910b3a08c4805517ab7283c2e689e73534ff3f2a94aa0e7bab1d79170175ee39

Sharing

Copy URL Twitter E-mail

General

Target
Uni Obhod.zip
Size 6.9MB
Sample261002-epfg3atdke
SHA256 910b3a08c4805517ab7283c2e689e73534ff3f2a94aa0e7bab1d79170175ee39
MD5 f39fb58bc5244261545fb877b8476965
SHA1 a52e18a35eded875ee1cf2c7ebc227c07ad01a49
SHA512 017848c21e119cb211825b1bdf92af65303de7478f0439ad964fc5fbfd2a6dfcce7f22426028d05657445b10456bd27a86bde0e18f8c56b21229807d405d46de
SSDEEP 196608:91aYCR7kqKXoIsh3wW2IP2rD5iM+c09Pl8530WsYL0/:91jnsNwWxP2rDVI85UYo/
TLSH
T17876333D2A4696CBB74251BD8FF2E1348A7739654A8046EE484BE23712C7359308FF97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Uni Obhod.zip
- Size 6.9MB
- SHA256 910b3a08c4805517ab7283c2e689e73534ff3f2a94aa0e7bab1d79170175ee39
- MD5 f39fb58bc5244261545fb877b8476965
- SHA1 a52e18a35eded875ee1cf2c7ebc227c07ad01a49
- SHA512 017848c21e119cb211825b1bdf92af65303de7478f0439ad964fc5fbfd2a6dfcce7f22426028d05657445b10456bd27a86bde0e18f8c56b21229807d405d46de
- SSDEEP 196608:91aYCR7kqKXoIsh3wW2IP2rD5iM+c09Pl8530WsYL0/:91jnsNwWxP2rDVI85UYo/
- TLSH
  T17876333D2A4696CBB74251BD8FF2E1348A7739654A8046EE484BE23712C7359308FF97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  NoMoreCookies-2.3.zip
- Size 560KB
- SHA256 398167bf3344b76b2b9dc3511a3a02345db06e82359f714d34554af15d537659
- MD5 d819b0e1978689952adf9f869f710ddd
- SHA1 531a88a7706788df606bb7d08967f8435d70cb91
- SHA512 06d1d1e6db1386f41f441a78d1bffd01e675bb455518dead9cc52a6f6d5c0400cd36ab9d4bb7676b032bdcc84fac687ca2fec8fe45467afe4ec047df2331fc4c
- SSDEEP 12288:AOw8u/3jg5w7g0XybbOKCrkEM/5kD1DeulgFMRTTLfReNThANcCI:Xxu/T3g0XSb9d5kD7OaTTLfRetJN
- TLSH
  T157C4339E6D920BD2BFC1C23CCF2066B5658746544F703B6E1ECE55CB33862CA402D97A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Components/MiniNoMoreCookies.dll
- Size 50KB
- SHA256 26405f27a485dcd4aefe40dfa2fd052d57046fd9a3da90212d108bd2fe2a7fa6
- MD5 c99249fbd341309413549783fddfaffe
- SHA1 18a40e0de838bf7b8d4389a56552323a0598ab5e
- SHA512 2e67a663c3974cc682e28a7f3886e873752ae926c9cc5d37eda8c0610c945f6a359df36cf9134925b1429a97074ede7f7dc827b8657b380927fd17fe1506eb75
- SSDEEP 1536:ppMfF+2Q6/uj/ZaIgjJrIuBEudYtw0gb/w:HMfFLQ6/u9aBjJrkudYqJb/
- TLSH
  T16C333B12B20140BEE57E4DF0291A69B595FDE8289FE123D313C66A6ADD125D0FD32B0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Components/MiniNoMoreCookies_x64.dll
- Size 198KB
- SHA256 bb012053b0712c72dfedb6110524a826c30477a638a86abddab4f93e4d086c52
- MD5 60e2d520d2e9007fdaff194ee39b4288
- SHA1 9cf3fb78a6d11c26f77aa5618f92f917aa10b400
- SHA512 22329dd656fa69ca48006518ebdcf048b45f14943b8a38db302405091cda9e16ceb705bf4e74565f94819885073f5a9890de5cd7a35a8b607c66e546b019eb07
- SSDEEP 6144:PQQsflVWj30TA7vCmduCAwYHuNK0/z+o:P4C30A7vCmQuIaK0K
- TLSH
  T1A4144A16B6A500B9ECB7913489471E06F772B8950330BB9F0B6046B99F3B7E05E3D792
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Components/NoMoreCookies.dll
- Size 58KB
- SHA256 1d75affc5168c89c31c5981e5f0edc664a56957b00c4f7dedef881fdda3e3098
- MD5 002cf817af0f4bd9f2faa763b86a243f
- SHA1 317454961a84c936b7cb826881693631681aca5e
- SHA512 2f085d8c8a2899b0d2793d0b88dc5c9f4971e69009400cb4973f9005643d63f0bdf99f35b4ac6661b5ef4d0c47afdfbfb516fc7be8bbdb004c1e50689930f565
- SSDEEP 1536:pFo+l7GUeO3QMuxaIP4W7sXZJVR5jB9+50Bt5ZWnvUd/vRtg//CGa7xk4XqPMw:/o+lCUegQMuUvW7gJVR5+mBbZWnvUd/V
- TLSH
  T131432B11E30160B3E97E09B334646A79947FBD3877F112D323825AAE9D221F67D35A0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Components/NoMoreCookiesService.exe
