01f8174e3549e36e729ce08059295c6bfa03c45276b35b0273ee5586624ec91d

Sharing

Copy URL Twitter E-mail

General

Target
KMSServersManager-048cf169b55cb1cf8405d29c5d939fbf.zip
Size 1.5MB
Sample260930-clq4aat19j
SHA256 01f8174e3549e36e729ce08059295c6bfa03c45276b35b0273ee5586624ec91d
MD5 a2841a05c16769d792ac29f89c134c24
SHA1 4789347d88c71d9848c7497aeedb69333031be25
SHA512 07709d4dd3e2f60003364d976ea68901489fd54acac3b0ea8848185258f27c6f2d57b2a9b9f056b7b8e0a6901766312262ca15e77902f2afc16eff9490af70b3
SSDEEP 24576:0ZDt/3xZTkoV98Rg0ke+gbaOtJGhOsgjMbFVVPVkj4eOBUlmPh+wLE6gazC+oi0V:KiorGgZe+2RtJGbgjMbFFYlmw0EvazCd
TLSH
T12F653328FE0ACA5CFC9601B93F052F116DEAD445F57C8FE94D051B2E39196AC2AB3116
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Install_Task_KMSServersManager.cmd
- Size 2KB
- SHA256 ffb0aa5af7b463161b622c3e07a0ffc9eae9c276b0b8c405746f4a1e450be07c
- MD5 78ea96b349c55050f0aee8581bb4b3eb
- SHA1 fb5dd1af205bba01f0416f6fe7f9a35d9f319812
- SHA512 b9a5b1247379ded2864d64369cc21d3f08cf1a4f399420fd463fa1fadfb22a7d5e1d700d17bdc16e0130474ef09f156edcad5bb835a5652820ce0bbc2eacc8bd
- TLSH
  T133514346216682870075B377AB013D67BF8D81BF2B68D39833A5147D32DF10593E97D9
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution persistence
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  KMSServersManager.cmd
- Size 13KB
- SHA256 ad9879857a02474a6b392a87376b8e8432068f26677416a92057581cf052c89e
- MD5 fbdfc905c71a57f06c2b97b17d943229
- SHA1 6de22867edc18beecc70b484ac7caae26f547da3
- SHA512 65368e30a05525507f0bd602db1185d68a3c9df7ca7c73dae8fa626d5eb9d3767c7e1c92410c8c75cb24e8d80aa2b548fce828f7e5513e2288dbb14ee4979648
- SSDEEP 192:wyxVcF3JBkW3bOZnZ8FYPJSDlXrCse77J4mFwQClajohL41hin40Cgi/U0+cNX/8:3IOZRxdYqWWin45/UMXnYoqoAz
- TLSH
  T1025295442C4982A710B8F3B26E0154477BDF41FF2A76CBE832915499B7DE62583BE3E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  UnInstall_Task_KMSServersManager.cmd
- Size 2KB
- SHA256 e747f20329cbd4725dff62169f7097d0b81cbb8633b70670f9183064ae490558
- MD5 75efc06e0a28726010692423ad39f6e4
- SHA1 75990073d32ba11f2b1b8878c7d12c17297b21a7
- SHA512 1ebf88b6d58b5b09836b7e725d7d9b193c01384ccaa51a2368ac4bee62308b3a6e19e888a502ba65d6bbb7ceb03b6901fd5affd8410e8901d0d0ff7bedf03127
- TLSH
  T1FB411316215642561070B377AA113D67BB8D81FF2B78D39833A2187D32DF112D6E93D9
- MD5 SHA1 SHA512 TLSH
Score

