4783ef21245dd14525ac95098ddc800251ccbc8c614351e22bab64178e455a3c

Sharing

Copy URL Twitter E-mail

General

Target
ToolsUnlock.zip
Size 138.2MB
Sample261014-2tesnatwcx
SHA256 4783ef21245dd14525ac95098ddc800251ccbc8c614351e22bab64178e455a3c
MD5 1a22149423bd5947ff0a1b8c18d056f5
SHA1 18aa6a3bd0052c8af129c94d61703fae20da7c3e
SHA512 69bd2545f2280b5b2ec4239e28eb5170b473fbed96a744c020981d71c7863767f15ea0a3b72766818850e2bbdd5c7ab15e26f4ac24287feff10b1c7c36443747
SSDEEP 3145728:gjvxm143ByK0xB52k7t4VAbWdoOO2ZJQJIyhEqeyXSHfPL7h:gbxmgHa5b7tvWbOaJQAwa77h
TLSH
T1B76833DD16993B3C82485D92C6C8BBBB44FADB23B66FD54A81E7B450CB2336DE21014D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ToolsUnlock.zip
- Size 138.2MB
- SHA256 4783ef21245dd14525ac95098ddc800251ccbc8c614351e22bab64178e455a3c
- MD5 1a22149423bd5947ff0a1b8c18d056f5
- SHA1 18aa6a3bd0052c8af129c94d61703fae20da7c3e
- SHA512 69bd2545f2280b5b2ec4239e28eb5170b473fbed96a744c020981d71c7863767f15ea0a3b72766818850e2bbdd5c7ab15e26f4ac24287feff10b1c7c36443747
- SSDEEP 3145728:gjvxm143ByK0xB52k7t4VAbWdoOO2ZJQJIyhEqeyXSHfPL7h:gbxmgHa5b7tvWbOaJQAwa77h
- TLSH
  T1B76833DD16993B3C82485D92C6C8BBBB44FADB23B66FD54A81E7B450CB2336DE21014D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Manual.txt
- Size 554B
- SHA256 7031f12000a96a45acb66b19a0528328f9f3b5dd1ad3d6199d0ffb694bd3017e
- MD5 111ed630a32d02e899a2e3b5b077d9d9
- SHA1 c889792169e6378fce2ba17a2ce2d0c90a2a77c0
- SHA512 95a3c393073117fdb62fc2c19b7c87838d7efc4a2ad2de7f3984093d8977a1d3560955404c789f0bd027cfdba7f78ce4135c81884a5d9003a19385079d827156
- TLSH
  T107F0819D0FC3027734B50977369B9AC1D120883955B7C1401FAD4118B27DEE38BC04AD
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  Tools_Unlock_Pro.rar
- Size 138.2MB
- SHA256 14379585c1c0bcf25b03ea53407774a3c9034baedf9ae6944a2f58c96740c6b1
- MD5 f4a8766ecdf08bb61c6d36e0569ac2f3
- SHA1 966ba0bba47812e9bf6be777bbe1968e1ec729f1
- SHA512 3f89a057d0794eba91244d6fff9a6416efe715dd12a250679301c2fc47cbbc4d8118dbfa2782ea21f6331d9f15ddebd13880fa23eeda58836ab98d7f56904506
- SSDEEP 3145728:rjvxm143ByK0xB52k7t4VAbWdoOO2ZJQJIyhEqeyXSHfPL77:rbxmgHa5b7tvWbOaJQAwa777
- TLSH
  T19B6833DD16993B3C82489D92C6C8BB7B44FADB23B66FD54A81E7B450CB2336DE21014D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  MEIPreload/CPFilters.dll
- Size 862KB
- SHA256 f558343f4693c151f9416b20cded176e1da4e6ebc133eb526d1dd5f5fdf596f0
- MD5 6b9d1597fd7c350d3cc9e86c76a204ce
- SHA1 a1213a4a4b875572f5ff2d4787cea50e3d350eec
