General

  • Target

    Bitdefender Total Security _.zip

  • Size

    437.9MB

  • Sample

    221012-ncdmdaddb3

  • MD5

    f27dbb274fb29ae23bbf99d2f0daba71

  • SHA1

    5661d95683b0bcc4307e6bc08a71b39e5a0580fa

  • SHA256

    d419d3a439932e77480ba9106cd4801ce41bd1aa928d74d3f5a2b50516d89d83

  • SHA512

    613d089eaedbb9ba407a067c82ec34ebb7d44054491993d4e82aa9b945ad0876d359e512b996bdb069c2216220cb1be9e9c9c616dd4f770301035564560f6aac

  • SSDEEP

    6291456:w1sO3upLl2XVJrCn4giZujeSnDXrUOOwzykqjCo68tt++cBURxU4IJlrkc5rkkSj:wID2F3gVj3UfwfU++cBVhkc5PhiHY167

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RarSFX0\lang\eula_en-US.html

Ransom Note
<p><!--BEGIN_TRANSLATABLE_TEXT-->Subscription Agreement and Terms of services for Home User Solutions<!--END_TRANSLATABLE_TEXT--></p> ______________________________________________________________________________________ <p><!--BEGIN_TRANSLATABLE_TEXT-->NOTICE TO ALL USERS: PLEASE READ THIS AGREEMENT CAREFULLY!<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->BY OPENING THIS PACKAGE, BREAKING THE SEAL, BY SELECTING "I ACCEPT", "OK", "CONTINUE", "YES" OR BY INSTALLING OR USING THE SOFTWARE IN ANY WAY, YOU ARE INDICATING YOUR COMPLETE UNDERSTANDING AND ACCEPTANCE OF THE TERMS OF THIS AGREEMENT.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->If the Software is downloaded from the websites (for paid or trial use purposes), this Agreement will be accepted and a contract formed when the end user ("You") selects an "I Accept", "OK" or "Yes" button or box below prior to download or installation. The Agreement is made available on Bitdefender websites as well for your reference. <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->Certain Bitdefender Solution may require an active and stable connection to the Internet in order to function. It is therefore your responsibility to ensure that you have at all times an active and stable Internet connection.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->IF YOU DO NOT AGREE TO THESE TERMS AND CONDITIONS DO NOT INSTALL OR ACCESS THE SOFTWARE OR OTHERWISE INDICATE REFUSAL, MAKE NO FURTHER USE OF THE SOFTWARE, AND CONTACT YOUR VENDOR OR CUSTOMER SERVICE, FOR INFORMATION ON HOW TO OBTAIN A REFUND OF THE MONEY YOU PAID FOR THE SOFTWARE AT ANY TIME DURING THE THIRTY (30) DAYS PERIOD FOLLOWING THE DATE OF PURCHASE.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->SOLUTION REGISTRATION. By accepting this Agreement, You agree to register Your Bitdefender Solution. Registration requires a valid activation code available in the transaction documentation from the Bitdefender distributor or reseller from which You obtained the Bitdefender Solution.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->Also Registration requires a valid Bitdefender Account that includes a valid email address for renewal and other notices and a valid product subscription. The Bitdefender Account is mandatory for the use of the Bitdefender Solution, as stated in the Documentation.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->You warrant that you are the legal owner of the device and you have all the legal rights to create your account. Please acknowledge that installing on your device Software, and taking in consideration the security policies and rules selected by you, you may experience access restrictions to device and data loss due to remote device lock or wipe commands applied by the administrator of the account manually through security policies. You as administrator have the right to monitor your device, locate it on map, enforce screen lock and authentication, lock and wipe device, encrypt media storage, remove temporary files, registry keys and browser data, scan applications and files on your device. Bitdefender shall not be held responsible for any damages resulting from privacy, data loss caused to you.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->This Subscription Agreement is a legal agreement between you (either an individual or a legal person) and BITDEFENDER for use of Software and Services identified above, which includes computer software and services, and may include associated media, printed materials, and “online” or electronic documentation (hereafter designated as “Software and Services"), all of which are protected by international copyright laws and international treaties.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->This Subscription Agreement covers Bitdefender Solutions for Home-Users for the permitted number of users or devices as detailed in the purchasing documentation, including related documentation and any update and upgrade of the applications delivered to you under the purchased subscription or any related services as defined in the documentation.