1db258757875ed1d931b705fd0d6ac801a0967ab38a9867a1070d5cf487b2a6a

Sharing

Copy URL Twitter E-mail

General

Target
zapret-discord-win64.zip
Size 1.3MB
Sample261104-xgr51aee25
SHA256 1db258757875ed1d931b705fd0d6ac801a0967ab38a9867a1070d5cf487b2a6a
MD5 9af2ff93297165d7974005bb7d1c93ed
SHA1 3e1d5b72e0ac6200cc8435fecbedde1687239ed6
SHA512 1a0e3536939c520892e13f967960ef8dba8a1f6a5c35e3c71b3e0ed0c13e2a66027ac20f9d9b9fe419ed2f385c0bf2c91e3684ca9ee00b7653e0e8fffaa3a594
SSDEEP 24576:0HwhKdV0gcXh0V8Y7Rgx0GGEIGwt2V4L6uK+4hIO3YYBEsyv6HP77EuZXOKon09:jhKIgcx09u6GHIp2V8KMYisYqz7Eu5OU
TLSH
T1AB6533B731FB9484FA94D2BB4B609A32432A134763DF06690FC42AD5117DB513837BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  bin/WinDivert.dll
- Size 46KB
- SHA256 16abd6a029e65557c6a309bea7b13bf81fff4e193567582e1cddbf6719f323e0
- MD5 407f321a43415b878b727e2c38152950
- SHA1 50aa3cc1cb575e057b335cad83a0242f31fc6d46
- SHA512 8d2235920a21b4142e1b561db181acb5c6a5725a5c9ba0f506e913ff5a0809fc8f7648a474318bc5837e37150ae82718a444954b71f29495c6fa5b90cfeb6eff
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T13623D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7992D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  bin/winws.exe
- Size 218KB
- SHA256 2da71e80878dc270ac83f5893ecbb841f9752a57f1da8ff9325636b4346bc632
- MD5 f2b2f039c9c21b12af463111a32a9a38
- SHA1 79794240614befc892f3f0915f5adac5d760d64d
- SHA512 131456e1e1fa2c2f178ca9510ebdd9d70642f1e23b33eb3d939f409547f8fc8d4806174ec7e4126d04d6c35dbbf440ecb1eb3377e86f66b8e996b793bf6913da
- SSDEEP 3072:Hd0M+XQsvL6HZSi44zstHi0OLD1/OwMbNF6rAhpQ2rrR3IckDiFh2F7J:HGMYn4V0oZRe6CIckuFMJ
- TLSH
  T1B7245B57E3D688F9C562C178D6AB6333A931FC452124EA4B9FD4CB142F62F10A12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  install.bat
- Size 3KB
- SHA256 bdc4d2839a129e30a0bca2d81fad7a789802e8e28deeb4587a65aa537577c17c
- MD5 40170fcecc2222c13b6a9864a7e4abe9
- SHA1 fdc2d8c0a5433fc8b0febf5efc35403978f8a8b3
- SHA512 e78b3f002c1d1b3f6d1b21729547cdedb3992af69b9a96058f8b83238f567f6bd9d5056dd4a11a101e73c42947b5e6eeb2cb415fd238caf762d60889d8e2eb14
- TLSH
  T1F551867BB641833976BE50F9749A6160BB05E44F2B9CEDC0B1F5113CB40C28DA79B64E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution persistence
- Creates new service(s)
  persistence execution
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral8 behavioral9
- Target
  presets/alt-split-disorder.bat
- Size 974B
- SHA256 c311166310f4b6a4652ccd489c4664a9de07804d8a0702b7ea6c908ccca7c7dc
- MD5 3a72db0016fe6f1ababc9eca846c43be
- SHA1 da559fd247ae3f8cdbe2f2af4eeae45dff8b54be
- SHA512 10145a9c1668824b8f7867347fccd7feae64ad31ce8f2cf6aba7c6c8864d0ae96af79de0c0bd7597eb8064f296e1eb487142702c47afd898861c3dde766135e1
- TLSH
  T1D311ED67B902812C2ABE10EEB47D36B9331AF4C727DECCD41A68297C2C0D247A30142F
- MD5 SHA1 SHA512 TLSH
Score

