a1a40f906bfa0649e655908076cfbe325175bde8c71926b02448443fac7d40af

Sharing

Copy URL Twitter E-mail

General

Target
CANdelaPersistors20 (1).exe
Size 107.8MB
Sample260922-kcyqrssbjf
SHA256 a1a40f906bfa0649e655908076cfbe325175bde8c71926b02448443fac7d40af
MD5 a470024cab70d6a39e9e735ddeb42827
SHA1 fe6d4fd1a32df56a02f03f281a46fb34dd38165a
SHA512 d13a0de94c6909b8864d8d8cffb0460f86b44e650c35d477814efc93eb8731c29cc0e275984e8ec73817038ff25bbc79690b117ec419bd19f650aeddfb381397
SSDEEP 3145728:ahMUnkP6DsH4Ociz5tuvVOPc/EW3UCNs6OyictQ6TmBG3I:uMS1DsY/KuvIgjUvfctQ6T2G3I
TLSH
T14B4833C398DCAE7CCEAA397E43A27B5D8ED1242F107A6C76E598CDC0125453297F4B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CANdelaPersistors20 (1).exe
- Size 107.8MB
- SHA256 a1a40f906bfa0649e655908076cfbe325175bde8c71926b02448443fac7d40af
- MD5 a470024cab70d6a39e9e735ddeb42827
- SHA1 fe6d4fd1a32df56a02f03f281a46fb34dd38165a
- SHA512 d13a0de94c6909b8864d8d8cffb0460f86b44e650c35d477814efc93eb8731c29cc0e275984e8ec73817038ff25bbc79690b117ec419bd19f650aeddfb381397
- SSDEEP 3145728:ahMUnkP6DsH4Ociz5tuvVOPc/EW3UCNs6OyictQ6TmBG3I:uMS1DsY/KuvIgjUvfctQ6T2G3I
- TLSH
  T14B4833C398DCAE7CCEAA397E43A27B5D8ED1242F107A6C76E598CDC0125453297F4B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence ransomware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral1 behavioral2
- Target
  CANdelaPersistors20.msi
- Size 38.4MB
- SHA256 84b3fbc064e11e91db0f01fe4b754cb010460aac39a0a5ab70a7290697ea3888
- MD5 75f6b1e1d0dbcf0fc34da6545abe584e
- SHA1 0fffc0e76df7d14a70a94444b8fa94f58d2cb513
- SHA512 2759c633b2744ff284942d689d199eea6954c440a8fe1c395f133690567eb7e2b9413fce080fa1dfcd58b78cea67985036836d797e8d1e5b3d8b8b60fb04fae6
- SSDEEP 786432:LPgBbJVuIEj+kcZbGwRzofl3Q7VuNgs5CB9UMDjO3/:LoBlVua9EJQ7VuNgvB9v
- TLSH
  T1B6973383EDA2EB3EE85ED1BE48572B2E81418D3D4F506C2361B7B054A1F4769A9F430D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence privilege_escalation ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  MSIChainer.exe
- Size 168KB
- SHA256 7c9eac57ec52aaf47e50a4d99670364c38791a2cdaa3ffbefee65ab8d5688365
- MD5 81bdb1550cbd6aa55d25a858096dff1a
- SHA1 94fe5de83ed7510aa606d6359e96d37cfb8f030c
- SHA512 cdc796cf9665518c1fcaa8d6be56554bc122b0c554e1a068985008fba2235d90a94afd71d7cb28a37fc8c26844541ae12d93ec3bb30ab4e5caedcd38b1937ca2
- SSDEEP 3072:AFcBCXoLaebmt1uO3KzfbvF6UhopxY6whps6FbEKY9OTEmcSLhxnf+Ud:AqBCXoLagmt1J0fbhra0TEmdrf+Ud
- TLSH
  T1E6F3070033F84657E6FFAAF9A87112914BF57D476A39E7CD1D8650EE18B2B80C960363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence ransomware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  Prerequisites/DotNetFX40/cs/Eula.rtf
- Size 3KB
- SHA256 c6147000fc34894c724c09cb69ffce75dd1263b69d063f75466d70b67b3c80dd
- MD5 b02c48825414edca106c92182d32bc8a
- SHA1 cf00219d69e3cff9777babece1ee9d8cdc776ac9
- SHA512 b8afe051701189f60789d0340fd15e81491456284305b55c4582d0153a2c8cb25f1edd05f40b50893c7cbb80ec57ff635d764db5f56aa2e945cf29e9c550e9ba
- TLSH
  T179711F1A5935D68C23B7114E8B87430FAF8E3A5A9BBBF4D9B3DF149514A313CA0966C0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Prerequisites/DotNetFX40/de/Eula.rtf
