34741eb9cafc374c8e5d3603350233c4aaa406e482e6123c2e52e1d19e7cdd3e

Sharing

Copy URL Twitter E-mail

General

Target
Zapret2GUI-lite.zip
Size 1.7MB
Sample261027-mxff2adc64
SHA256 34741eb9cafc374c8e5d3603350233c4aaa406e482e6123c2e52e1d19e7cdd3e
MD5 81fd5f528f804cbcc21e2a150d9a3149
SHA1 6fbdaaf1781aff2885b1126ba9c8b137f4045067
SHA512 2a3c63fe52c3d8e8196bf2aab29d3640277282332c38092b42d07b5dc3103a9720b9ee5a96957cc4e4ab93aff0f11ce56d572d6dd8574054e25a1dd50a0a7eef
SSDEEP 49152:DuTQ5NorTHGxnUta5bvLokMbHK2i9cZH6U:DuUHUS1zdDokMjK2i9cZHV
TLSH
T146853376B045DECBDA26DB315C0E8D1549E7A0803180FBCE77C479858E29C835FB9A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  bin/WinDivert.dll
- Size 46KB
- SHA256 16abd6a029e65557c6a309bea7b13bf81fff4e193567582e1cddbf6719f323e0
- MD5 407f321a43415b878b727e2c38152950
- SHA1 50aa3cc1cb575e057b335cad83a0242f31fc6d46
- SHA512 8d2235920a21b4142e1b561db181acb5c6a5725a5c9ba0f506e913ff5a0809fc8f7648a474318bc5837e37150ae82718a444954b71f29495c6fa5b90cfeb6eff
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T13623D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7992D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  bin/winws2.exe
- Size 641KB
- SHA256 a25355939cbe7f643c8e746c41b38d367600813898385415245b09b565d84c96
- MD5 e61e533024af451053a54bcd5316da55
- SHA1 c1275fbcef43e96481a988cfdb26eb95062e658b
- SHA512 17395b3b4fd88668f58955541aa683aaba77d6ed62ebdd9ea444efe4e09be4cb7e0cb929474dbc2e8b38160055ba409f0014ae6c9a8286527d8044883dae0384
- SSDEEP 12288:G9p2C1FPrqXUb2Qb01NronM/e3MafehBrI1gBrNZM6:u9Nqm2Qb01dQM/xafKh8Wr
- TLSH
  T185D47C06E2A248BAC46291718B9ED732B731FC491334AB1E3B64F7181F35D605A9F76C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  lua/zapret-auto.lua
- Size 20KB
- SHA256 c2028f544134b0dec33f054ac54fe4f2315d969ba034601456f72017fd5f8528
- MD5 eccead0f735db874d75c1c11719ec492
- SHA1 3eb0fcf533fd7f9649d29b15159aa01d53ffb4f8
- SHA512 1b0642220822f4951afb33c92bbfc7638321c37c38189bdb02a317a361a7ee8ab933d788d924ef64a1295db47ac1ba3e12cb43818f9ef82952f28a12c492df03
- SSDEEP 384:63XwNmUNOhLJrbgl4ggcfXZmE3pLAyulgSriMJ989Un2jYyXuTw:63/vhLJrMl4ggchmE9LulgIiMJ989U+3
- TLSH
  T1E292748F33A5E2611E1912F8D41F3616AE3EF4A6828C2554E5CD0FA0262741FE4F7F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  lua/zapret-lib.lua
- Size 90KB
- SHA256 b67a470f23b00a8d6e732c4e5135a39b224511e0b71809d5f4616adf62674980
- MD5 387a52c6a18bff57072e6dac3084781d
- SHA1 884fe05ac90882191d574ae631ae2ef6c40bd8d7
- SHA512 e17a90764c095b5723e5bf8a57ef80b1a80b0ccae8e4d278cb973c05c5f8ad04a2525cc9ee199cb1d8c248c039fe659ae0ac3fed6a2f16b9b748b89ad6be6717
- SSDEEP 1536:84Oc4TT2a12F79QbbHR6UCfdmYBGhmgrgyf7KXq:8Rc4TT2wfx6ddzurgyfAq
- TLSH
  T1929309CE37AAB2AE168032B5C00F2E517E6CF676618CD615E0CC81B5750969FD1F3A78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  lua/zapret-tests.lua
- Size 36KB
- SHA256 82664cb50a751a531b63dce094ac03de5045b16b489e726ff32a9a1034811459
