d534d718a13d4b435ba2e1532f6fe379418be438677ad36196cac5e25e8e4450

Sharing

Copy URL Twitter E-mail

General

Target
ZapretTray-0.8.zip
Size 1.6MB
Sample261107-1pgwsavyc1
SHA256 d534d718a13d4b435ba2e1532f6fe379418be438677ad36196cac5e25e8e4450
MD5 1c2f745ec2527dd330d5bf8bdc2c2ddf
SHA1 18e0cb7781a0d4391fe570b38edddbd452e497bf
SHA512 82de8d695e3c25d47b5b1899d6aac493921aebaea1e3126090f87bec37cd079e43c9ca806b78ed836f9baca98588d13115d2a89b88c9e5b5c08e37ac1dec584d
SSDEEP 24576:KkTdlejXO95NorTSqGx0cAj/Ko3ibh15bvLoHcDjY294tcRqKKxxnB6kx3jm:puTQ5NorTHGxnUta5bvLokMbHKCB18
TLSH
T12F7533AAA04AD58BD346B3365C0A0B1404E1B5D03490EF8E7FD935889B15CD76FE8E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Setup.exe
- Size 80KB
- SHA256 033c4463a8fdb52ca6b379c0cec480294932e3c7642902675755e3c167e564f1
- MD5 5f1883021def3c18c2875d4c02ee7c96
- SHA1 4ec75706b7f9403dab411cfe7119b26f08507a8c
- SHA512 d85512cf44bfacda4d445bb4aec00a17252f93194c8890c88be01dd1985bdf9313abefe298dc364c5ae6b10fe487548f4bd4b9a16dbf4354372bb9c7478c3bfd
- SSDEEP 1536:JjOpnMTdZYXWZli0s8TTPkt1HONbh/1YYEERgD8:dsXWy0s8TTPcsph/1YYEEo
- TLSH
  T18F834A06B7F9C628E3BE4F38947205D00735FA53AB63D75C1C8B58BC05267E18926BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery persistence
behavioral1 behavioral2
- Target
  files\ZapretTray.exe
- Size 276KB
- SHA256 dced936739574375ff5fc0b6b21910759d6fff456d11095f289ec0aa645bd752
- MD5 651cb640c0e86ce90cd7757e55e46be3
- SHA1 beaac06d7d6ed6b21db8822db71fc896eef13f42
- SHA512 8f5cbfbe49bd007f3c232f3096c8f031b629929f973b82e127b2064c186994f43c3b70cfef103324f06e9615e37d21f2422c5f00481e00265f9fd7030beca6d0
- SSDEEP 6144:3Rlv1fAD3+6gtzkBDtc7GPgZstWgtrD5wge:3Jf8gm+VurD+
- TLSH
  T1C4544B0FB7B98F65FAAE8738807105C18672B307E75EEB485CCB68FC1459371A61126B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery execution persistence privilege_escalation
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  files\core\bin\WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  files\core\bin\WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  files\core\bin\cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  files\core\bin\winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  files\core\general (ALT).bat
- Size 3KB
- SHA256 03daa1e91c59264139110c4fd0216ac57e7387efa1c7abdb0f9c3e65492b5edb
- MD5 5a8b4cd8849bd1c9b22a9182dfaa629f
- SHA1 d54226dc27e92e2116884f9114d4bbee796fa788
- SHA512 09fca6e42dcfde29f53540b8d3c5f9e07ac3198f00d6d4befdf6e77035f999f5370f54316e28670b7cfb60ebe20abb782150af4552450e2b29a276ec7de11d26
- TLSH
  T1E4816BA7E00CDE47F5CD653EF89BA5A420279C8329D6D452839B89F8CC0EDBD684E480
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral12 behavioral13
- Target
  files\core\general (ALT10).bat
- Size 3KB
- SHA256 00a37955e2a8e2c2df1859c7e542c24a26f613373a0930e68b20bdeed08d4863
- MD5 91e4da2117ed62a323d8ccaf4a0e9693
- SHA1 271b25f95c008fb79752f3086c538f3ecb94ea2e
- SHA512 3b7583db9256bd8582afa2860ed4a79b724c174405a8c4fd73a4ab4bda375b3dfbfc9686bbcc066c462e3cc2e74b3b92208f41b36ebbf4f5d74a79dd2240a56b
- TLSH
  T142713CA7E00CDE47F58C697DF89EA5B42127DCC328D6D456439B85E8CC0ECBE584E484
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral14 behavioral15
- Target
  files\core\general (ALT11).bat
- Size 4KB
- SHA256 f11cf901444b7b1de316dae78852449f8d390e2ccd9d5eeb7a03ef732cbd1bae
- MD5 38664ef4dc5812b7e11210f2d565efdd
- SHA1 92fa06a726cf6829dc405224a6b1849c9c462f59
- SHA512 a12c3dbc81e8a9f35f65308aa587044f58ed5e980d6c9bdf77be9beb8fd2062c78395564ab7e2575bcf2a6c70f40e66690954b8bd8e58ba1e87e90313f9912fe
- SSDEEP 96:nL674QGB/GRRQ1zbIKdUGB/GRAVv/GRRQuv/GRA5P+R0ri5+RRLx/:A4QGB/GRRGEVGB/GRkv/GRRDv/GRUP+6
- TLSH
  T16F9137A3E00CEE4AF68E747EF49EA6A5211788C328D6D452439B45E8CD0EDB9194E485
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral16 behavioral17
- Target
  files\core\general (ALT12).bat
- Size 4KB
- SHA256 9b21fa52d50668b162e5e1caf39b56478184a22565588ec4dce92f4a25fb2dd1
- MD5 93d8406c772c53dbf7d93d684d712524
- SHA1 d58db5e1917e0c1708afcc9b605b4641f99792b4
