347e0575413b639a35d18c4ecdb7729ab838cf8836ef7fbc8b64c319846f3763

Sharing

Copy URL Twitter E-mail

General

Target
zx.zip
Size 10.0MB
Sample260924-bcztdsys2l
SHA256 347e0575413b639a35d18c4ecdb7729ab838cf8836ef7fbc8b64c319846f3763
MD5 76e11c8c25e0911b2948e6bb2d571047
SHA1 bf21d2fd42a56a18b8807859a542fbf92a8f71c4
SHA512 5cb2b3276eb6993c340280f79b11190e942da5ea3f50b0c89e562cec422afabc63286b48b3a8c11fe74ffcc5c1ee60f01abee5017186a90e8c2b8a169ad8ac92
SSDEEP 196608:SY2cF/PJUvQG0vpRBX3H6i/8JBe5mGHxghMk8Ez5uOr2T90efm9ok8W+XMgWmNq4:S1aUkrql+ghinEI90eu9okp+XMgWAqez
TLSH
T16DB6331F2279B61AF2CC117EE81B06A9D80BFFD604DE95D262D076413AB78336764393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution ransomware

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://github.com/rrcyber/ZX/raw/refs/heads/main/zx.zip

Targets

- Target
  zx.zip
- Size 10.0MB
- SHA256 347e0575413b639a35d18c4ecdb7729ab838cf8836ef7fbc8b64c319846f3763
- MD5 76e11c8c25e0911b2948e6bb2d571047
- SHA1 bf21d2fd42a56a18b8807859a542fbf92a8f71c4
- SHA512 5cb2b3276eb6993c340280f79b11190e942da5ea3f50b0c89e562cec422afabc63286b48b3a8c11fe74ffcc5c1ee60f01abee5017186a90e8c2b8a169ad8ac92
- SSDEEP 196608:SY2cF/PJUvQG0vpRBX3H6i/8JBe5mGHxghMk8Ez5uOr2T90efm9ok8W+XMgWmNq4:S1aUkrql+ghinEI90eu9okp+XMgWAqez
- TLSH
  T16DB6331F2279B61AF2CC117EE81B06A9D80BFFD604DE95D262D076413AB78336764393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  README.txt
- Size 341B
- SHA256 1046ab5b4ab1b452febcab77f80fb712dd9b995811abb73f1905c7d0755654e2
- MD5 9c7ce0576490d0cf45520a53d2909eb9
- SHA1 fc27fa3a768d4de39ce4a5fcb9595e67189c8b3e
- SHA512 8bee280a84d1ce49762ee47e4666d7b856b062d7b76dba8040288566d81af8ba3857133043c6ed9eec959ee52562ba5dec7e717c25f6e18ea6860a97cb82e34b
- TLSH
  T1CDE07D3D882E82D3984640512217B587D6DEA932414955E177CDD56469B4309033E44F
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  ZXTERNAL.bat
- Size 105B
- SHA256 56bb13497afa8c967a84aa5dbeea6f80f811db9bc734b703c878faf9cb24dcd3
- MD5 b425ed2776f00ac9d0559d63c53c6b73
- SHA1 6a4c7baa980753b552a76c511d741a46254c494a
- SHA512 db22cb8ce3c581ae0f44e39ea810315ebdcff6269813674eb0437c4a95805d8a11a972e49c657c33f54f9fa73055702daa1a3adea6a708bdab9802da009d5018
- TLSH
  T1FEB0126AB71CC34F2173EC2520C940B0185D22076212BFC333E0133DE88F129C1991CD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral5 behavioral6
- Target
  libcurl.dll
- Size 638KB
- SHA256 9883961d1ea6b501420b8d57ac4c22e6786874fc5c33a60f51f1092db6b6d503
- MD5 406828dfb7b5b0010ae6ef42aa191edf
- SHA1 15d3aad6fb91a25b40589e6a7ffef706171ca709
- SHA512 2bb385b88c08c8cbb3679b378d5f88ff6d2a734aec38ba5d3c0735159cf013d5467e873de82853eeb1a0baee2edc1ff7aded7a6b363c2749170795570c58eb03
- SSDEEP 12288:W/clYFXBoBWhlYxOw+CyB8nRfTed5/gklQnAPlgTgc:W0lYFXBoBaYxpbBed5/gklQnAPw
- TLSH
  T1E4D46D55B3F401A9E167C17CC2439623E7B6B0546321A7DB07B4CABA6F13BE2673A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  msvcp140.dll
- Size 628KB
- SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
- MD5 4796bb351c00d47717906bbee4e20837
- SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
- SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
- SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
- TLSH
  T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  skybox\sky_bk0001.bmp
- Size 12.0MB
- SHA256 1c90ba5e79b4a7ab784323c18e43fe54cd4c58cc15d9452609306c871efd6872
- MD5 ab8d926acd85b3e871ff261cf3ed570f
- SHA1 4230f685fae20275acc4c781c8238c39550dd5dc
- SHA512 7a3a4b6f9f0096e4aacf67614bc7476a77be1249d79f8ee48d5bed1cadc9acfbaa29a88b0c5d0496480b0ed9994e4d3c404400b9defaead77336aaf77b23f063
- SSDEEP 6144:Xl3l5Cj3WEKT1s/7yIBWXjQGw3TIIBnnGP/I1ON0cy/9DTsWfV1cjyNXKoawp8VZ:VUenvPZ
- TLSH
  T1F9C6516F6D897CF0DB4EE6F317623DEC9110794DCA27A09E49128E330B5B63A3758681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  skybox\sky_bk0001.png
- Size 561KB
- SHA256 a4091845acf2dcc51298ca95c79f09056fc7bafde5dfba6ab0d2e52586959e80
- MD5 e47d83c89f649a8b11e8b9b774058ac8
- SHA1 7bb870c284551f56476b940be0f898fde8c50bfb
- SHA512 885c8e3654cb8e3a3ce64d33a111c8a913ac67d6a8a2f44583e6a370b32d44f1f38584a00989ada7e3ceac544d3d033c982f11d41cd56ef1584e04536845a439
- SSDEEP 12288:apmr8ko2NEKQXe2yF+UcXamju5lshfcea2lu89L:0mr0epkXamS5u/a2rx
- TLSH
  T192C4234DCB509B4BD9BE1D3D6F23EC359735ADC924094F3A2A3910666C85B2CF838E46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  skybox\sky_black0001.bmp
- Size 12.0MB
- SHA256 5d72f8276b095a99b45a58607f40e61c5172a0f4bbfbc176121ff45833651a46
- MD5 8d20719e5a702ff38722b9eb78122385
- SHA1 3905871f6e3372ec5591492aa990ab3f311b8f7e
- SHA512 2c70900195a37761b0463fc2ba79f986f99f1d05346d19779892957e1e9d763252de84636efe4a66407da0bd8d9bd884bdd69f5daaaf3b31a53008c1aabca9c8
- SSDEEP 3:elbtlllunlllf:Rl/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  skybox\sky_black0001.png
- Size 20KB
- SHA256 ede92eac0f0d25a087bb5f386a85fdbd7107f1269bdaecb433507e9d86bf9aaf
- MD5 1c0e70dfe21e154ab02d9fdc6942d711
- SHA1 c271e907942ea125dca36f38a0b85e05600c672c
- SHA512 8e24e9f9d445f59545345610cb8807bb832e653c28e720e2c58f623fe77587a98e95c3c379a0f2478d5e310c89f6dd52bce2fee6d9cf415957c779515d0b2828
- SSDEEP 96:J99999999999999999999999999999999999999999999999999999999999999e:0
- TLSH
  T12C92E524DAC93892ED341EBE5349DFF0BA304971CB505A6DF3F80075BA5E906192AB4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  skybox\sky_dn0001.bmp
- Size 12.0MB
- SHA256 9b438d1eb444bef09dc403252bf4349f0d5b85a536be61fdf78ae78af66f507b
- MD5 72faae3f10518439ac906d6ad4316a2a
- SHA1 ef2116a95dc0321a796f095c30f3cea58ade22e7
- SHA512 3172994c5caf5784fd5bb8aa68e5c131bef80dacf9092e732fcc568357672e5465eedb88bb0f446b1e3c5f1b28653b7e367ccdabbeaa09c19cc92ee78ea0532e
- SSDEEP 3:elbtlllunlllfku3:Rl/8u3
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  skybox\sky_dn0001.png
- Size 16KB
- SHA256 7ec0fa9b4e41fc6e01fa00539c789e4e37606ebe6dc4d3048a241a23af88caf9
- MD5 8cd8f73b026e6a6ccc89ec224b88a24c
- SHA1 d635dac89c703d56d12ee02a5dc01609ebc0ae0d
- SHA512 47c8e32e2d535a74c61c134a2d9922c7e571b644f1895c3fc344696311d8905d6f044c4f857c60738d546759ab7382374340131b1177f0fc441fd19da9edb10b
