1f861cbdc9bff26984d51ca7d7b8b08d8238be2d9ebde16f6bc578d759e5a60a

Sharing

Copy URL Twitter E-mail

General

Target
zapret-discord-youtube-1.10.0__1_.zip
Size 1.4MB
Sample261027-p3a5lstygt
SHA256 1f861cbdc9bff26984d51ca7d7b8b08d8238be2d9ebde16f6bc578d759e5a60a
MD5 3746cb93759882a96b4649ad805c263d
SHA1 c7b997183e7aba6e2bd5eba7c8bfdf10262c5f2b
SHA512 6ee7a0e196e4ce260552962fcbe5320a4387d090797465e21ce34d3d0c9da157fd5ef810bd4af17184b5c37bc394b19462901d0856f4ba193eb65e2aa2b97729
SSDEEP 24576:Scjh9+TiOV9A7D0AtWL+kcatqOCRcKNEiN5GrZPbG7GQrDmIL5we:ScL+uUAtWfxtqOQ154Pa7RrDFL5we
TLSH
T118652307C93E414DCB997837190DB91E55076AC23CFA97B46392C2CCF9ADB623770A92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT).bat
- Size 1KB
- SHA256 59f538b559fbcc8220d2cb4c0f8dfa41dd0f2429a8f265d84e723b8f71918b6d
- MD5 c998d04c1bfe00bb50e0b927cdfb291a
- SHA1 7eb3fdccc355ae2779a9066e65828c49ac9f9c59
- SHA512 0251747d90c934c7d273fa2a57c84bf54944409a4629304c563e12204baef1e99a25033053324644f7173b9db10c5c20c631ce8ef968bc9bc27239aaef532521
- TLSH
  T113219B203D806076987AB9998A9F3B08A61FF1479F561B1C5316FC98670ECD3C5507F9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
behavioral8 behavioral9
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT10).bat
- Size 3KB
- SHA256 3decb16f9066ac0d9898cece5d62f070267491c36ef78b28d9980e313bbab61c
- MD5 e07ba5261cc65a9cfab54d2f5f9f07d2
- SHA1 e91ba94e021e8f1c5b46f4d0f00c091142fb710e
- SHA512 a5e6cb7c742862c0e10e6992ab963048b32f93f3767a6766d1655f2b380205b78c862483e39cf06e0fbcfd7607c7f29ca8e8661e4842c05fc7a421bd0e29b93a
- TLSH
  T18F712AA7E00CDE47F58CA97EF85FA5B42027DC8328D6D452439B89E8CC4ECBE584E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10 behavioral11
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT11).bat
- Size 4KB
- SHA256 831577c7afd863dd3d1c43a894df76992f1af5b45c34e7f92d70a27adbefbb2c
- MD5 8c782844cb7f1f381d4d34776a8731e3
- SHA1 7ee5de7a3735180160337c9a31d769ce5b7eaf92
- SHA512 c38075b40ee4f1537ea96d292c49217dfaadd1375be1b01b34ac113c6bfc01607e9a961a45db2a6d652a306dc63550a11b4e235bd1181836bccec9dd46b3eee4
- SSDEEP 96:nL67mQGB/GRRQ1zbIKdUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLx/:AmQGB/GRRGEVGB/GRKv/GRRDv/GRuP+S
- TLSH
  T134816DA3E00CEE46F6CE753EF45FF6A5201788C328D6D452439B89E8CC4EDB9594E084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral12 behavioral13
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT12).bat
- Size 3KB
- SHA256 2d66242a0f23384c1321ff77e9316ebba069fe72310c7260b26206f1c00f9db1
- MD5 0b099061a29c95dff690af9e88f363f6
- SHA1 cfc36567e5f134452797dae2593234f8a4b8d082
- SHA512 1b9ba65cffb740c8126275e308405571c16d99abe0167d2a01c0785a25e17203179dc97c87a4caf929424d7ce88435b03d088a384d8681e6dca8f2bc6f48e813
- TLSH
  T141815DA3E00CEE46F6CD757EF85FF6A5201788C328D6D452439B89D8CC4EDBA594E085
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral14 behavioral15
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT2).bat
- Size 3KB
- SHA256 f928a447fd312866c02e3a06519537c892424c9133a6ec91ee741664ff17595e
- MD5 19740924254d81f4811a6704e7fa3246
- SHA1 33515547dea40f040a95ed90d161dda34a02f695
- SHA512 12222b2c13d15b57a88701beab9e56b56702b4c9942927280ccd1d0e0070802ce8fb772f398a29c920570e0b5bacd4d316875788fbfee1a9382ba6954ec51479
- TLSH
  T19A610757E00DDE4AB68E783FF89EE5E42017C8C31CD6D452539789E8C84EDFA494E485
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral16 behavioral17
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT3).bat
- Size 3KB
- SHA256 521e95e530b3ef3f159f1696c554f8844822e24b4ca6fff5975ac45fd3660247
- MD5 44bee5b9046d852cea55172184318360
- SHA1 1ae9de083bb3446779dfe1110fa9e7ada05cbcc2
- SHA512 ab916610170e95c2a1233167862f52bf3715df3e19d71aad08836a769752326e788f3554adbbb1a3c5ba58a252093a7648006d8ab14e50c724dd218eb165adc6
- TLSH
  T15F714B93E00DDE46F5CD6C7EF84EA5B5601788872CD6C85152DA89E8CC4EDFA6C4B085
