00a419884bfd0a02f9e3b6c0bb72bd52cfdc61736c6385f44b208305095a661c

Sharing

Copy URL Twitter E-mail

General

Target
unlockall-release (1) (1).zip
Size 2.7MB
Sample261113-24xffssz2n
SHA256 00a419884bfd0a02f9e3b6c0bb72bd52cfdc61736c6385f44b208305095a661c
MD5 1389357ac62904b697a6db786d59fbcb
SHA1 b3e7663b3924f9b5ca4515bba517f4ef712a5b37
SHA512 369db56fcc04901398947534be50c637015f7cdeb7534f0a6746574c64f6cfb4eb3aa4fb76b577e8620c4b9e8cce4ad50463c18d3f2d6b1a33014acf3e32655c
SSDEEP 49152:Gubk2ni6+xGHCq0oJEc//HeB009dRm+uYTSXzaG9lhpZUExOgnP/OgoTnfZCWcAG:GWk2ni6+8imJEws7RPpTYzaGdpOEOgnf
TLSH
T17BD5337DA971F5D6CA0C966C61FA80ABE543BB0B5EEE704563E68390331F6C4829F4C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  unlockall-release (1) (1).zip
- Size 2.7MB
- SHA256 00a419884bfd0a02f9e3b6c0bb72bd52cfdc61736c6385f44b208305095a661c
- MD5 1389357ac62904b697a6db786d59fbcb
- SHA1 b3e7663b3924f9b5ca4515bba517f4ef712a5b37
- SHA512 369db56fcc04901398947534be50c637015f7cdeb7534f0a6746574c64f6cfb4eb3aa4fb76b577e8620c4b9e8cce4ad50463c18d3f2d6b1a33014acf3e32655c
- SSDEEP 49152:Gubk2ni6+xGHCq0oJEc//HeB009dRm+uYTSXzaG9lhpZUExOgnP/OgoTnfZCWcAG:GWk2ni6+8imJEws7RPpTYzaGdpOEOgnf
- TLSH
  T17BD5337DA971F5D6CA0C966C61FA80ABE543BB0B5EEE704563E68390331F6C4829F4C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  unlockall-release (1) (1)/unlockall-release/README.md
- Size 5KB
- SHA256 3bf95a210a5799cee51d5c74645e7f8d9e110cd74b6964267ffecdf16f9cd17b
- MD5 769b90e24c1fecda0b5e695f697f293a
- SHA1 0daabdc32f1cb12f18720f5eddbb0028a58be397
- SHA512 17e7974ffaa15bce3d9fee631b449fbf38abd34631cd26013d3ef00eb3caa98571925122e4c6528b805bc37bd5f50665480f8b2a00976e1ed7b591bf71d538ec
- SSDEEP 96:8FG5VOBTMJLJtyp6QNitkKalvy5q8r9KHlV5svVRpGIVzYV9+FR:8Y3OBTMJLygiiGKalvyY8xUsA+13
- TLSH
  T1D7B1E98E7755777348B1C262E62F3AE1F76C84194237202075AE9268E74D2BAC23BCC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  unlockall-release (1) (1)/unlockall-release/driver/lifus.sys
- Size 24KB
- SHA256 47a03a13015f7cf4099a37136feeec9dc19765052c51113a600f5fd123d2ddab
- MD5 55ec8cd41e755ab9dca118dfcf37350a
- SHA1 7b9d7b778f377570c8dd41f67b852afb4f6d08c7
- SHA512 2c2699cd32ddeff5123de01872b4aa4d129e6931b3c81cb41e2a1e0850963b85503514e4abb71640a3ea65ce1fe732741ace40baff358aefbc9ca9111cfa597f
- SSDEEP 384:NmB/dAdOskXf5RVrb0PO04cT96p4IRIw55bCxqxWWeVhO2C97:Nmod/kSG04cTgphRIw55EqxWWefI
- TLSH
  T1AAB24C89938918F8E6BBC67D81B602DBAAB079151312A7CF4970C5342E63FD4B736F00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  unlockall-release (1) (1)/unlockall-release/get-symbols.ps1
- Size 5KB
- SHA256 c83a37fa87e25f917b5c6057b5f315b53446ab9a69e66be9a1a2e32754542eba
- MD5 4952a67048273eebe32158473978deb6
- SHA1 dbc3d7bc515dff3a451c24a5234fe2dfbe67e2a7
- SHA512 9d91dbbdc85c1d1711c5c77d1939d90a34b52c50bdc629519cfecf6003f5b538d9a02dbfcc1e4b18b08daa1e6f15f4c2b08d6d8e1272ebb3d712549414970f87
- SSDEEP 96:3SrMuf1uI9oyioJT1icN7w3Ie1w3m32Wj/iLIO+S/q4P1SCv64SLGiQwSIdgSmE8:3Jg1jeyioB1iMs3nLiLx+S/r1SCvtWGF
- TLSH
  T11DB1A41BBCA0C76B4743113A5ACA884DBB0DA05F005D1F057C2DD1C9BFA992C8EE6AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  unlockall-release (1) (1)/unlockall-release/load-driver.cmd
- Size 4KB
- SHA256 899ff9a09f82be5bbeb406fe5fefed8e0f6ce9dd79cfff4199c2c8085cf0b6e4
- MD5 ce8b93b8114b1116cbf8a59da6a1e939
- SHA1 7b0e1a45d30399f8f63f4f2b1b8fb1928136d637
- SHA512 2708325f0461a19c4624532190607281fd3b0445b779951a68a3a6201296aa3744160be11ff4fae44ac49915714b8abe93deb1c54e177c27e2958b4215db5848
- SSDEEP 96:ycPX2jdmX3GKN0g4jd4eFKJY9Rocg9taC:ycPXMS/N0zWZAoeC
- TLSH
  T117A1736E3E4187B254BFC923BA5B2900F32E445F063A9AD87052913DFF894AD85FC8D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Drops file in Drivers directory
