4d71fa5f1bedc947a25c77aba9c8244e087e1fd40cbdc7d358b79b538a75cb30

Sharing

Copy URL Twitter E-mail

General

Target
Nodura1488.ZapretUltimate-win-Portable.zip
Size 8.5MB
Sample261027-1qvt2aee75
SHA256 4d71fa5f1bedc947a25c77aba9c8244e087e1fd40cbdc7d358b79b538a75cb30
MD5 fa28c98bddf60f4055ddb456a6f24627
SHA1 de7633203a93002f0ee91bec2542a4f043215860
SHA512 36baf278fa0b654e6fdf965f459d4dfcf24127f6b440d6aa926ce15b5deb38802c47e8e82f48afe79760677fe7fa3272beda9efea803a4dd1c68a1cf544eb542
SSDEEP 196608:6S2Ey2Sh2auZ64BQcXlWEV8ihIuDLmTcObNgbytaQSCuTmv6N9w:6S2EyLIFNXlWi8ihIuDLmlNBSTTmvW9w
TLSH
T1269633BB04BB818F655C8D75CA8E3D8100566FFDB0C27C22D8DC1370D6FAABA564A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Update.exe
- Size 3.7MB
- SHA256 6849325f8fb57ff5d13497c984b9de82e6b5d46ddfbc857145012d104886287f
- MD5 9f90608b7ce7d0a2f726988e42ae7e70
- SHA1 802802cd2e4d5ffb342a0917247585076e98320d
- SHA512 8585215aa63e2fc0e6cb3beb14fe3b289deb45c2b1b8e78a16dec5b9892a9a2e5872014119172f01596f0bc76597831315b89f0da4597f1cf5a77ca141b8c035
- SSDEEP 49152:x0z1f+viTnGsRHs8jVrr3TZlzW1qmHVpFkSZu:m+v0ntHsOnaH
- TLSH
  T16006AE62FF42D0FBC48A01B6E42DF37D9636A1558B6A85C392A94C4C6CE13B09C5739F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  ZAPRET ULTIMATE.exe
- Size 383KB
- SHA256 4c534cd6da97532203dc60699b04043eaea3a2e4752ed1857b30736dc9cbda28
- MD5 265a4b60085e0ee319e62f2d636606d2
- SHA1 a461df6fdb5a54c208580399b7de72e476451f1f
- SHA512 3143ba6726403c25f757365f670f7a6b021d1815cafae1d8eebd9c3f486f353aa04ad5808ed746891d12938b5bcd7a259a2799ea7f445f180768010bba908941
- SSDEEP 6144:MnGCgJJkYL+FwHS6thnL5qEW18NoQ2UWASSgNlXgCtBZ19gLz1ulvlDe+dzYufZs:sSJJkYLauS67aQ2UWIgXgCtgLz1uXe+W
- TLSH
  T19C849D52BF40C0B7D44740729D3DE73ECB3AA1161B11CEE7B3E50A989D357A04E366AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Loads dropped DLL
behavioral3 behavioral4
- Target
  current/Microsoft.Windows.SDK.NET.dll
- Size 23.7MB
- SHA256 0ec371d93798852e36461c8adddbeadce0f963a04752f0b64e54fe19c1c834a7
- MD5 a00b91c2e00b89e387705af95b72bd6e
- SHA1 eb57d8d9b8c1e4434044c28b608113e49d53ccf9
- SHA512 93b88a2ef85206765144c7c082662da7a3ad57fb08af9f8bbc0355721c12cf52f6a6920adad08778c4d2054652636d24d095b998c282f9b1e92b9234808f3165
- SSDEEP 98304:POCu/R1ZTAk4bl5EUBMXyLImPbjAd+deA/tlCjvT7HiYyhILyV3K3CrLtHOpdGxD:POCu51ZTAFLzbjblIjvT7CThIPPBrYj
- TLSH
  T15D477E2297A44E3DC98F5773E4B603264335C60AAF4393EA581C979D2F833460B59AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  current/Velopack.dll
- Size 271KB
- SHA256 f22e845bc153e9f7859c36de9df074bb3831db7db08c68739f0cd1e356352ed1
- MD5 909fe47436cd85c1ba16498eb3217d82
- SHA1 5e3e7ebbccc0b84407a0edb9eee5cbb9e9068baf
