04617f8a82f057cc4f030f8d7b16cdd5cd32309fe0fa2fb9b8744c8cae0d8c16

Sharing

Copy URL Twitter E-mail

General

Target
26501.1000_arm64_en-us_multi_bc94140e_convert.zip
Size 8KB
Sample261020-216jysde85
SHA256 04617f8a82f057cc4f030f8d7b16cdd5cd32309fe0fa2fb9b8744c8cae0d8c16
MD5 fb1aa407f59e5d10b31f236a72a70a09
SHA1 2cc05aa2e4a6e2cd108f66c1fc246551a2582c49
SHA512 a31bbbfcdd0253d74d224e52b8200863c29aba2b645292be70576019297446899437d266967ff5d6cbda5d94c0e58673ef5db9573ded8e72567a20d6a8240975
SSDEEP 192:jpdxsC95YHcuw+9p479pPrR6yAPALPZMEmpfB91tXfsd:jpXsCTYHcul9p479pDR6yaAGEmpfB91O
TLSH
T1F4027FB49134AD75C64DB97AE5782A0D7D347EC12312F24914B8DC18647C2FBBB0998B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://uupdump.net/misc/aria2c.exe

Targets

- Target
  26501.1000_arm64_en-us_multi_bc94140e_convert.zip
- Size 8KB
- SHA256 04617f8a82f057cc4f030f8d7b16cdd5cd32309fe0fa2fb9b8744c8cae0d8c16
- MD5 fb1aa407f59e5d10b31f236a72a70a09
- SHA1 2cc05aa2e4a6e2cd108f66c1fc246551a2582c49
- SHA512 a31bbbfcdd0253d74d224e52b8200863c29aba2b645292be70576019297446899437d266967ff5d6cbda5d94c0e58673ef5db9573ded8e72567a20d6a8240975
- SSDEEP 192:jpdxsC95YHcuw+9p479pPrR6yAPALPZMEmpfB91tXfsd:jpXsCTYHcul9p479pDR6yaAGEmpfB91O
- TLSH
  T1F4027FB49134AD75C64DB97AE5782A0D7D347EC12312F24914B8DC18647C2FBBB0998B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  ConvertConfig.ini
- Size 652B
- SHA256 d70a286b1c6d7b00bcf024ffd4136013d97f8434b1eefd048a3f944a17e8df8c
- MD5 5d525060c0da539b02ad6aa972ae2084
- SHA1 912f4e962cc4a0465f02965f6a0a271d20d07105
- SHA512 1a1ed0f825ea5bb991b71d17297c8b2a553cc63129725a5011f81a4453a9be1f2d126c237176d39349141dee0dd0f0e787e003307acd577845195b5d67900d5f
- TLSH
  T15FF04C851B0386FE04E7D1440EF511A161E6C0A39C72224835AC53EC6F6B2685AF9B89
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral2
- Target
  CustomAppsList.txt
- Size 3KB
- SHA256 1f2fbc910a0f016ead61d1feef41d1e7b75e234753572ae37c83d0dae955cc94
- MD5 fbf61cf1243b9d8ba4d7aae6925a2896
- SHA1 6f421f03f3bb6024009f3cba7c81abf64ebc440f
- SHA512 86d2f5d53014155c33406ca2788a0effbc367b58a3baa187668f0767f22d13ce235ce5d9b1154139a9e8de0b8a838273a82dbf67b882fcce60203476b18d8eae
- TLSH
  T1A971589085F9E8D3CE3A3883EDC78A51BDAA0BC79005DF1438E5861E68B37D6B309441
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence ransomware
behavioral3
- Target
  files/convert_config_linux
- Size 25B
- SHA256 dfd83df824c5e34b2e402fd176f714d62bb512be8cb2dd07cf530f5e51f23ae7
- MD5 0f802038b21e07556124eef30a64da20
- SHA1 22ba7d64d9197451d39092b9ef34d272ec3053e0
- SHA512 f3372cdebb134f056a6785e2a421bda6762333956443c647442a74a7cbc7a7db29bf6669b63ff206ec555d2882bab7f0df07ebdbaa78f59771b4c1458ff51ed5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral4
- Target
  files/convert_config_macos
- Size 25B
- SHA256 dfd83df824c5e34b2e402fd176f714d62bb512be8cb2dd07cf530f5e51f23ae7
- MD5 0f802038b21e07556124eef30a64da20
- SHA1 22ba7d64d9197451d39092b9ef34d272ec3053e0
- SHA512 f3372cdebb134f056a6785e2a421bda6762333956443c647442a74a7cbc7a7db29bf6669b63ff206ec555d2882bab7f0df07ebdbaa78f59771b4c1458ff51ed5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5
- Target
  files/converter_multi
- Size 429B
- SHA256 a4eae7918ed6ce3dd43ad47a39c9d5e0f06ad80c5f2f1ca52fe113d60827dcef
- MD5 52547b1827909a2dcd77083f4e31f841
- SHA1 7ed60136395209a2c07e23bd2b537ad1e8c8e891
