1823903fe6dd190d4c3e7e563a026ee0042ff35337a3eba7c4bcc4beddcf942d

Sharing

Copy URL Twitter E-mail

General

Target
HFkiller_full.zip
Size 8.2MB
Sample261113-pexnpsbt4v
SHA256 1823903fe6dd190d4c3e7e563a026ee0042ff35337a3eba7c4bcc4beddcf942d
MD5 f638b2b8b7dec41171e45edf4a702fef
SHA1 3525fb4e287b2e3c24c4fdff6b2ebd3b1d67573f
SHA512 4da9aaec4b44ebd6c670a6b178c4793fc496bfb73782e4e94ee176b7b07cde73510dcd33a9168fa230ac54bedf6c4d9531657d9c29694ef6d343d199e2e39d7b
SSDEEP 196608:qtnQLEnFE6c9ibTITBR5L7ssG/3a3jv9dEeENeaUdwYe3kFK:6hFENibwPJ7zG/3a35+V7
TLSH
T146962371DB142C43EB0FA5B7D31CC81DE899D182845C5A1F38BC59DC587A680AB39FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution ransomware

Malware Config

Targets

- Target
  HFkiller_full/HFkiller_full.exe
- Size 12.3MB
- SHA256 3ba31e83a49e1f514f970e12d9776a4035eb05b0b187a797068baaaec8b14775
- MD5 5f5ad376c198f0d8401c4c651e35176e
- SHA1 7cc3c367218dee1e526ec48ce1ee97b8de724ae3
- SHA512 81c4c406a8d850809b05b1c9295d789acdc8bfdef324c80bb3e18fdb01b30c7ac48ac4ceb32178322dd3908cf18b767510138d1855740a53f720e7b4f67fbe10
- SSDEEP 196608:CMDqObBmfud2q2XBEUs81uVdcc+rk84C7djGzVTNM88kydKV3:COqObndt410ycQk84C7IxTNekyde
- TLSH
  T17FD6AD56F3F801A9E5BBC178C5674517EBB2B8451320E7DF45A08A692F23BE06E3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  HFkiller_full/ps/Certificate.format.ps1xml
- Size 12KB
- SHA256 031bdb9c0a1b9f05d3916d6ef18f9e85446c5aa903040df3a6d0c773014770c3
- MD5 e6fa887396e50f1f398dc6612fb60a3e
- SHA1 23f12de672616abb861d5eeebf0a203c831aee94
- SHA512 412a4aa02ddaa131fcaba54d1545b84d7a9d7b7b589758b63c04733eb1d32f967e0c8864bb66ac2b8ba106422a364cb2c1ac86394c0b55cf1b8310343968d6bb
- SSDEEP 192:XyHd6BFjItaCXqbxWBvE/kImGIR2//+K/:XmKFS2xAmkImGIR2/+K/
- TLSH
  T1E5427B4AD2E07FF019B1452AFBA9A5D5DE14930F086B2650F2DC7B0B2FB9CA54133636
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  HFkiller_full/ps/Diagnostics.Format.ps1xml
- Size 4KB
- SHA256 95ebb76eb0cd0db44c293212e137aa3f0ced2c579ab218137f407c06f2fb8194
- MD5 c713fd615034119f2e74dd9875a41796
- SHA1 312ffdb56a11c9213377dae50b2a882e77399f15
- SHA512 92e3d2795e852e2c42950b36aee8d17b59a44007ef259ed6d301e1b4ad0532c9acc186382be2188351228872cc18d59194926620eda345ec2e299efcde552ea5
- SSDEEP 48:fJBJ2QlBVtq0svUlMaSLkKRMXhXIDk+kw1+xXBJ2QVtD44yLkKkX7/X/l/XIDk+1:fPto/Tk7louJqkllo3j
- TLSH
  T192A1AC4323EE511872776A5D3E7248B48F2BB921297DD9EE10AC304ECFE7E1285517A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  HFkiller_full/ps/Event.Format.ps1xml
- Size 9KB
- SHA256 9a5e2b8a297fae8c9f24ff1a5c13830442a5c490eff939026c5d29ec33255192
- MD5 2ed53401bbb77ed6089ede39a6d7d7eb
- SHA1 e6f8baa878810f1c5fca2e7c06263a27c3791249
