102ee579117c30020b74b2e0f4ecffd0a75a3c3719666c82f64cfedffd9b94d9

Sharing

Copy URL Twitter E-mail

General

Target
discord-youtube-zapret-1.10.2.rar
Size 7.7MB
Sample261020-pxp2kshv8x
SHA256 102ee579117c30020b74b2e0f4ecffd0a75a3c3719666c82f64cfedffd9b94d9
MD5 e7cce8750275f3204306faffa6a6ce17
SHA1 3c73a5960dfea55888f5d36e02d9a36204f62cab
SHA512 8769e58734171886a2a910d5196e07698f60a8b49d2ab9c56961e859927b4db24b4194bf9421a4a1b5f5b8366d3a9c76a00ed8918850747ffb6c76126bcaae6f
SSDEEP 196608:/JjTSxNHH6NuTWcE3rBJrlfzekth0wcIUQd8njLBJgR2RqVhv:/BSoCXArBJrlfzeEhXcIvqnjLBJgI8hv
TLSH
T18C8633598EF6A14EFC81853F27600226DB9AE146512BC1975F71973B202BD8DC3B39F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  bin/windivert.exe
- Size 7.8MB
- SHA256 b8aa14b5f1b5b7a07180b490104f78d17abee506a635c94a6c014f33860203f7
- MD5 7162333f9481f23070e9607372e6eece
- SHA1 ebc8cfb4981d00d6cc9c7152dbfe07e54ae10c87
- SHA512 3b67a29105c813b801637faa3a22ada8e7d427046295ddd1c8378eba969c4dae59d4b8be6ddb4cfa88992aff8c9123eb500e520506828e2c36bdfe9d2ed3f4c2
- SSDEEP 98304:YKaeG7DVgjKddg15b6xI0DPnLMv7oEVyII+/xdNX6ZTH:PG19d88xI0j4v7kII+fN0
- TLSH
  T14F86F123A9916778C45AE1354622D022F762FC582B2593F3798DB2783B337F496B4BC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10
- Looks for VirtualBox executables on disk
behavioral6 behavioral7
- Target
  bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  general (ALT).bat
- Size 3KB
- SHA256 08622902885892c1bdbaa9b0b7e4dd6fc0bd6749230c454ed3d28556063e03e0
- MD5 d3ee6723f47e21cd48be1970ffe4fceb
- SHA1 2150fd35b1e12722284a3389f52e6d67cf1155d8
- SHA512 2c02879d743693c816b4e9f88167b863bbc024604b14a642d6d145ef473c0b47d39d0993cf017a51fed8b25a6c68e9393f52236473a9c148961f34ac2668eebf
- TLSH
  T1B58149A7E00CDE47F5CDA53EF85FA5A421279C8328D6D452835B89E8CC4EDBE684E484
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral10 behavioral11
- Target
  general (ALT10).bat
- Size 3KB
- SHA256 c08f21385bd05452315c7b4141c22d08562219f5f860017c10770eedcda096bb
- MD5 d58e61e5f5950cb5c6e1ed9dc63b78b6
- SHA1 7589c13c3792c895060b8f6c9a6fb2b843013b60
- SHA512 5d483f040c1d6cadb3f6d4301a2d87a52b6411c74aa151179b7fb457941087f187a35654fb8cc14e5879096493050a33f7f3e6b56cf507423750b4597e179aa4
- TLSH
  T1C5712AA7E00CDE47F58CA97DF85EA5B42127988328D6D456439B89E8CC0EDBE684E484
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral12 behavioral13
- Target
  general (ALT11).bat
- Size 4KB
- SHA256 f7506b711ffef9714271d4ea69ef453048f9f0f578c85086d1b5769e22b69031
- MD5 9e654baf22223253e1d5e71f6b8e7886
- SHA1 434b4415a239c11b214ad044170115037bcfa270
- SHA512 d0e72eb7f6b26c3bd8b740637fc6814c2c090957f475c28f2c44b8694e429a449d45924b7dcf273b5fc1be0a77be33b8ac4051d7615f407ab70922772a03eba3
- SSDEEP 96:nL67gQGB/GRRQ1zbIKdUGB/GRwVv/GRRQuv/GRw5P+R2rS5+RRLx/:AgQGB/GRRGEVGB/GRUv/GRRDv/GRkP+a
- TLSH
  T159914BA3E00CEE4AF6CE757EF45FF6A5201798C328D6D452435B89E8CC0EDB9595E084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral14 behavioral15
- Target
  general (ALT12).bat
- Size 4KB
- SHA256 1f897db735f1213b32af853d6a9f6b86ea2712f70b2c08195b305610d1615ea3
- MD5 52ad09e2f80eb7ba5eb59b16e06abbdf
- SHA1 ee2fcaba1d37c4f68c71868f692af7d5b3afe4e9
- SHA512 2ecedf0e53f0aa3d366acb4e4020ae17de3cf63d62c70cfa4a8962d42bb3f95a2c6800e1662c912564443d1d114f041a2fa1880197c16af725c80be79b84db37
- SSDEEP 96:nL67gQGB/GRRQ1zoLIiUGB/GR6Vv/GRRQuv/GR65P+RmjS5+RRLx/:AgQGB/GRRGl1GB/GRKv/GRRDv/GRuP+4
- TLSH
  T18F917DA3E00CEE4AF6CD757EF85FF6A5201788C328D6D452439B89D8CC0EDBA594E085
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral16 behavioral17
- Target
  general (ALT13).bat
- Size 3KB
- SHA256 d282359dde31a14bc149e6154ec211cb1184048c3e4351ebea37cf035a1ab93f
- MD5 255212863d924cbf716ba9f88931a456
- SHA1 11d8fb3a5975f864e1cc961935162e3e6542f8a2
- SHA512 f7e9e67542b6a247770b1b6952c22b53d76ae41210d2eef80256796fc98b162cbe65501b51f16b5a5e5ec3d5a7e6ff73b06942d15e9d54fb1d3f8d7c50a9953c
