Resubmissions

31-12-2021 07:48

211231-jndpasfbgk 10

General

  • Target

    Bitdefender.Antivirus.v25.0.26.88.exe

  • Size

    12.9MB

  • Sample

    211231-jndpasfbgk

  • MD5

    2ed1a518f5711a6d76fd5e038be96f9e

  • SHA1

    c66900065762296fae037716e283f5cab5e1db9a

  • SHA256

    590d385c35a94e2292fdf6d5c805874b3bdd9f1ae0ca4883ef036b3a8d23d72d

  • SHA512

    44b81e24bca1fb6d9fcfad8ca69ec5a5867c60ce95b04b367c0bb7a8e56b706f1b85b4c82b83c124d62d80734d47af62f0e34aaae73ebb293446a34a4d7becf2

Malware Config

Extracted

Path

C:\Program Files\Bitdefender Antivirus Free\lang\en-us\eula.html

Ransom Note
 <h3 style="background-image: url();"><!--BEGIN_TRANSLATABLE_TEXT-->LICENSE AGREEMENT<!--END_TRANSLATABLE_TEXT--></h3><hr> <div> <p><!--BEGIN_TRANSLATABLE_TEXT-->NOTICE TO ALL USERS: PLEASE READ THIS AGREEMENT CAREFULLY.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->BY OPENING THIS PACKAGE, BREAKING THE SEAL, BY SELECTING "I ACCEPT", "OK", "CONTINUE", "YES" OR BY INSTALLING OR USING THE SOFTWARE IN ANY WAY, YOU ARE INDICATING YOUR COMPLETE UNDERSTANDING AND ACCEPTANCE OF THE TERMS OF THIS AGREEMENT. If the Software is downloaded from the websites (for paid or trial use purposes), this Agreement will be accepted and a contract formed when you selects an "I Accept", "OK" or "Yes" button or box below prior to download or installation.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->IF YOU DO NOT AGREE TO THESE TERMS AND CONDITIONS DO NOT INSTALL OR ACCESS THE SOFTWARE OR OTHERWISE INDICATE REFUSAL, MAKE NO FURTHER USE OF THE SOFTWARE, AND CONTACT YOUR VENDOR OR CUSTOMER SERVICE, FOR INFORMATION ON HOW TO OBTAIN A REFUND OF THE MONEY YOU PAID FOR THE SOFTWARE AT ANY TIME DURING THE THIRTY (30) DAYS PERIOD FOLLOWING THE DATE OF PURCHASE.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->PRODUCT REGISTRATION. By accepting this Agreement, You agree to register Your Software. Registration requires a valid product serial number and a valid email address for renewal and other notices.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->The Bitdefender Account is necessary for the activation of the online features, as stated in the Product Documentation.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->You warrant that you are the legal owner of the device and you have all the legal rights to create your account. Please acknowledge that installing on your device Software, and taking in consideration the security policies and rules selected by you, you may experience access restrictions to device and data loss due to remote device lock or wipe commands applied by the administrator of the account manually through security policies. You as administrator( have the right to monitor your device, locate it on map, enforce screen lock and authentication, lock and wipe device, encrypt media storage, scan applications and file on your device. Bitdefender shall not be held responsible for any damages resulting from privacy, data loss caused to you.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->This License Agreement covers Bitdefender Products for home-users licensed to you, including related documentation and any update and upgrade of the applications delivered to you under the purchased license or any related service agreement as defined in the documentation and any copy of these items.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->The Bitdefender Product offers an Internet control software which shall be software installed on your device ( computer, mobile, mobile computer device) that intercepts Internet-bound traffic, to monitor traffic and permits You to limit access to certain content. The software on Your personal device connects to a server network infrastructure and then send it to Bitdefender servers for categorization.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->The Bitdefender Product may allow you to track the device location, disable access to the device, transmit images that have been capture with the camera of your device or voice records that have been recorded by the recorder of your device (if available). You may not use the services to gain unauthorized access, to upload, transmit, transfer data or information to Bitdefender or third parties by any means. You agree that your use of these services will be in compliance with any laws which are applicable to you.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->This License Agreement is a legal agreement between you (either an individual or a legal person) and BITDEFENDER for use of BITDEFENDER's software product identified above, which includes software and services for your device, and may include associated media, printed materials, and "online" or electronic documentation (hereafter designated as "Bitdefender Product"), all of which are protected by international copyright laws and international treaties. By installing, copying or using Bitdefender Product, you agree to be bound by the terms of this Agreement.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->GRANT OF LICENSE. Bitdefender Product is protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties. Bitdefender Product is licensed, not sold. This agreement only gives You some rights to use Bitdefender Product. Bitdefender reserves all other rights. Unless applicable law gives you more rights despite this limitation, You may use Bitdefender Product only as expressly permitted in this Agreement.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->Bitdefender hereby grants you and only you the following non-exclusive, limited, non assignable, non-transferable, non-sublicensable and royalty-bearing license to use Bitdefender Product.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->You will have certain rights to use the Bitdefender Product during the License Period, which shall begin on the date of Your initial installation of the Bitdefender Product regardless of the number of copies that You are permitted to use, and shall last for the period of time set forth in the Documentation or the applicable transaction documentation from the Bitdefender distributor or reseller from which You obtained the Bitdefender Product. The Bitdefender Product may automatically be deactivated at the end of the License Period, and You will not be entitled to receive any feature or content updates to the Bitdefender Product.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->You can use one copy of the Bitdefender Product on a single device. If a greater number of copies and/or number of devices is specified within the sale transaction documentation from the authorized distributor or reseller from which You obtained the Bitdefender Product (Permitted Number), You shall have the right to copy the Bitdefender Product in accordance with such specifications;<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->You can make one copy of the Bitdefender Product for back-up or archival purposes; If the Bitdefender Product supports multiple platforms or languages, if you receive the Bitdefender Product on multiple media, if you otherwise receive multiple copies of the Bitdefender Product, or if you receive the Bitdefender Product bundled with other software, the total number of your Devices on which all versions of the Bitdefender Product are installed may not exceed the Permitted Number.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->During the installation process, the Bitdefender Product may uninstall or disable other security products if such products or features are incompatible with Bitdefender Product.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->TRIAL LICENSE. If You are a trial user, You may use Bitdefender Product for evaluation or testing purposes in a non-production environment for thirty (30) days from the date You download Bitdefender Product (the "Trial Period"). During the Trial Period, You are entitled to web or email based technical support in the country where You are located and to Updates, if applicable. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, BITDEFENDER PRODUCT AND ANY SERVICES AND RELATED DOCUMENTATION USED FOR EVALUATION PURPOSES ARE PROVIDED TO YOU "AS IS" WITHOUT WARRANTIES OF ANY KIND. Your right to use Bitdefender Product ends when the Trial Period ends or if You violate any term of this Agreement. Upon termination of the Evaluation Period, You must delete or destroy all copies of Bitdefender Product and documentation and stop using the Service. Your obligations and rights under this Agreement will continue to apply after the end of the Trial Period.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->TERMS OF LICENSE. You will have certain rights to use the Bitdefender Product during the License Period, which shall begin on the date of Your initial installation of the Bitdefender Product regardless of the number of copies that You are permitted to use, and shall last for the period of time set forth in the Documentation or the applicable transaction documentation from the Bitdefender distributor or reseller from which You obtained the Bitdefender Product. The Bitdefender Product may automatically be deactivated at the end of the License Period, and You will not be entitled to receive any feature or content updates to the Bitdefender Product.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->If you have agreed to permit Bitdefender to automatically renew your subscription to Bitdefender Product by charging a valid credit card number which you have provided to Bitdefender, your subscription will be automatically renewed thirty (30) days prior to the expiration of the term and each anniversary thereafter for a fee no greater than Bitdefender's then-current price, excluding promotional and discount pricing. You must provide current, complete and accurate information for your billing account. You must promptly update all information to keep your billing account current, complete, and accurate (such as, but not limited to a change in billing address, credit card number, or credit card expiration date), and you must promptly notify Bitdefender if your credit card is canceled (such as, but not limited to for loss or theft). If you fail to provide Bitdefender any of the foregoing information, you agree that Bitdefender may continue charging you for any subscription automatically renewed unless you inform Bitdefender's Customer Care department at http://www.Bitdefender.com/site/Main/contactForm/ (or any other local number provided by the respective Bitdefender entity in your region) not to renew your subscription to Bitdefender Product at least thirty (30) days prior to the expiration of your subscription to Bitdefender Product and informing them of your desire not to have such subscription automatically renewed. This Agreement will terminate automatically if you fail to comply with any of the limitations or other requirements described herein. Upon any termination or expiration of this Agreement, you must cease use of Bitdefender Product and destroy all copies of Bitdefender and the Documentation.