- SHA512 f0c86fb7da3641f0eb8a913e8adbc1a925d39c46b736c18d5baed1621c2da8969505387916e614f670f130171be9e37b5cb648814d8d2f28252b5c296e53991a
- SSDEEP 48:yyDtJAnqQV+MWQK89y3gyL0y9X1XDX7XoDk+kg1exQAnqtVQPlXPybyHL0l+XbX8:dt7fl0yPl4dYPln0lIst46Vr6oj
- TLSH
  T19A229A4323EE5118B1775A5D393388B44F2BBA21597DD9AE01AC304FCFE3E1296507A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  HFkiller_full/ps/Examples/profile.ps1
- Size 461B
- SHA256 9f51461c6bb0fa44dea4b80d3bfd23e266ba2592e2f4c29d004c7f01a14e078a
- MD5 8624762990fa5970a2cb25cba70e9ad4
- SHA1 30e18f1bb325f85290c85131fc2232c141c8086f
- SHA512 2dbda62735c575cae5fbec87405fe9d128f6797b4710c3ca14232c6ce6509910e122e8be04a1e8168e90a7a75750889cc2188132bce146ff76b981e86b9deeec
- TLSH
  T18EF05CDCB5039DA52B783F5A34013E1020A67156C8B95F8D04B6B2C5E12FB5E46FE411
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  HFkiller_full/ps/FileSystem.format.ps1xml
- Size 24KB
- SHA256 38ad45871b7d47d4bf1cfbe1d7d0a8d78fc1f0dd4dee2747d64aa6d1297d7a96
- MD5 8f1b890ade25a9b8b119b42887d561e4
- SHA1 5bc84f859cc0def53fdaa8128438fdf4fa7ff4b4
- SHA512 020fd777f79b5158a1364321ccbcf3597185ad51107bce511386ef599c34585e1b2807cc5b4f1b4b766f4e0015ef84772eeea9a59e8e0283dabc575729aabff1
- SSDEEP 192:N05fjwIcfD20klGb0/Sv0EwXlVG70qlqj:N05fEvFWGyj
- TLSH
  T168B2E24363EE5508B2B76A5C2A37C8744F2BBA61593DC67D02AC304FCBE7D1296117A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  HFkiller_full/ps/Help.format.ps1xml
- Size 89KB
- SHA256 21701fbd643a1c8246989a9aefd43afb07ab0ae4de5bc65ac3ce36dd1a785768
- MD5 fdf795ae64b823fe2dde2a443f1d34f4
- SHA1 cb572b08bf448a9d9fa0ac2ad8f02b5c338087a6
- SHA512 34933193753139daab930d18ce287fe296407b89104f69414ea84386a51f4ec0e1f6b53440ddda6f77f16962d5c925a443879b402e5517695e5774839533acbe
- SSDEEP 384:XmQXLIL0m+6LQLeLblZqpGhdd0ddZDCQmw7rzp:XmQXLIL0m+6LQLeLbipGaNF7rzp
- TLSH
  T1A7933B2552F04FB40DF5087AB79CAC52DD2693A718618299BECD2B570FF2C61B873932
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  HFkiller_full/ps/Modules/AppBackgroundTask/Microsoft.Windows.AppBackgroundTask.Commands.dll
- Size 8KB
- SHA256 74c68aefe849f0a20571c41a2d7fa676b2046c5bb391add8442c1910703c9d9a
- MD5 f0570c4f0e4dc2942b188a5737c4a880
- SHA1 5f6bd9368bb37fb84df8d793a627083c73c14068
- SHA512 4e32da8a946d8b2f9aba9e26244c52ef836c596815572dc630f23008cbeb45ddd4ab8e79c4d778da8cc39363f758483b97844f3d08202e78e89b69e6f977c501
- SSDEEP 96:ysNvCabsjY8ASBazyUdnj08r6wa63J8Kb0D6H61avTpASKx0I+DzDYVkIbL/tbLC:dZbpdjgBybb4f04ZIzV2Wy0AW
- TLSH
  T125025190A3F8062AFAFF1F767C7646155AB77E52AC33C72D1044920A5D32B948A31B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  HFkiller_full/ps/Modules/AppvClient/AppVClientCmdlets.psm1
- Size 7KB
- SHA256 cd32996ba34772f476b8182ef2ceec35db676a6b7ef464a4cfd19711d9008f5c
