71d194fb6617e5117ca9e387c037a410d600b37116bc82341c9635d403a4cbd7

Sharing

Copy URL Twitter E-mail

General

Target
zapret-v1.8.zip
Size 1.9MB
Sample261104-3vm14agw2p
SHA256 71d194fb6617e5117ca9e387c037a410d600b37116bc82341c9635d403a4cbd7
MD5 929da0edcd730ace17a3a6efcbd1c81d
SHA1 cbd49e1f67f78353302901a0edcdf6117d8b077a
SHA512 f72f5d1cb4cc2ab0dab8cca245a5378776b71039a30793f378e36d84c853b55279c09e1411d9ca3cc693b68b4b1031c0757da651e97582b3e87c5fa7a1afc041
SSDEEP 49152:XISu2eARcL+uUAtWfxtqOQ154PwjSAeXB:4Su21RcNttWfxtqZ4P5AeR
TLSH
T1A495331DC43F4A0DCF87B4B5155CA82E02421A4A1CD36A18B65255FCF99D0F22BF9BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  zapret/bin/WinDivert.dll
- Size 46KB
- SHA256 16abd6a029e65557c6a309bea7b13bf81fff4e193567582e1cddbf6719f323e0
- MD5 407f321a43415b878b727e2c38152950
- SHA1 50aa3cc1cb575e057b335cad83a0242f31fc6d46
- SHA512 8d2235920a21b4142e1b561db181acb5c6a5725a5c9ba0f506e913ff5a0809fc8f7648a474318bc5837e37150ae82718a444954b71f29495c6fa5b90cfeb6eff
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T13623D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7992D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  zapret/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  zapret/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  zapret/bin/winws2.exe
- Size 641KB
- SHA256 ba4ceccdea3576da0a0991a50d7893ea911de197281338132dbec02a5b2fcf58
- MD5 9d6589930197aa1609fe428b689af75e
- SHA1 b7d9fff2d7928d7eff87de037eabc8ba1c3f798c
- SHA512 7ef04d622c4b6c9b67f334308b11d998136b1f8fa7694b0bd72020497ead5d047f6372c5f4f009eb4e70646a12fb68af303a45364b27d2d74d4a0aebcba9090a
- SSDEEP 12288:/dre9GRrrDYC1rhFV48ZzpJhZPRWwUOLIVpBlF1ZM6:JbkC1rhP48xpJ7RTJcVr
- TLSH
  T11CD47C06E2A248BAC46291718B9ED732B731FC491324AB1E3B64F71C1F35D605A9F76C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  zapret/lua/zapret-auto.lua
- Size 20KB
- SHA256 23a9b99a776d868d92f4cc0ee5110f5c1f12fe746620d9c0337022dbc2f52df0
- MD5 0c8c7f602e6b00044f9b8becb121b95e
- SHA1 eb46f8059e8ae4b8ecd4faf566178239e946db49
- SHA512 f98b01bb3a9accf2e920211fce01070fc6fe75ec3aa4fd9179dd0e5cec0719eaa0638f40dfb5143e3410d3cd1b122ed495c7fd6d54d29ddf7db7aba2b9f95f7b
- SSDEEP 384:63XwNmUNOhLJrChgl4ggcfXZmX3pLAyuIgSriMJ989Un2jYyXuTw:63/vhLJrCil4ggchmX9LuIgIiMJ989UQ
- TLSH
  T12692648E33A5E2611E1912F8D41F3616AE3EE4A6C28C2554E5CD0FA0252741FE4F7F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  zapret/lua/zapret-lib.lua
- Size 91KB
- SHA256 6bf528fef1f0fc3c65e189216fc8a06bb873f6e25d1c29d2bfa4695a09b73440
- MD5 6a4cfc60aaf9cc27aa1992c95ec4297a
- SHA1 3a5a6929e3c9e635f90856081e9fcf5f94bd2497
- SHA512 73bc3db59b441b18bcbe5850f46ebc8654854f35b39cf53f7ff63215724443088499d98724112c033534fca57ebc1b6feba8c4820645f09b31f362a07db1d86e
- SSDEEP 1536:84Oc4TT2a1GF/9QbbHV6UCfdmYBGhmgrg2OjdKXq:8Rc4TT2wP16ddzurg2Ojyq
- TLSH
  T15793F9CE3BAAB2AE168032B5C00F1E547E6CF676618CD615E0CC81B5750969FD1F3A78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  zapret/tools/autotune.ps1
- Size 4KB
- SHA256 523f89e3dd3468611c5424e8d14be67ada3d877987d72f8d8b20ea9a1f4911eb