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral18 behavioral19
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT4).bat
- Size 3KB
- SHA256 40e6c319fb96020ece42cf0cc44f53252f53449207d420a9507dd06c99fde6a2
- MD5 d4a5ba1236d2dfe6c1f4471c2229b8e4
- SHA1 16ca5603a7c85d3173113d5499b693929f6b4a34
- SHA512 355dbcdf059dab6c0126df7d024ebe0a81139303740d7fcbe6b563cab330d6b61b9b0b270cd5f13ebc4fbb1ce40d23d7b6c66b1d134c8a356d0584cd28653d62
- TLSH
  T124715993E00CDE46F6CDA53EF86FA6A421179CC318D6D452839B89F8DC0ECBE584E594
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral20 behavioral21
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT5).bat
- Size 2KB
- SHA256 a81c276ecae34c3c39c5d862bbf1ef841ff04864bd854485178adf5a8121f9f8
- MD5 2ca56a417d5ef64ae7e8c0b58fedeeba
- SHA1 6413271c89dc8674e29602977a1acd0d9237871d
- SHA512 5addc0f3d27a840db184f01b3152c663e52af6ae73082b30481bd087a26b63a31c492eaa9682b0d0de5e4bf9a7827c8055db290b20c2bcbbed12604f8fdaed1b
- TLSH
  T1E0411387E00DDE46B48DA83EFC5AA5F5701B98C32CE5D466539788E8C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral22 behavioral23
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT6).bat
- Size 3KB
- SHA256 ed7a09a6686191fa8a2bf733b5b4d26fefa45c92b62266e1f94bb56aeffcd079
- MD5 c3ff7ea1add327011ee6730b4053966d
- SHA1 4e2eae34810683c4484cfadde15e5a1453e23fe6
- SHA512 76ded952ffe8406af1588c2163cc66851a8605fdb9e165f94d81a3e8e8d48287d434bb7c6a145561820ec4dbf83b3cf13a06d05cb17bca6474a8936d026e2b7a
- TLSH
  T135611657E00DDE4AB6CEB83FF85EA5E52007C8C31CD6D452539B89E8C84FDBA494E485
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral24 behavioral25
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT7).bat
- Size 3KB
- SHA256 57cb714ea0e385ab3cea37543fd9ac7d591142571192217b39a6ce7c04f85f15
- MD5 96e72a33cf63c887ef194cedd6ee22db
- SHA1 0e5a8595f435fc4d01be203da895f5117fe585ba
- SHA512 83c853db87e8e37ba5dbb02ce35d88833d5a11dcb6c8bc3e4ab21506878385d38de720fd5ac022ab85eb1e2f473daf14aef4fee5fcd11f83f66fd79c923b0f86
- TLSH
  T13751F797E00DDE46B68EA83EFC9AA5F52017C8C31CD6D462539789E8C84EDEE4C4E485
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral26 behavioral27
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT8).bat
- Size 3KB
- SHA256 6241e40c1bf03f7df54fd5b45c907064a0b9dcd1617840a83f0047b852195070
- MD5 dc68b5fd5beb4f016302b72c5c82f759
- SHA1 9f9e7636b27361e8ba193d7def4321cc2534ffa8
- SHA512 c214c9f91865ce27e55d2e55e97342558b5c584d00e53f208f8a0729384561efcca23898a009fe00e95556f68aa8a001ca056c000962ab93263f6726f53e7c21
- TLSH
  T1E7613893E00CDE46F58CA83EF85FA5B42127DC872CE6D451539B88F8D84EDBE584E584
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral28 behavioral29
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (ALT9).bat
- Size 3KB
- SHA256 56430f0594058f6a1585509a0b52a532348d9e9913c723a4952fa8009c079d43
- MD5 887f170da8b6c662cabb459d142cc7a4
- SHA1 c32a4eea7583550812d67cbdd3926c087abb6153
- SHA512 0595cb2cfac83211e26d32e2cde40741df4ec7d744843c8f5dad6abd06409d60ad33227b914205a5d336415d39027c31dc1f57837b76e026b14bf87fe1168d7f
- TLSH
  T177616993E00DDF4AB58D6C3EF89BA5B52417C8872CE6C851638689F8C84EDAE5C4F485
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral30 behavioral31
- Target
  zapret-discord-youtube-1.10.0 (1)/zapret-discord-youtube-1.10.0/general (EXP).bat
- Size 4KB
- SHA256 f5423c9142e00531900d243f3b2ec20862739c60ee1fb5fd26305933cb4f60ac
- MD5 02798ca53b7121f764c636e810cf6849
- SHA1 4db395c238a6f2b782bd6530524d84b8cf66dc4b
- SHA512 d31d2594a2a5f21e81a22014879eda66c8453a02cb4155b6ca2c5e710c12ff8820851a08d46b0a4829d592549e0463eb80c513604bb2b976c6522bbc412bd79d
- SSDEEP 96:nL67m3GB/GRRQ1pTr8JIiUGB/GRzVv/GRRQuv/tRz5P+RZ5+RR1ui/:Am3GB/GRRIB1GB/GR5v/GRRDv/tR9P+O
- TLSH
  T139914CA3E00DEE4AF6CE747EF85FF5A52017C8C328D6D452429B45E8CC4EDBA584A084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Sets file to hidden

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32