- MD5 a7707eb2d7938e7e976eff010a88bf65
- SHA1 d6d6656aa3375e35cb23f95662b3045142977d9a
- SHA512 f8b1e999b82b05de589a4108d7245f60e3fa521788dad5de54e4a39994ad6ccc9f729d9ca1df4720216876496d8c23adbe54ce51b3b2a0f1f9dde760e6640962
- SSDEEP 192:Z3sCPT+34NyH/g8Lf0FIM4/5e4jZTjlwxjaCpK3CpK9:Z3sCPa34Nyfg8Lf0FIM4/vjRj0jaCLM
- TLSH
  T14CE11F793788439401F72A65BAB5C012C93A13A7313E6E10BAFD58C41FB7915EA2CF5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  HFkiller_full/ps/Modules/AppvClient/Microsoft.AppV.AppVClientPowerShell.dll
- Size 106KB
- SHA256 03e319b2c4e517445475d7b7a919cbb45a82938776b66c1c1ff35c72be2d8ac4
- MD5 d06a1e84694bb6a8a45ce1675ed8dc0b
- SHA1 c4c50e469f0d4613e57309186fb70838589512ce
- SHA512 32fc4dde36d3a082ed6ad83e977e3ba6c22ea4920a7908a3a361d4ef4dfa46e92040ad3fb63e1fddb8ea20893b6082d6d865fe220d53d2f2f328527359d7f01b
- SSDEEP 1536:xlhm7VVvHtAl7aKtqsPlHE55/V8/qwD/Pnryl+fyO3JP3wbnVdoqx3QHRdmpPoBV:xDeVvhsdHEXoPnu/WJP3wbToqx3a7mu
- TLSH
  T166B33A90B36C576BD39B8A7CF06484220739EE41362BDB6558E0F5DD1C63B849B123BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  HFkiller_full/ps/Modules/AppvClient/Microsoft.AppV.AppvClientComConsumer.dll
- Size 708KB
- SHA256 cad5235fc8ada4f743e6de606f187ef9049cc3ef9a5b58f8a3a55530aaf8d552
- MD5 a8a98193426da75e34bc8b27e2ffbdef
- SHA1 e8b0721cdf1340df537e9115184716a9b5091c74
- SHA512 71dab1479a775d9023afee618f1da5efad44d6a7972f72405940b14fb2cf7453a7af35efd8def5d5eedc23346f74758404fa51c73e3a1403fa3de44f4ca30076
- SSDEEP 12288:WHU8V5+0r8SXGNUbTizUxhlUbRjoDBTb+gLSKf/jrXcy+tieJFWOihNxEEOVmU8c:WHU8GzqDBTb+gLSKf/jrXcy+tieJFWO4
- TLSH
  T104F41AB6AB934ABAC3BE1A7E99B3C31197B5B421430281C7E27461191CD33C8F675D72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  HFkiller_full/ps/Modules/AppvClient/Microsoft.AppV.ClientProgrammability.Eventing.dll
- Size 169KB
- SHA256 5fe32be6aa14df923da9e7fda752c0ce48b97137274baf8f1798f12fcecd6bdd
- MD5 31fb5298ff5db857fb6fb4f1a58bac9a
- SHA1 02ac2626d3c78ed3fd8beec1f0d98267bc994592
- SHA512 2e9af5f6f86ed34f92848ddb756d6e7aafc48d4ed1db995d56690d1fd02c1eb30f1980ca87a7ae383439fbc7d5b0d9bf246f1e0ff82fe30ec6e678d9ee4d7c22
- SSDEEP 3072:3x9/VwXFoGvFbxM+HHYq8ajY5P8B43z3asLTd1XqtIroiN9kFUMG0QxgjnbMTcEq:jeXFfvFbxM+nvGO43z3asLT0
- TLSH
  T1B804CF87C2357A06D44F0E726C178B42A596829DA2845C4FEFDDE08FC5A4EAD6F103B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  HFkiller_full/ps/Modules/AppvClient/zh-HANS/Microsoft.AppV.AppVClientPowerShell.resources.dll
- Size 8KB
- SHA256 39d9a10650b1c1c43cf9ff37735b6abec0b42b43752c7b6dfd159f3d11107c82
- MD5 7117efbfc18d39cfd773a7946246a37e
- SHA1 6fc690fed8cbcb9d196e2426950c9620fe116079
