a432007fcb8e27cf5ccf65ff522dc21d10ee8466e05d5417696efebaf05deee5

Sharing

Copy URL Twitter E-mail

General

Target
qkx9dp1.rar
Size 22.0MB
Sample261030-wfe9dazzhw
SHA256 a432007fcb8e27cf5ccf65ff522dc21d10ee8466e05d5417696efebaf05deee5
MD5 921e45a71baa2c1b7edeac9b178426b8
SHA1 16c119bb34f273127e4ddeadc08a7a78b2e8221e
SHA512 d68e7d2ff50894a74b4578f5bbb4e80e02a74ee3a8fc20b289ec877f185de225f3f2539724c3bc7c751a87b4a79b4770c131ee2998792b5e2f38bdf3d80d1181
SSDEEP 393216:HN9BeEELvPAhP211BfWGkSh8AQlyBrM2YUlvLqDDsnsh07S5Ez7WiCA7jWJCYbYY:HzBoLv13fW9SWAQlyIUlqAs2G5KWif7E
TLSH
T1893733508631632D67B240BFF3AAE253491102E2DB77D70F9270ABF554E0229EFE6587
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  id_token_rayan/desktop.ini
- Size 142B
- SHA256 c80a96b2841236ac1763270aa2d5a7865ad652a68f991981cb9818721be837c3
- MD5 7cfcdf7519c1ed9a3485bc708f5260ea
- SHA1 f4254d4d9dc62f4fcfd1b68391f977c351ea118f
- SHA512 e485a9e5e4351d2f67a4a03b673e5131e21b2e7e491bef1fb77178c92da3ef33e6b484c1c48aa3a851f71bb8e08e0cb5f16f500c2af2089dc1880f33ac5d9975
- TLSH
  T137C02B07605B80B1F707C00FE10689584A900C774CDFF100C391969360D4906CEDCB1C
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral1 behavioral2
- Target
  id_token_rayan/id_token_rayan.exe
- Size 22.6MB
- SHA256 c84d864fe6c4d276730bc8835bc8cc12eb25d3ced60cceb7dd09d3466d66ab64
- MD5 b2f69a4da4cadbd10d5c6e1326a996d1
- SHA1 070a7ed2ca05eff54fb494a408e183581a4ce018
- SHA512 fd58dedce655c727f02c86f56c0ce87d3452fbbbb087e549b3fea7bcd6c4683a700d38a7700880ded8e94140f09f6d5fffe3da71b7dd3ada1ebb584795ae771a
- SSDEEP 393216:2Vs3SW0chMC2dIxUSUW8oLKqeqH92HOhl0hCML+8ADtAiJLwqFaxCjTh:2Vs3SW08uIxqW8o2ud0OhcCMrgtAitVH
- TLSH
  T1203733A833504E1ED493933A99E0D332BB613E90A244C28745F1FD53B5BF4F6AE986D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
behavioral3 behavioral4
- Target
  id_token_protected.pyc
- Size 10.7MB
- SHA256 54b65802dd24fb7c5dac17cb344960bdf6c67a5afeb67d8977348d899d996d7a
- MD5 eaaf8c4c82a8723a4b2f702758b18eca
- SHA1 abf049b35a576512306e1b1ce6c493485637c25a
- SHA512 143c9991fd90386070febb687ab49eea368f4d483018116ada1026e189ffe01bfa96ca50e99042e75444441bf70f2327b905a1f4c453bfa182fe4573d0b054e5
- SSDEEP 49152:YYCrHjXf3XHZjwybgmW7xeN+7qDs5i3VJMgMmtm4oPdwvmNhonAZdNH8z6l8OASq:m
- TLSH
  T1D3B633115F696E6FCE68433931BF2F1E0BA10F85840EF4D993D968CB219EB81153786B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  id_token_rayan/مهمممممممم.txt
- Size 153B
- SHA256 9c4a44676e291569cfde8448bbc98d77bfdc7b36a399e21e486ba6cd5f41d4b2
- MD5 87739e087f9e56ca791d1841f4134ccc
- SHA1 25cecf275e6e17df078478c137d0faa3fb17344a
- SHA512 d6a4b509cd1141ada5b42a31d76c29a1b1e74c689144fbe7b256857b4b680af8937c4e846126b106a48a7d2a8d1c3361cba3a2393da7ea145719a3815a34dab0
- TLSH
  T1C9C048A806B7087046434CEA0BD09818F4CE6A32A33DF0101F5DA29F01C88CEB38B121
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Uses WMI to collect hardware manufacturer information

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8