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->The Bitdefender Solution offers an Internet control software which shall be software installed on your device (computer, mobile, mobile computer device) that intercepts Internet-bound traffic, to monitor traffic and permits You to limit access to certain content. The software on Your personal device connects to a server network infrastructure and then send it to Bitdefender servers for categorization. <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->The Bitdefender Solution may block certain unsafe applications that attempt to access protected resources on your device. This may result in applications not starting or not behave properly. Please note that You granting access to these applications may result in data loss or data theft. <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->The Bitdefender Solution having the Anti-Theft feature available, may allow you to track the device location, disable access to the device, transmit images that have been capture with the camera of your device or voice records that have been recorded by the recorder of your device (if available). You may not use the services to gain unauthorized access, to upload, transmit, and transfer data or information to Bitdefender or third parties by any means. You agree that your use of these services will be in compliance with any laws which are applicable to you.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->The Bitdefender Solution has the Bitdefender VPN included as a feature which allows You to use VPN functionality to protect your privacy. Bitdefender VPN is limited to 200 MB of traffic per day for each device in your existing subscription. Should You want to benefit from an updated plan that offers unlimited traffic and allows selection of different server locations, You must upgrade to Bitdefender VPN Premium for an additional cost. The Bitdefender VPN Premium is limited to 10 concurrent sessions. The VPN functionality is a third party software and it is licensed to You under the respective third party licenses mentioned herein. By accepting this Agreement, You agree to accept and comply with https://www.hotspotshield.com/terms/ for the Bitdefender VPN and Bitdefender VPN Premium and with https://www.hotspotshield.com/privacy/ for the Bitdefender VPN and Bitdefender VPN Premium which terms are in addition to the terms and conditions stated in this Agreement.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->Bitdefender Solution is protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties. Bitdefender software that is installed on your device, as part of the Bitdefender Solution, is licensed, not sold. You are only entitled to use the Bitdefender Solution for the limited period stated in the purchase documentation. Your use of the Bitdefender Solution is limited to the permitted number of users or devices as detailed in the purchasing documentation. Bitdefender reserves all other rights. Unless applicable law gives you more rights despite this limitation, You may use Bitdefender Solution only as expressly permitted in this Agreement. <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->Bitdefender hereby grants you and only you the following non-exclusive, limited, non-sublicensable, non-commercial right to use Bitdefender Solution for your personal use only.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->You can use one copy of the Bitdefender Solution on a single device only. If a greater number of copies and/or number of devices is specified within the sale transaction documentation from the authorized distributor or reseller from which You obtained the Bitdefender Solution (Permitted Number), You shall have the right to copy the Bitdefender Solution in accordance with such specifications of Perminted number; If the Bitdefender Solution supports multiple platforms or languages, if you receive the Bitdefender Solution on multiple media, if you otherwise receive multiple copies of the Bitdefender Solution, or if you receive the Bitdefender Solution bundled with other software, the total number of your Devices on which all versions of the Bitdefender Solution are installed may not exceed the Permitted Number.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->During the installation process, the Bitdefender Solution may uninstall or disable other security products if such products or features are incompatible with Bitdefender Solution.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->Bitdefender Solutions- Family pack, having unlimited usage rights, restricts the usage within your household and it is intended to be used on devices belonging to family members living in the same household according to fair usage policy. Limitations may apply in case installations overreach residential usage. Bitdefender reserves the right to limit the users if it determines an abuse of the usage of the Bitdefender Solution.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->FAIR USAGE POLICY. The following is a non-exhaustive list of practices that would not be considered fair usage: i) Using subscriptions for telemarketing or services offered to third parties to generate income for yourself or others; ii) Re-selling or sharing subscription activation codes to other users ( this may lead in breach of a party privacy rights); <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->Other practices may be relevant in determining fair usage, therefore Bitdefender reserves the right to take any unlawful, prohibited, abnormal or unusual activity into account in making its determination. Bitdefender may at its option, terminate or suspend its relationship with you, and your use of any Bitdefender solution immediately if it determines you are using the product contrary to fair use practices.