17bd4980523fc1add4fa2e9ce77bb50023bb886886d920fa53471cf3238afbca

Sharing

Copy URL Twitter E-mail

General

Target
RegionLauncher-0.3.0-alpha.27-win-x64.zip
Size 23.5MB
Sample261113-1px8rsss8k
SHA256 17bd4980523fc1add4fa2e9ce77bb50023bb886886d920fa53471cf3238afbca
MD5 8414cedc2349204a0a481442fdd679e9
SHA1 bbdebf92f1cc62104cd1952d9598f5dfbc67203b
SHA512 e176d49fa37eae696fdd6e2dd3dfbfabcf4b0ef7282e7351332641053024a050004e1813775523393cfd0bca20a56cf58195ff5714e2ff031c6c510b3903afb6
SSDEEP 393216:qo81LFNZ8Amu+3JAxvU7JFA/aXb4L4xpUoNmnrQJbMWwxsv93em5WgxBqXu91nMU:qo81LF23JUYUar4L4rUoNWkJbfksJeWZ
TLSH
T14C473398CA950E54C7371C32B522E4B65CB35DCD9EBBE22ED8B811604BE53307607ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  app/DnsProbe.exe
- Size 172KB
- SHA256 a5f9729164b5ed0c36125ab8f59281f9afb0164cdea9d05ec5504613ed0e735d
- MD5 ad3fe9e876c5695e1a814b76aa07d318
- SHA1 72850a2476f266b5f1cd2cafd523ed217a7b0d88
- SHA512 d9ed419750530fe2bb0c280f1739d844738299ebe3d951a767da6fa26e22a8d58781cf2221b82cc12438bb627c969d60fbc8302ef425621c42b8a574520df1f1
- SSDEEP 3072:XlP6bBwB2Ko89Jj9NcuAh4T0oWuvYLdCj+1Kou+cMM:XlPto89JJNcug4jvYhwWPM
- TLSH
  T10E047D15B7A611FAE1378A38C8520A02FB737C5547A0AADF17904AF69E237D09F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  app/DnsProbe32.exe
- Size 135KB
- SHA256 c5f6fe9b1738bb3e969334db9980d6caafe3036f1045fffbccd90a7f66ec1f2b
- MD5 4de7e3d6d4010926b37f74fd4a47e050
- SHA1 bfff53a702484ab0354a3dd687e568ccf503d2e8
- SHA512 f754e8deea8e7179bde48661892765ebcecceb3e97203fdd30f09e7cd0d45b135dce57382ec9f4ca52339969e457b9f6735beacf2dfa94b1d33e18bf708782ab
- SSDEEP 3072:GDkepcfkDWFxk/JaB5VxMopiB7iRxB/0+FPB0gh7:GekDR/+LMopiV0v/73F
- TLSH
  T1E7D36C11B8D1D033D6AA4C304965CEB58E2EFCB04FA06DDB77841EF64E246D09B39A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  app/RegionHook.dll
- Size 285KB
- SHA256 1d679877b1759a358b70c0e5d6e8d3bdf64027a97d7accf5227617b8d5683ba9
- MD5 8dde133766a139ed574c621a01a15b43
- SHA1 010d1211a4a2872c14c56e36855c606830561413
- SHA512 67adcfde10125adfc302909f89af7fa69b9807cb9b5b5bdc6e59e307cde1aaf7a46639508cce4000c84e889e4abf1d252cf11b33d373ee632894567b5d4e18a3
- SSDEEP 6144:RRo733aCQTPgYmeOjXIp/D7pvWGqrjCu9iky1ky/bwH1:vkts3vWGqrjBMzk1
- TLSH
  T197546C5AE6A508BBE527C17DCD538A09E7B2BC1A0360D6DB43904E9A5F23BD04F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  app/RegionHook32.dll
- Size 223KB
- SHA256 f34dc45738aea2165c9f9f75b3722e0354ec2336780f7e5cd24edd42aacbe1a5
- MD5 219edc584b58d0c5d711afbf73aa75a5
- SHA1 e58f885070e31ea3dcbac311264a736481697c0c
- SHA512 ba4fcd6c5c9945e8376eeeded6337ec2dea613b3234631f5c659ba088a424344baa2ff5455618fa996ad9602d8747997650462db6d219fd2503cc83cc3acf0d3
- SSDEEP 3072:T4lpQVtcsocKDQc3E/IOmKhRmrzk2EZ0zvdf2CooeqDSMLrnmv5LBECTS29PtPLB:T4ltEZ0rdudJz2rn2ECTS8PtgtxX+cC
- TLSH
  T179246C01B941D473D6AE0974492DDF798ABCF9A08F6298CB73842EEA4D606C07F3571B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  app/RegionInject32.exe
- Size 93KB
- SHA256 d636f6a5a41f2828bc48e91d0aab8cdba30b45d86550771b62044c8345260ace
