74d7735c55216f1ebc3e9d68d3e6c8e9f945d3d6cd10deba55520be119bd5fdc

General

Target
zararli.zip
Size 525KB
Sample261018-rlrgdabc89
SHA256 74d7735c55216f1ebc3e9d68d3e6c8e9f945d3d6cd10deba55520be119bd5fdc
MD5 3111059488e0a24ab7c3c3712530ed71
SHA1 951fb817e776a69a4f5c7ea55d6991318fb5d48f
SHA512 8bbf6c337d5b3b73424064a3b8133f56069dc5314cf328d2c24e3d236b3efa43aee3d4919c590d1306ef5d9926dd62bbc7448db75e85ddca2212fb8302aa2288
SSDEEP 12288:DBNOf2BkDLs9plh1tgvd8wycSYAXJ+MEEbuxNMcpNWY2HEyF4/rC:DBQf2BkDLs9plh4FyciSenHE24/2
TLSH
T177B423DAB88F13F6E4EF179C15CBC8240C38C65FD1715D5AD9B8E75A30C6228B83A529
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Oxymorphazone (x64).exe
- Size 173KB
- SHA256 7045b85e1b7dca29eab66baf73739a17889d644fd1a16a2c52c06c3e5cde20ae
- MD5 3d0322c1fab03efd169be5f58aabe610
- SHA1 e696b151f865b7441cce50b33ff8b68772138fb5
- SHA512 50413c833ca84b94e3226fb83dd61f3c60d0aefae66f17d9e8569693698f5e1700c4ca046c0c664ac43422804fee796c00a63f56b5431b5f2eb3a8e655959813
- SSDEEP 3072:duLC1xXAhmuy2elv5Ta1HVDzmONoDv7k/q37hK:dnXPupeZI1HdXFK9
- TLSH
  T14E045B0772A235E5E5728674C4619A36F77338710760CFAF02E086773F26291BE6BB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Oxymorphazone (x86).exe
- Size 155KB
- SHA256 61d4f06ca3f1a9957557474cfeaa05e3b0b50287dd7436f7c6051e565e51906a
- MD5 a4e01f885e4c77a240a4e6eb857e3402
- SHA1 646b1bbebe9dfc02a0bd6c82af2aeadb7ae089ff
- SHA512 afe0d53fc296b0d4fe2e101fee7e504f36c163fd4460ffe0f156700ba186a12a307952d44bbf7569d491220aa15ca47aa798424d256d8bff34579d070b22de79
- SSDEEP 3072:Y1LBN3otshrrEhvO5TEwLiYk0/ZmIS3dct:6oGWvO58KZu3it
- TLSH
  T14CF37E05B4C5D972E57319700475EAB59E2EFDB00B699EBB23C42A2F2E290D34C36D63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral2
- Target
  Oxymorphazone-safety (x64).exe
- Size 140KB
- SHA256 cbaefb8dbfc6523fbd4467ae9f8d64210d1691548f1d47582cfed64533d3fb96
- MD5 b18393d161f4ee018f9d636605da76a9
- SHA1 578d05c11ba5571f962b3cb05b671cef83880638
- SHA512 997e57c7219492a13ab4b10080f0ce75e111a26b1275a9e7befa3ef8cf2ba796cb48f6badd76402685c3e5135f84b6fb5f678b7a5c605bb07ce75b6f791f4e42
- SSDEEP 3072:TGSeUVytGMlZUh8oUy1QPKnvvimq77p+g:TLVMDU5Uy16R/p
- TLSH
  T121E35C07736231E5D57286748461EA66E7737C7107608FAF02E18A673F271D0BE6BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Oxymorphazone-safety (x86).exe
- Size 122KB
- SHA256 429463bf6f19019407793d8c823c59f189ad0a807c6fa47f9c4a6580ba3cdd3d
- MD5 df3d60c77cfda021f90ceecc0f14d88e
- SHA1 955b78b1009bf3b910853ea500fa6cc7e23c8ddc
- SHA512 b175d4a863527ee4b36cdcbd1f4ac0f9fbc7aac74c1de4a3ec31c8396761a009e802bec11a9dd9b133b3e719ca76b94df75ccb87075e4168de194dcc45c30ea1
- SSDEEP 1536:ESBHiNoHYEfsFek32GDyFvW8ZjJ3QIvKtTC2YprWgpnszWg7QJAsWxcdrwHA6yFO:7iWnZJA4KTC2Yrs7w5rwAFxKh5LJ
- TLSH
  T1A4C35C01B4D599B2E5B2097114A5DBB65D3EFDB00B594BBB23D4262F6E280C31C37E63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  zararlı/hydrogenx86.exe
- Size 108KB
- SHA256 fdb3dbba544d167c7b21bff4ca7277a90cd98b75e64fa03513c7ce55be33d1dd
- MD5 775aa2d429165e5b4e74385f1d163c31
- SHA1 b8657078e1fdc5583bceb4bc0bd89278e9c3ac35
- SHA512 55ab88d7029fa0046257b3ac8c30305b86bd9b73077519082a38c1bfc546296e189a754867fc5bf039e837acf54f28004108780808f4a9d65df71ac741089396
- SSDEEP 3072:bmPwlRm8c/92DeUSUQ2ZWsVnkxmdBwqvN:iPwlRmUDxQIDwqvN
- TLSH
  T1E1B36C01B6D08472F9B3193615B0EAB58A7FF9711F509DEB23A40A6A0F381D09D73A77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral5
- Target
  salinewin1.5-safety.exe
- Size 245KB
- SHA256 bafd3d712a32b884001dccd7f6f77fd9aa515b254352310e20f67026364c7884
- MD5 e69d64dfc3d809dc8dbdda9c367b0afc
- SHA1 dc61951ccd463291bb2e2758fc8afebaa8ffadcc
- SHA512 d5e644ab734168d5f42028a6196aba091a60b8536e0101e15254ecc154f564b495f4d66d948399cd4de42f19423cb500a8f8b90d59652fb31e68f1375e28def5
- SSDEEP 3072:3WiJUpGuEy1AXy4e5II5CoTbLYiBZP5pHQpYR95WPNp/H:GBpduiPRZPPHQpY35WPNpf
- TLSH
  T127347D21B5C1C4F1F97945356836C9910E6AFC36AF501EAF3298332F0E751E2453AEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  salinewin1.5.exe
- Size 279KB
- SHA256 fbdaec9e16cb120887975def752432ff798834d521cfc87b24923bf6d3acfe4a
- MD5 7c4230a18208485741aa283707ce3a96
- SHA1 30d637688d60697379405272d6665bd8965d175f
- SHA512 81eebfa2f3ccffd8fe4714b6685760727c6c397ba27ea50b298777b8321a899dd94b49b0456e32072392249924fa1949daf5296be49d2c7827db1d36d6d56808
- SSDEEP 3072:qJ+qjy1h6nzfIIv2mGYndBO5CRNArWcMZuxo9AF3CrBZP5pHQpYR95WPNpHjcH:cDrIwBIrnCZPPHQpY35WPNpw
- TLSH
  T1F4547C11B5C1C4F1F97506366825CA910F6AFC359F905EAF3298332F0E751E2853AEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral7