350d436e30c3a6aa5b1f80be738267ca630e8079c2c6f8a8434b3aeec68702ea

Sharing

Copy URL Twitter E-mail

General

Target
SaimoTV-Windows.zip
Size 50.3MB
Sample261029-1nsa5ace68
SHA256 350d436e30c3a6aa5b1f80be738267ca630e8079c2c6f8a8434b3aeec68702ea
MD5 bbf9f110e1261846352e88d9c9f8d063
SHA1 8f964cdc86d6ef74a423361024b87dd99e901155
SHA512 5ea846fe252c90dc40a062d0c11b7586f5c62c3e76925d1a75a042b42c51236ac5039fe1a598a89044aabf680179d3f26dcf8a562cb8c56f0f277e852a2e8034
SSDEEP 1572864:gleNUQKYGwwXqgbobwhrC4LkAXI2u5hh4MSvOT8lnDrHBS1:+tQlG1aEoIrC4LvXLulPSvOsn3h6
TLSH
T1A7C73318C7F97FAF9667E87BB242AF4C51F5D9A08D850C630782B303365192E998DDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SaimoTV/LEIAME.txt
- Size 1KB
- SHA256 73c4be579bdf2edb5ede295ddecdfa15efb7cfa85a14b49f1970e57f48cf81da
- MD5 a06208d2d85cb25b7d3820a40d10e818
- SHA1 98d36237407f4ef74e4d34386c46bb59988a3160
- SHA512 046449cf0ea9f1fa6489c7ca57cff4a6a688adda1181f384fe328de038de57bb54608bad0b4cd6c3dc2fcf8c572c987eb5ac2137107257ce4d9a22a9315daedc
- TLSH
  T1C721951E0E9813A3792263E2FB07CF2319F481865507DAD5C03F078A78C4A46D53B5B9
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral1 behavioral2
- Target
  SaimoTV/Saimo TV.exe
- Size 9.0MB
- SHA256 e6a3cae6979791e84daa2d54606f7ad39a799ef1d0bea03648fae6f087f639bc
- MD5 923396c1b025fa2a2be3debd37ff5836
- SHA1 5d591d5948b8dfa961fbf7a7f4e43463ea6e9aa6
- SHA512 312fd99b2f1c43e6f3da6c1a9aa9199e3a561517e7d8e8d21864b92a317f4961235a2cd02c56356b003b3e1d7c55b7da55d5e68dd77ca78d0c276b4300ed9ede
- SSDEEP 98304:xKA9ByaVHNvp8V+iy/q7wGPP7AUMioBdwxX2KBxM0P61jcSycbj+sQUM:tz6wcK0X/BPuj1y2f
- TLSH
  T1A4969E83F2A681EEC05AC474935AB633F632B88F4A3472BB67D44A212F55F509F0D719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  SaimoTV/libmpv-2.dll
- Size 115.2MB
- SHA256 d2d081547efea8a1530f4ba0bf58a0d72069b25c40d8b2a7071cea5aa82381c6
- MD5 ab0fadc9880c07719efc1b874f921113
- SHA1 26bc3fe2d3af50e891838e21dcd74491425f4336
- SHA512 18fa31a41c20ccac77e2cd4d39ea9c77295b584978e87490ff034f3fa1216b928d82a1bab3ad6d6c32ba8d1183e8586dc4d3a138615f8b2146cd15e6060bc30c
- SSDEEP 786432:bIL66VXOK/PuW68m0tWnB0UwNyrebvZmSSRzv/gyyV:U6IXO4ZERrejsvW
- TLSH
  T1BD489E4BF19790ACD41BC5B4436AB722FA34785D43245AEB32D896343E76BC06B7AF40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SaimoTV/vulkan-1.dll
- Size 1.6MB
- SHA256 e1fcfc9489beefa6a6d9d11d6c7517f6a2b7f16e0d3fb8f4103bee0210f314a3
- MD5 d4ea41e406808d362d05e1d70810533e
- SHA1 0d584e57dd0215a78734c52ef53d1527457a02d9
- SHA512 d95d5e44cf146fe4b27f0aaaa36bc133eb9243d2b4732165dea815cee91b64ec689797ec4aa16eef1f6d7f6a661f6c1df806aac69aa30a25c53171b5d3647ee6
- SSDEEP 49152:wWeNfNaoczDDr3FTKNlC1k+Dkw7ejv6g3v0TAE7yoeH9EO:PdO
- TLSH
  T179857D66DBA81654C2BB823CC8518B4FC6B3F85113249BCF01B907E55F53BE46ABEB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8