7d2d5eec88face8ac97f86bbc9cc25b08dbfedce46731df513b82d03949ff05f

Sharing

Copy URL Twitter E-mail

General

Target
zapret-v1.9.zip
Size 1.9MB
Sample261104-3vls2aes9v
SHA256 7d2d5eec88face8ac97f86bbc9cc25b08dbfedce46731df513b82d03949ff05f
MD5 8bdc847bf6d8c5937bb90b55ac9d5479
SHA1 f06dbfa43c2e5e06b469c688877e0598c202196b
SHA512 9fcd9f9e5d759d2398f6f9bba07dc895c947ed929204e5f8c8d8ddea09c9688985ca13ebbb10fecc1185c07cd5225c2cfa6fc75fe274e12e159d462549c11a95
SSDEEP 49152:mosySu2eARcL+uUAtWfxtqOQ154PwjSAeX3:mmSu21RcNttWfxtqZ4P5AeH
TLSH
T171953359D43F490CCFC778B5144DE42F02425A891CD36A28A21256FCF89E0A76BFABDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  zapret/bin/WinDivert.dll
- Size 46KB
- SHA256 16abd6a029e65557c6a309bea7b13bf81fff4e193567582e1cddbf6719f323e0
- MD5 407f321a43415b878b727e2c38152950
- SHA1 50aa3cc1cb575e057b335cad83a0242f31fc6d46
- SHA512 8d2235920a21b4142e1b561db181acb5c6a5725a5c9ba0f506e913ff5a0809fc8f7648a474318bc5837e37150ae82718a444954b71f29495c6fa5b90cfeb6eff
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T13623D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7992D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  zapret/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  zapret/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  zapret/bin/winws2.exe
- Size 641KB
- SHA256 ba4ceccdea3576da0a0991a50d7893ea911de197281338132dbec02a5b2fcf58
- MD5 9d6589930197aa1609fe428b689af75e
- SHA1 b7d9fff2d7928d7eff87de037eabc8ba1c3f798c
- SHA512 7ef04d622c4b6c9b67f334308b11d998136b1f8fa7694b0bd72020497ead5d047f6372c5f4f009eb4e70646a12fb68af303a45364b27d2d74d4a0aebcba9090a
- SSDEEP 12288:/dre9GRrrDYC1rhFV48ZzpJhZPRWwUOLIVpBlF1ZM6:JbkC1rhP48xpJ7RTJcVr
- TLSH
  T11CD47C06E2A248BAC46291718B9ED732B731FC491324AB1E3B64F71C1F35D605A9F76C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  zapret/lua/zapret-auto.lua
- Size 20KB
- SHA256 23a9b99a776d868d92f4cc0ee5110f5c1f12fe746620d9c0337022dbc2f52df0
- MD5 0c8c7f602e6b00044f9b8becb121b95e
- SHA1 eb46f8059e8ae4b8ecd4faf566178239e946db49
- SHA512 f98b01bb3a9accf2e920211fce01070fc6fe75ec3aa4fd9179dd0e5cec0719eaa0638f40dfb5143e3410d3cd1b122ed495c7fd6d54d29ddf7db7aba2b9f95f7b
- SSDEEP 384:63XwNmUNOhLJrChgl4ggcfXZmX3pLAyuIgSriMJ989Un2jYyXuTw:63/vhLJrCil4ggchmX9LuIgIiMJ989UQ
- TLSH
  T12692648E33A5E2611E1912F8D41F3616AE3EE4A6C28C2554E5CD0FA0252741FE4F7F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  zapret/lua/zapret-lib.lua
- Size 91KB
- SHA256 6bf528fef1f0fc3c65e189216fc8a06bb873f6e25d1c29d2bfa4695a09b73440
- MD5 6a4cfc60aaf9cc27aa1992c95ec4297a
- SHA1 3a5a6929e3c9e635f90856081e9fcf5f94bd2497
- SHA512 73bc3db59b441b18bcbe5850f46ebc8654854f35b39cf53f7ff63215724443088499d98724112c033534fca57ebc1b6feba8c4820645f09b31f362a07db1d86e
- SSDEEP 1536:84Oc4TT2a1GF/9QbbHV6UCfdmYBGhmgrg2OjdKXq:8Rc4TT2wP16ddzurg2Ojyq
- TLSH
  T15793F9CE3BAAB2AE168032B5C00F1E547E6CF676618CD615E0CC81B5750969FD1F3A78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  zapret/tools/autotune.ps1
- Size 4KB
- SHA256 e82f1902dbf0fe82b31f0742e412feb22c6b456e52c97dca79337d9daf9360c5