4^/10

execution
behavioral10 behavioral11
- Target
  presets/default-fake-multidisorder.bat
- Size 1KB
- SHA256 648c6308b1ad9f1cfaed6710c621814bee85df289dbcf3561c315865776af1e8
- MD5 e78a898fb5f325b64f4ad21b98ed5cc4
- SHA1 69abec204281b2be9d4c052fd598296c4262c709
- SHA512 719e16344b2f35e20602adba7ad2665ed7d72ac5cbcf793cf1314add4f115321330463fde627ed23a53f445472602cad5f7ff4f0a6f303aa798801b4fedb2a1d
- TLSH
  T17C11AD57F503C0197AAE20ADB42E3268321BF8CB37DEDCC0469C147C680C247B70115B
- MD5 SHA1 SHA512 TLSH
Score

4^/10

execution
behavioral12 behavioral13
- Target
  tools/blockcheck.ps1
- Size 7KB
- SHA256 3ad5321ffb0c794a56114a6e81677e7893de41a07f6da03324f2d4aa59174529
- MD5 40d358a2fcd0b9e45453497abf36378e
- SHA1 89dea60ccd115c1620f19a78685bf141fc99cc19
- SHA512 320540ff6737ea2152da7ad205b8e9928b9b7a3ae04c5a4fc72dad120849816493a8d7e81512d6e54304f75419bb6134287bccd9bd0d85f0d29e83d43310ddb7
- SSDEEP 192:tlDwfwb9AE8Lyz2dfh/0q0mUGiuu4/tjEcvjmwOst:tlc4EE2dfhMJf4/5Njmw1t
- TLSH
  T1ACF1B879660651A94373573BEDD7E119EB2E102BC15A120078ADC2EC1FB593EC3B4E8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
behavioral14 behavioral15
- Target
  tools/collect-diagnostics.ps1
- Size 3KB
- SHA256 d6d0cb05077647e974a759be4c422130a334aa2e42597ce5df6ad2d1a9f8ce01
- MD5 0a7db3eabeb8cd0cffc95ff41b4a633d
- SHA1 f307cb6fa5937488309c44ebc17c922c2dcfde36
- SHA512 7ee6d021f7efd7d3ec0c3ece7844bb85e27c4d48b4f46b07a1c1cdd93ff6aafe3079a711d7686d3a72b17a4a1a5f9be043e8f4485d1eaf1eb0d686f1061efe8c
- TLSH
  T1A6819590279A313A53610BABFB47AC21076E979DC4723250E0FD879C49B95AFC788B47
- MD5 SHA1 SHA512 TLSH
Score