- SHA512 5e567d89bcca3a83e4b689821262f31b76f407590e2e3b2a2f58877e2e3646c91f1d9be2f0a8b84ee3e79dfea9830214c4fcef95f1fd950fd2d1497bc96f900e
- SSDEEP 96:nL674QGB/GRRQ1zoLIiUGB/GRKVv/GRRQuv/GRK5P+REji5+RRLx/:A4QGB/GRRGl1GB/GRav/GRRDv/GReP+g
- TLSH
  T1109149A3E00CEE4AF68D747EF89EE6A4301788C328D6D453439B85E8CC0EDBD594E485
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral18 behavioral19
- Target
  files\core\general (ALT13).bat
- Size 3KB
- SHA256 8eadbd0eac63aa87adaaf07359b815c316614c27cf6b478e4ef9b35c2fd8e7b7
- MD5 82a31bff3556ba00d49834b278e0c642
- SHA1 a3995ec5fd3f91f4186af30218a6596c5a1fc61b
- SHA512 8686b8190250b90de8a5e4abcff08d3320b48f380cecf5f1c66232b03d3ab147992754e5ba6ab3e3882e102a399a92112964ff857a239dc43ff1234a2cf489d6
- TLSH
  T1FE818E63E00CDE47F5CD697EF85FEAA16027888728D6D452539B49E8CC0EDBE684F481
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral20 behavioral21
- Target
  files\core\general (ALT2).bat
- Size 3KB
- SHA256 c9a43d689bae4303b061294aa8ce8dcd5c5a38f19c962391cafeef82bf7b5023
- MD5 f7466f42744a09aed245dc31e05d4620
- SHA1 f008f4c982f90c56d503cb8919547a1cc6e5933a
- SHA512 e4a53daddb8308c1d6025226428c471ebb8a0e209e308453e1da39ea6ef23009524113987b4fec3801d5605698644efd11644f84c6003a93f96c38e4aea34192
- TLSH
  T166610757E00DDE4AB68E783FF89EE5E42017C8C31CD6D452529789E8C84EDFA494E485
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral22 behavioral23
- Target
  files\core\general (ALT3).bat
- Size 3KB
- SHA256 eff9c48a0b379cd1c8f770bd7e64c52dad99e1f7ae082de5bc2fb8a88d9ee43c
- MD5 53bc1c1c7f49ef19f8bc1a336b19c166
- SHA1 6d81e9989c80002378088009f097e60085db70be
- SHA512 6782502ee1e2ed97e06f5215d3775c162e8f4d35a401697a80b9d7a0734572242092a3b4320c1054383c3e4724e6006de7bfe1f779586ed20503f0cac2ed8454
- TLSH
  T129715B93E00CDE46F5CD687EF88EA5B56427888728D6C85152DA49E8CC4EDFA6C4F085
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral24 behavioral25
- Target
  files\core\general (ALT4).bat
- Size 3KB
- SHA256 1565de56c2782c79ce20277081ea39643957d74db2b0df17e4ec493aad43afaf
- MD5 ba4e3711e01e80e8d70eec4c44098d61
- SHA1 13571571e0d6d295172961a5c9021128e726746a
- SHA512 c9c0be5d7dc6f77278da65e4b2d6c83c4d166838400c40b4736155fdeab2a850031ecfc4f8c4813db78a38e909c0c65d9c21a1c7344284878beae8c955543029
- TLSH
  T18E813993E00CDE46F6CDA53EF8ABA6A421179CC318D6D452439B89F8CC0EDBD584E594
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral26 behavioral27
- Target
  files\core\general (ALT5).bat
- Size 2KB
- SHA256 e745729c4785de344b36105407b5b6bdbda17d655be7c314b3aa73826db79272
- MD5 1f035e25fe65433fa229f90f18468ef6
- SHA1 0f4b03120ed08ea11b291940726d119a77d872c3
- SHA512 e6e33b1e907c554cd683ad10c9cd02472516de6b9738bb4ed16bd41dacbc1873bf421cd92a9992cafc084e758753e7b8e386d2da266bac994f4572b202c34f9e
- TLSH
  T13341F397E00DDE46B48DA83EFC5AA5F5601B98C32CE5D466539788E8C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral28 behavioral29
- Target
  files\core\general (ALT6).bat
- Size 3KB
- SHA256 c32d3a253a3dcd827b5a6d3a1d903beaeda0e5ee65c1d2d1b0abbfc1f04f3005
- MD5 37ec25f0901fbea19ac76881e634402e
- SHA1 04bf0761db34aae33c00e5e3b00f48ca2a72ce2c
- SHA512 e2052e74adc43a8f5721ec4228b51efdf24054c05e5381b85353ec3a32a0e6b051248d60774ad171cfe5cc65e5aa9da6cd6ce35708a11e3bd796b90f63362428
- TLSH
  T15B611657E00DDE4AB6CEB83FF85EA5E52007C8C31CD6D452529B89E8C84FDBA494E485
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral30 behavioral31
- Target
  files\core\general (ALT7).bat
- Size 3KB
- SHA256 147911332e2734a3a7ff760fbabb1bd44d29e75ed0be12bced734270ec592ac9
- MD5 7f98211bb42a98978221987bc39c6c3e
- SHA1 a2c0c10c2074f090f819d7817bb38b7c6ccaa950
- SHA512 dffd8afa407318abc55777e0b95b398a1298fb3ab6deaf57909e9cf737e6d8f3c17b4e76da5597a09d77e49a6fd51fe97a1e07d7f31a335aef691d2e3944beb5
- TLSH
  T19251F797E00DDE46B68EA83EFC9AA5F52017C8C31CD6D462539789E8C84EDEE4C4E485
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

System Service Discovery

T1007

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32