- MD5 fd1e39c8ac9f4f1cca65747e8f75a6d8
- SHA1 f378d6cf79bae2d5878fb055be960cf9b13334b9
- SHA512 fc4afb6cdbd4ce3a05b77f0474366f8176878d741f8d57d80bd63cbfd7f4088ea8271b755fbf6d3595dd879e0a861325689e86abbf55a35ca7b46dab79db91f4
- SSDEEP 96:SWsbdATRmUUrIJ2lnmA9nq8WVPIx/6eiIww:GxC9UrIJ2FmA9sVPghiIR
- TLSH
  T136A17825959D40FE11C0A107C989F50D356944FF6566931135BD2CEA5FE203CCB3AE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  zapret/tools/diag.ps1
- Size 2KB
- SHA256 45d7ff600d3825b92c0748309830beeb34d699a8cacf44185b7538568b9692e3
- MD5 686cfb4f1016c29a22648469e0474f70
- SHA1 7d1f0623be602e44830bb3bcd2ee891674800f07
- SHA512 a045565178b4c84fa79a188ae5055b7d7a6232b253c8f0e93abd75f37be66f4bc47ead91acff648829efd4e28c6905ab5cf683a79b8374aec261c761fb8ba435
- TLSH
  T185416114D5DC302E5101A05BE868FD4A39EB18FF7F2E8A2209A43D6F75F20188B7578E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral14 behavioral15
- Target
  zapret/tools/lib.ps1
- Size 237KB
- SHA256 9402bed16f6fea1678f1226ba3f0a120900aeba4afdac321c02c72127b8e308d
- MD5 1a64110d1a19784ef0df7b6871e47f0e
- SHA1 e7320ac5487865d12c86c75795e5face08bd4e82
- SHA512 83bc0fc971d9685b546cb63a9365ccb3c9704ac4b881d6dbc6ebbc05455401d2068fb336db8e045914f751b5ad0b85a1677cb353585ad68208f06f02d5d5316e
- SSDEEP 3072:MJkS1dR1weQmYsKMmTbVi9L6PH9IQ6Wz/kXkGfWckm1H7rut301r7R:MrRaeQlwmTEeHqQ6Wgmm1bil0f
- TLSH
  T17E34D81179DC94991283B02BDD49A80DBEBB00BF662E970135BC95ED7FE1038C77CA99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  zapret/tools/menu.ps1
- Size 70KB
- SHA256 f8bcd1c58e0905197c4c8cbb1848b4e56604fd015d9232a7bdfe93d251407f8a
- MD5 73e47fde618656050090c6387761a0eb
- SHA1 3d44a42956fa1bb7060d6ee96a154733670ac27d
- SHA512 1905f9cecb63df1f7fe6b0d3870ca4d967f4e8d40e2e130b42de153fd606c65c3976a162cec7077ed0c46da3b8d51329f2a1a4c41b3bf2b2cd88eb0418afce72
- SSDEEP 1536:IHGgfJUvC/tfnA9MwRGtMi9z+cov+s6Jx:LSnJWXQovWx
- TLSH
  T1A863422095C9245A1282B06FDC44EC0D3AE754FFBA1E5B1535AC19AE7FE203CC67CA67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies file permissions
  discovery
behavioral18 behavioral19
- Target
  zapret/tools/notify.ps1
- Size 3KB
- SHA256 159042fa40d65b9a2f53bc2df369aae1475308d9053bb600d14f48bd06769b72
- MD5 8436e079a3daaa8d13ab4ea800481b92
- SHA1 abb87e89b584e36e0d63e4c36f9c2428d2dea0e5
- SHA512 a6980cf53c17c218751e973695b6a3a2f530b6772d485d202856f3138b3fcc7be17c45e596fc9c230d395d41838c938e59ddd82efacdcc69a3148f004b15ed71
- TLSH
  T19F716121998A506C5E41B167C948BA0E7E4B48FF3BAA530110EE1D5D7EF2038463EF57
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  zapret/tools/provider-check.ps1
- Size 6KB
- SHA256 dad2ed244a6314f7ad24241abcd22910837d7b35978dc4617544b022d0713402
- MD5 e450c18c9c14e7d9e29cf25bfe0ffe20
- SHA1 a116fe4c03e56931761fb46cfb7db08b387c2654
- SHA512 a86f7242e30444f3d3b90964a732f16a2a29f60a141b31c3a088822916e662485246a0bd0e7062e0591637b91fe2600052eb5bce0c4fe85248d67b3ef5243fff
- SSDEEP 192:srhNk9mh150JIMOQm59bXouASurdQnGFs:q5QVoGrO
- TLSH
  T18CD1952086C9244F0282F10B9818FC4D79A740BEAE6B5B36257C599F36F317CC13D7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Modifies file permissions
