115ad6a4be58320c98f992b1dae26e162976158c3cced251584a2b78f059b822

Sharing

Copy URL Twitter E-mail

General

Target
b760e7d2-c267-4972-b8e4-5cb21020e75e.exe
Size 7.8MB
Sample260925-pl2agaxy5n
SHA256 115ad6a4be58320c98f992b1dae26e162976158c3cced251584a2b78f059b822
MD5 3017f921a6c42a267842cc8bae9384c1
SHA1 08dbc3f4e4d362130bf19b5604d370cc39b66d72
SHA512 6aceceb89e731eb8da16657d2ccc6c60009f64264366e4d14c3043fea5b770b965e38a9ea5f3f53e03b588e79e3b86178b6f64bedc06c521795784bb181483fe
SSDEEP 196608:36cZrw1/2r+iR4iAiIU43IlI1M9bxgdJrV5s4:9w1/2CiR4HiptgPBS4
TLSH
T1898633927F84CC56E65174771830DB6482288D940A63D85BF4E6BF6FFE325013B6E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  b760e7d2-c267-4972-b8e4-5cb21020e75e.exe
- Size 7.8MB
- SHA256 115ad6a4be58320c98f992b1dae26e162976158c3cced251584a2b78f059b822
- MD5 3017f921a6c42a267842cc8bae9384c1
- SHA1 08dbc3f4e4d362130bf19b5604d370cc39b66d72
- SHA512 6aceceb89e731eb8da16657d2ccc6c60009f64264366e4d14c3043fea5b770b965e38a9ea5f3f53e03b588e79e3b86178b6f64bedc06c521795784bb181483fe
- SSDEEP 196608:36cZrw1/2r+iR4iAiIU43IlI1M9bxgdJrV5s4:9w1/2CiR4HiptgPBS4
- TLSH
  T1898633927F84CC56E65174771830DB6482288D940A63D85BF4E6BF6FFE325013B6E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Dialer.dll
- Size 3KB
- SHA256 50000fc294ceee47b02cfe46c3fa8d84d7bec637a0ec45cc228c9f6127e90fef
- MD5 ec35e13c61f465a41933d2c6e5fa6fa7
- SHA1 7cece085598d9f1660ef94333c6104e2c8936a71
- SHA512 47f357f052bd6aff9c1f144039469bd9d04c250d5a2c8e3f8de9d38d176ddd10d1057fad195cb7df80a03d8663a0e60d54a98e3018ee0d975d2cb194f958b2a1
- TLSH
  T1DE71305392D88AF1E24A037B748B250AA1F7FC1117A3D50CEA88070635772C4BCB7BA1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 4KB
- SHA256 89ed50600e7046184f80b2a20b5299f35a0439fab1ad1f9f5fc55606955b6186
- MD5 1be3fc5971da6f9b86843d0763912fb6
- SHA1 e921bfa5b330102630420007a63fde0c439f0cdc
- SHA512 99e5a4e888c6cbd2b67464162516aec5a564447fec389012acd8873aa6312020bfe5f0d68e83f54a7320355c5f828f7769f666d5cfd12f2ceed02a6d5b66dc4d
- TLSH
  T1618195717BF409F2C1D5073326B2159739E972202B730A0BA8D796A65D418FBF86C362
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 c345001e8939d4ebf43e2241d870cf0484ddd4fdb3a718670019bb94623c1b47
- MD5 0a80d382e3cc59cd375f0673391a6d35
- SHA1 05e6a9456adb9b95ccfd41a42dcea2e7e029886e
- SHA512 a0bca1649bdbd4986646791496579d4beac2abddb4d1127a601f75f53e2fc60ff99a2d5407b798a354d752eb488b8c340539122529088397f0b3d02d8315c406
- SSDEEP 48:S46+/3TKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mhGofjLl:zluPbOBtWZBV8jAWiAJCdv2CmDL
- TLSH
  T141C173B4B3C248B9C491553778A737D36612AE746784500F9B6711AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
- MD5 ca332bb753b0775d5e806e236ddcec55
- SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
- SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
- SSDEEP 192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
- TLSH