- MD5 4a8a304f71027f3452298966507c2c1a
- SHA1 038d9ce7f9400bfbf624dffa20750524a3e9f7ec
- SHA512 5d96eeb0e04302df562f03662adca158ee506a1dc164bcbf17cb99ddc7ffb6991d71de00076262abf7dcae6d6d9e0619b7afc06d59bec6597033e1f50e2514a5
- SSDEEP 1536:7otpvxS9v9hxP3Agzw/HhpFzYpm5HoNmc+RnvRPA6RV8RQbzMsW/oUcdxQqYfllw:70vxS9VhBAiKzYpmemc+RvRPAs8RQHvC
- TLSH
  T181938E40B5D2C471EA7209354CB8DE75463EF9601F649FEB339812BE4F342C05A36AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  app/RegionInject64.exe
- Size 121KB
- SHA256 603a3a7336d3cde9b5e136eb9d68b72e70b221d156c12941fdef13b871a0b0be
- MD5 15d2fa04c7b6a235d7842841390b90d3
- SHA1 199729169e235a2d34f32d08c2a44cb1b6c9fff5
- SHA512 166f5c849987b555b3db62f2751869e143048626b9a7200bc4d1e15cdd99abd56e98f36562fc7182d6968ae28965e9e1176904823d7c5e7855ce215623dfaa5a
- SSDEEP 3072:5R3HBh06SOFGFRkN6K1p41lgthW+K9THYEbiy:vX36Rk9v4PgjMiy
- TLSH
  T1D8C35A47B3E931F8E177867984920A0AEB76B8314761ABDF07A4475A1F237D08D3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  app/RegionLauncher.dll
- Size 258KB
- SHA256 21906a57089c0f6782049cc303d527da3f2ad6470bd1e1aa35769ec4611565c2
- MD5 b422e696bec17f4e8743a85284aac35e
- SHA1 a0f4a54785a4d839e8139eab0a13a322b7af6ac5
- SHA512 156916572aa3cd8a8f6fdefad3bf24745176f1e841e9275dca9ec0eb665db00371991a99e2947d4c88dee062637c3dd46be81dd130294477abd40c171e771c4f
- SSDEEP 6144:hGvZ1A8NSaRhzW5h3XBIHVeJNC8Z/g52b8ZYg52:hGvA8NdRhzWT9N
- TLSH
  T12044BF6433BC4F47C5EF4FBDA074319243B9C66FA556FB8D8D8578DE08A63806801A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  app/RegionLauncher.exe
- Size 206KB
- SHA256 66c279fbc827feb11ec580d8006b326e5e175b801dffb31c4696381d3bb3e57b
- MD5 8528daf5ecaa1c5b9433e7f257b53adf
- SHA1 c60c67a75471c5c981752046ac2c126d00c5c5ef
- SHA512 c6d30ab78e2f19116c62caeaae7599fef3005488be5133db5918cea20d35d43cbcb5ef911060c8720f05b59072062e108a85b87698e37e050961496837a4c84c
- SSDEEP 3072:UVDxk88wN1nLVu7dL1Z9QnlX9rE38wm1VzaAT5T5a0y7Di8U4zgRjJITuH:wHRu7F1nQnZ88Uo18Zzg52
- TLSH
  T143246D13A7A811BEE1B3D67CC9A24941FB7278594B71A7CF07504EB60F66BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Loads dropped DLL
behavioral15 behavioral16
- Target
  app/RegionProbe.exe
- Size 173KB
- SHA256 bdd34af0b978b80a814283b164706af7a89ec9f9de60cdb332ae3cce224f3d63
- MD5 180bb11fa0da05ccb6ca7240373ad835
- SHA1 9fe138474e725f2e9448188ee80160950357486c
- SHA512 dfa1148eaee4b9ffdf1f68671f0a8bfa33c186de2c2b2c80f03e21f86f58c8d9e330e7fb40bec4e2df9a90227a53f54443ff0cd981ba41aff396a04aa83e5d37
- SSDEEP 3072:2CAIi7rViRd6bHqGCxCqMXR3403S3zU7EEfRr2LV4uZKxC:2CAIjseGCxCqMB1szU7tfXC
- TLSH
  T16A046C05B3E911F9E1778278C9924602E7B3781507309BEF07A4577AAF276D09E3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18
- Target
  app/RegionProbe32.exe
- Size 135KB
- SHA256 805f93d77ca664a10b04795eed8fd9bf607a125a2885ce6022e7899c5496aeb7
- MD5 fb6d0aafc0a41792e0d8eafe8c64835f
- SHA1 b53e38f7d18b5feb6283ebfe7e855875ea709344
- SHA512 0c12786a5cbdf6b7f5423d96d79f9e3d5d78ebfd375b32f5f7c40494248673347d3e5dae4dfeb00fe3e401254ed924984a864af27d69eaf5bbf1d444665d3e97