- Size 3KB
- SHA256 a448fe5954ec68b7c395da387545c1664c3f4baade021e6157ec142997d93ca2
- MD5 94190970fb79c7085de2e97ae4630b07
- SHA1 272677f49985098ca0477d6a8c1e70e4bddb646c
- SHA512 7a7ee485d20912fc533e83eae0f151dc142c2f01051735d1f9b20a7146154a04c8269fc9f71ac82e57925b566e07e716cded6db8b11026225ceaac209311531f
- TLSH
  T1AE61E616B8E3129947363BB80701A05BBB1F47FBEE49F666D2284550023BBF8445E888
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Prerequisites/DotNetFX40/dotNetFx40_Full_x86_x64.exe
- Size 48.1MB
- SHA256 65e064258f2e418816b304f646ff9e87af101e4c9552ab064bb74d281c38659f
- MD5 251743dfd3fda414570524bac9e55381
- SHA1 58da3d74db353aad03588cbb5cea8234166d8b99
- SHA512 241ba3f82f37818407bc00909c160b653b45a1a3d156e043b87ba18a7819294716705c952c7b46516c4afd86e6f99bad23e7235b951a371ae6728107f19e5f23
- SSDEEP 1572864:cAVBjIQSzQe3cf7xOCHKYrLn+XxdjrALIjOqWY99:VVBIbzQe3u7KYrCDS9299
- TLSH
  T179B733E571D48830CDA32ABA07D976B54FF66D6B1BBCA9EB7C8487E1910095293B1F00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  Prerequisites/DotNetFX40/en/Eula.rtf
- Size 3KB
- SHA256 da3d6a6ac223744df01c920eae5f43e017f52350831c4f3f6bb38d78232ea3b4
- MD5 b7129c4881f118fcb38f27cfb00cd36d
- SHA1 148989b710205c6a67b3f960567f6daa98d75bda
- SHA512 c0816d7676ddf0774eb9022bd305cdcdfef590be38e20c2d5584968bca78e10a14be375fa892593f11d04be2734a30b5c1d21814b88c31814c713e08546436e7
- TLSH
  T11F61427E828602D30AD601D53E51D09FFF1F23FA5DEAE466E0A89C0112B3B5DE0729E0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Prerequisites/DotNetFX40/es/Eula.rtf
- Size 2KB
- SHA256 aad96e7f4037e977997c630dec015ecf09cf73c1f5b73f84944e60b309eaab66
- MD5 d40c65f632063e5cdfef104e324d0ad4
- SHA1 49faba625badf413763bd913edb62510d3790e98
- SHA512 6a948fa1602e517021c98861b0df12fcb707fbbebf094dde96d9e60cc7ded30b07c1bf6ca8541117a362b5eb8703d61051cf187083c91076e0ad235cf72b7237
- TLSH
  T1795171B95988974215BB02829F81C19FFB5D0BC25D4DD6D2E0DE590400B679CE06BFEC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Prerequisites/DotNetFX40/fr/Eula.rtf
- Size 3KB
- SHA256 8880b979a4f8ecdd529241d9ae02583fecd21010ea1e255a1cbcd0c6fb2f75e9
- MD5 e0da85db8b02a89a63601ea6b9ad7ff8
- SHA1 5f91c397cf3fbf4475ff71339b2d69c45694130f
- SHA512 c8f47154145507c89d9b599d725c3444a206ae2afac2aca4b2ea18980dec134a25fc539ce1fb2291af942dc1ca25ee2fff323fb17f43f5bf91157a30b19bcd17
- TLSH
  T1D271749E88D495DA0A5B10A15F02C22FAF6EC695EA4DCB60D0F99C42023246CF37F67C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Prerequisites/DotNetFX40/it/Eula.rtf
- Size 3KB
- SHA256 c405ab9949c10619742af1af153521ffd85c16821324c16233b025f982a98cad
- MD5 6c9c19bfed724146512493f05cba4f0f
- SHA1 de249075aac70d4661ed559fd64de9f33de43db5
- SHA512 709a522477121ee32152dbe7f90ee4b597621761854b55a791c07c9521ffb899a21c0b84351a68ac3a583b43a91ac5164ef34259d153d21b47c404b4313893b3
- TLSH
  T11671A9375586118E0F9A13D99FB1C05EFB6E0AEDDD9ED8E1D0A41E0411BB74CF02D958
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Prerequisites/DotNetFX40/ja/Eula.rtf
- Size 9KB