6^/10

defense_evasion discovery execution persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral5 behavioral6
- Target
  cyggcc_s-1.dll
- Size 108KB
- SHA256 0aa9dba17c91e94178aef17953bca88db60e4b27afeceb2a3826a268e4bc0205
- MD5 9ac4cda1b5082732d14b725fd28c7df4
- SHA1 9e11a8308f6eeedf00be244bacd4e52b713bb151
- SHA512 a09f7160fbe7c46751a639c8762ffa737e767ce9c95b1c28d59c07f7dc66f8bf75a716da1fbd4f02cc6282be6afbf4986a865c9a62daaca62d56a70369430d65
- SSDEEP 1536:o4iwultju4/8/bIag/5UMInQ0MVnkY0OwXVv2Ve5xsBg:oqmt64/IIag/pTVnc2oHsBg
- TLSH
  T190B32950FA8B10E5D45779B051A7A73F9E343E160034EEB9FF89E75BE532702B12920A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  cygwin1.dll
- Size 3.3MB
- SHA256 7203f05765c21579807d425714d29a3022e6e045a5e1925c62fbb6f670baa420
- MD5 a51d350f4b983320cd6a9c85009da952
- SHA1 3b3d4722081ea9513c318874ac06cda44c0bd3a5
- SHA512 d06b26105884b9e671ee338ff907c82c8611366ac0b3c3a0565745dd79c9acb20b8af4c4cdf52fa34cdcca64c650146ecdcfb2edecd1f2d78a04b465fa57552b
- SSDEEP 98304:cy8gHq7TRGKZrJj//xJjaeBtfklfMdgYLe1u4CUb8bA/PRbRLhAZ:cy8hDHB+lfM3
- TLSH
  T13FF57B4CE6CB54F6DD5B5AB0A19BF32F13346B10C275CF97EA4859A2EE23F825502B01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  readme.html
- Size 135KB
- SHA256 be8b2730eff153acec15217c325201d680662d7abf030abf824425f2c69f21b9
- MD5 92698dcf794378ba3061e4e2dfce0a6d
- SHA1 b046befa9fec12f7dc8f68ae3a117894f082fb1a
- SHA512 1ff91b9ebc8d666a35ce0f2bdc5d467284cb461f46238889144cef0fa42ff9b85dcc359d6d8bbade39e619422909d6e3725175b1dd1a02a3f2e97b7357fcc807
- SSDEEP 3072:kDfP/GUUrOucJDK7C5b/RV/7njs32Jpz4vDEEJBJcy91sBbhKYIEoV:ykOHDK7CR/kbQYAM1sB1UEoV
- TLSH
  T138D3F1F3114EA8DF33221D1BEC193B04AC5578BF6B82C2469DAD588734EB150CE699E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  sed.exe
- Size 233KB
- SHA256 fa92711c026494025ac8f3066441d616ff5ec7ddeb2fe33e91ef2b7d105c547b
- MD5 033259e625e44aea1483100c273e3839
- SHA1 bab7d8ebcef9e339f200add65189d567ef72686b
- SHA512 a566afe752b7f6a6bef8c377aa777a0df1b65744053575e46cd57a042501cad36c0aa4e6e85338fda0b17349c14801f5edd77da6a17a621895628852d5624a04
- SSDEEP 6144:s9+uV2qQK7VGWPxGpH1WM+ma/1U+PdkoMVoVXxdunE42d:s9+iQ6VGWPxGpH1WzDUedkoMVyxD42d
- TLSH
  T19734BF81F5C1C072E681113A596AC7328D3679368B3995D3F7F80E79AF212E1EA3534E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  slmgr.vbs
- Size 139KB
- SHA256 95fc646d222d324db46f603a7f675c329fe59a567ed27fdaed2a572a19206816
- MD5 3903bcab32a4a853dfa54962112d4d02
- SHA1 ba6433fba48797cd43463441358004ac81b76a8b
- SHA512 db27b16ec8f8139c44c433d51350fbda6c8f8113e2e8178ff53298b4dace5ef93d65d7cc422f5a2d544d053471c36392da4acd2b7da8af38bb42344db70dbe0a
- SSDEEP 1536:CY4NiWnudQV24qf4t0OeJBIGtCnCQf147Xt1wbsSXiMvQiih:CY4h4QAlf4WIICCG14791wXyM4iih
- TLSH
  T1E9D37283E64750B864B702B3ED1B526EFF60109B60655800BF8E488D5F7679DC3B678E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  vlmcs.exe
- Size 53KB
- SHA256 21dda576a2f67c10f8c3e396e490cfd59d7b3c4578fe749adee81e4167009b0f
- MD5 b25ebd521d647ac7eb4a8ac43f5032d3
- SHA1 f6fe635d0dc2dcc0cd7e4852a497403fb6b3a998
- SHA512 72458ca3a1261ec12c256833ab120acc3979fe21f2bb36a9ad71c9776df9504be000327b1c4fa909d8b0e756f419d26712d13cd75d9a9c0457f913c26b51c394
- SSDEEP 768:noAN+L2/NAk4Mrem9R+LZbHSsc+G/WRGHU3Kd1nVvd4yxBHooooooooooooooooZ:7NAw65ysNG/WRGftaPW
- TLSH
  T179334A8AB7D3E0B1E47B01F0049F9B3FD776B11461A2C712FA5D84549FC2663629BAC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18