c833fffd18faa16264807ee67150b5ba923f765b7d33f0f80947028c3a86d6a8

General

Target
setup.zip
Size 4.1MB
Sample261107-2aa1csfy2z
SHA256 c833fffd18faa16264807ee67150b5ba923f765b7d33f0f80947028c3a86d6a8
MD5 43ad1b8527d1d2cdab8c222369523e5c
SHA1 12c86a6180a5ec0825ddfa68239764b08ff7071b
SHA512 ea8666237a6ec6b8d04d487a424268b3b878d689a1d8a08f47173d51d88c348b66be965c46acb57fa308f50ae3079ace9ad76f1c44fabab92ef276443b7a50c6
SSDEEP 98304:s86tQy+5jDwHHC8uNONfqtLQmj0p1HW9XdyH5If:nV2uNOstLnjkMQZIf
TLSH
T1BF16337BD4ECC78AFA0DE63E517CCAF742EC4DAAC9068CE464791523E0D94C95A140FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  auth\lFK4eRRGv35m
- Size 417.0MB
- SHA256 802a3767b6963307806f5b12338f6a1c5d1d93a61f491adaffa9b64f4cc75663
- MD5 3ab53f72bc2db1a44eee3c7a556b4fc0
- SHA1 650f2ba649d3b066c1d6c453f3400417267d541e
- SHA512 6855e250648f1b11279a599dac47aeb379bf4dc4db1e706727923c8bee21d500712a72fb10691f1f64f769fba414ad4f7979a1777314aef18cdede26f1011008
- SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
- TLSH
  T1D5298E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
behavioral1
- Target
  rename.exe
- Size 4.5MB
- SHA256 66a1f6ccc9f869945bec8149f1af5ce5bb587d3d25c8008cfdc0bf3c0cebf9c2
- MD5 42fe4a56c232d4f65bfa7ad9eab99812
- SHA1 ff382fff460371f167ae09d2f2cf54d7d6264a0b
- SHA512 3694acd3980705493876209de679cd316f596f5255be2a0eb23971dbef18a8c54adb08f7dad42217ca855768910bba8d6f1d9d69f74429f2a64af9f9fc29c1c6
- SSDEEP 98304:+bwdaDFrhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1Y:+bUEFHGpELcoR1Y
- TLSH
  T131269DC6BF88F5E0C4A48834B916D5BDC6737C7A8A11468732D7FB1F2A37180552B92B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
behavioral2
- Target
  vcruntime140.dll
- Size 116KB
- SHA256 f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
- MD5 699dd61122d91e80abdfcc396ce0ec10
- SHA1 7b23a6562e78e1d4be2a16fc7044bdcea724855e
- SHA512 2517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff
- SSDEEP 1536:KqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbsecbWcmpCGa3QFzFtjXzp:KqvQFDUXqWn7CkRG7YecbWb9a3kDX9
- TLSH
  T16AC37C4573A802B7D62EC274C1E25E46EB75B5418770ABCF03B589AA0F13BE1AE3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  version.dll
- Size 124KB
- SHA256 00f6b47ed70472f6b7cf95b8cdeb33d254906d780148df205320a0f7d25298e4
- MD5 410af86d672a4886ff7ecae3c8c0c5a7
- SHA1 e2308e96a4f97972dc3f382b8e23f776e5206aac
- SHA512 96695a111688b87f6c7073878a0f80190ca2fc1b5ec7b91f9e8f10cc2aae9a3b9b5a34596242dd9210f409502aa927f77f9a3404c354f8e95de5034800fb83a1
- SSDEEP 3072:PArsEFFJFC9pVpcGgD4H3zFOSwCYnn6iouckVPxIiTON4F:PArsqF7cpMdDC3JO6A
- TLSH
  T1D2C34B1BB6B5507BE26A8938C4530A05DF72BC918BA0ABDF07900DDA1E637D49F3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
behavioral4