  discovery
behavioral22 behavioral23
- Target
  zapret/tools/report.ps1
- Size 9KB
- SHA256 7b6c18c2b99a0f2fb512db11473e84839984b86deb252e2c189ca8f0e2ec24c4
- MD5 82425af9b9e6d0050a974b280b956cb1
- SHA1 00e3054f6b12755ffa76e51f21986b68ce75c607
- SHA512 aceda4ad3d4bc4c57f58da15f494ae469423e3c2b8e304c0284a7cab20d5ca55cf7899ad595d43243fd74da42dac491e85b8a184791c60f22384ecdf1231f897
- SSDEEP 192:C8RnH1pXqHbtz9bXoS7TbqQT9uDxOwb8C6OwAbswfouYfCQ:C8Ezb7BeTwC6Owc5hQ
- TLSH
  T1E612961075E874AB3181711FC85D9C0E2E6720BF762A9315237D956D78F34A8CA2CEAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware execution persistence privilege_escalation spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral24 behavioral25
- Target
  zapret/tools/scan.ps1
- Size 12KB
- SHA256 22a2dc9c95971a0a4d24e5568dc6c49bfaf6ce9bcf08e11b92e1470ff4613c47
- MD5 2eef30a9515d19d1b0b6bbeb525a2709
- SHA1 53bb735d9606e453a97800a101e167d134290b88
- SHA512 a27fcabf4ba277ae8619078d705847cffe2b7b1e82286654f61740da3d27bb7efefe1613b9664f1298299128162b73b6a0f9ce2412a83ac25590bcbc022897b9
- SSDEEP 192:qhyZ2FpRmk2vyWMmyGXdQUC/C25V/cg+6eBEvdoWKfTczf4SjSDPGiRPAS334SJH:qV1mkZmKUkfbmT1VhN3+2D8V8B
- TLSH
  T13D4297119ACF98AE0147F05BDC44A509BFAA00FF6A5F4710359C56EE7BF107CC62C99A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  zapret/tools/test.ps1
- Size 40KB
- SHA256 172252c0af567a14591ff42b35e56f25d6883359a66116b9be6d5ccb9475095a
- MD5 f356f4d3b10ca8888beee194bff46e27
- SHA1 345ecdf520f296b392c1ae3b204608dcbbc554bf
- SHA512 f4dd8b27f0151b00ce220fc51f010c17c130f6c7cd1c04188fe5a08b0d5b2185168d0a0b74470674cd9e9e1e20de133ddb3a01520432b22123a8f93ce811ab40
- SSDEEP 768:AWOTBcjdXacB2k2yHpOLFTY2AE2XvekzoJYseG2mb+oEdk6rQ99:AWgBcjdXacB2k2yHpOLIE0ezJYJRS+of
- TLSH
  T19403951066DC94EE1242F05BCC45A40DBEA604FF791A5B1279BC5AED7FE203CC27CA66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  zapret/tools/tgbridge.cs
- Size 43KB
- SHA256 0484bc401feeae11b6607aa3c96e9f4db7260a698b6b366dabe7680453a01711
- MD5 96e4fc7228fdcf7e18ab72f30840eca2
- SHA1 918e8fb21b687696ba90e1a1e47a0510b2cb9cce
- SHA512 f602db1fabdf2f56fac950d9402dc0eb34677916ad988c13653d03143e71d377afa9b2dba5620875c713bb7e9cef306e273c5666df3559b2e3ed63c63439b435
- SSDEEP 768:Gh7BcFP47Wb/l9G7eDy1stNkHs1g2kVFW+39VnC:GY147Wbl9l+1uNkMNk7PnC
- TLSH
  T1C713D90102F3A8760353B03EDB43A50ABA35817F36AFED1ABA5E49197F55424C7BCB94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  zapret/tools/tgbridge.ps1
- Size 1KB
- SHA256 ca0061a88da20325ca92931fbd43cc9e0b8ff968eaf8c81f1a7b0e2aff7840a4
- MD5 e993325fd9501f095c4556a65656fb1d
- SHA1 954b3e88dbade0eaa5f0336eb7bf1f3149868a0b
- SHA512 4123b3e065ecd396cf61d2fa1b8b4fba955b4616c0eac1eed608f2eb4f06b82b9d266fa0820f2a86bd58c9790320366a6b1e4fc31a1bcbe55947aa1a65be7f58
- TLSH
  T15A3151B2B69B519E1989F063E050FE4F744B94FE665E433004BAA82EB0FA56887313C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Modifies file permissions

Modifies file permissions

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32