0db7d7beac10f1091d9841205f9353d4d2737cfd33c5978aa4b6e8000e1991c8

General

Target
R-Zapret-Windows-x64-0.1.2.zip
Size 578KB
Sample261107-pemthaxzft
SHA256 0db7d7beac10f1091d9841205f9353d4d2737cfd33c5978aa4b6e8000e1991c8
MD5 9c791ffe9f2774181cd01ae1308772b1
SHA1 9c09fcd70d5f3048bb691deb956888e38c667e50
SHA512 4f14869112a21a613e362678785ca3cb7da443a49079838d05b261444f3f59ccc52b0f107f451f2f7e05e5bf204731477b439c2c37ca5db4c6f89a2bf193b1a4
SSDEEP 12288:CgEvD24/yMiuiSQykbyBMnjNUx3/QljXCQ/52sBSfLH49dY6hdjV2:C9KMiqQykdNk6x2LH4Q6Th2
TLSH
T129C42325E7DA1A268B51EEECDE0634F0C03C62A5E827F03C25A0AA3FC573D953795E15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  R Zapret 0.1.2/Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 e6c517412c245c0f0d65fc494d4f7bf883eba3cfd7023c3f66cc1fe774ec0a22
- MD5 d11bf35a62c936818a1aec6adf97c580
- SHA1 c41e19c622114c68a2376cfe024c8df12129dbfc
- SHA512 fc3197d8188f13572b3120d69e476f06fc28493b0ae02f6c00d2815b8520d3b5258d5356636529908b773b1f07204fb7a3aea94af6826b3c3161b68b5c2ab2bd
- SSDEEP 12288:MBfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsR+rP322y:EQcl41Or
- TLSH
  T1B9D4522223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  R Zapret 0.1.2/Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 362ede7adc427ff631cd313418d6d331c01eb1f7874a5ca54911130739792145
- MD5 7da84c369b60a0e6c481f94adf718511
- SHA1 baed762bbff901d5dfdc4653b0de5cc50fc66a32
- SHA512 9f40d616d5a7cbeb504e59e32e68f262a5d7d3f865af5f06e02c18cc000c233acf9a912e5e722f3a63e695e7795ce436daa8c1df68b46e2060fafb47165617d7
- SSDEEP 768:DvQNb2vIYymJ22Mss+5lQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSx8:Dcb2vLblQ+ZDgcEST3p4JjrjaeFSUyaA
- TLSH
  T15B033B4087ECC517E6EB1F78A9B491610BBA7EC37D61D7A90C84B1EA0C73BD055143AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  R Zapret 0.1.2/R Zapret.exe
- Size 740KB
- SHA256 1f776b847738426dd58d1d070d79fdc73c292ab5d9a2e12076bd224377ceb2d1
- MD5 0541a367539796f03295ba933dbd56fa
- SHA1 fdffb6e415050d4771207324bf5140943dd48026
- SHA512 01546470baa4a7df5d9811bc1f60f5b58442c5ec7dad5b631b043847c09f678dfa87329bba9618656b268054f0c090cd8697dea05ff370449d7053da08d8d398
- SSDEEP 12288:KHVRoXW7nV4jrIIETiNwm1grOMHY9ialI8UYpAGBA7a94JkSFsCHND:PXW7nOvIhTHrq9Z+T
- TLSH
  T106F4B0735247BDEAE6B726A094183E904C3CA9B76258D254FDCC11ADB5ED120FF3C8A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral5 behavioral6
- Target
  R Zapret 0.1.2/WebView2Loader.dll
- Size 156KB
- SHA256 2f965e10aed3b356a408978a0e6d74eb86e3e722dd008fa9ad39f68884479e85
- MD5 11d7bd8636add5f848a99586718212b1
- SHA1 e51b5cecc7e0b339925ac75ec65688efe4a73ec3
- SHA512 b7281b04069359e863578e80cb42a76cc7594486f6f9acc3eba4294932bea527f8a67a0d1e3c95d502c438e2d9450f434f836a74f9f771cf75711c1b0c8f116c
- SSDEEP 3072:qf5y3UwE64Y+8eWi6aeagd1ra1kNQG/ZTbiWEtJRm7VAbmz:4y3UwqYlt7agd1re9WEtJAVF
- TLSH
  T162F35B5BB2E44077E17BC278C5A74A42E776B8110750AAEF036447792F237D0AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7