7e4f770fcf41ef71c6c20949b818193e16c76e68c664571a6316b4b8d22832e5

General

Target
HEU_KMS_Activator_v64.0.0.rar
Size 4.9MB
Sample261102-bpyf4aet2t
SHA256 7e4f770fcf41ef71c6c20949b818193e16c76e68c664571a6316b4b8d22832e5
MD5 61fef6ed4d40deef3323ce73056be53e
SHA1 64ac05da02e86174238d2cf6112ab4145545fcd1
SHA512 3bbff6a5425635bdd5ed9eefc0e80ebf0f85677e8d3461d3f3e7ac2446c3ac35a76f65464609b4553d0bfe120199a661668efc2e01ce031fbfc823ea1c473045
SSDEEP 98304:8URd0CvhiHq2Rq9GKvOqzpaxIIAovniUjQQNYoRNcFYH:8CdSZR+jzpuF8Q
TLSH
T1703633BB117DB578257201F31A2CC349E78035E781B49824F9A169312ED6B2C63FADF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  HEU_KMS_Activator_v64.0.0.rar
- Size 4.9MB
- SHA256 7e4f770fcf41ef71c6c20949b818193e16c76e68c664571a6316b4b8d22832e5
- MD5 61fef6ed4d40deef3323ce73056be53e
- SHA1 64ac05da02e86174238d2cf6112ab4145545fcd1
- SHA512 3bbff6a5425635bdd5ed9eefc0e80ebf0f85677e8d3461d3f3e7ac2446c3ac35a76f65464609b4553d0bfe120199a661668efc2e01ce031fbfc823ea1c473045
- SSDEEP 98304:8URd0CvhiHq2Rq9GKvOqzpaxIIAovniUjQQNYoRNcFYH:8CdSZR+jzpuF8Q
- TLSH
  T1703633BB117DB578257201F31A2CC349E78035E781B49824F9A169312ED6B2C63FADF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  HEU_KMS_Activator_v64.0.0.exe
- Size 4.5MB
- SHA256 6ad72af453a9c4db99a30317e97689e893a110681e84655392865c8a813e8a5c
- MD5 d02212c7fb76461347686d99cfbd25c6
- SHA1 912e34145e5822e6dbc98eac55b2a1b80f7ea305
- SHA512 5b65a3f929ef593bc957da360d8b9b15ee825bdb1b407e19a3980936ef460a2860e4afbadd10ba7870f2231cd0ec0bbfe95388416afa1ba50d4f3312ea764015
- SSDEEP 98304:G+S9bgH9IDIZzMxqJ5w2zbArLVuoeWgunT3IlhCA6l+keOq8:9Mcd8IRGi5w2nAQoeWgun7luP8
- TLSH
  T1692633D6B20FE90CC890E7B4611D9E4AD653FB89560F72AE7FA07A693D1434006CC9E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks for any installed AV software in registry
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  out.upx
- Size 5.0MB
- SHA256 2764bcf2ad0a82bd037dab34ae37b65f7eef52499abcb4a6be1707586da1a990
- MD5 3366908173f8239affc20a11e8cbd63a
- SHA1 024f17c4e4d7cd1b2d7d2e88359b4be936b8bd55
- SHA512 97458d9a9b3314086887bf375ccb76775a4d2309c2aaa7d480c182100186e682fea583cfcf1e03e85156df7434b51c5063444b027808f8149e615c413d0d4908
- SSDEEP 98304:GjTQYxsW5qIDIZzMxqJ5w2zbArLVuoeWgunT3IlhCA6l+keOq8:G3dxf08IRGi5w2nAQoeWgun7luP8
- TLSH
  T14B3623427342D02AFF97D3724B0AEE0697796B560117B62F27A81D39BE70370067D6A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  当前目录添加到WD白名单.cmd
- Size 416B
- SHA256 f9e65a39bfcb45fa75a3fcce4c421a33ddd726dbf5a300ada0623f1ee3fcded2
- MD5 0c629d146aeff1670273d4ffa0c6b01b
- SHA1 45933d928fde7041f7dcdec38e7bb177ec9dc0ac
- SHA512 b3d77dc80f7861f19bae99cf0cff269e906d27302b7383705ff9ea89dc4faa65ab563500aa9b7e3849b37c627e07a9cf3855d235ce88fae300d41155f34a6f6a
- TLSH
  T116E0EC6240EA445F663673608E5D61553C1FD1BB0A599DC36630C4607904988F1EBE5B
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral4
- Target
  当前目录移除WD白名单.cmd
- Size 422B
- SHA256 608896bbc173dda3037eefca287ad6de2b032c14423b01d06135632c54037995
- MD5 550eb7300f60e7b2746c1c33aa2dc3a5
- SHA1 00f442cd25aae45a8d0097d983c7922fc5c5417e
- SHA512 927a36d33812d0100b4bed427f6899b41928e0e98acd19c3634db81df14469bd0056b7e18d2e42aa910aabca4111ac86bad60998bdb94909fe3978729e13f8b2
- TLSH
  T113E05C2200EA441E673632608E1E25552C0FC1BB4A5DADC32630C4607904988F1EBE1B
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral5
- Target
  更新地址：微信公众号.jpg
- Size 628KB
- SHA256 36483cea085373955d9c504faf8d0a608a4109760a7bcc36fc38887c8c45ddec
- MD5 123a56f34eee911cf7947e67082643a5
- SHA1 29b31beb20aab73b4c77c34f0d50a939153b4843
- SHA512 588fd2251a9dd56195a7f8231b7cb270c3a11de2a8fe93f5ecd8ca80a8407a92420d9b08b30706354e90117dbed0a4cbbe197d239c7c8fee16e5a16d59243c41
- SSDEEP 12288:2PmmG7QG1DpDp8Ykz94nFxXB/mq6w0W1CCDIxQ:DXx+Yk4ki7BMxQ
- TLSH
  T137D4CAA68DB07F56BD561D1863A06FBA104D282F5BE9020CB85DCF8B7183DDA70DF846
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  更新日志.txt
- Size 41KB
- SHA256 2ab146e4aedc502629b4c9cb0b47ab5d09310481001bd21f58213f9bd3d620cc
- MD5 de551fc6ce06d405be2e1bf9e80d25e8
- SHA1 7a3c1b029741dca01d6dac9c25c3f246ffda5ac0
- SHA512 5b7739934a59b27c7051d168c14bdd046cae9660bb5ee3d79523f27992a309d1d7cae295a6edb9f1b257512eae523c11ee582191bb7c117f88a7583250cb86fc
- SSDEEP 768:uWw5o5yGjfqNYpwBErFeotR2Ck5CTi3Sh:uWws5fuE+C5m3Sh
- TLSH
  T1EA13D627B52F0417F336627A83164582CA7580D1866BCEE2B06DB8F44FB324927EF95D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7