  T1C3325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE20BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/execDos.dll
- Size 5KB
- SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
- MD5 0deb397ca1e716bb7b15e1754e52b2ac
- SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
- SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
- SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
- TLSH
  T153C1E73AF2E409B3C2A806343EA6A42B17F9D02B071409B7876321CC6CD0DB8FE74256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/extstrip.dll
- Size 2KB
- SHA256 89e8931f2adba8aa67ce199a510965fd51ce430acf067478910c5b622827e08d
- MD5 720cc2e5a1f83a7db72e009353f21ac0
- SHA1 4b6ec18d4971738cbd9ba42211f51d5295f86002
- SHA512 a17fec91066e1ef7f1ef39b61cf077481dda12204690f5006010c9bfb1899721d10c22c3a95a7f6276d2689380eea93e32a45b24dd153ee9006c79ddb70ced80
- TLSH
  T183513233FFF48677D08D73790A57A89861FA6E441BAA420D19AA0C0F39056AE053DB01
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 a7c5516478ab02b5d6c1684b3c2b31ee03331712bcd9f9a8ef8309d2b72c8ec4
- MD5 904d8313031ac05e2bac3dd329828833
- SHA1 6c8322f76e5c38bc24b0bcc057a510c92ec40b43
- SHA512 9d524ebc965f224e1a16f537f71df0963c586fd548cb9a901f8afb1951416dd656d5493cc5e304157dfa6d70d69bcd4c5a5b140fceb3736548e71fe7086b6de8
- SSDEEP 192:oR8cxzvTyl4tgi8pPjQM0PuAg0YNyAUIFtSP:IBxzm+t18pZ0WAg0RzIFg
- TLSH
  T14812F793E5A860B3C2D3523F35BE2B2EC7BD5335B0512C0482738A497A6947A6E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 193d396fc7be5fed9d585de3c43e23d640c1dce725499f0274b3898c248545aa
- MD5 ec62e1a8d16d8f1b0eb792aa26e5de5c
- SHA1 faa219618aec99cffb81c312728dc56c1fdc5798
- SHA512 cb3f3458cf734ab7b964ed25cac87ff2938292eed9caae1305b2e5975bde885f4d8b06d05d4099ef614982cd55d97e9ddc0f13bbe2cdd9fb642d008788ed3017
- SSDEEP 96:O7fhZwXd8KgEbAa9PweF1WxD8ZLMJGgmkNp38:/N8KgWAuLWxD8ZAGgmkN
- TLSH
  T178D1D6FA76C20DF3D54D96702F36381703BD94A21B610261CBD35AEA1EA2A92FE24701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsis_winamp.dll
- Size 4KB
- SHA256 5946278545abbd0b0f5188752fe095e200c85abe0783632a00726d090c0753ec
- MD5 1e1ded1cf1c69852f2074693459fb3b5
- SHA1 81b165cae4d38a98760131989fdd8aed2c918679
- SHA512 a6f9a43d4432658c3504629e9209ad350af69eff542d139e0ccfe0dbf8662f15034edd3cf8b56d606a740b66c8221cafad999088a4e64a4c9c9fb47793a19f96
- SSDEEP 48:SEdAWvTa5HlE1m198EqtjbglT68HY06mzWB+wUKCmMpzm7n4/ZS9:LA2a5Fcm198EqtjMlv47mzWBVgaj4/w
- TLSH
  T13191B872FF6004B1E2D11EB135C139B259F499316528590BD6C61685342578AFCBE63B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Components/ssdp.w6c
- Size 17KB
- SHA256 4b06e904543ba45cdbfa7eb093cb276c44eae2bec5470b5de38d31ef51281995
- MD5 53a9bb3057cf84129141b5d3874307e6
- SHA1 555b28607713ee2e1dec68d827de0e0c3ee38264
- SHA512 8b15656eec79c511263618290dd4fd941c889732ab547c7ec9ddb32839e7fe0c4eb81e01d6e72963afeb81b34806385432d6fad95992b7f34294e839bff20428
- SSDEEP 384:s0pwR4/gMnXfnpRNNUhtTy/P823ACLreLOtWlNC3t8:TwR4IGXfnpjMtqP8cAcyLOtWfU8
- TLSH
