7151ca176febb89e103184f34757a3661be3fb9f4fb5f4de8f286166f9afcf61

Sharing

Copy URL Twitter E-mail

General

Target
boltv2.zip
Size 806KB
Sample261024-ymm9nsdy3p
SHA256 7151ca176febb89e103184f34757a3661be3fb9f4fb5f4de8f286166f9afcf61
MD5 c70521ed661e55268d8ef9a5543dd373
SHA1 1a898677dc2e8a9581f9ad6a97c613dabcbb8b11
SHA512 6200a824b9162cb9c44e7a48b44811e84c121d2df248c8dc472522dd92508643d8d488c829aa61d8cefe57a041a858c6aca6f161c2adb31981e5104b425a5d48
SSDEEP 12288:tNxdpK+kFOvlZ2yDgVaMjNxb84UqM/Xmw4MBiU0t8GyseeGAh7rYAltY9m/YQtno:tNxO+xjKbg7eU0uG/FGjaUMnWzOXeTT
TLSH
T1190533E1E6809CB012D63AB89215DF5319FE5B80F6CCC7427ECE7EE270658D8825325E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  boltv2.zip
- Size 806KB
- SHA256 7151ca176febb89e103184f34757a3661be3fb9f4fb5f4de8f286166f9afcf61
- MD5 c70521ed661e55268d8ef9a5543dd373
- SHA1 1a898677dc2e8a9581f9ad6a97c613dabcbb8b11
- SHA512 6200a824b9162cb9c44e7a48b44811e84c121d2df248c8dc472522dd92508643d8d488c829aa61d8cefe57a041a858c6aca6f161c2adb31981e5104b425a5d48
- SSDEEP 12288:tNxdpK+kFOvlZ2yDgVaMjNxb84UqM/Xmw4MBiU0t8GyseeGAh7rYAltY9m/YQtno:tNxO+xjKbg7eU0uG/FGjaUMnWzOXeTT
- TLSH
  T1190533E1E6809CB012D63AB89215DF5319FE5B80F6CCC7427ECE7EE270658D8825325E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  boltv2/combos/combos.txt
- Size 10B
- SHA256 fb4ee0c43511c35ea68933569b83fa9040ef579ab587b5736fd45ee29f3ce7d1
- MD5 c28573abb7904793cea66e0b529868c0
- SHA1 226a4e6ac4846d61d0868a279ce292b8a967ec66
- SHA512 0c5024ac8392d757ea2ba0cbb92c846403220120d08f9775f300163e825486e84591443b5a7e0e49f6b5442dbb0000981acbdc6c03cb1aa6416d6575d4ef7b7b
- MD5 SHA1 SHA512
Score