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  unlockall-release (1) (1)/unlockall-release/loader/loader.exe
- Size 185KB
- SHA256 8889c534fb157aec400b8e2894109f5daa532e8fc1e7020c86be94768e8f8cb5
- MD5 cdefb873eedf9afc99e67e53408ad21b
- SHA1 df79d2976e001264fbb5108b24188c566759ef0d
- SHA512 12024935d6b8c88e12562eaab9dfe7a7c84fec908a307a731022c25ceaddc08c5deb8db75746d80f418908720fe70faac54e91b2b4242312d79b72212465d549
- SSDEEP 3072:NlQkDJkZQqHq8LQ9EduXhVsgfVcnQNVnsp/ny4xO3wA1Rd:riuqHLu1hVsiOQNyxEPd
- TLSH
  T186046B61B3E900EDE1B79A38C9611621FAB2781117349ADF436852B9DF377C0ED39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  unlockall-release (1) (1)/unlockall-release/loader/safe-rva.ps1
- Size 6KB
- SHA256 5ea066ead38d9617dbc8b682c9e8679620df95f2b0f027902259af1200a25ba2
- MD5 b012e9ab8938a5ac045773e8611074e3
- SHA1 19d3a6b58db671480d43ec1aaad807fd1e660dc3
- SHA512 db624b4c272e5db8b2f4964c82eaf9bcafd0c88f1dd5d64ee733c301b14f78cb80fcbe57baf7d116bbbc91835f4d6bd794aae0dadbc6b6a60d8817005e96cd2e
- SSDEEP 192:NIeG2Nmd3hqHGK5l75IYteW+RiQP+jiQcUgy1iQEkdTxraNxY502o:NVNmd3hqHGKD7WYtZTrBo
- TLSH
  T12AD121183EA4D7190183D129799E810DF669B02B056CAF047DBC52D8FF4906D85BEFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  unlockall-release (1) (1)/unlockall-release/loader/sec-rva.ps1
- Size 5KB
- SHA256 8bddadb11da7e8fabd951ad197a05891da4123b4d776b7ab236eaeb4d2e79a98
- MD5 35e14e56b691ac35db6961d0500da936
- SHA1 e99625daeeff8e76bf0434a6bc3ffc3c153a1792
- SHA512 a66c4e8965665d03281936c00dc31628a4bb219c6989dba2db5bda92fb54b078603dbc1601235be9c28bdb0583716538180da58f8c9ba3caf88a2da41e106850
- SSDEEP 96:02ODB4Q6E8GUQY/df5j4YybkqlKCalHPl6g/2lQ5AYCo9sOIpBa:5ODaQ6E8G6/Ipb7KCalvlFIQ5ANoiBa
- TLSH
  T185C184154F23423218A1D217A6CEA1C7EB5B402717BE6920B8ED93249F47168E57CFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  unlockall-release (1) (1)/unlockall-release/setup.cmd
- Size 1KB
- SHA256 783091a243b6d45b1880b0a9269c28d2b96296ff08e54b76352c82718290cf1a
- MD5 882d6f6ea9ead020060ef6cce3c2b8c9
- SHA1 21dc44b88e99c69a7e736fce427dcee3a202dd5a
- SHA512 d65fb3de58ad1021ca8911bfca101d68ce0554d4379d8a1fbb21a0cf7ad5802f4f082028c8cb4b3121ee2a78a04b387cf838fab2b45201f75644441a8c1b0d08
- TLSH
  T1F821331BF10D83B391A4D8155E2A6290BA18429F42151DEC785FA138BF0D7C09FFCAC0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution
- Drops file in Drivers directory
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
behavioral17 behavioral18
- Target
  unlockall-release (1) (1)/unlockall-release/unload-driver.cmd
- Size 309B
- SHA256 b00e74386476981c2bd3eb18765bbf758e6564678ff51c569225dfcbdcb1ec4b
- MD5 90c595ba40a28b1fac5487691defec01
- SHA1 417e1ca1538b4d7090641ce9970d3800e0ee7d5c
- SHA512 96a5eda1984b443196e5c962c2849843f0126e6908760d0fca5f46f849517b8f9ffec9a12729b0161f7d595c3116cfcabed2cf701c85ce53429b1b72d58ecaa6
- TLSH
  T1F3E07D0374C966B11052D4D47E3D43B23284019F1245AED5F0576039A9908C4DFEECC5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  unlockall-release (1) (1)/unlockall-release/unlockall.exe
- Size 8.9MB
- SHA256 e15617351c54e56a40e315d34b095bfe9e4d539ac99318b824b85b07ff7aa4d3
- MD5 1af9fc40887c575cfb7e5e42261156fc
- SHA1 0c04c5dd8e7c433be6641f863eb1fe117f97ee5d
- SHA512 1846e90f03b61a693da6bf6730bcd237d055028b26bb4b73998c5583d775c548293c0463c90789cd9d760a3e9e71ca5d1228bb3455939d591ade38aa1bc2583e
- SSDEEP 49152:itZZUCmV64kpfDAMgM8nqlj95sYDD21ed5Uj2VPliorW4yPiaDH5YF1cXAGy5Iy2:ZONDIDk1/5T45f9ytncRrXRunP0L3j
- TLSH
  T121967C62659500A1E0BAC175CEDB5E03DBB2784E4331EBEB0580ED974E6FAF0AD75B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22