5621c6846841ecf9616a34d267238283bdf4653f983ced0d31766f6ab89c4155

Sharing

Copy URL Twitter E-mail

General

Target
Agisoft Metashape Professional 2.2.2 Build 20760.rar
Size 191.0MB
Sample261014-vqpp5aws5j
SHA256 5621c6846841ecf9616a34d267238283bdf4653f983ced0d31766f6ab89c4155
MD5 d7c08268da02c887809ce4555ccf0e3e
SHA1 3016bf385ea35a668724c2ffd82f9a305c266e18
SHA512 c93aa349cab8379e20466256718f9b3117fda01d2b1417fca4ce9e7998f1ce1b4cd1d8b17d655e699ec0f37af0a0c3cba6c5efa47d3f44d4e7a4dc99c3642628
SSDEEP 3145728:c3rOT4I47bgfuyshbpC3XL4fzxQwg1UM5CY0NkWW9eFqC2rrWERcXzJrCHBK4d:aOT4I4vgfuRYXsrg1Z5CzW9eFRERcXzo
TLSH
T186A833FE03ACE3E73C3A81504747D982F2614C0260A7D8875FA97D1492A52D9BCBB7D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Agisoft Metashape Professional 2.2.2 Build 20760.rar
- Size 191.0MB
- SHA256 5621c6846841ecf9616a34d267238283bdf4653f983ced0d31766f6ab89c4155
- MD5 d7c08268da02c887809ce4555ccf0e3e
- SHA1 3016bf385ea35a668724c2ffd82f9a305c266e18
- SHA512 c93aa349cab8379e20466256718f9b3117fda01d2b1417fca4ce9e7998f1ce1b4cd1d8b17d655e699ec0f37af0a0c3cba6c5efa47d3f44d4e7a4dc99c3642628
- SSDEEP 3145728:c3rOT4I47bgfuyshbpC3XL4fzxQwg1UM5CY0NkWW9eFqC2rrWERcXzJrCHBK4d:aOT4I4vgfuRYXsrg1Z5CzW9eFRERcXzo
- TLSH
  T186A833FE03ACE3E73C3A81504747D982F2614C0260A7D8875FA97D1492A52D9BCBB7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2
- Target
  Setup.msi
- Size 187.7MB
- SHA256 6109dfcf2e4a079d0fc1f3129ceb21e7426ded30cf7c0829bd05d309f9ebb77e
- MD5 9e4f85fc119bbeb16184e09b5df5a2a0
- SHA1 9d182b8b0d6cbee1b4e1e13af5668917c37cefbc
- SHA512 04868bc9b8d63648628ae7d58223f0aa388e7187d914a455b981d765cc08a258aad488669e8ee912eb5e63e46b291362118dda539efceb8be0106ba90909abee
- SSDEEP 3145728:nb3VLHnHn1kJAsjWSCyzRfIJp+ct8/e0l65xlWA4j6dw9n8E3jC67XEIqdtcCbAg:nbFbVKAK4yzRfIJwU8EoA4j6dwt77iN7
- TLSH
  T1F2983341DE41EC96F5B5823A5332E205CA73FD696786041929B8B21C5C7F7C92EBEC0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  iphlpapi.dll
- Size 6.5MB
- SHA256 dde19914fe4b569cf182b8b6a3eda485a31d9d0a8e3654d659d3d3baf403d09c
- MD5 9e898d21d590bc6f1ffbcf27e48852bf
- SHA1 58edf08f8f955890a701261f23bd6824c1a04673
- SHA512 96a1dfe9eeaebbe4ad8f7f4c1b203cc3648b551461eec399482c24d1351b2a89222c8fb9ba3b9b7a075874c47e461a57c90891436aa37ccf79acac4180b48c06
- SSDEEP 196608:T1DBRDaIerGZ+r/27Hd9N6ARqh1XsdIwQojy:xtZCrq+6J68qh1Xsd6
- TLSH
  T1656623AE62543368D41AC5389833BD45B2FA504F57E9C57E72CFBAC0272B911E682F07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral5 behavioral6
- Target
  metashape.lic
- Size 93B
- SHA256 99a65997712c34e44cf9c5e9ab50f2c7e61daa7ad4ad2a11ddf189de7fd35cdd
- MD5 8e13f9ccdd48344b2f6d41cbccd3ac1b
- SHA1 5b809da5e876b0d608cd504b9a32be8327f19dd4
- SHA512 8c8aa345bbd97d316c9987c70a0519c1de4bf3fef25cca587ef4afb79deed7936b173d76c15991052833282fdf545a1d203614cbdffa4326c19a60e289a6714a
- TLSH
  T115B01275E03090165A40405183558DC73ED017A323C90C410891E1911C2A118C3180D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8