199791facc57a9df2b567ea40c70f05e53e9112e828f6834c2c16f724b943e12

Sharing

Copy URL Twitter E-mail

General

Target
nikkeminiloader_oG7STxbESBb.wg.intl.exe
Size 8.6MB
Sample261104-1venlsf12j
SHA256 199791facc57a9df2b567ea40c70f05e53e9112e828f6834c2c16f724b943e12
MD5 335069badb99337b20a62cbda5cd5af1
SHA1 694bc2bf76ab2715824737433a0c7d4cc85e0dff
SHA512 19e5a93c87fe0a5991a365377db0954cb5aa46109c70f7082ec902c78336c5547607e1ea68d00760ac67b931a5025f8e1cb44e9409d33cea8e1df0324d9f59e7
SSDEEP 196608:J+cAa55JA3mNoZ26cgjzBcPBRPWmbcIs/a/2lwW1RGoVrr:J+cn55JPs/hzo3rAIoyawWFrr
TLSH
T17D9633D6A0C3D586F4B66E78009E8674E6532C1B86629C333964FD2B393B5F3C97B142
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  nikkeminiloader_oG7STxbESBb.wg.intl.exe
- Size 8.6MB
- SHA256 199791facc57a9df2b567ea40c70f05e53e9112e828f6834c2c16f724b943e12
- MD5 335069badb99337b20a62cbda5cd5af1
- SHA1 694bc2bf76ab2715824737433a0c7d4cc85e0dff
- SHA512 19e5a93c87fe0a5991a365377db0954cb5aa46109c70f7082ec902c78336c5547607e1ea68d00760ac67b931a5025f8e1cb44e9409d33cea8e1df0324d9f59e7
- SSDEEP 196608:J+cAa55JA3mNoZ26cgjzBcPBRPWmbcIs/a/2lwW1RGoVrr:J+cn55JPs/hzo3rAIoyawWFrr
- TLSH
  T17D9633D6A0C3D586F4B66E78009E8674E6532C1B86629C333964FD2B393B5F3C97B142
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence ransomware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  nikke_Miniloader.exe
- Size 5.0MB
- SHA256 e8e98a8882a1d2a03bef6ee54c7ee49cf6878cbaa8cdee8ba1816418fbdc991c
- MD5 d41ec5d6d4d0c2ead4d78d9c41ae8302
- SHA1 39ca3deac9eaae006328698acf2e30ab059c08e8
- SHA512 1253dd125e751377bfa08a3ae9b6b0b954ec12a7c57bd2fc0b3451b7b03ab035aec71af9e6b5062a7a9a8e820cfeed75bc8f518bc6234765a50149263a2ba37f
- SSDEEP 98304:as0pvKobt9A4IBBOz3pr6S3WQsNU99d4DyNJBZinhUt4veG7cUHPd3:aB6Oz5KUrNJBZ0Gt4W+cAP1
- TLSH
  T1C836BF327A8240B2E5A30270592AFFB9EDBFA9700736C5D342907F5D5D712C2563A36B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  tiny_dl/VersionService.exe
- Size 10.3MB
- SHA256 fabab4177f320e78082ec45047c87ef3286a5eed39a87780ba9699ac0b362187
- MD5 efdb796b94ead12bd64d66ece0b2252d
- SHA1 415954572249b82e3718c92e2dbca4582e833b65
- SHA512 11817f5245fa2c5bbf7c1997f3b8d4e3f81f9c0830a02f61c1ce178d79a6080345d78889209b0f24129b3e8d212c9b7f36c337727457d140e1366a8c86e3b331
- SSDEEP 196608:cixg5NkeeNG7ll5GU3mwBDXbz3hQiTpBS1GEI0rj0wVtQi/iW1o:FC6axVNT61Zj0k9KWC
- TLSH
  T14AB68C31B740D53FC6130573552E66FF106877328BB588CBA7082A6C5BB4AD2A734EA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  tiny_dl/VersionServiceProxy.dll
- Size 1.8MB
- SHA256 97c545103f69204081dcee6eee238fe06dbee73321a83e46ede491205dfda892
- MD5 e253c9193bb72c1d693321699c85472e
- SHA1 6a69361cb0fa32d3ddafbb3da6b42dc8d4a72860
- SHA512 65dc8e215d1a6a90136c83763159a6063e192cfbf75c7a85d5c5c07ac05e40846526fcbbf0852f07c29725d1c33ddcc0686902772fc3bca3e2d168d165f392fd
- SSDEEP 49152:v9J/pUW2MknzBLD1cze5G6D0WZTdX2UPki0c9GEh:v9J/pYnFLqzeg6oq
- TLSH
  T1AD957D327640C43AC65F1232983DA5AF019CBB7107B445DF679C7A7EAF744C29A31A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8