- SSDEEP 3072:+/oPTYhVwtTbiwpGvsePqRHJhrUSzmE3B1Iy23zfuv:QgtWs9JhrUSSAzIZm
- TLSH
  T112D38D1179D1C072D9B755350978CFB2867DF8300F609EDB6398267A9F242C06F35AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20
- Target
  app/RegionSession.exe
- Size 269KB
- SHA256 243e0ade7d3248f662793753b23271c224a89aca4fc60863a791c2189091de04
- MD5 792151fab9decb727fbb8d7185d644a8
- SHA1 f2aced3965ce328b427bb4cfff231116f7540f82
- SHA512 2144e8aedc276ea13b407a2155a9566f29c92d01c338c521fa4244500da9edc66c1689add2b54323f179e09ff89de065058b4b37653123a910164ff76fa0c53f
- SSDEEP 6144:ree5/x3cC2+fliuWo+MAr21yb1gnbTJDX:iwuuP+Zr21SKb
- TLSH
  T1D6447D15F7A418FAED67857DC9538902EB72BC5247A0EACF03905AA71F236D04E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  app/YamlDotNet.dll
- Size 293KB
- SHA256 d618138109a40e4a7250e49e2abad8c450e3636bee18d7499ab231e37fa9150a
- MD5 9593434009bbc4a1f81209c477a0a52b
- SHA1 5ad5f8b22d2c04a9c859a1d063860553dac258ff
- SHA512 d982bd851119197e9602f7f4f5f545bcfd03d23b2bdf7253eb1e1f0334ab937b823d95e254549900f879b02d31c5c8ddc88d126571551203015b918b8ae42ebb
- SSDEEP 6144:wA/HZpgZdsEsAFHsIU2UVcYaPWk2N3w1:V/HZpgZdsR0ZUdchPWk2N30
- TLSH
  T174543C0373AD4326EB9F67F9B8B0119947F9FC2AA0B9E78D198694E51C527D04A007B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  app/proxy/mihomo.exe
- Size 58.5MB
- SHA256 926bfea2ce48a247d6a7ce4cf641980e416202d5e40fe4ee5c949089ace0e197
- MD5 e8bb17c6fd6f26a46ce86edf08373395
- SHA1 7276dbee666c1d50b856ab4e4117aeb3706f849c
- SHA512 85c3689a6c4995c5de3ab4e6301dc505be32ccb2d974694796b916cb5a36b0a165add9b7a4bfc6d27ede1db7fa82afdbda3881463216d1d9fcec2ab35f06c1bc
- SSDEEP 393216:0kLMJeBN3c1yMcljd5dP9psjptXxlmx1gpJblkQV5VjV4tpOaLN/hH+KO:0kLXG1yMU3DpQON/hH
- TLSH
  T18DD7494BF82A4CD9F4A9C43885A696277B317CA9572433E71B10FA146F3EFD059BA310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  install/package/ProxyBridgeCore.dll
- Size 231KB
- SHA256 b7161a69c8cfb96288e9a36c6d2f5d0853514a6ad7fe574248175ef7ae093a03
- MD5 1860c8bb83e8af97d51b7b2bc0b85cf2
- SHA1 6bdec3771521ee413b8ff36f36dfced5e71363dc
- SHA512 7c66efcc017d041988b1296221eac0acf33a76ac2dca70b0c8d02edbccab3bd43d1cd72cfc81604222c72df2d2f358970cd5833678854b3e2f9eba0f6fe1fe9b
- SSDEEP 3072:HBleNMyGc5c98zM8ZkwOMlIeXVLehLJblqsC48cOPo89xT3UAH7:HeNMyvCt9wOMfFLehJbcFms7
- TLSH
  T154347D45B7A10CF9EC63C13DC9939616E7B278050720DBEF03604666AF2B7E1663E752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  install/package/RegionNetworkService.exe
- Size 196KB
- SHA256 54bab635f76569f78485e9b772a86faeb4eb704e7283bd1fec8556111075d9e9
- MD5 ad2062a363ece4ce0471f4caadf39fd9
- SHA1 3a7a4f98a3d2e121e9869f54cbdfc6e0e3c24660
- SHA512 3f1189275dae4f0f2c14c66d8703bf2bca9df9b56713edaa9e51c3388dbe40cbcd18a642942496a7f9ab8e4a743731120a37183fe8732af2e2f6b9fa5c5a1cc3
- SSDEEP 3072:dt43niM77aXx8xiQO3qYDpP95U806B9mqBQttW5kKMX2l2D3xn:dt43niM77lKDpPTu6NQtcg3
- TLSH
  T120147D15B7A510FAE2678578C9420902FB737C4647A0AADF43904BF59F376E0AE3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  install/package/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32