203b12b14160f19259d2297af9b42a27aaf696f6a9c9019e6a130075b07280c1

Sharing

Copy URL Twitter E-mail

General

Target
Linou-Free-Retrac-62718.zip
Size 17.9MB
Sample261020-vbexdaf17p
SHA256 203b12b14160f19259d2297af9b42a27aaf696f6a9c9019e6a130075b07280c1
MD5 2ad6a39211bef80ee1dbe7646cbbbc6c
SHA1 4a5752e3cd70e0c0042a1bb7a8fa2ac14c27dd94
SHA512 886fee2ce0839f900d1d85bf9a8affcb1ef6ddfd80a65dfa50f9ae5f70a02e4d0e45c1e39d4ae413d7d8cbe3e07bcd41b7d1b6be25c3d118a78fbc6c6c3338fa
SSDEEP 393216:/DmqBFonM6AKPfJrIsCFK+rJELiP+pdoEKDRon3YGo5s20COt:77BOMsfJrIsC0LiP+dhEdG20COt
TLSH
T1C11733400993D6EC29FE0738F739809656969EBF3B3C30505A6A8DA0998BF4C93CD55F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Linou-Free-Retrac-62718.zip
- Size 17.9MB
- SHA256 203b12b14160f19259d2297af9b42a27aaf696f6a9c9019e6a130075b07280c1
- MD5 2ad6a39211bef80ee1dbe7646cbbbc6c
- SHA1 4a5752e3cd70e0c0042a1bb7a8fa2ac14c27dd94
- SHA512 886fee2ce0839f900d1d85bf9a8affcb1ef6ddfd80a65dfa50f9ae5f70a02e4d0e45c1e39d4ae413d7d8cbe3e07bcd41b7d1b6be25c3d118a78fbc6c6c3338fa
- SSDEEP 393216:/DmqBFonM6AKPfJrIsCFK+rJELiP+pdoEKDRon3YGo5s20COt:77BOMsfJrIsC0LiP+dhEdG20COt
- TLSH
  T1C11733400993D6EC29FE0738F739809656969EBF3B3C30505A6A8DA0998BF4C93CD55F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  WizardPackage_755864.exe
- Size 125.9MB
- SHA256 d76bc68115e015a9eabbdb8678a8da0ddcb9659a5972eb13ee13785448d4b4f6
- MD5 f49888ff68c3bf3a8c148d0dc4e12d1a
- SHA1 5c33e2b43ec98e75fc786b4e06142b4ef0b91821
- SHA512 9397dd12d282398cbd28aec0c1373dc80e5f1ad74b489580f73da67140a2790c094f591c063fc46c6d7412fd44af16558efd5b024e749d1abe881dd412854838
- SSDEEP 393216:rM6EI/RK9IYUuZx556oKz4qJdCzibm1fwY5Rbmeq:rdZ/UIYx556oKizib2ftXi
- TLSH
  T19158E3B13DC121E0E6AECF17D6FEDB29D36667762A113C0A047767940F22782F64681B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  res/bin/arc/arc.groups
- Size 3KB
- SHA256 83c0e531baa84679e9b299be5dbc3fa8ea7860d755edbd767d09c97251a6250e
- MD5 bf4626893ce9d025058746a0ef72eda8
- SHA1 2d90145fbc8ffe886f16edf8a5767f8847fa386a
- SHA512 46dad7791fa8a556e3064fa140f67053ecdf544a88d6e8fd375e83d263d8479e170b87001093185b06856f03fcc30576dbe8ccc7ce8727d6e2f8f4296f80f1c3
- TLSH
  T168611FCF78BD27CB18D534AA1D07B1D32EFCF8F9B6A16250240E99043A2D19914F57B6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  res/bin/arc/arc.ini
- Size 48KB
- SHA256 05959c54642276184242f4a559d13a59d025b395d7bb75249a0f23a69e8940d9
- MD5 dd7651047b5013994ad93e0d95f4f50b
- SHA1 9fd836bb809eb0584536eeb52a9bb963f22a0dc1
- SHA512 d7838faa1c0616d27340871c4343c85a4143f14085d6bb61cab174a32b943a38094fedd7f0dd759f9fa4b4ea2d5e10ce810f2518240af2747bb18beacdd7d98e
- SSDEEP 384:fX1B8vokjiT9PI/cc+BQE+MOELSkN2ZeEgxJ+wgyrD6XNFXzVCiIGaOAaB3zcr3l:dkgPHXakN2sEcPgRIGaOPntS
- TLSH
  T1FF238A373C35944568B842A05FF4464EEF5C3A1A3A0857146B4EB3DB4753E89EAC3EE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  res/bin/arc/empty.arc