- SHA512 318444275762df4efdaefccf60debef7e747c9fc98445fa0c141893fd203edf301251b1350619c78c0461d72c5abd4d9b73743e40c1c9d302ccbea3754a46f30
- TLSH
  T1C3E055A3813B0B0B22498C1E842C0A66BB858BD48FF292920A14CC859696CB258F7F04
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  files/converter_windows
- Size 301B
- SHA256 be1fcb13934fc4326cece3f667f9c44f9b04c055cf1800398031624e2ddcb1ef
- MD5 f31049d703231fb0bb2a2b7a28452020
- SHA1 841e8e0286e17e49d7f9d192dbe123eb7ff33774
- SHA512 3d78f0be3a7d740b20f18c1df592f34609fdbbe9366c221ff429b3abcc030b0385ffe789869c33966a844ecd1c82e18f634c2901726fbb6a3c080c09130228d0
- TLSH
  T112E0C2FB3922878931071D89B85A189F9B0FC5898AA49B46C0AEC07557158FA0BC2E54
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  files/get_aria2.ps1
- Size 1KB
- SHA256 4cb3b3a9149d7dedfb71796ded682a097dee2454dc6b40ff95e0b33d022db4a6
- MD5 55bd4dcbb931e1592c2e74f426522895
- SHA1 22357bdb378e04315de00aad801597b89b63f396
- SHA512 07b8e6ee8bc91cc566cd6449d313c5b95290c5f16f618dc2857ba6aacb2e97d22bc91eb288f18882e870fd71ae3aa42d62f4d4b525b18e75178b422546f6d02b
- TLSH
  T15431E02AA4B00624A50B16FD4D5FA244659B4137811E1FA9B1FCF1517F9603CCBED8F6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
behavioral8
- Target
  readme.unix.md
- Size 1014B
- SHA256 4a253552b658d0affc4e6dafa55f18fd693fee333cd5c8b64d1ff9b885cc22a3
- MD5 6ac8e0a3282c0b67561ad948de5f7c2c
- SHA1 a3b9e96b3ef31b87e89ec262cefca66ca6d36cd2
- SHA512 6b35fe9f50f5abea014d0415e3fea6bac67ad70e4b20d6503fff3c1058b185dc993f5bcdd8c04ceea398272e94c76a670311851680923679944c63b17cf9d748
- TLSH
  T18B11581E5FC7E3753CC30F90200E89669356EC2C91621B171D7B09F0611F3D541BB891
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  uup_download_linux.sh
- Size 2KB
- SHA256 26db225bed6071d6a3ace7f63f60ba3b65d3c8c48709edfdd117138a82b962fd
- MD5 6cceb4a2f63f0e6ed3d9ab0b6e83f419
- SHA1 5a4953a8070de001543ba8eaefb3950d313f926d
- SHA512 c2fa324d032a20c263fb92f14da7e9db1350ecc2b73b3267988fe49f94e42cf20266c68ea6907030be79bf8e5b145e1289c4cbc88f612c405bc4866b75916e96
- TLSH
  T10C51521BF02A696B306C02F9700B61EBA719966F1D18BA7400A7863670865E5F4FB773
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  uup_download_macos.sh
- Size 2KB
- SHA256 26db225bed6071d6a3ace7f63f60ba3b65d3c8c48709edfdd117138a82b962fd
- MD5 6cceb4a2f63f0e6ed3d9ab0b6e83f419
- SHA1 5a4953a8070de001543ba8eaefb3950d313f926d
- SHA512 c2fa324d032a20c263fb92f14da7e9db1350ecc2b73b3267988fe49f94e42cf20266c68ea6907030be79bf8e5b145e1289c4cbc88f612c405bc4866b75916e96
- TLSH
  T10C51521BF02A696B306C02F9700B61EBA719966F1D18BA7400A7863670865E5F4FB773
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  uup_download_windows.cmd
- Size 4KB
- SHA256 bfb8b5aad08bb78f84f86bcb8ecda07ebaaa26ebfce5242074e1c8ff009d7f4c
- MD5 c144409a31c1cb9a6788c0f9961fce1e
- SHA1 d53a19bec293454000611565d3caa88bc5028f7b
- SHA512 d290ffb491eb664ac5defed9f7004383e40f89b17f6b6a50d799a56a3aba35f20fb5ce6ec734859414a50c16293765724c05867df14e5b007589eb6157103e5f
- SSDEEP 48:cy1UetyOMg2UuGyjrk7PLhPsFibSUGQ0vtDdge7f4HzFzEt8PxOhXgR/FYUk:T1Ue+5xXm+Qot7btIxOOk
- TLSH
  T1D091B803242D807F32A44745A22B71A2D31CA3EF1E19B65D307A93396A537D1AEF61B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Badlisted process makes network request

Downloads MZ/PE file

Badlisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12