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->UPGRADES. If Bitdefender is labeled as an upgrade, you must be properly licensed to use a product identified by BITDEFENDER as being eligible for the upgrade in order to use Bitdefender Product. A Bitdefender Product labeled as an upgrade replaces and/or supplements the product that formed the basis for your eligibility for the upgrade. You may use the resulting upgraded product only in accordance with the terms of this License Agreement. If Bitdefender Product is an upgrade of a component of a package of software programs that you licensed as a single Bitdefender Product may be used and transferred only as part of that single product package and may not be separated for use by more than the total number of licensed users. The terms and conditions of this license replace and supersede any previous agreements that may have existed between you and BITDEFENDER regarding the original product or the resulting upgraded product.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->COPYRIGHT. All rights, titles and interest in and to Bitdefender and all copyright rights in and to Bitdefender (including but not limited to any code, images, photographs, logos, animations, video, audio, music, text, and "applets" incorporated into Bitdefender), the accompanying printed materials, and any copies of Bitdefender are owned by BITDEFENDER, with the understanding that rights, titles and interest in and to certain third party software identified in the accompanying Third Party License Terms are owned by their respective owners. Bitdefender is protected by copyright laws and international treaty provisions. Therefore, you must treat Bitdefender like any other copyrighted material. You may not copy the printed materials accompanying Bitdefender. You must produce and include all copyright notices in their original form for all copies created irrespective of the media or form in which Bitdefender exists. You may not sub-license, rent, sell, lease or share the Bitdefender license. You may not reverse engineer, recompile, disassemble, create derivative works, modify, translate, or make any attempt to discover the source code for Bitdefender, except as and only to the extent explicitly permitted by the licensing terms, identified in the accompanying Third Party License Terms, governing use of the third party software.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->TECHNICAL SUPPORT. Certain technical support features may be offered by Bitdefender for the license term of the Bitdefender Product and may include live chat with a technical support consultant and/or assistance from a technical support consultant via remote access. If such features are offered and You choose to access such Technical Support it shall be governed by the following conditions: Any such Technical Support shall be provided in Bitdefender's sole discretion without any guarantee or warranty of any kind. It is solely Your responsibility to complete a backup of all Your existing data, software and programs before receiving any Technical Support. In the course of providing the Technical Support, Bitdefender may determine that the technical issue is beyond the scope of the Technical Support. Bitdefender reserves the right to refuse, suspend or terminate any of the Technical Support in its sole discretion.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->LIMITED WARRANTY. BITDEFENDER warrants that the media on which Bitdefender is distributed is free from defects for a period of thirty days from the date of delivery of Bitdefender to you. Your sole remedy for a breach of this warranty will be that BITDEFENDER , at its option, may replace the defective media upon receipt of the damaged media, or refund the money you paid for Bitdefender. BITDEFENDER does not warrant that Bitdefender will be uninterrupted or error free or that the errors will be corrected. BITDEFENDER does not warrant that Bitdefender will meet your requirements.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, BITDEFENDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, WITH RESPECT TO THE BITDEFENDER PRODUCTS, ENHANCEMENTS, MAINTENANCE OR SUPPORT RELATED THERETO, OR ANY OTHER MATERIALS (TANGIBLE OR INTANGIBLE) OR SERVICES SUPPLIED BY HIM. BITDEFENDER HEREBY EXPRESSLY DISCLAIMS ANY IMPLIED WARRANTIES AND CONDITIONS, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, LOSS OF DATA, DEVICE FAILURE OR MALFUNCTION FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON INTERFERENCE, ACCURACY OF DATA, ACCURACY OF INFORMATIONAL CONTENT, SYSTEM INTEGRATION, AND NON INFRINGEMENT OF THIRD PARTY RIGHTS BY FILTERING, DISABLING, OR REMOVING SUCH THIRD PARTY'S SOFTWARE, SPYWARE, ADWARE, COOKIES, EMAILS, DOCUMENTS, ADVERTISEMENTS OR THE LIKE, WHETHER ARISING BY STATUTE, LAW, COURSE OF DEALING, CUSTOM AND PRACTICE, OR TRADE USAGE. Bitdefender is acting on behalf of its suppliers and marketing partners for the purpose of disclaiming, excluding and/or limiting obligations, warranties and liability as provided in this Agreement, but in no other respects and for no other purpose. The foregoing provisions shall be enforceable to the maximum extent permitted by applicable law.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->The Bitdefender Product, as provided under this Agreement, can contain features and functionalities that allows You t
Emails

[email protected].<!--END_TRANSLATABLE_TEXT--></p>

[email protected]<!--END_TRANSLATABLE_TEXT--></p>

URLs

http://www.Bitdefender.com/site/Main/contactForm/

Targets

    • Target

      Bitdefender.Antivirus.v25.0.26.88.exe

    • Size

      12.9MB

    • MD5

      2ed1a518f5711a6d76fd5e038be96f9e

    • SHA1

      c66900065762296fae037716e283f5cab5e1db9a

    • SHA256

      590d385c35a94e2292fdf6d5c805874b3bdd9f1ae0ca4883ef036b3a8d23d72d

    • SHA512

      44b81e24bca1fb6d9fcfad8ca69ec5a5867c60ce95b04b367c0bb7a8e56b706f1b85b4c82b83c124d62d80734d47af62f0e34aaae73ebb293446a34a4d7becf2

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Sets file execution options in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Tasks