- SHA512 32c040c61dc283c352b7f83bd6b1cb58d8d4a3d9d2d73a8e22f10cf033cf7654ca79d0b038bfd580601aeed873234445a5594c22018a8291c4671a9b72339fd2
- SSDEEP 192:WjQWd53+vFIeqkptH6I/nhB7jGhDjW70W:WjQWqvdpTL/h1ChDjW70W
- TLSH
  T184F1954263F499A9F1F75FB49AB78954EA3FFC32AA34D61D0990060C5C229805DA0F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  HFkiller_full/ps/Modules/AppvClient/zh-HANS/Microsoft.AppV.AppvClientComConsumer.resources.dll
- Size 19KB
- SHA256 5eb6f31f731fefb0fabcf717768dcb8eace23a615b1fdf040a1858144e3238e8
- MD5 c31a231ccd1ef576ff63e0a9f258ee8e
- SHA1 501420443b0cff183213aa29b876c199c03a1b45
- SHA512 58931092a99e8a4cf8b9c2b1a8a6f5ee9356daecb6acdab6517c29f1463ab280d2ba98d356d827913579632e73ee3116b2abe6e1e4bb6cfd3921f12894a87101
- SSDEEP 384:5hH4/jxkjomGQ2r3kp06snBf6jyMBakzNfjnzQJiZT7WRSW:+XQC3kpaSDQkzNfjnzQJi0
- TLSH
  T15592D70137E8DEEAF0F70BB49BFB916BE12AFD366622C05C59C0570E59249814E6473E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  HFkiller_full/ps/Modules/Appx/Appx.psm1
- Size 4KB
- SHA256 803c85d5791301e7db218a0953bcdbbd362671f38699f5afb6497a890ac6a2c4
- MD5 2614010db06cefec4f7cd5474862b00d
- SHA1 1404e610c191fdd03865336dd6ac8174e4411d65
- SHA512 a67d86757a29e04a33c931bc78cb36ef2d302491cf7d1886ede72f5ed39dc82514a7ff44a6a742d48a2d8b64e106bda3e75197c75058b49e89d7e1cad4b30dc9
- SSDEEP 96:s6emk04syFnQE9YlM0kjNj38jHZPY49Ylf2n5QPPI9YlCYQPPI9IVfOI9wc0Yyol:v8PaMr8TZ7aGa7K9ucN
- TLSH
  T14FA11064D72C9787A07F5B5FB6574804E90A129771185E6037EC0FAC8F72762E00AFAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  HFkiller_full/ps/Modules/AssignedAccess/AssignedAccess.psm1
- Size 13KB
- SHA256 b4247c8500b73e30c4e523a110c9ebbef6e6c8663dc9b9233d9ef0c6d1867e38
- MD5 3e38a11d1f2cfdab23b2be8ed72bb152
- SHA1 a972e9141e4eb823b865dc42a486cf76d6ce3758
- SHA512 71c772f82b6225bab02ba2af78818f49a6776170a0ecd9b3aa23e52fedbbc2526a0e862eabe59d44e145042b4d3635efc0ce95b3cd0674e645a2e84bc40055b8
- SSDEEP 384:+oFyXPXu27XD8lwsr2vBYhy38xCSk58A2XjF:+QyXPXuoaws2vBYh48xCv58A2XjF
- TLSH
  T11C52F8959B4202A8063703798E299258E9D9003793FA02A1FCFC4E515F3A796C776FCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  HFkiller_full/ps/Modules/BitLocker/BitLocker.Format.ps1xml
- Size 5KB
- SHA256 3c2c92a8a68795d13565610906665fdfd709dfbdbd3d0f6be91a9d40a93f0521
- MD5 e39046c77784240fe79cdc7e61e5971f
- SHA1 e6c1da119db4ddf6285512b66278697874f7016b
- SHA512 a4ada1bbec94fb8d425f0f256a1f0db142ec398e7b73fa45f9ec06290fb8dd5890677e07687a5d20a30dc65b67d63c3396c440d502136c081ab0c2a58e93ceaa
- SSDEEP 48:yc9u58JaVfVMoMMXqf0sK3CsfDSu0S7SyLklXxXBw7SxiX5hXJXwXPXIDk+kw1+l:N9Y69MpDo8rkO7S0Clof6
- TLSH
  T149C1CB5323EE5118B277665C3E374CB04F2BBA262579D9AE40AC300FDFE3A1246517A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32