Extracted

• • Target
    NixwareCrack.exe
  • Size 4.5MB
  • SHA256 66a1f6ccc9f869945bec8149f1af5ce5bb587d3d25c8008cfdc0bf3c0cebf9c2
  • MD5 42fe4a56c232d4f65bfa7ad9eab99812
  • SHA1 ff382fff460371f167ae09d2f2cf54d7d6264a0b
  • SHA512 3694acd3980705493876209de679cd316f596f5255be2a0eb23971dbef18a8c54adb08f7dad42217ca855768910bba8d6f1d9d69f74429f2a64af9f9fc29c1c6
  • SSDEEP 98304:+bwdaDFrhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1Y:+bUEFHGpELcoR1Y
  • TLSH
    T131269DC6BF88F5E0C4A48834B916D5BDC6737C7A8A11468732D7FB1F2A37180552B92B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2
• • Target
    auth\De4g2YtIAWgs
  • Size 30.9MB
  • SHA256 91053ce8c51dd4afb8d98fca1fe51a756bad216195282f6041b6e8a9907c781d
  • MD5 d35691e5352ffbba95cc7487cc0ee689
  • SHA1 6c08ea2893505cddd90af7435acb8c343a99c3e1
  • SHA512 559f73bdd7011e2f249e003e95a5c342614fc6658a6be451c1c95393b9388966bb089673ce912c4d39499df2d7992de204a4e1fca1d9f9df51cb50a89166380b
  • SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
  • TLSH
    T164678E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  behavioral3behavioral4
• • Target
    vcruntime140.dll
  • Size 116KB
  • SHA256 f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
  • MD5 699dd61122d91e80abdfcc396ce0ec10
  • SHA1 7b23a6562e78e1d4be2a16fc7044bdcea724855e
  • SHA512 2517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff
  • SSDEEP 1536:KqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbsecbWcmpCGa3QFzFtjXzp:KqvQFDUXqWn7CkRG7YecbWb9a3kDX9
  • TLSH
    T16AC37C4573A802B7D62EC274C1E25E46EB75B5418770ABCF03B589AA0F13BE1AE3D345
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    version.dll
  • Size 124KB
  • SHA256 00f6b47ed70472f6b7cf95b8cdeb33d254906d780148df205320a0f7d25298e4
  • MD5 410af86d672a4886ff7ecae3c8c0c5a7
  • SHA1 e2308e96a4f97972dc3f382b8e23f776e5206aac
  • SHA512 96695a111688b87f6c7073878a0f80190ca2fc1b5ec7b91f9e8f10cc2aae9a3b9b5a34596242dd9210f409502aa927f77f9a3404c354f8e95de5034800fb83a1
  • SSDEEP 3072:PArsEFFJFC9pVpcGgD4H3zFOSwCYnn6iouckVPxIiTON4F:PArsqF7cpMdDC3JO6A
  • TLSH
    T1D2C34B1BB6B5507BE26A8938C4530A05DF72BC918BA0ABDF07900DDA1E637D49F3DB11
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  behavioral7behavioral8