- TLSH
  T13D817E63E00CDE47F5CD697EF85FEAA16027888728D6D452539B49E8CC0EDBE684F481
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral18 behavioral19
- Target
  general (ALT2).bat
- Size 3KB
- SHA256 0279201743004b3af41d9e6d9e20995b19784893ce49634b37cb5b15e2848ea2
- MD5 d0827d0381b0858636252ea7e33f575c
- SHA1 7aedd7d6cb8223e537f09036f7c5d698c7e10b78
- SHA512 9b4137b14bc755716399b0d5cb9c950699ec21bef5f2ec228142c63a62d26b3e0562843bc670358ef61c42a942c6a87369f86a02c150dd98cebbee65249c8e88
- TLSH
  T1F0611857E00DDE4AB68E783FF85EE5E42017C8C31CD6D452529789E8C84EDFE494E485
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral20 behavioral21
- Target
  general (ALT3).bat
- Size 3KB
- SHA256 3d3ec8670e60ab4b3c0c694d703aeaf187677569d354731dbcf89f923b4bc04b
- MD5 44dc129c2bc47867f3819162021389b0
- SHA1 0806ce50a009f42412df0f1283b8a4d730976efb
- SHA512 2988b55d480d485809908590c63924aebde6d54e7e0aaf802eadb6747b2e5f0f791324312ce8b3446969a605f7b80ff69e572c77e2069526f422b8922e48e5a4
- TLSH
  T166716B93E00CDE47F5CDA87EF84EA5B56027888728D6C85152DA89E8CC4EDFA6C4F085
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral22 behavioral23
- Target
  general (ALT4).bat
- Size 3KB
- SHA256 c565c338ec625f5df278868b459b5e6c61a8e245c95fc7347db005b7702a0262
- MD5 87d5c5d647ede7bc7f35517d73c04faa
- SHA1 a786cd0f3267bdec25459856b2694bdb01a5ca8b
- SHA512 51cf604f5e937fba21be3eeb5d21437469779c3416b70d4f323d65fa7bf9a82a816b146c877442a1e4b228bf1d11a98e8d6ea5b2c7eb15afdaf158017cb0f311
- TLSH
  T122815BA3E00CDE46F6CDA53EF86FA6A421179CC318D6D452439B89F8CC0EDBE584E594
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral24 behavioral25
- Target
  general (ALT5).bat
- Size 2KB
- SHA256 f4c63db76fd66625d4e4b32acce2e4ca81199c258675925b758d15ab1893e58d
- MD5 31a3b6514946b3c1f17374a4017e17b0
- SHA1 35cc27d51767e8d1713da6ce6ea0064562b68af8
- SHA512 9f663d902c7d2e94a93e575e1ae449523e75e5f974c31fe9920cca7d927b1c24f906acafcbbfb255e0cdb86df42f7afafaf8047ce756b2df675012602b89fa26
- TLSH
  T1B5412697E00DDE46B48DA83EFC5AA5F5701B98C32CE5D452539788E4C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral26 behavioral27
- Target
  general (ALT6).bat
- Size 3KB
- SHA256 47dd3e4496e775e9160b8fdd5d20e3bd232c7688789a47db304dc3f16c9011ea
- MD5 ba2c3d2526238f6ee396240985317c92
- SHA1 aabafef76596ffd3d2a521e045edb97339c141ec
- SHA512 7e78159f79e7d2495d5c601fcbb8548995383f1e5b681ae1a192f0da21914cf5897b0b5b6247d1001ca24d021b354829e3ccfbfe54c843c46777d3d733f76857
- TLSH
  T199612667E00DDE4AB6CEB83FF85EA5E52007C8C31CD6D452529B89E8C84FDAE494E485
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral28 behavioral29
- Target
  general (ALT7).bat
- Size 3KB
- SHA256 7bfb72533815866720701b3eb472da69d4260554a2498f619269fe50a583fa2f
- MD5 095d37b41243047171be055874df4ba0
- SHA1 1daeab031d1bb246f805e8cd2a5b4f642ad69143
- SHA512 69d8a24fbe4c461c037cd755c7ae31abade2aaf58a1619e2b7780e1757301da6c33454e52cde1e3f69ec5feac293ba4bb2d4552272a81e82261338370d379ed7
- TLSH
  T1B2610797E00DDE46B68EA83EFC9EA5F52117C8C31CD6D462539789E8C84EDAE484E484
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral30 behavioral31
- Target
  general (ALT8).bat
- Size 3KB
- SHA256 81d1b19508b5f3f9e10d5c9dda875c72db0231bc6534adf1932f2a226eb69a19
- MD5 4e32629f7937634fa2d9b2f7b8596700
- SHA1 d656d9ef60585b3e93ce7f648991e459a2e25b06
- SHA512 b8bf581f71a483ce619919e6e75ee5289d97af0f1e82dd7a281ce7234907c211b1fab89f43dad229b630c64193ff8b279c86378abe98a37dd37d3765fd9216d7
- TLSH
  T196715993E00CDE46F58CA83EF85FA6B42127DC832CE5D452539B88F8D84EDBE584E584
- MD5 SHA1 SHA512 TLSH
Score

9^/10

discovery execution persistence privilege_escalation
- Looks for VirtualBox executables on disk
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

Looks for VirtualBox executables on disk

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32