e81f0e867fcfc1281a4ffcda4be8e28d11545bd79e9bbb3b13a3c53873174ab3

Sharing

Copy URL Twitter E-mail

General

Target
13112026_0349_12112026_点击安装简体中文语言包n-rywulq-Wav64.exe.zip
Size 3.3MB
Sample261113-edd5vsft3t
SHA256 e81f0e867fcfc1281a4ffcda4be8e28d11545bd79e9bbb3b13a3c53873174ab3
MD5 6c3734616a4d8844c709cb26979a2130
SHA1 2901a88d43e55b7ed1f242bb6cde223217fda408
SHA512 b6a3f201a0d5b7fadedef708fc1624e45c180ed5553cce2afc1c6240504c01886868809054c7970d9f93050471927bc8fe183259470c9b0c6882cb9980d541e1
SSDEEP 49152:oE4E3CDGEGxwf+vURq/MoJXZ5+xeLQjJW7RJkoNHQntL+U4WKeF1IEAJG46:oIwGVmRq/ZJJUx0QjJqRJkoNwB+Krp
TLSH
T136F5335A7B4C432848888AB3E59ED50C5731AFE56CC8CD1E7A780FA63DC6465C878C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  点击安装简体中文包.msi
- Size 2.5MB
- SHA256 8079500fc6eeefa5cbbaf5a4d1933605a8091faf56189b0836ec48ae9637d096
- MD5 1a348cccdbc465e32a1b573a15991014
- SHA1 e1fc52a224ddaaca24dd177109aff613639453ed
- SHA512 b13e8f265c4c0625a62e0f9a344686adf19dc53302b2db3b9e0f926075a1d7fcec1a577c977382ef4f0b9ae0f72e3f9c403de38cb09cbded9117eec96a6ab816
- SSDEEP 49152:V4wKi/qIG0TYbBOpjjuoDgZ1gPcj3Z77lSK7Fbm:uaqRipjjHDk16cj317lSKZa
- TLSH
  T1A2C5336BFCC9CB15C58E5EB2848AD72D9234ADC0AD48CD0A377C7A723D2723545E899C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  点击安装简体中文语言包n/X64c.lnk
- Size 2KB
- SHA256 653fc69d7d8cee458479e4e083e59c022d45d3ccfde817be07f9e93ac48cde2a
- MD5 3ed399c3105749d8c2fb3df5a23335ac
- SHA1 13c94844301ffb91537530749cb812234530b01f
- SHA512 82abcd1d6bb89bcc2eac2dc169731301b92c41f81773d40e4eeaaa0f782fb5caee402571f28f28fc7f4bf9ab2b3b5ed38693910ed8db03e4fcbf14fbfe538ae2
- TLSH
  T14151E0252AD74607E7FB5AF67FB5A010E277F48A2F04C94F4189440C6833528D964F1B
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  点击安装简体中文语言包n/rywulq/MaxxAudioAPOShell64.dll
- Size 115KB
- SHA256 bc6e4bcabd7a8f933a010ddbf127ba6af980d28648597d374f882c5fa2b9ec55
- MD5 37155db635782c526bf25be7fce2f57c
- SHA1 ebdb233841bbc82d56b0e92157f93a9b0bfef4aa
- SHA512 ad279d353a876b445543208864d6960db1c69862c19b2341e0396ccf34569cb829dbd3ee057ba9e8bcd1d4080912407db72353c6b1259816387007c46a4ef476
- SSDEEP 3072:RFIu8EmrRYSBGyMW32lf/bw8Ad3tqWJAhOJm:LzeYMas2lfzu/BU
- TLSH
  T13BB35C5772EA00FBE5A38239C8635A06E776B85247619FEF03A4475A1F133D05D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  点击安装简体中文语言包n/rywulq/Wav64.exe
- Size 1.2MB
- SHA256 165c979d3ef0ffdd9b4d03ee53fb97071c93db4e586c21a8371558307e940456
- MD5 79003b577d58661e9d81abc93046bed8
- SHA1 fd864d6e1350d8fbaf51e9d78a583dff7885c50e
- SHA512 1ff73310268012ba3ad95ac3d26be0ae2c2372d51ea4568a45b27e8ee0aa3bb492ab301ef5ecf0dc4fa29b467943438d2a44ded8c1bf732219a8b64510099c12
- SSDEEP 12288:Cg7NyYi+Q5Ai6iMxeAoRizJGJECJHlWRhuYku5IN9n47G5+wQ:tNtVi6nxea1kZJFWRcYxIlyG5tQ
- TLSH
  T110455B5A766080E0F166C33AC5728AA7F7727C211BE197DB15A0B35A5F376E40E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8