- Size 74B
- SHA256 7a415a80cd7a99bf233b5a6318c3892e677b850c47d2a6c1f626d41cfe14bb0a
- MD5 3cb3718b61c3c0e4e6186dbdb7e075a9
- SHA1 016fc3a1922680bae47db0afe39e0cc81f0e6a49
- SHA512 470ff3fc98203c6e571eb6af07b581ac3b065fa9371cc575da4be69b7aad3ade543cdecd7247004dea620b1bde0921da0659a403040ccaa5fdcd61be51b01444
- TLSH
  T1D6A01211C72000730F31401B6A44C502EA0074041CAA8846C16124CC50040208244108
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  res/conf/bookmarks.txt
- Size 358B
- SHA256 e60664153706c5e25171abce34fd9e757bd372b8603d47631be220acec9ea777
- MD5 db473d9010d7cfd265a5d3ea1c0e1536
- SHA1 6f7911614182a514a9040957abf1c153d7fb82f7
- SHA512 71c9a539f309b75e6777b15b18471d1d468583650368e73b11d80847fe9ed7efa63159016e5107f37695be83df849319cbef6e1b96e3bbff227ae21d8d846d5e
- TLSH
  T14DE0EDB75CE3C647131081554320281DF5CD6914ADB8352D7BB04AE0079187EEB929AF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  res/conf/conf-lastgood.txt
- Size 13KB
- SHA256 92b0a0e5c6a3c8bd6b13bf665d926bfc231899faea17ed67aa38200e76e64ca8
- MD5 8b4990c78ecc67d1fceb151ccea85e82
- SHA1 6b10b6e04a6aaa4cf6985e48e0f99970076bc70f
- SHA512 34aad3c8bd143e137da09e6b462c562550e989b323ae20228e6dbba19d5e0e8f1f5e78fa8dd7f9c2d9049154e3105e2c68f4a562d143f3e02c916fd866db71f8
- SSDEEP 384:tVCdNX1WEfELYMzt8Xh7P9yz899cDOm5q:tVqNlWEbMzt8p9e899cDX5q
- TLSH
  T18052B535B84BD229E7431445672215D0F3FC6888567B36AC38AD8E7420558BEF2EF2BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  res/conf/conf.txt
- Size 13KB
- SHA256 92b0a0e5c6a3c8bd6b13bf665d926bfc231899faea17ed67aa38200e76e64ca8
- MD5 8b4990c78ecc67d1fceb151ccea85e82
- SHA1 6b10b6e04a6aaa4cf6985e48e0f99970076bc70f
- SHA512 34aad3c8bd143e137da09e6b462c562550e989b323ae20228e6dbba19d5e0e8f1f5e78fa8dd7f9c2d9049154e3105e2c68f4a562d143f3e02c916fd866db71f8
- SSDEEP 384:tVCdNX1WEfELYMzt8Xh7P9yz899cDOm5q:tVqNlWEbMzt8p9e899cDX5q
- TLSH
  T18052B535B84BD229E7431445672215D0F3FC6888567B36AC38AD8E7420558BEF2EF2BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral17 behavioral18
- Target
  res/share/batch/Windows/SendTo/readme-SendTo.txt
- Size 924B
- SHA256 d94ded9768454b988c6cbb31d6c7d8e68449894e2015a81880d9686b4b99ae98
- MD5 69321df9169c8dae6efc8ed02326ad53
- SHA1 f18f3ea6c3eae51800491499890dcfcb5b8ef42e
- SHA512 4df9d9d52ea3070d092c0274ee78687b3614cd04ea7f2e99267a03b5cdaa7a376b956bab32770c3131b5c8b63e227acd62c181b2b01dce9c44033841906417f5
- TLSH
  T1EE1100912F0293E8754372465AA7A9645324D56CF388997422EFDEACB242A0243F3CB0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  res/share/batch/Windows/Windows 11 mini context menu/add Zippex, add to 7Z.reg
- Size 1KB
- SHA256 b37de59b6bc1e5675520400583d3aa7165420f18d6bbf566c30d9a5c30d2b7ae
- MD5 95d3b532047bcfbe58fafd487f01e6c1
- SHA1 28677f83a8538e4a0686e58021466a0fb72fcd5b
