922284e818f510fb0d81d0c317458919b
  • SSDEEP 768:FqVnDX38+t1ehxQ7unyskUplx3tUeLTjWfgeOVGM4jjfS3XJvai:kjs+t1ehxQuntkULceeM4sXJz
  • TLSH
    T131F27D1622F1887BF5B6073149B7BB36F7BBD600011155636B742FAB2D31243DE2A28E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral17behavioral18
• • Target
    $R9/Stubs/bzip2_solid
  • Size 34KB
  • SHA256 5a9ecc6d9dbd32c54507496f022ecca949e18235bb0865e1aa345eb84e6af0cf
  • MD5 0a108faf2f740e2b1a97d64985fdd1b4
  • SHA1 e349e668f756ea4b9460bcb2be54504dc357d3d1
  • SHA512 3f27d919d40dfbd431c1516a8803178d5e699f91856e8f9616b7f3fdc755af863f25c29cf08191775ab04d1457a0db8741e1697a66bd2c84252de58942c16faf
  • SSDEEP 768:/Jyky/Nki4Q/JRQ/RZ49ylKR2e7jbEcIKFvGmjXO3XJOai:hiki4Q/JR2RZ49A1ecjXJ+
  • TLSH
    T1CAF27D1661F1C87BF5AA473249B3BB3AF7B7D600051156531B602F6B6E31243DE2B28E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral19behavioral20
• • Target
    $R9/Stubs/lzma
  • Size 33KB
  • SHA256 b72d402fce699b21bbf0a4a86ab9fb7f8a083aeacd4f797be7a7f6f91ef93d62
  • MD5 9557ea4608e64b857c1125eb41ba7429
  • SHA1 d7276eccc032919c84fc05f206d3cdd0b40fe1fb
  • SHA512 8eb238cd34668c12779553b7ef15cbeb4d8dd7aac36b5f044c680b83b04f7e2564905625e14ae5c5e06e4e9b5ccdb1663a08aa63a95e176266d59924061a6ce8
  • SSDEEP 768:/ip/4K0wirQK33PaH81Fej4w0kGvFONg4jjfS3XJWai:6Zr0wirt3/aEecbsg4sXJW
  • TLSH
    T11BF25B9636F1843BE55607304AB7EB7AFBB7A200162156576F601F7E3D21282CE1938F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral21behavioral22
• • Target
    $R9/Stubs/zlib
  • Size 35KB
  • SHA256 c96383fe97a213140741bf5df71f322753200c094cb22db634e050d2be744a4f
  • MD5 346d3c8665f307a06aba85f8745360e8
  • SHA1 de87ba7e2553f0efd531d30d6a5997dab9a6bc2f
  • SHA512 6d9910251618226bfd94c94661b86db0b6c07d5dbc5445cbd0ae7bd34fc42e0b2af53fbd14b57969cda9deb747dae7837209eb4c61b4b130b0170f584b839aa2
  • SSDEEP 768:x0gFJMBrbxJQJFiXDYwQ5NTdKqP5sCOfZ7jrG0D3cjfS3XJQai:xfYBrbzmFizYwUK1G0DRXJQ
  • TLSH
    T142F28E06B7F1897BE596473105B3BB7AFBBBC10016211A035BB41FBE3C612839D1A24E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral23behavioral24
• • Target
    $R9/makensis.exe
  • Size 484KB
  • SHA256 572a6f9cb5b37b6eec13b578d346c2568ce3ec88bb711d75dac9e82fc01c8860
  • MD5 e79833cb0d7b2573819ded2122b57bdd
  • SHA1 71ead8cd4a95704a0cade630bb3ce280af7e028e
  • SHA512 4b023e60392ead0691621a1306286fda6cdc4c447f164c8f249c59db2500d8b98514d93c7a7e8d3cfd60818d2ca74e84ec24163492765b6c17fe94ea0385bd69
  • SSDEEP 12288:LhHlj+wtKJVIo9ZoACV6sil8+eSycI+Tt0XCyzLHWj:Lxl+0KJVpneV6siy+I+TtcCyzLHW
  • TLSH
    T178B4AF117DB580B5CD46B1B00DBE9B767678D6960B228BC3B7C4DD382E234B1A33725A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral25behavioral26
• • Target
    information.vbe
  • Size 1KB
  • SHA256 30daba44a4a25ff5750508613f897057a55337458f19b562e2ed1172c77e626b
  • MD5 e9ffdb716af3d355b25096a8ed4de8ef
  • SHA1 66e2b15ba4dbfa127c3ec86abce666870a4a168a
  • SHA512 f157dc99dfd4c1bec37deba85ed5250f70e169ab2d21b2c75d7d94b4463608c3c74ed9ab773e1359735cb95cb1f38333887d3c8e65c80c0cdfeee8bcb0d019f3
  • TLSH
    T100211A74D35187803E819BC6DAA41AA01099AF73375C674F74E6CD650B0123CD5CC92D
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral27behavioral28