8ae6ced473b7e81038f525869b48af46cff6334a0a863b26accaf7943f20655b

Sharing

Copy URL Twitter E-mail

General

Target
nos.zip
Size 2.6MB
Sample261018-vetvpse17j
SHA256 8ae6ced473b7e81038f525869b48af46cff6334a0a863b26accaf7943f20655b
MD5 e9967ee241eee061dc84062aced4bb58
SHA1 4d02c7235e35284491d7cb16ccc3c625b2bdfb5a
SHA512 4496225d81793541e6b2534725b3814f75283ddfa2ed759428e46374f96fb7bc2d23bfd681f3b20dee7deff2d1084042226fed2803bd6b6e98dfc3001d74e7be
SSDEEP 49152:3tERnSGGKr7ml9cJ09qFjgqCo7mijF3cblI+L4UTcK38KaGS5DJcn6S:3t6FG99cJQqFkNraFs5XL4UqKarFJcnT
TLSH
T111C5332CE69D2E7EAB5FA1D9191398CFE80E82256E13C30B1B8481F49540277DDFDD94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ymd(Copy 10).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  ymd(Copy 11).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  ymd(Copy 12).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  ymd(Copy 13).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  ymd(Copy 15).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9
- Target
  ymd(Copy 16).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  ymd(Copy 17).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  ymd(Copy 18).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  ymd(Copy 19).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  ymd(Copy 2).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19 behavioral20
- Target
  ymd(Copy 20).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral21 behavioral22
- Target
  ymd(Copy 21).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23 behavioral24
- Target
  ymd(Copy 22).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral25 behavioral26
- Target
  ymd(Copy 23).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral27 behavioral28
- Target
  ymd(Copy 24).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral29 behavioral30
- Target
  ymd(Copy 25).bat
- Size 141B
- SHA256 c721196733f64522d2030c6a93e4670354262ab7cfef3b77a2b336e8d0088db5
- MD5 9c5b47b030b7cabd5aec1ed1c8b915cb
- SHA1 c9bef0852b1e2da76cbb9cbcb567f9bf62bee969
- SHA512 2458fdfe8fbca28af1ad3f7978e293ff4e460fbf06d9e955154c704417b3924132bc25e7631dcda17b59e39077cae364e4770066a40122915e307b2d7939ba7b
- TLSH
  T197C02B748B8A8D31A0A7C83CD48304E41C3F42D8FD211BBD603D4B4370A867C0964287
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

UPX packed file

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

UPX packed file

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32