- SHA512 efd59d2caef15801ba20871d0279efc817d6194597144209d0c0a87881a65ea2dd3c006290e77540889aae3e22c52582ea40650b77c17ebfc80ed39f651a350a
- TLSH
  T1B531154BED16956C4CD12268032B9E93B395CBDCA1CB2CC5D2FC8B9A309158747AB4B9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  res/share/batch/Windows/Windows 11 mini context menu/add Zippex, add to BZip2.reg
- Size 1KB
- SHA256 e574c6a8bc34c805d534b3d351bbf813c0ddceff72b11e5b4079a1cd8c0c7293
- MD5 daf77a569eb1753491b0c29b32058d41
- SHA1 5ded00ee9cce4f8f1b5f53c66c56b0a2e899af78
- SHA512 c3d67cccd25e5684df853e3fe3dae31a9517fccacec569907e4a5d8e52efeae20775bd838dff70b42d620c494e07fbe0fb8279e5e77636bbc11adade0ed8447a
- TLSH
  T17A31E14AED1295AC8DD12278032BEE93A3D5CBDCA1CB2CC5D1FC8799309518646AF4B9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  res/share/batch/readme-batch.txt
- Size 601B
- SHA256 b4490e118d3bebb311f8215d14647b2ffdaecf805df7817dac306a1eba61b3fb
- MD5 a6e77bc8a16f582752dff054d08767f8
- SHA1 93e081ba738b907731398a36ccd415aa11bc14c4
- SHA512 a43e4c4aeb5dee8caf5a3fcf8a5667743291ad67c02184e207e3f9788685e43d51636dcada6f0f8f213af90cb339e09bce171d65587155e5744e10c67623b11c
- TLSH
  T1A3F04C673D91F0A95073D9565127E507432CC83981C2AF032DF9C58459C16DDA9BBF54
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  res/share/copying/copying.txt
- Size 7KB
- SHA256 a853c2ffec17057872340eee242ae4d96cbf2b520ae27d903e1b2fef1a5f9d1c
- MD5 6a6a8e020838b23406c81b19c1d46df6
- SHA1 e7d563f52bf5295e6dba1d67ac23e9f6a160fab9
- SHA512 12291afdbc1daf063a0829e93fbd95fb8eac599cfb962408dd900ce261dc1117d3ae2b7fd27b90c3ed69e57c4398a0b678b0ffd1df8ba7c1ed02d0280825d3af
- SSDEEP 192:Che7vhVL0qhYqlpIle4RrJQSsOBng4kS/cKM6L:bvjxhYWpce48OngvA
- TLSH
  T1A3F1C07B674013B602C305526A8F61CEA36AA07A36738D6438ADC25C1767C3593B77EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral27 behavioral28
- Target
  res/share/copying/third-parties/7z License.txt
- Size 1KB
- SHA256 20343526e04ce61eed2675282462e7080d305246f7807386621149c2025765d9
- MD5 899a48828b85c4b0402ee7cf1f65b62b
- SHA1 73ba604e5a4e4ea6fb4ad23b8adf3982b2c82d10
- SHA512 efd02998961261ffa64332ea13876906d55a8bd8209bf94f922d97889ddf1181129b6a08e5747f1c0a07e69cfc3a05e86d18afc3e06325b51598f52360881b1b
- TLSH
  T1C241101F2E0A92B254F2C1812E8640CFF32E651F7B1D489978AD834C2F3E59543FE688
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  res/share/copying/third-parties/7z codecs LICENSE.txt
- Size 983B
- SHA256 5b5871cbe2e6d3217d519252e86e3810185e48ba4ac3ef5d7b06e3b6e4cd9b3b
- MD5 c4d28dac338eed294219387960a75b0c
- SHA1 b171e58a73b98088289fd49967ad38f5d2d1c909
- SHA512 c88caee190f595189b119faaef1359e35ac0114cf735d083ec683294dea37d3ba62ab644383c4e3c0aca0239c47570233e0eff8a3ebf0c5127c041fd51866fcd
- TLSH
  T11911214D1E0083B319D0C29539C711CED316839B7B8E4054201983564B3E2A207FE6D0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32