- SHA512 9d83e3e9c3e90d363efa61b7803a607982fd74045f5ddb1fcdbf7af70f4901b3dc6e861fe9d88a867d4c53c220423d9ff09feae8c58bc3852ea4b38cc72efff4
- SSDEEP 24576:prij+VQYnP8DzPZSw1kPAxhN+u2L7KOy4:AjAQYnP8hD1BSJn0
- TLSH
  T1A8156B56EAEC81A4C06AD13DE6E69216FBB23C07170646FB42604B5E7F37AF45A3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7
- Target
  MEIPreload/CredProvDataModel.dll
- Size 573KB
- SHA256 5eb2abd74b415c4f0df6a20358045873c437a146427095493790a431606cc8bd
- MD5 28d0ab27c32de0fc9607e9b7d10b9f45
- SHA1 6c23366a148260f2f80838843dcac7755df9590c
- SHA512 6075602149e08f1926944dbbd53125e8e6fe570e35115c0960733a6aa88ea6583740f6277bc546e82e4bd92e3da712461c65594eba991fd69803f6136bed84a2
- SSDEEP 6144:afmrkwZ3nFLN2zAm8LaJ6zki6wn36qKmurFfO+gt+tjdKMvekjH4J4AINe02EGz:wwZnFhesgiNXn36jBfOZ+tjFbjY4c
- TLSH
  T11FC43B1A5BDC43A2D93AD13CC2A34A49F2B278011B7296CB5252421EDF7FBE55E3D360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  MEIPreload/Qt5Core.dll
- Size 5.1MB
- SHA256 4f8dc460162407cfccb1be6ef9cce45c4449de838aeffa3fd33378f01a3f9cc4
- MD5 7d180286e9c071c7bc3a6bc2ace792ac
- SHA1 f5947d69aeaacc8a378721f3750b049cc41dddef
- SHA512 9b30d5dd48e736da770e71622b79da294829621565cfc4d995ca31c8cfbbbe2d577677f4240e0ff2d995deeeb5f894018412596c141e8360dd77bf12596ce167
- SSDEEP 49152:q1AH+7g4QrRpvOK8Bbl+Gy+/LZsxRFNHlZTlJsv6tWKFdu9C/cPk4VHEYI9CV4eO:E5gje5lCjzJsv6tWKFdu9CtvDhgwcY
- TLSH
  T18746AFA17B57857AE5A2D270C8BA632F0539AD124B1385C7D39C370A4A746E23F3B707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  MEIPreload/Qt5Gui.dll
- Size 5.6MB
- SHA256 80016776efea2b2a838c3ffa4c82e5f146baff68c36073c0c34668809d1c4297
- MD5 5b0f3d5b1b29b5e650375093c7afa243
- SHA1 1920cbc98bd46a3a72bcfb45caefcfa2649a92e6
- SHA512 9db9a90ab5a1a768e079cf9b10f1da868ac7dae774e90e139ee047c9c8fb43cc5b3e01ae3724ea74efd64409eeeafbcda4f04da3e86265575a3831a4fc69cc8c
- SSDEEP 49152:FKUDGaBVW3sDAPNaiCZPcSnt8KQ6oOtA/tiG7WwjrAxLXwQ98vd+hc0WM66fL5cQ:wUKssPdOy/tZWnXThVc5tnB6NDrd
- TLSH
  T15B562BD1F18671B3C962D2BB270F623FA076A956C30483C3C6996E9558743FA0F7B906
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  MEIPreload/Qt5Network.dll
- Size 1.0MB
- SHA256 37275f3ea79d15a2792bf21f71f1df825f201cf8b33aa1f94ca93d62d76b216c
- MD5 2e3db1cd1ec59d08706438258e86ea30
- SHA1 bc20b1e40049386e6bea3f448a6852bc879a8821
- SHA512 0c0e0e02ccadc3f2b3f6c8cbf2c162fb73734b0b244c80048968a6fe268450a270a3f92b155daf6268fef246d26ad417e6cec224133fd66e6ffb3a5394b04358
- SSDEEP 24576:Aul0ktv339DOBVXaIFP698DWk7PVmr0qwjb:A8sJVWAcwnH
- TLSH
  T1BD256C92B786C0B2E84481F5455EEB67E53DB1388B0666E3E34C6FE2D151ED21E3F182
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Readme.txt
- Size 27B
- SHA256 61375ed3e91db502a240e45220b94a26464497aa23d05997544c9f3c9ece46f2
- MD5 a9767a78f0471d8e95bf327d10545aad
- SHA1 15482cd91e318412e9783b186b30c67f733358e6
- SHA512 65ce51f1404647286f24d91b703edbc95e038fa07da20dbb8fd7eab133aaa4c42a3fe04379357ab0fa23c2511053fa081c4436e7f97c447da5ae90722303fa31
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  locales/ca.pak
- Size 355KB
- SHA256 6ba3af1433ac46dd5a72eee46a315eeea2ad425b03f1a3b5f797a8a2991cd64f
- MD5 efbbfef96f93a084c8c7a55d5e286982
- SHA1 5eed6c9fa646a1a37cc4e34c741500225ee5f729
- SHA512 914eef7f21e81c06c992a4e13372ad627175704dbee40a0e31464aef998ba8b60d7799d759bc1bef96e64dca7b7bb86e417b9dbedb20f3acc5d23cef349a9e1f
- SSDEEP 6144:at/yu3Km6pZ+qs5PAk4N3Mw2juwYMezgIs3czlE48ao24KPQlqmwWrMWLb9u1RBU:a1P3Km6pZ+qs5PAk4N3Mw2juwYMezgIC
- TLSH
  T1C2740A239BC93B6744C2320ABB46C217F58CA9847B06D294F5AF0B1623CCADCD6776D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  locales/hi.pak
- Size 749KB
- SHA256 e12c0f1aae841103030e077c429db999d0ac47e862e39d43a042b67f232d3edc
- MD5 22459abf3f09d840da94ef312fa9e508
- SHA1 8d6462f9509c62d04ab332093f68f9216cd5da60
- SHA512 2c62d91835d9aa80b8e2c9d9c23164b5294cac028816159b7c042e5f940718d1eb12679e6695b57674691a5cf77581537d90782e18466176cda37a3f5551f594
- SSDEEP 3072:gT3ToHjqnmRhmYbe8P/5yEw3kw3db2v4REm5dmYswDyGR3JT0Ke2/u3+8AwndNTD:gTTcXRojY5+9YEG
- TLSH
  T190F4190CEBBEF3B55DEC3C8A32890D3BD59D3674A3E5521348D5B3DB9844CB4146A2A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/it.pak
- Size 346KB
- SHA256 6182276dbe1a101c27cd19222771636380f163b417f1841ab343351d24cb76e2
- MD5 e5c3755da2bdc72dc82abbfb943e51cb
- SHA1 c299ca20fc6f8df675fb861a0aa64b6512f90e2b
- SHA512 32ff6a4f296d3417cd85e1a6edda48df6eada5e7a3f83299122f5baac0ab6d95e101d3056d99c758e058d33e1b6010d43ea3942ef3c597c72c702b07f4ddcee8
- SSDEEP 6144:ClHnvtQ70j6SrqRRhsO1tGT9T+SGJwN/w3GqwKO+8YrJUmB8tZ9+2joZeYpLOv6k:ClH/ZEP8AU24QJB5RW
- TLSH
  T18F741B36A5D620151A866359E621B081FB6EB8CDFE41721C999B431C23CFE44F2EDB87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/ja.pak
- Size 426KB
- SHA256 38e959f5c548a9b139b46f6243f8baf919cc2951bbadb2d55080b86567830348
- MD5 f0e5da5f828351081d7f116196549030
- SHA1 b669e4ab35119bd735a57c749cd3d9bfee941fc9
- SHA512 b03ea27664d89e4c68e5c36697382abe13b477c137290f4bb79d9fce416b1a5301e6ee372fa7becc4b097ea2ff247833427d64cb729d366532f282a0fb9bb56e
