c52abc7d08f5bf735b390587177cd798b173b93340f7268445b1b86e7e229b50

Sharing

Copy URL Twitter E-mail

General

Target
MegaBasterd.Setup.Files.zip
Size 69.6MB
Sample261102-sppmmads2k
SHA256 c52abc7d08f5bf735b390587177cd798b173b93340f7268445b1b86e7e229b50
MD5 b5639b9029def11c2968de7c483c92aa
SHA1 cdbb42d328ba2ba2eff04d06e2dd922ef9574c6b
SHA512 a44c4ccc36c3d76ae8671447e992e1808877c2626b1b036620b81ba9a271000f7e90a4b4b032bed8f9fcaa217695a3b73036fc69c53ef747862580697d0b8b3f
SSDEEP 1572864:jcRibtxeU3HYKEUxgvL8On5ratEQEfmMckn8tFLshwtl9YJhGZPy:Ymo43EXzRratemqSvbCJhGZq
TLSH
T103F733B4975DD8C6E2A7F6B872DE020E9B3387E03661148F05A425C60DCBEE10F9A747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MegaBasterd.exe
- Size 1.0MB
- SHA256 5aabea7f15b2cadb7d0c72ce8127c2690ce151fbca4b3d59f98a357d5edc2e02
- MD5 cdbe768eb6c56bb16c8322e0944e974a
- SHA1 537d332be71948fdfb97ee952a62ed1904f497f9
- SHA512 93c7126ce96559acd459212d90801cb2a9dcce11f477fc4d0497422ce8d9cb2ba686012bda540c6822ebce2ef73d5e99be605f400cb5c88850dae1264271505f
- SSDEEP 12288:0bKzuyVCt5IQ6RmjgmTwk6Y29ib04ZU5anejz7GS9OdJKGBdfxijNjfe5y:0bUuyVxoVA9ib0GAkrfxijhfL
- TLSH
  T1F835CE61A7B30FFFF5EEC13445160E11E6A1381C47E05AAB438C52D7DE62B857AFAA10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery spyware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  lib/py3-windows-x86_64/python.exe
- Size 101KB
- SHA256 7c220ddbc41821a2c15199449fed09c0717e928f1d31abf0af7011c211d153a0
- MD5 27bdf16d0c85f535431d64d55d139c59
- SHA1 310a89ea3fe5bf77811178920b52d26eb903a9ca
- SHA512 6c3d4af08d2971c7938ba4e41a580da1fbdd5ed4ffd576384df03e8214b098e78f992a10b9b321fe8d4f05fd3158b0d9c2132355eb6e8b224c8d5316dcebc320
- SSDEEP 3072:Xly3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:OQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T15EA3F2065B5616BEE821803F9B93157697B0FBA327904CCB2211A2354FF7BC1AF37469
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  lib/py3-windows-x86_64/pythonw.exe
- Size 101KB
- SHA256 170d9b63a64f3eeb786e56838ac9a4e13dcebe2a8bc9b8b4693a986552537c0b
- MD5 ed55ba1ba33f83c7df8754180e97f0b0
- SHA1 3f39dd413e29d312239997f022ef29460c30be96
- SHA512 eace1a82bb144a841950874cd740176605dab6c2efbe2997927430a401fade80fbfa66a1a292ea58cf245f6a0a2b5e214ace230d5ae174b42309ebf9ed383057
- SSDEEP 3072:GlC3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:BQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T125A3F2065B5616BEE821803F9793157697B0FBA327904CCB2211A2354FF7BC1AF37469
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  lib/py3-windows-x86_64/renpy.exe
- Size 102KB
- SHA256 8dabd499909d27f919ef1bb1bc863aba87e36d6e969b462471cc881653a374d0
- MD5 97e64590abd8174a9766e2b4bfb7e9c2
- SHA1 7c31efea38a12249927e65a663db22e2a6798053
- SHA512 5bfc71c7d248ddf354cbb497fecfff62993a96c8e994c20adc84698e01f920e01f39e4b1241f5c3213a238d93968f38b054d32a3cd5d3b0b95486e946555b2ac
- SSDEEP 3072:iQ4y3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:HQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T106A3F2066B5612BDE931403AA6A30A7AD7B0FBA3275148CB1211D2350FB7BC1EE375E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  lib/py3-windows-x86_64/zsync.exe
- Size 92KB
- SHA256 dbc39d1d4ddc8c744e7840a294f906920c532adc0dc9e69f7664a91b55b2ff77
- MD5 2e9d3dc697a2e1fc5c5be1f7e04508dd
- SHA1 0f72289874472de314aecefeb5457812f1c72481
- SHA512 d938a7d94c869b3b67c70d016b10c6a3c79fc3e928f3471a829b925041feb192f2f4d77993cd450d8246e0a4eec94f2275fd44ffbb931e15a5f9e74624dc0d16
- SSDEEP 1536:/9yPhoPyrELhNx4xKM87bsp9G8e5VuSYJadGo7/TjX3DvrnAvp3ITPvsXXlgpoIW:KEL+kM87QpRKuSGI/TjX3DvrnAvp3ITn
- TLSH
  T1CB934A89FAC75AF6ED77097044D2F27F8730E601C414CE92D748DE8AE973962281A6CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  lib/py3-windows-x86_64/zsyncmake.exe
- Size 91KB
- SHA256 bb9c90f996a54a6c697f41a7897eb924e90e18a07746b612bcb5e034892f260f
- MD5 ac2119ef9d738e1a3b7f83c40616a238
- SHA1 d3f4e1675e39318e3ad9fa62b1144da637617234
- SHA512 f1274568f646ed807e01268f01407349f4b7d3be3ddc5bea29d44bc260847e6a45017809406632f65fbca25d3c7a96438356bf41b3c71f0f9360e85fd091ada5
- SSDEEP 1536:4bjZoLhn7LOuW35VgkJFNqGTfJUM8EoqUxvr7fYnPHv3jz/jDnTnbPr7Hf/TLzAJ:4/eLpW/gS/BUM8EIvr7fYnPHv3jz/jDo
- TLSH
  T19B935B4AFACB8AF2DD77493084D7E27F5B30E100C514DE9BE388DA46E913932591A3C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12