- MD5 6343a283647e9b30109eb24c260624f7
- SHA1 7bfae4c96eb0707e509e6d320d92f6bb8ff1aa57
- SHA512 e5decf26f42805cfdef0b52982a83064880fdaaa41f75add5fdadbb393dfbfb54ca5a106a3614ecef915ce0970c5fe357dea6147df0f1329fdd643182a9e6854
- SSDEEP 48:k3fWU2obdRtUdTRmOiMprlytxC/MBVIJ2rphLJS7WzqjAL7k9yA66TsHau0lYVgS:SWsbdATRmUUrIJ2lnmA9nq8WVPfXIww
- TLSH
  T1A9916625859C40FE11C0A10BC989F50D796948FF6666931135BD2CEA5FE213CCB39E6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  zapret/tools/diag.ps1
- Size 2KB
- SHA256 45d7ff600d3825b92c0748309830beeb34d699a8cacf44185b7538568b9692e3
- MD5 686cfb4f1016c29a22648469e0474f70
- SHA1 7d1f0623be602e44830bb3bcd2ee891674800f07
- SHA512 a045565178b4c84fa79a188ae5055b7d7a6232b253c8f0e93abd75f37be66f4bc47ead91acff648829efd4e28c6905ab5cf683a79b8374aec261c761fb8ba435
- TLSH
  T185416114D5DC302E5101A05BE868FD4A39EB18FF7F2E8A2209A43D6F75F20188B7578E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral14 behavioral15
- Target
  zapret/tools/lib.ps1
- Size 215KB
- SHA256 70cfd669a4547e0b106c50e0bbd5d91c1518b624268705d54726fc274c6ba285
- MD5 72c6887f080373a484c42ca61bbe77fc
- SHA1 e14c78c29729f30cbbb13dceac799833f343aa14
- SHA512 47b8a0e1a3993a8d40b329d3788cc74f42cc3158e50a6191efcb084a45983cc45aac894685c8a1672485764558a1a412afd73e9dbe4888b42eab361350165157
- SSDEEP 3072:fJSR1dR1weQmYspe23b/iq2PH9IQ6sz/kXkGsWckm1H7ruSL01r7R:fkRaeQlx23mTHqQ6sgxm1bi80f
- TLSH
  T1A724D81169DC949A1383B02BDD45A80DBEBB00BF662E970135BC99ED7FE1038C77CA59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  zapret/tools/menu.ps1
- Size 69KB
- SHA256 1c04c5da9bae804b034fac7a882d065e27efd599a4610968be61913f385c4f68
- MD5 dc8c704be73ca2a96f22a0c00c3e856c
- SHA1 500af8e8c12e9bec945c4ec428b117a0d5550d78
- SHA512 1a6ca0bc73b29e85b32d6e321b157783172e5bf8ef34495fafe2134ba9fbcf944917d90a9767d52fdbb90e0820011173d405dddbb4aafe2478e8722592ca7917
- SSDEEP 768:ib8rf07AUWEcZ/tfQyA9uxwoSG/KugVTQainj+z+vvsC9VGf4ZYIL/vgYIq6b5P:I8rfJUvC/tfnA9MwRGtsiiz+f/v+q6bZ
- TLSH
  T1B163322095C9245E1282B06FDC44EC0D3AE754FFBA1E5B1535AC19AE7FE202CC67CA67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies file permissions
  discovery
behavioral18 behavioral19
- Target
  zapret/tools/notify.ps1
- Size 3KB
- SHA256 159042fa40d65b9a2f53bc2df369aae1475308d9053bb600d14f48bd06769b72
- MD5 8436e079a3daaa8d13ab4ea800481b92
- SHA1 abb87e89b584e36e0d63e4c36f9c2428d2dea0e5
- SHA512 a6980cf53c17c218751e973695b6a3a2f530b6772d485d202856f3138b3fcc7be17c45e596fc9c230d395d41838c938e59ddd82efacdcc69a3148f004b15ed71
- TLSH
  T19F716121998A506C5E41B167C948BA0E7E4B48FF3BAA530110EE1D5D7EF2038463EF57
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  zapret/tools/provider-check.ps1
- Size 6KB
- SHA256 dad2ed244a6314f7ad24241abcd22910837d7b35978dc4617544b022d0713402
- MD5 e450c18c9c14e7d9e29cf25bfe0ffe20
- SHA1 a116fe4c03e56931761fb46cfb7db08b387c2654
- SHA512 a86f7242e30444f3d3b90964a732f16a2a29f60a141b31c3a088822916e662485246a0bd0e7062e0591637b91fe2600052eb5bce0c4fe85248d67b3ef5243fff
- SSDEEP 192:srhNk9mh150JIMOQm59bXouASurdQnGFs:q5QVoGrO
- TLSH