- MD5 a6cfaac8b4f12f644bf791c3da2db824
- SHA1 baa0168b11fc3b08088f0b264728093f292bd889
- SHA512 a90a1d8b7686a2b0a7254f016fc839aec434fd41747c3357d0bb42a2ed86b621c1fe4a250ffb97371c6d99fa15c6453555b9e4fa0ec395f3ed487a44ff9184f1
- SSDEEP 768:5alnzVSr+xTZPVNQBcaEuSP+KOmnVw72XC:kpSr+xxVNQBc/uSP4
- TLSH
  T1C9F2C68AFA9B8458988221BCDD7971416868FE37A4E57833E14F870DC27D58F61A3D38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  service-install.bat
- Size 3KB
- SHA256 270346e6d44f8d9567a6c250bbbc816c777c0958afff40bdaf7a74415a18576a
- MD5 1ae88d1e0f11ce9f15dc3e44399f51d3
- SHA1 71d07cc42fcc66138613170bbec22e8ad189fe29
- SHA512 07b655d0e006b8bb7192d5210b43ddaccd6d6de9aab63014f9ef3f65ad48d3830aead4e802392cc3e9fab0544482873189ea6291d907484fad21a6db1417e8f4
- TLSH
  T11C71589AF409CA19ACF3D01BB0BBAD17E085FD9688C4A581E3496F5CF5C353B7244AC9
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery execution persistence
- Creates new service(s)
  persistence execution
- Stops running service(s)
  defense_evasion execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral14 behavioral15
- Target
  service-remove.bat
- Size 141B
- SHA256 d9543563ea3f0c79d3066e6eb0947df8a179faeabada32475da82930bb73f33f
- MD5 85c3edc18f26f83c579ac86ae887a090
- SHA1 9774505f25970f02feb41c698ba0f83e4736ff68
- SHA512 0d4f3764349dbf98b7c056468ea498e4272b990fa19e364450e13e551be972768d4a575bfebb9537760ed49aab0a77b339ce4f989fad81086d192956b32bfd2e
- TLSH
  T111C08C1F38039C201087A0C250F33045AA80CA574CA7BEC09CD3A138AC80548220540A
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
behavioral16 behavioral17
- Target
  service.bat
- Size 1004B
- SHA256 d3368bb74fd0c23d245446abc2768682cc6a546101db6dbae4124c5b5d4e0876
- MD5 5223cf4cf6ea6f8dd95d1ba718e540d3
- SHA1 90d6d95678288eb38728bd71f332d34f34fa3f53
- SHA512 3fc3622ae0d4f8d6a55b132884f88297864240d18b9a6b7fdcdb65faedc4f5c54a1510bb35150076efd3005faee8fddca7b69acf64f3bd69150300a662b4cc66
- TLSH
  T1B211BA47319294335B7466B38E302009F609D2CB0325AE6C70AB42747A4C7CABBD91F2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  start-auto.bat
- Size 3KB
- SHA256 3b8fd9d9115dbb8e45e6bbc067e616fa08b4eceb077019602ecd68ba7c5e2a33
- MD5 dab8ad712b081d3e9775623a3ca9e34f
- SHA1 fc3bc191fd2501416fa7b008359df62299b44411
- SHA512 430c97d3fa87e5cf71872ccc08560d8129735ab1bc5477f1de411d579ea9f774528f84d93094ae6809c53a09d4e8d2b1355a16bc2252fd6ba544f10d4323054a
- TLSH
  T121818AAAF668D91EA9DBA06FE05EA9001087DD9B88C0D141F34CEF6C19C7D1B7509BCD
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral20 behavioral21
- Target
  start-default-alt.bat
- Size 2KB
- SHA256 17198e44fb3e2e1b74754b19236faa37880bc8fa3bbaea5b170b0fcc988704b6
- MD5 0d6c904cedb2ad5b2b124d5b781fd0ab
- SHA1 b39494e489b28bce9aed85028e45394e26e9d511
- SHA512 64366292dbeef3daeae52a0a7b737e08be578df34645cc61f92ce65c26a5c7a48695dccd7b8148519fd263444b3bf033458ea12a394c7f1ee8708f1dd556dabc
- TLSH