- SHA512 f6444ef5d5391e04dd22b9893ea50ad3e9614cc245c7580110270d85c125157bce923ad3e4665543a2eddf8ed8310cc7c6974124523b833ff2c14eff87879d32
- SSDEEP 3072:eo+y+mz0SG2JczzlOjBo2N/i3Pn3a9VsQcuKa4E9sKSEQ0RyS+W7OFUqAVauFBvG:eo5+ceTfja4ENSE/RyS+8OFUPVNz
- TLSH
  T1BD44390023F48227E2BF6F79FCB4244987F5F647F86ADB5D058468ED19633909841BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  current/WinRT.Runtime.dll
- Size 516KB
- SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
- MD5 edb1f8d15fe41838cd449141187ae032
- SHA1 c7344afcdaced6911ab5288b0ade76f66dd41203
- SHA512 5756ccbafa1440d114f8d9b163ea0c2678300ba24c9979b837ba232cc6813f74a29fc0a23b9bc1d7f53c6ce5f15cdacd6804a755ac816116536c56cd9ca43c0e
- SSDEEP 12288:A4Yh4z+uZSlne+7/SQ2YaxhaNHav96iTtqen:HRSucPTx2YaxhaW
- TLSH
  T12CB44A80A7FD9A1AE7BE1334B03416144B71FC17AA13E39F674895B81D637998E40BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  current/ZapretUltimate.Core.dll
- Size 51KB
- SHA256 e079500cd703323e5d8de04dbebb9aeea217bfb0684ccf8d9512ad7a4264d450
- MD5 18ae66e69e6eddda2a64e91692e4fe9a
- SHA1 834151a8ae5e6d14a729ab8e65ec890eed636b73
- SHA512 0648301c966c02ade7d51b507e5f2a6eb6386fe07bf5b866374e1beabb5919eb397b182ee9c61a0daa51bbf9e2179e40b8e02d9b5b626db4265f46ad35b29f3f
- SSDEEP 768:oXwhRtRBcu0yS8dmsmc4zLBkuTW/vUAjfNy3muYMmU+4RlzEK78lIIBPhKH0HD:oXQtRzShBkoW/iYlU+4nYu8IIDDD
- TLSH
  T18233190533AE8727C78E17BDA9644155437AE3267202FFBB5D8878EA3CA33941514BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  current/ZapretUltimate.dll
- Size 160KB
- SHA256 c91d84f29e7d0c0ef2dc369133cf14d0eb5a382ae3a4d39aae223a05fc229f8c
- MD5 7e93147a576029928663460da61125c3
- SHA1 9b7d8561ef143f68bafcc80ac475de3302a12eea
- SHA512 be7859387252ccb5b55c56d279d278629cec6bad630ed6a15cbf6827dabfc0ec82d335e6ddc247a6071ce6e20a28b18fc51aa174a1a337d7d3877811ec635f59
- SSDEEP 3072:1Gv1qlnN4IBZrr9T8xAFP+fy/rbI/0HbC/8knekHyF22roE8:Kqj4K1lPX/rbIUbC/8wetroE
- TLSH
  T137F39E24A3AC8F63EA2FB77D555001A587B5A30A3D1AFB8D9D8E7CFC1592352E410327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  current/ZapretUltimate.exe
- Size 159KB
- SHA256 8919d1b99b5163a9eda0b80c99d48773db06f619eb0fdd363142b1fe0805ccc7
- MD5 633603e72ced3e60139e39d1b17e6f3e
- SHA1 1e78ebb30f1c07996bf0c563371ba108329d7320
- SHA512 452c8ba46c2d0d653d9d83b4b4d73c9a8f2d3be6998a4e8a4c718fee4cc27d45790593a5d350389b1f36c3ed59faa62a97198687cd619be6bbc3881785837bf1
- SSDEEP 3072:wVDxk88wN1nLVu7dL1Z9Qnlf9rE38wGTbzaAT5sb:cHRu7F1nQnB8KK7
- TLSH
  T1C4F33B13A6A851FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Loads dropped DLL

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16