6^/10

adware execution spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral16 behavioral17
- Target
  tools/install-tasks.ps1
- Size 2KB
- SHA256 df96f93c4d1f63d0049f10f1f418ea18e2f4aa794e214ffe12d861d55ba27880
- MD5 92e5b0ab52ac39a7a16b676662f67c98
- SHA1 ddffcdfc6e742034bd6fa812ed50a3c8793a8232
- SHA512 22dbfd80ebefedc49db16c74431b0a8e29f08e50d27a722bdc4b18e9e4f1c7160fca93f9ce8d7732cd7e5c21e3d3a7738c6ae829cd9c8dcaf10d9987ffff4847
- TLSH
  T1B04132BDF660722A9E334D2DC090A6916C7FA02C9573722CB3578138B5EA06FC34219F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in System32 directory
behavioral18 behavioral19
- Target
  tools/remove-tasks.ps1
- Size 1KB
- SHA256 8bf9e61116531106658f0bee530a11b81f59d85b99547a3bb1a95c7c19aa1522
- MD5 dcbe4745e0afca1d00b3e9f5b1a0be1e
- SHA1 b1368fe144164201aedf746e38fa588fbd680986
- SHA512 e2dd4149573c50b30a873a4ad466623f583a209a5cea32f09263e43e13115b6ca4aad1ebb80157be8d21331b74c0e81e9ae36d50893b0d857edd032601bee7da
- TLSH
  T17F1116A567C112AD29714B7AC4C36345FE5A117EC0AB1340B639C16C7FE501BDB7095F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  tools/tray.ps1
- Size 6KB
- SHA256 7804fe6a609650515f57185f0cc0b196cc1c56b233d7b46b169e38ca46bd6bc0
- MD5 197d7cfdc970539f00605c9453fa0c1c
- SHA1 19d0aa9b4983c2a26228916fe8a18b0e138b5903
- SHA512 8ae2da0a8e05bb7dd7fedc9170b6d3a990df733795a5266bb4bf6223fde5adfccbeacf6ec6bfc308dcd9ebed36a0601a7b57382dba75f54ce2645bf413bbc47f
- SSDEEP 192:nOgP1/Vpt8Vxg6PLJ6mNLTxysAwXC2RHkyV6g:Og1/7t8V66DJ6mpTMs9S2i2
- TLSH
  T1F5E1633C521ED1828BB1A22FCD8BA582ED25523BA41EB80137DEC28CEFB9055C775775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  tools/verify.ps1
- Size 2KB
- SHA256 eb7e06b320cd0064cc6a72d366389991b22780339fc4f8e86910b180bcef7053
- MD5 4f13671bd781e3684af438e5864d709b
- SHA1 a9eb4ad7773feb0311e5101cc79b84e7406156ee
- SHA512 35c7241e253382536313813eab1b9c9689cd9f42ae80ec66ae50a81fc70b1bfa241e4d54f2de7930c39556d345125e8a8dd498068bdca965a8cb0471316a067a
- TLSH
  T1B541512AE309517E777314BBC8CB2A15ED4120AE435D46C471EC84F83AA990EC2368E2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral24 behavioral25
- Target
  tools/watchdog.ps1
- Size 6KB
- SHA256 142c94344afc11d96f192fabe23751396aaf03ddb19cd19c5f1f46dcd5f6e7bd
- MD5 ae10b710c12bf978d8eb9f6319c6a216
- SHA1 92e9e3f75011dd159951189db24bbc0c030407bb
- SHA512 b622adb7c55dce2b43dc755ad86213cd15609927d73e7eea862e3b3eaea0de2f5d12bb4e01298a8a16eb01a504d2651f306edd550768fed2c0ccd7486c252c7b
- SSDEEP 192:1p3Qv2vmYmywBoDdxfUX1Gq9dT/0RMIglkMUcy38:r3QvDKolGYT/0RMIglNUcy38
- TLSH
  T1DFC1041A55111169ADF207378C9E9058FBA7047F81552900B4AE81893FB4A3CE3AEFDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  uninstall.bat
- Size 1002B
- SHA256 4650463827007ea73388ed8d7e0b8efcd9d2d20615bfc99f965600d4dfe232d0
- MD5 97dc84291bd5f639b709fce5b1af7296
- SHA1 47347f94bf2c94542341e37cdfea3de4595cff30
- SHA512 8cdeb53f230f9ca82975efe013a56bf89704ac5dbdd661b30b727021c54f9dcdcbb05fc9cdfbdd3ea9eb9f91b6615f805d9ace28f48ef7e9b91875091b5e8771
- TLSH
  T12211593FB5832E6911F020D188B615567B8546DBDDAB3ED130F3926C7808389AB8881E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
behavioral28 behavioral29

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Targets

Creates new service(s)

Stops running service(s)

Contacts third-party web service commonly abused for C2

Stops running service(s)

Contacts third-party web service commonly abused for C2

Command and Scripting Interpreter: PowerShell

Drops file in System32 directory

Badlisted process makes network request

Contacts third-party web service commonly abused for C2

Stops running service(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29