- SSDEEP 12:6v/7/W3M/9/jRERERERERERERERERERERERERERERERERERERERERERERERERERP:1Nt
- TLSH
  T1F4721256E3001FAED0FC8E3A07874D30B7B202D589A6432A2E2C51283C49B6C6C7DFC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  skybox\sky_ft0001.bmp
- Size 12.0MB
- SHA256 bef76c6291c74e53aff8fdc2f77be00c9a2032819990a5a989e1f14a2905834f
- MD5 f257d33697ed5b11323db1ce545b71cf
- SHA1 bb6da744aaebd95567c076fa415ead6919911e78
- SHA512 9bfe49a4a76068030c41d7b2d8608da39dd57f235f036d202acb24286416d8db6c981496202a3024a1cd84d1c780ca248453a3982a5562217376ae076c22b70f
- SSDEEP 6144:Y6DenlTXEmiSib9EQJi5i50FtVLUN+pzoumiVRO4+vQet7xgkrvMOQB:Yadg
- TLSH
  T18AC68223526A3EF6DA8DDFB726513E1CC22076CC5B4FDC8D881046715F2AA2EB785718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  skybox\sky_ft0001.png
- Size 484KB
- SHA256 08db56a48cdf99c026d2f4df638aca6d1f7afcc50ae801d77b753c2c5e6a835e
- MD5 ae1e381a45eb255b700cc113e848e695
- SHA1 ccbb6f1fe961fee23cbc4ea39d5b01f35cbfd320
- SHA512 9007918699f9ec7d63c82f3ba1ee072946f30fa3a883f1825f3aa2b6415e8a7bba2ac191a1af5a39580c29496d6b4ea34e2494d32d3590f711ac6cedc43d7703
- SSDEEP 12288:gCHlaQK81auK8ny1x5vYp0Pn/1TteLeXBlgCH:BFDauzny1x5vNtJiOBlZ
- TLSH
  T1ECB42301D976A53ED03016FA48952DD276B30DC9A3C99B28663E36BD2DF632F46D7230
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  skybox\sky_lf0001.bmp
- Size 12.0MB
- SHA256 3ab124394810078838f573ad660ec651f469a4af1a63c5380e1003cf5ac4f2f6
- MD5 72758f0c6de044442f9a91deb21c0df7
- SHA1 2565ab292f9ee69b88a76d5229b6787ecee7a6d6
- SHA512 5a5c5ad413d0e26d298553af3ed15f6aaf86ce846bf9fb6129290879d0332db5e133db32d2faccea48e83e93a0083b94a2925d2b1789cfb566f5e34c5b02abb6
- SSDEEP 3072:LSlSSSKStS7SSSS+SSSSSn8SSSSS0SSSSXSSSSSSSfSSSSSSSSSSMSSSSSSSSSSi:hyU3ejG+NL5viEh
- TLSH
  T186C63ABB654A3EF197CDDEB31B627C5CD1102A8C4B9FADC844118A72173A91F7364AE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  skybox\sky_lf0001.png
- Size 447KB
- SHA256 ca41fc04749869104778538d23aeb71ba5062650274b71e5637cc6ebe9ee09ff
- MD5 726de941343bcd6b3b2cfe5b9a7b605e
- SHA1 165e0c54764ff86c16640a56b83a2a10b6c6ecc4
- SHA512 25e7055f1016f6cd16960166cd7ea80deae04dbad85f25cdb39c65486e48558025d6e05a5dd9fa000f415eaa1d04e97c7568ca4a9735aa4821a220fdcb1d9b37
- SSDEEP 12288:e1Ht2ynkV3x9+KcXrSH+arhhewTGjJi3LPOZLRu6uYBXjt:yN2yn8x9+l0+arhTSFd5RuOXjt
- TLSH
  T157A4230DD78787A9DDBF4D7106194FA061B28EE1887B127A6BB8B26DD2C43453C38BC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  skybox\sky_rt0001.bmp
- Size 12.0MB
- SHA256 7ed1ca7b619f7aa2395f06c5b85c90d8d912a43cf051ddcb5ec468a9558f7989
- MD5 83369bd954ee56c6aca9345a3747ad6a
- SHA1 ad125967f5acf9102a41d2b80508b2feca042061
- SHA512 7226f9b293e495bcbddfa4299313d42dfe47b652ac2fb705dcda4a3fbcf8c67b2b50b127ad111cf1d304e30ea5c7dc03258846dc51c8a309040d73227c5b08b3
- SSDEEP 98304:BBmtE+2+8hP8I3yloxuFT547Fn92e45/CFZB/9/egrKwJQg0Ofttyk9ljl90D2OB:BQ2J0H
- TLSH
  T1FDC6846B5A4E3EF3C68ED7F30B916DEC96106A8C5A1BAD8E44114F731B66B2D3740780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Badlisted process makes network request

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32