- SSDEEP 3072:dfKEgpwclvFk6xowoHYVwomDDrUIC02DVYENnPkwoILgl9NH7UbeCF5OAgHbFE5Z:dfzjchlLCDrUIC02FNLp5IVO
- TLSH
  T198945F6CE3C969369D6193A22C0E36D17606AC5FFCA23A36442DC074BD70BCEE515AF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/lv.pak
- Size 377KB
- SHA256 9fb6cccd66a0cfe9268dd04771a196a5fc738daf1c2d900b62c3f317ae3cd2a3
- MD5 47976c120e8448f074e738f053487d6b
- SHA1 5919af9ff70004f2b9e6b0a71039f2821cffad1c
- SHA512 5df577bb2cfc817ad5d60b954a12f58637c0e6e0d8e32ac1a8d70c3b96ae088e61cd40099382d6483c93db5131d7c3791d8b6708b964cbccd372df5c66947c47
- SSDEEP 6144:/zJpFhhTtVFoHmjYNK4uCAkapCZ5akDyAh9AxlatuM3rc1V3C:NamYE4u3kRZ5uS+V3C
- TLSH
  T1FD842A659EC68FAA4E505DCB7327D122A9CCD740FE03E112ED7D4B2A510F52432B6EE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/ml.pak
- Size 876KB
- SHA256 32a7beddbf9cb89a71d8ae39a4775a6c4d0019b561c118d617b4f641ae19a7a3
- MD5 6f212da5692a21938bb69d2cbd62d225
- SHA1 f9e574372424ebb8afd2a9871526fb28bf0960ed
- SHA512 91cfcd9b8219916ee34e3f0ec3d4a7c33fe5602deeffe4b4001d4cc489158df7a1b34298dacbfcdfda448142cae1fe4ae00c4b89c29a148a119477419f6ecd61
- SSDEEP 12288:LljBbeIc++Ai7VIMASTKMmWcE+xwbbAujgDl25f2VJ35k++m:xlC++5in25fw3j
- TLSH
  T10415BF5BA035CD3B0FD102257B4E2FABCD5B8FE140AF668B5869B2628C59F7D0C99431
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/ms.pak
- Size 326KB
- SHA256 c1d942082af1be8af656bff280e6f21671f0c5536aee15b68670643c8baec8e9
- MD5 d888ecaf12476f1649dabe9004f1545b
- SHA1 01601799d74c315322bb7a090b1aa59b2b783bfe
- SHA512 c5a2311badd33db72bdfaaa9ca598ce38c8c9cb5389907d6ace963cba497ea74e295b7db9f5d2b37b3b15a86a1c89b85f952a0b054efa0491d7e1054209cc447
- SSDEEP 3072:aWN7kZP6QP1Lo3tvvW4xKn20EBiOrr55hOr4F4V2l+5bHV3ju6cvuBS0Sc60T8u5:amIP69v5xm2akr5ne4F435bHVzb0U
- TLSH
  T1E764C5029EDD3118096843D5D2DE6A1B3CDD3333B705AF268DA08FB016AE7A43756F89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/nl.pak
- Size 330KB
- SHA256 342ba48365b9eaa5cff9034b19568676e2214a16c3f782bcd98a7907e239b357
- MD5 d46b83eb65bc8cc0176813ad343dd95e
- SHA1 37b8d82adb8ab314a0287ec4fb5b084f92353544
- SHA512 1b0035fa4cd5afec64bf79a7ca8b2947cbea5d8db9b6cba7d131f4647f66e6804940ae2f94620609b5d8e87ac472b1496256041df59e54dfbd6e4877c61cd282
- SSDEEP 3072:Iy0Yc4MUiBqTEVpo4UHi4gvYjsCKXBZaK6zuv5OlqmK3OAH8a56Y/lHkB0ja+25h:Iy0B4JYj4gN5cqzxR/ab5eFjb/aEW
- TLSH
  T10874FA07B89E253E59C0B385F6084FBBBF2AD22CC26CEA7D94DDD1351843F5851AD889
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32