d1b22ddf69c3ec26b296354e65b2054ebcd5a56aacd62e8d8aa3e466c466e789

Sharing

Copy URL Twitter E-mail

General

Target
Release.zip
Size 1.1MB
Sample261022-w5thasbc49
SHA256 d1b22ddf69c3ec26b296354e65b2054ebcd5a56aacd62e8d8aa3e466c466e789
MD5 cc50673656df54c321561a1c6b3da716
SHA1 5b80166aa2dd790231f0b1341efe0680d9fe2e38
SHA512 f673f0d1a63e34d7fd4142da237c46cea0542eed087efa7c709875ff78ec5d50ba35bd2f3e10bbf7d4eea567c483b7064cbe964f93b7163061e51320c6ff6694
SSDEEP 24576:F+50SHgbuO0MjdM8yfAPnqOTmciow1Pm/RFKUk7MWbN1RruY:FglH20MjmfeqOTmcNwdmJFUMWbN1NN
TLSH
T14C453313C957189D83E93D7ACA215570B6212C623A7F3F9ECC318B856F633CA862BC54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Release.zip
- Size 1.1MB
- SHA256 d1b22ddf69c3ec26b296354e65b2054ebcd5a56aacd62e8d8aa3e466c466e789
- MD5 cc50673656df54c321561a1c6b3da716
- SHA1 5b80166aa2dd790231f0b1341efe0680d9fe2e38
- SHA512 f673f0d1a63e34d7fd4142da237c46cea0542eed087efa7c709875ff78ec5d50ba35bd2f3e10bbf7d4eea567c483b7064cbe964f93b7163061e51320c6ff6694
- SSDEEP 24576:F+50SHgbuO0MjdM8yfAPnqOTmciow1Pm/RFKUk7MWbN1RruY:FglH20MjmfeqOTmcNwdmJFUMWbN1NN
- TLSH
  T14C453313C957189D83E93D7ACA215570B6212C623A7F3F9ECC318B856F633CA862BC54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Guna.UI2.dll
- Size 2.1MB
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH
  T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  VirusBuilder.exe
- Size 117KB
- SHA256 9ee86ab1d6e4d75901eaf4f2ac91c9032dc0782c36af449185ab12f4ed7a0de6
- MD5 4bd416c01b82aacc4baf4374f280823c
- SHA1 e89fc6bd2751b3b096a4ce76f0f862fe1c6313c9
- SHA512 3d00b2c6a3acf4f224ede3249da5fe9311cc7c074d2f0815b24047ec8a9cbefe31a421c7902ee4abda1371257f51c3e3c587ad51781d4ad8b1b95b7ae460413d
- SSDEEP 3072:EDLd/ftMpWbwVmXmP1uHWl6wbXV1u6ZcHsl:I/f2kbkmXc1u2lf1uYcHs
- TLSH
  T121C3E61036FB4967E47F49B84AF7510243B3A0236578DAD87ECD51A90FE37044AA1FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit discovery execution persistence
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral5 behavioral6
- Target
  VirusBuilder.pdb
- Size 105KB
- SHA256 2a51e7757ba105589a5cf95f2b4c648a725237c841b2a760d610cca7af4bd18d
- MD5 4b18bab0ff07910f3819755972bb0c57
- SHA1 651d65914eff994c64a6b6efa500cd6bc52bd0eb
- SHA512 60914566a72064bced488acadc7808b40501461cf1a3007b9636ca0bb4f24c66d3f2712a55dcba606bb27184e14a0bd4f87c39f2757f66f597b5dfdf2421b076
- SSDEEP 768:yVct5Zct5cBhkA/nM2M8N1UYhFMn/qDSUXRIpmdQNH+59nwb8IySxHgON4GYddQI:HO38flLM7UXRIz+PC8nUHgON4GY/o80
- TLSH
  T17EB36057BB81CA33C45985F8469B4F3D4638ED805F8297CB6398B26C3EF33691DA1258
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  nasm.dll
- Size 1.2MB
- SHA256 a4735165141570d966b577d594c0541c29baed4978078c1c7237b855f8592a87
- MD5 2f17bab79b9e5caa79c4f493a18fb06c
- SHA1 f3eb8a09529b82fc08e919517e098644ddc01004
- SHA512 37c62999e11f3a44c02bad2ad9941213c0264312f228de32466818ec84d745312f941f4adf6e4bf3f49d5d91e8df56dbf39b7966ed8d4b214b484c93635ca154
- SSDEEP 24576:2zYx3PgYWwocek/r2+AAYNh3tBULAkS7Le:2koA/qhlL3rmzS7
- TLSH
  T1A4459422A687D9A3C40E1270DDC7D32977B2E0F46B368B87BA4C97AF7D213A11CC5546
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9