- SHA256 2abdc7246e95e420b4e66cc3c07acdb56ff390bcd524e0d8525d5bf345030a5a
- MD5 75ce7d721bdb78f1020acf2b206b1859
- SHA1 cc0418de8806811d21b19005bc5db0092767f340
- SHA512 fafac863dc825fc0b104751fe62cda2c43048683f9d7e45659784206ea67f1aa98ea282afc2a3a4ba287d03f73b21ec1e2f8c02f5d036ce96caefd851a5389e5
- SSDEEP 192:tEf13/qC2+PCsANROmuuU8EhZFJEj2VQoKOwyWAOxzpOh+uqaJgt2:tBtQoCnGDzhuqz2
- TLSH
  T1AC22692774B8F87C1AC4A6D99F66D4FD6ADF08064F77F103B94E6253081A15F87832A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Prerequisites/DotNetFX40/ko/Eula.rtf
- Size 12KB
- SHA256 2954edb51628942a37a9bf58da628932638c35ed61744892e42623fe4ccd06a0
- MD5 a3b318528e286ec387e81934e5d3b081
- SHA1 cedcc08d008e21c0e88eef8354dab8cff2ef51ad
- SHA512 3544d9be654c859cde2b9cd8614c5abed89e488dfee2f51ab92a509873dc504942e375388d12379de9d29deede662667f8cc4bc6d2dcd50c5ac865ce6c44352d
- SSDEEP 192:MUf0PVF4MjeKojIfE6wK+b/mIr4tIAcAIce5rD6O1IuonKZim+dfNAW6qUK84Zn+:aK0wB/Tr4TmckIuCm+TAWdUN/re2
- TLSH
  T19442D46170BCF64D44617C5EB6F600DF7BAD810F4CFAF2186B5F22BB8CAA18E914A541
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Prerequisites/DotNetFX40/pl/Eula.rtf
- Size 3KB
- SHA256 4f2d6a8979c89592877555fe8f576d5f631132452afe86114d35e9531a1ca948
- MD5 bb93b108d4be954133380f7709e7ba1e
- SHA1 34376037b3c5879142796a2f524e5b3ea6097ed1
- SHA512 69c60ef8c0e6a8f7a92ec9a9c94c99f6dde39477d8dee041abf7a164025d7ebfc9f0c7399ad8c9ed150861b00fc47f1f1cb40bb245aa87ed7904b1bae6a4271b
- TLSH
  T1E181745EED48E5CCF63226C5E2C3524E73CD8A865C26F2A8B31F2CA544B76582229572
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Prerequisites/DotNetFX40/pt-BR/Eula.rtf
- Size 3KB
- SHA256 0af1f04f416712387bf87c93fa846b4e8eb0ac25e284a2a3578c58e2724e2778
- MD5 e43708161843a33d34d6fdf966d36397
- SHA1 2e5c0450cebd9a737a90908eeddaae2d0b3e2940
- SHA512 fb334d29bbbc2d19d20c5260c55bf83d9d6d242c6a8f04ac88f8280a63e6af32fb5d96703e43d39f6863d17b27d9e0e36cbab1099127e5fa281255a19ae39e0d
- TLSH
  T1E071313AA08DD14E1D1A24418FC3C08FF70F4289996EF4E5D79F28A859F672DA057398
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Prerequisites/DotNetFX40/ru/Eula.rtf
- Size 53KB
- SHA256 59ad806664e3ce4a024452985c4602d5610126a16fc36ade018a9756accc92cc
- MD5 2277852a45da18b12beec5fb6f08cdc9
- SHA1 e564862d098bd111430c4208eaa1add5cd52a601
- SHA512 ed9726d207479e4df494c6af17e64909ea6649ddd8bdc3e37229a73270b4a159b2b11c1add462871dd40a23033e6b3f8a26e3ea1fa6e3b7316153af13b316cd2
- SSDEEP 768:3CR6rdlWFJv3zGz9tWQ2ni8UNo/8PZrS14Z:3CcrMeDZ
- TLSH
  T1203311B48419128AC2139A697F0BFC497E2AF91D98F45094B6ABC2FB553FD7CC163423
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Prerequisites/DotNetFX40/tr/Eula.rtf
- Size 3KB
- SHA256 a8850f6dbf56b6c55d255e81b15a3d17196eee89ffbe41cdfca19205628c1a7b
- MD5 d71a0d5b6cb13901cd35c036d395be59
- SHA1 b0f83cf648c2e84119a32afd2e0ef409bb2047ce
- SHA512 fe7c6e54014ad963f51850973f5ae5872fba9843f1c20973f5e875008064f870a5217c2c9ada3d92a3f1b2df6318d5137814943d6295e72cf27343df93b957e1
- TLSH
  T14581460E509DE6BD2226059E83E1019F6B8F441D2D77F1A8E7CF547318133D980B9AE8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32