ZeroCleare Wiper Malware | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Dropper
Trojan
Pua
Threat Names:
RawDisk
Trojan.GenericKD.32949123
Trojan.Agent.EJCG
...

ClientUpdate.exe

Windows Exe (x86-64)

Created at 2020-01-17T20:49:00

...

Indicators

File (12)
»
Filename Hash Operations Category Severity
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ClientUpdate.exe MD5: 1a69a02b0cd10b1764521fec4b7376c9
SHA1: 0d0b9299674868dbec74317c9c20de0c6c5a0549
SHA256: becb74a8a71a324c78625aa589e77631633d0f15af1473dfe34eca06e7ec6b86
SSDeep: 6144:HwDOaOGnrViaqj8qxA5ZmDvHBGTVdEolim6U9iceu:Ho3q5vhGTXj
ImpHash: bbe6985c2fe1daabb9a70eb12e8b1eb9 		Access Sample File
Malicious
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\elrawdsk.sys MD5: 993e9cb95301126debdea7dd66b9e121
SHA1: a7133c316c534d1331c801bbcd3f4c62141013a1
SHA256: 36a4e35abf2217887e97041e3e0b17483aa4d2c1aee6feadd48ef448bf1b9e6c
SSDeep: 384:9a5MM0mSc80J0sES5EGr7Btpqu1Ehc+PGhzgWdSLSbf/V+23HzirUJ2R8mf:9i3SAHOoz1a2clLST/zzixl
ImpHash: 6863bacaac5428e1e55a107a613c0717 		Dropped File
Malicious
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\saddrv.sys MD5: eaea9ccb40c82af8f3867cd0f4dd5e9d
SHA1: 7c1b25518dee1e30b5a6eaa1ea8e4a3780c24d0c
SHA256: cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986
SSDeep: 768:mkD7TfQS7D8ueMKxp0pO/Qw+FKebe3vFQFftSJfghVotiTAlLwJidG:33d38uezp0Dw+49tKMgVxAlIiw
ImpHash: b262e8d078ede007ebd0aa71b9152863 		Access, Delete Dropped File
Suspicious
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop - Access
Not Available
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\elrawdsk.sys - Access
Not Available
C:\windows\system32\cmd.exe - Access
Not Available
\??\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\elrawdsk.sys - Access, Write
Not Available
\??\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\saddrv.sys - Access, Write
Not Available
\\.\VBoxDrv - Access
Not Available
\\.\c: - Access
Not Available
\\?\ElRawDisk\??\c:#b4b615c28ccd059cf8ed1abf1c71fe03c0354522990af63adf3c911e2287a4b906d47d - Access
Not Available
soy.exe - Access
Not Available
Registry (18)
»
Registry Key Name Operations
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Oracle\VirtualBox Access
Mutex (1)
»
Mutex Name Operations
Ptición de trabajo Access
Export to TXT Export to JSON
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image