  T10E517EE6F419CA2AB8CB906BF45BF9001186D9DA88C49641F30CFF5C19CBD1BB644B8D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral22 behavioral23
- Target
  start-default.bat
- Size 2KB
- SHA256 2045591ceb18fd50e52bb6cc38f3f9b8827bf15815960d9bc2b8b6784dda231c
- MD5 310d0e89813f767636ff275aedc05642
- SHA1 9b34e7adc5e5f3af90ac0508064172d8e80b248e
- SHA512 2c399b53f2566f5fc26411c9abf96aef4db6bd47cbee17a511a7ae257e81a3bf6b7c1ba4d70132a826ca3165ef4c77c68e090fce31aff08128193c83fbd93f5d
- TLSH
  T1CB517CE6F419CA2AB8CB906BF05BF9001186D9DA88C49641F30CFF5C19C7D1BB644B8D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral24 behavioral25
- Target
  start-fake-disorder.bat
- Size 2KB
- SHA256 55923229f8749a5de8f73e532dc386acc6c79f2995741398517e87af6da1c58d
- MD5 5d4963f674ce74503a8c60db5aa56f9e
- SHA1 35c2bf783dbf1cb5183264188bdac48b8a4a64dc
- SHA512 ddbe914d6f4533fd089cb766b52c8826c143d18861c185196b96c112672c7832a62cf518b2f98a4a53bb4342b3c5c67a7018aeb7de792f4135f06ff750ab614e
- TLSH
  T19B518BD6F40DCA35B8CB906BB05BE9111156C9DEC8C4A681F34CEE5C29CBD1BB244B8D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral26 behavioral27
- Target
  start-fake-multidisorder.bat
- Size 2KB
- SHA256 ea085a1ba417c56df15920c045a435eca734643ab97339c629741f16a0359333
- MD5 95afce7524440a6e46155060acbb4bcb
- SHA1 617012338bb96c6f5073ecbf81a0eb89aad059ee
- SHA512 619aaca2d947c7b71552cce6a4e7a640fe2573a6442b5f8785d483ace0e552750616b53ee12d9d95806b611a84fe4a245f75dcca45d67904af59218095d40373
- TLSH
  T13F518DD6F41DCA25F9CB906BB45FF9001146D9DB88C49641F30CEE9C29CBD1BB644B89
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral28 behavioral29
- Target
  start-fake-only.bat
- Size 2KB
- SHA256 148baa8af294c6099072bd3ef49543978f61169eacd7ce9b31622457c1fb62d1
- MD5 f8b847fe152ffeedf292e4f98fa4a314
- SHA1 adc84593b924c9ddaa740d1303d406fd822e3388
- SHA512 7528fe30fe0c5b25e4a9f423248721999db7ea895d2c8eba1943aaaffd64d3c13cd3d8a434412db893413c1524ee4561713dd6a1da1205dff6b14bb574ba0240
- TLSH
  T102517BE6F40DCA26F8CB906BB49BE9101145D9DE88C49681F30CFF6C19CBD1BB644B89
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral30 behavioral31
- Target
  start-fakedsplit.bat
- Size 2KB
- SHA256 69e04a8bf615ad06aaeb01eb44070df49d2cdf54580cdf42d00d7d77af882b3a
- MD5 3336d450dfcd1a3681e1cc99c92ca5ab
- SHA1 2fb5d3824491e9a3a1e7fc38a8c73248e65306f5
- SHA512 13bc4d422f953c8a245e300839549d8c1c8c525b1e7d87dcdc2212973c9c534c32333a14576dda3212d4a1f944bf2bdbe4ffcbbf9f6cb5e512ca8f50afa11144
- TLSH
  T187516BE6F41DCA26F9DB906BB05FE9001186D9DA88C49641F30CEF5C19CBD1BB644BC9
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Targets

Creates new service(s)

Stops running service(s)

Discovers running processes

Stops running service(s)

Discovers running processes

Discovers running processes

Discovers running processes

Discovers running processes

Discovers running processes

Discovers running processes

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32