3^/10

execution ransomware
behavioral2
- Target
  boltv2/config.yml
- Size 416B
- SHA256 fc02c1a46458bf769faca88f0085be3e479f25f5b1c8cab5a9d4ab52bd4546b8
- MD5 7124e69e4a02a34607441a770eb1e7a1
- SHA1 a9f341f1f58549e68844e68a120ab2616a214dc2
- SHA512 d7c14e94cb130286bfe7d69ffdbd1fcd560a852a3540217f4d12b5d214b8658d3348c48e4b1877e33cb213a5f6d788c729076973751c3545358daf3c8ed11a61
- TLSH
  T1D2E0ED34B496307CC3B9021CCA8CF3D3A227040721FF75A5EB21417CEE028A54613C80
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  boltv2/hwid_checker.exe
- Size 332KB
- SHA256 ca40d8cb06a1084ad3171d12172049aef384cbc9209dca9d59baa6ef03b116e3
- MD5 220fbda16a22c14ef41b4e83fced781f
- SHA1 7a85ae7e2355195fe390f852f3b0bcdf82ae6266
- SHA512 279d348c838177a1a99b0106dede6df4a5a6cf112df1f91f33fdabcf5a8fdbeec64ca17bef410b9b110b3975df7c49757660c35a8d8f7e1aff7a498b1e0d243b
- SSDEEP 6144:6NMD/QHKW8TA1WxqgRFQEQwGfiUOVTj9cnOCVBbjhFDXVs:6o/QH2LsgRFQ7wGfVgVChi
- TLSH
  T11D746B53FAA555BCD156C03883569173FA73B88E06207DFF12E496342F6AE252F2CB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral4
- Target
  boltv2/libgcc_s_seh-1.dll
- Size 156KB
- SHA256 9c73644b976369433d874e7994e4c5c0038504202e818abb8a13fc3ca19b7fe6
- MD5 260b095555a83c968f10a00245258c81
- SHA1 e7498b83454cfd12fc04137f272c1c333f9d82a8
- SHA512 0c9385686b5e5e7c6762a83060acc26cef61bd070ec5d4fefc61a3f76cb4226144a88dfaf7c5dd3aa7eab7a65d1f16221cff9bca4b8b411aa38ad571e02d351b
- SSDEEP 3072:LF+SlSSJ27O3uojNklYTXzOnSUuzVq3b89OLHKFlvhKF3BT:e7OeojNePuzVsZLGlvhKFRT
- TLSH
  T1F9F32957F59360BCC516E2709A939FB1E833FC744320A8B313D4FA386DA2F81AA59751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  boltv2/libstdc++-6.dll
- Size 1.7MB
- SHA256 ca19714e5ad67053b328a01644445f30a4defb33191ed16fba210998757aea28
- MD5 539fde6f24bc4b357f01858b9240ba4b
- SHA1 3d30f5386d25c9bb98311448b44936fa2cb1685c
- SHA512 ca5f3eb7aaf91e7b86ad91bb61262254411a7c53c11c33f3630d53a7e65e47673e14835b1c0b853ec857f0d69bc1408e536f5164fbf1d3db32af9da0745e5f12
- SSDEEP 24576:rVtOn8wwNA1v8Wtcph5TeNJevER+ZyP20x4Cn:rVtOn8wwNu5tcph58LAKP
- TLSH
  T125853B13EB934CBCCDE7EBB0925B5336AA20FC654938293D6F59C7341B52E50522EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  boltv2/libwinpthread-1.dll
- Size 55KB
- SHA256 aa9cc3b24a3b41dd2095c24307f3a14e7a8182e859be26aaabc693a115e6e0b5
- MD5 9368f9abf901df0bcbded94e09df6132
- SHA1 2e22dabfc824d4f7690e0ebf9644b3ddf37d64c3
- SHA512 2a8d7f3970a879a5d941f7def9985e0a340be879f6d10ac5cc4f7022abb26ff15de7eccdcfefbbab65836f510307957d456d5db4aee81a538a1734e577a125c0
- SSDEEP 1536:2+F4WZO74TSiiMSXaEOKTo1TWPQTUR33Ytm:2+F4WZHKXsKTo1TWPQTUxYtm
- TLSH
  T174432A02724510FCE847C0359A661726F8B2B4201735A9DF9366D2363FACAF4AB3DBD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  boltv2/proxies.txt
- Size 19B
- SHA256 936e0b11a87cc89173dca265279e4b6d62f9865b2e45ea359814e7f8d4cfe4cf
- MD5 26c30c23cbecdeda399d3a9b8eeff25b
- SHA1 9187c65e2eef4dfb0176d60aed02d00073fea01e
- SHA512 f142068c0d95edc8d06d4c4d6984d73c1cc908473a7cb91c34576d04fb717f843473c8ae470c0d9d6ecf5743a35b7a558829f2762f21640f03bedfc4b248bc9b
- MD5 SHA1 SHA512
Score

3^/10

execution ransomware
behavioral8
- Target
  boltv2/readme.txt
- Size 172B
- SHA256 e83ea2dba96a385df04f744215fae2ea06f621f6a9312243c87cd25bc44da312
- MD5 079915800a743f3de04e11278b62b20c
- SHA1 42b87ff8199f501e627617fbfa6c1f1a1c3eeae3
- SHA512 674012895ee1c36daade520acbe5a9256bdce2df565456b32f25e5b1d199002dcda922fa9498fbb4dd1de6e28dda4938a5b0f46bf3b98d82b72664f27f8235cf
- TLSH
  T1F4C00257FADCC006B5D441C7C25B3804F82BC894B7C8C229E4D1DBF09A0D8391102444
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9