- Size 50KB
- SHA256 9ff907b21da3b4ddd7f32802b48e9028c704b435ca48c00b952e3364b3857dc9
- MD5 7099f18ac4d2df04b40239ea08ddea21
- SHA1 fe19d3af8cc861d2cc9a8b828a93455d7ff8ea50
- SHA512 cf4626943d4817498d33ae519044f865ab07727feecb01ba9b51dbda9dc47d6c0944b6942444f91a639ebafbb1da92c9e74a28e1cfec032d5572af01589d85cf
- SSDEEP 1536:MgRaHSTa43mTRT3GpZt8Gi9qoM3P61xga9LQ:4HA3yWpLR53S1xX9M
- TLSH
  T11933D053AAED8B71C8E735313932A740067CC353AE4AAB3E45F981590D6578D0BC6F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Components/NoMoreCookiesService_x64.exe
- Size 49KB
- SHA256 9e7f5ea1387a7414a95d6aaf05bf1481f7ec184498bf2a41e0ad86061f3a7bab
- MD5 640fda72f19eefa7b5594bc753a08ddc
- SHA1 1549cfaa4a29bb37add40918d01d6213f06eb2d5
- SHA512 47c8adc49198f0e90024677e27862c48d84c5d6370abf0673fe5f8e71c86b55b16948bb04d6e20def143a0483152d28c9cf1b1e4a85d1265be8595ee5357829e
- SSDEEP 1536:VvRaHSTa43mTRT3GpZt8Gi9qoM3P61xga9LQ:qHA3yWpLR53S1xX9M
- TLSH
  T10C33E093AAED8770C8E735313932A740067CD343AE4AAB3D41F981590DA578D0BD6F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Components/NoMoreCookies_x64.dll
- Size 207KB
- SHA256 e1c90107b1423834601248032e67ee8e69a36b1ac3a6d7a4cbc74efe02798f94
- MD5 40c1905df6e28c541dd081fc5e926b3d
- SHA1 806479f5532cd4277050e273c6fbf9339c4f6a40
- SHA512 e572df942987c59191a9eae8e155e8c5ff84337e20b4a56bd30325e09cbf0b097ab6e6974dc343a0075727ac87bd659da363435bb55277526abe097c43af2bd8
- SSDEEP 6144:CRxVNldtv6UVA7vOQMXQJrUua0tiM+kRZ8WF:CFraUVA7vOQI+VLtiMvZl
- TLSH
  T121244A96B2A600B8FCB7913489531E06F772B8550738A79F03E046799F2B7E0AD3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Components/XNoMoreCookies.dll
- Size 59KB
- SHA256 3e7429ff295ec3bfaa71b5de6a14aed3f4d95d0c54c107aa0c974aec9acf63d8
- MD5 ec20bc52f139ac805e0b6064c6485b13
- SHA1 eb9d187e1aa3bfba742d42cb4dcc1d2077daaf11
- SHA512 8991c04fa81cce8c9520f51e4cd63a5ace46ab9272e9e8103e1ae0762989bb8bc8ecc08a384b7a7f10c0ad980f5324d776b141ed5a08c906493b583649425bee
- SSDEEP 1536:p4G4+uoKOSXULPMIPiiGiyeVR5zB3vVdBt5Dpeyrw:qG4+uFOSXULUFNxeVR/vVdBbVeI
- TLSH
  T150534C31B3C140B1E57A09B03A247679947EBD3847F952D32B866E3B8D62DF67D30A05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Components/XNoMoreCookies_x64.dll
- Size 209KB
- SHA256 fd4ea02ddb32398b3d054a66786bc22a3ffc554dcea001f5febcf8e668de0bcb
- MD5 bc39fa740f14f6e3a225285349a5684b
- SHA1 a7244eb18c2a755f1254427218217c44e184dadf
- SHA512 a5b22c7273d4f7363aa8e0cf2c4d7fcd9160c515d373a16ced26bd1c03ee3575541c4c0d178cc04b791c70a735c1788dbc70774e4b1753c430a83441b9be9ebf
- SSDEEP 6144:ONaAP1WiBxZA7vePIM23PPdK0ggWkQK8AH4I:OzPBxZA7vePvSF/ggGKxYI
- TLSH
  T1AD244B16BAA400F8ECB781388A531906F776B81547309B9F03B2867D9F2B7E09D7DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  NoMoreCookiesInstaller.exe
- Size 113KB
- SHA256 07693b8e6ef2e9605e287bdc45086996df9dceaa91121541316a87179f4ed234
- MD5 2619bcd0526ea3b87d97c73bdf57ecbd
- SHA1 d9c36606f7fd2441b4b587a7fddc5afaea3a6d5e
- SHA512 2c6e0602a5df47f9d1df9729707fbe783641be6f1be470060297abc4358810df6c61b2d987a69fe3b6b0c0b92235ec16d5b50f9a0c24d9d1baf7931d1590afdd
- SSDEEP 3072:HW+Oefdo5ojFBD3LTnvHA3yWpLR53S1xX9a:2+po6ZMlpXmX
- TLSH
  T13AB39D0167FD0664F6FF2FB179B152440B76F963AD34E31C0259045E1AB2B4ACAA9F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Contacts third-party web service commonly abused for C2

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22