  T162723A42BB6660F2C7EA163459726336AD69B5209DE298073F23A79D0D7B061FD38313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Microsoft.VC90.CRT/msvcp90.dll
- Size 555KB
- SHA256 4f7ed27b532888ce72b96e52952073eab2354160d1156924489054b7fa9b0b1a
- MD5 6de5c66e434a9c1729575763d891c6c2
- SHA1 a230e64e0a5830544a25890f70ce9c9296245945
- SHA512 27ec83ee49b752a31a9469e17104ed039d74919a103b625a9250ac2d4d8b8601034d8b3e2fa87aadbafbdb89b01c1152943e8f9a470293cc7d62c2eefa389d2c
- SSDEEP 12288:iUmYoJC//83zMHZg7/yToyvYXO84hUgiW6QR7t5C3Ooc8SHkC2eRZRzS:iUmYoO83W0y8yeO8L3Ooc8SHkC2e8
- TLSH
  T175C4B3233B474AF5E89273F022C9132297B9FC950720B3D392DBE1A55F9A3C95673990
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Microsoft.VC90.CRT/msvcr90.dll
- Size 637KB
- SHA256 8e7fe1a1f3550c479ffd86a77bc9d10686d47f8727025bb891d8f4f0259354c8
- MD5 cdbe9690cf2b8409facad94fac9479c9
- SHA1 4bcdfe2c1b354645314a4ce26b55b2b1a0212db9
- SHA512 9c84ed9a66ce20a22e14fa00c1a0db716133f7b2450a3c0d20b1dcf74e030337c4c6a4953e40e10fc94706dc607236e773ba8999b21bd6e072ab24a487e8f942
- SSDEEP 12288:phr4UC+Yu/A0BI4yWkoGKJwZ9axKmhYTMAO7wFVjCUmRyybD:tYfyZFGKJjxKmhSMABnCUmRyybD
- TLSH
  T1E4D49D11B6E2C032C8E611B8569CEB725A7F64B0032468E3BBD50FEDC9647D0E63775A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  Plugins/Freeform/wacs/freetype/freetype.wac
- Size 331KB
- SHA256 e5ba5b12e07cf59c8d5386dafe8e0a29eea4a148f3fccc4c4cbfced2ca3d6e75
- MD5 a7b92ef35f1a67ab1fd1344113cb2eef
- SHA1 d2e584fd42ee2a624f7f452bc64d0245ce8fafff
- SHA512 261d4edae10a248f56f5f0bc36126955a1d0da3cdcf867b80e7c2d6f0373dc3db80e0cedc9105eea92b0086a55972bc6a19a6f3ad35ef3b2684309be57e49fa8
- SSDEEP 6144:X+nJdMayswBB9F9m7BOEvC8mJNDD+QCIRKvTt2/Ck2KwrgAgGvgXFS00jOtUF:X+nMahaxm1HmTka2LgAN4V
- TLSH
  T1F974C052F3E0817AC27623715726EB1A2F79B70001B899DBDFD80C8DDE65621F739A06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Plugins/dsp_sps.dll
- Size 40KB
- SHA256 8c8a631071cc4d1811db5f0658631608d750cfdab00a3b129d6c9ff19e6662a5
- MD5 5d11df40f6003cd81cbe3f2c239475a6
- SHA1 ef22351d6b9ed13ad40038e8d9de4fca58487853
- SHA512 ed8b2d166c1f3fbaebc743ee0ab33a031ffa6b92b66d939a397a0edf79cb3da6d0b797fed905e955849fc3cf4a9f2d3b4ef0b1bf8378a9fee1e32b7f0a1ade14
- SSDEEP 768:tEoHJKCii9G+qjk3MG4BDWVPZa9ssUV4UlZKej/y4EmK28dbm25F:tuI4jQkBDKBx4Ul4ezy4JKZr
- TLSH
  T15C135CA1B786D172D1B608B494E32B319B788C80177068937670E6DC1A76FE3F6253DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Plugins/enc_flac.dll
- Size 18KB
- SHA256 67d7d9ab9517bbace6aff3808218a549d7cc61bf28138523b67ee7c25438139d
- MD5 58904d83b96eb0d085a58ec3ee3720a1
- SHA1 ec72f542ec7cefcebf8d5779d2d732cf9822f8b0
- SHA512 90eb2e786666e3320dfab3fd6bdf9724a3f44641a70327403ba9c4e93ad1c4792dfe89bf045776a01fc6346615ef5ebc837943247b39c5d8ae79fe4d7a8e052e
- SSDEEP 384:ZYFTwocdnPxH8SrBHXTmT9FTMtwgAzOtMjl+nyTlsa0J:ZYFcTBxHNd3i5FTMtwrOtAjTlsn
- TLSH
  T14B8239017B605077E9A3067139B65F264ABDB6202AF1CC075E6377981CB9585FE3A702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32