  T18CD1952086C9244F0282F10B9818FC4D79A740BEAE6B5B36257C599F36F317CC13D7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Modifies file permissions
  discovery
behavioral22 behavioral23
- Target
  zapret/tools/report.ps1
- Size 8KB
- SHA256 f654fac391b040c0bfae38e7558db9dd554330271cbfb154825342817a1d713d
- MD5 6aa8b91d7742a2f96554bd7f48a248f4
- SHA1 5e1bb2ec3380e0f3db626ac1d56db1d2d2739d70
- SHA512 dafa2558555f1b488a45050889951cb4cb8c2ad73d5b15023d44b66211cf07462d6ac3a5c5e2e3ed932d3e4107c986673c07c515d3426f6905edbe642d98a3ac
- SSDEEP 192:C8RnH1pXqHbtz9bXopbqQT9uDxOwb8C6OwAbswfoOYfCQ:C8Ez6eTwC6Owc5HQ
- TLSH
  T1A902861075E8746B3181710FC85D9C0E2E6720BF762A931927BD956D78F34A8CA2CA6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware execution persistence privilege_escalation spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral24 behavioral25
- Target
  zapret/tools/scan.ps1
- Size 12KB
- SHA256 22a2dc9c95971a0a4d24e5568dc6c49bfaf6ce9bcf08e11b92e1470ff4613c47
- MD5 2eef30a9515d19d1b0b6bbeb525a2709
- SHA1 53bb735d9606e453a97800a101e167d134290b88
- SHA512 a27fcabf4ba277ae8619078d705847cffe2b7b1e82286654f61740da3d27bb7efefe1613b9664f1298299128162b73b6a0f9ce2412a83ac25590bcbc022897b9
- SSDEEP 192:qhyZ2FpRmk2vyWMmyGXdQUC/C25V/cg+6eBEvdoWKfTczf4SjSDPGiRPAS334SJH:qV1mkZmKUkfbmT1VhN3+2D8V8B
- TLSH
  T13D4297119ACF98AE0147F05BDC44A509BFAA00FF6A5F4710359C56EE7BF107CC62C99A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  zapret/tools/test.ps1
- Size 38KB
- SHA256 430301656fd8a8a13e0ff1264f64ccc42bf03ae6ec71e43ee84b1f364e5f6ed5
- MD5 b6175418096f39dc25dd4cd722b0049c
- SHA1 22fc68ad40f2885901ec50b42b931751aea35314
- SHA512 8e04b721198292ba94876036375e49fa866a7ac68457c49848c80a2dcfe26299a5f63a8721ce382e467d12598cb5aecfbb0acd7aec9cb6aa54aca7c4cd513611
- SSDEEP 768:AWOTBcjdXacB2k2yHpOLFTY2AEuXvekn6J+seG2mb+oEFa6rQ9p:AWgBcjdXacB2k2yHpOLIEceBJ+JRS+oJ
- TLSH
  T1D903840066DC94DE1242F05BCC45A80DBEA614BF791E5B1279BC96E97FE203CC27CA66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  zapret/tools/tgbridge.cs
- Size 43KB
- SHA256 0484bc401feeae11b6607aa3c96e9f4db7260a698b6b366dabe7680453a01711
- MD5 96e4fc7228fdcf7e18ab72f30840eca2
- SHA1 918e8fb21b687696ba90e1a1e47a0510b2cb9cce
- SHA512 f602db1fabdf2f56fac950d9402dc0eb34677916ad988c13653d03143e71d377afa9b2dba5620875c713bb7e9cef306e273c5666df3559b2e3ed63c63439b435
- SSDEEP 768:Gh7BcFP47Wb/l9G7eDy1stNkHs1g2kVFW+39VnC:GY147Wbl9l+1uNkMNk7PnC
- TLSH
  T1C713D90102F3A8760353B03EDB43A50ABA35817F36AFED1ABA5E49197F55424C7BCB94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  zapret/tools/tgbridge.ps1
- Size 1KB
- SHA256 ca0061a88da20325ca92931fbd43cc9e0b8ff968eaf8c81f1a7b0e2aff7840a4
- MD5 e993325fd9501f095c4556a65656fb1d
- SHA1 954b3e88dbade0eaa5f0336eb7bf1f3149868a0b
- SHA512 4123b3e065ecd396cf61d2fa1b8b4fba955b4616c0eac1eed608f2eb4f06b82b9d266fa0820f2a86bd58c9790320366a6b1e4fc31a1bcbe55947aa1a65be7f58
- TLSH
  T15A3151B2B69B519E1989F063E050FE4F744B94FE665E433004BAA82EB0FA56887313C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Modifies file permissions

Modifies file permissions

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32