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->FREE, TRIAL OR BETA SUBSCRIPTION. If You are a trial or beta user, You may use Bitdefender Solution for evaluation or testing purposes in a non-production environment for thirty (30) days from the date You download Bitdefender Solution (the "Trial Period"). During the Trial Period, You can receive web or email based technical support in the country where You are located and Updates, if applicable, without any guarantee or warranty of any kind. <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->THE PROVISIONS OF THE SECTION, APPLY IN LIEU OF SECTION WARRANTIES WITH RESPECT TO ANY FREE/TRIAL AND BETA SOLUTIONS. <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, BITDEFENDER SOLUTION USED FOR FREE, TRIAL PURPOSES OR BETA SOLUTIONAS ARE PROVIDED TO YOU "AS IS" WITHOUT WARRANTIES OF ANY KIND. <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->THE BETA SOLUTION HEREUNDER IS BELIEVED TO CONTAIN DEFECTS AND A PRIMARY PURPOSE OF THIS BETA TESTING IS TO OBTAIN FEEDBACK ON SOFTWARE AND SERVICES PERFORMANCE AND THE IDENTIFICATION OF DEFECTS. YOU ARE ADVISED TO SAFEGUARD IMPORTANT DATA, TO USE CAUTION AND NOT TO RELY IN ANY WAY ON THE CORRECT FUNCTIONING OR PERFORMANCE OF THE SOFTWARE AND/OR ACCOMPANYING MATERIALS. <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->Your right to use Bitdefender Solution ends when the Trial Period ends or if You violate any term of this Agreement. Upon termination of the Trial Period, You must delete or destroy all copies of Bitdefender Solution and Documentation and stop using the Service. Your obligations and rights under this Agreement will continue to apply after the end of the Trial Period.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->TERMS OF SUBSCRIPTION. You will have certain rights to use the Bitdefender Solution during the Subscription Period, which shall begin on the date You register your Bitdefender Solution on your account, regardless of the number of copies that You are permitted to use, and shall last for the period of time set forth in the Documentation or the applicable transaction documentation from the Bitdefender distributor or reseller from which You obtained the Bitdefender Solution. <!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->The Bitdefender Solution may automatically be deactivated at the end of the Subscription Period, and You will not be entitled to receive any feature or content updates to the Bitdefender Solution.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->AUTOMATICAL RENEWAL. If you have agreed to permit Bitdefender to automatically renew your subscription to Bitdefender Solution by charging a valid credit card number which you have provided to Bitdefender, your subscription will be automatically renewed thirty (30) days prior to the expiration of the term and each anniversary thereafter for a fee no greater than Bitdefender's then-current price, excluding promotional and discount pricing. You must provide current, complete and accurate information for your billing account. You must promptly update all information to keep your billing account current, complete, and accurate (such as, but not limited to a change in billing address, credit card number, or credit card expiration date), and you must promptly notify Bitdefender if your credit card is cancelled (such as, but not limited to for loss or theft). If you fail to provide Bitdefender any of the foregoing information, you agree that Bitdefender may continue charging you for any subscription automatically renewed unless you inform Bitdefender's Customer Care department at http://www.bitdefender.com/site/Main/contactForm/ (or any other local number provided by the respective Bitdefender entity in your region) not to renew your subscription to Bitdefender Solution at least thirty (30) days prior to the expiration of your subscription to Bitdefender Solution and informing them of your desire not to have such subscription automatically renewed. This Agreement will terminate automatically if you fail to comply with any of the limitations or other requirements described herein. Upon any termination or expiration of this Agreement, you must cease use of Bitdefender Solution and destroy all copies of Bitdefender and the Documentation.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->UPGRADES. If a Bitdefender software is labelled as an upgrade, you must be properly subscribed to use a product identified by Bitdefender as being eligible for the upgrade in order to use Bitdefender Solution. A Bitdefender Solution labelled as an upgrade replaces and/or supplements the product that formed the basis for your eligibility for the upgrade. You may use the resulting upgraded product only in accordance with the terms of this Subscription Agreement. If Bitdefender Solution is an upgrade of a component of a package of software programs that you received as a single Bitdefender Solution, it may be used and transferred only as part of that single product package and may not be separated for use by more than the total number of permitted users. The terms and conditions of this Subscription Agreement replace and supersede any previous agreements that may have existed between you and Bitdefender regarding the original product or the resulting upgraded product. By using the Bitdefender Solution and accepting this agreement you consent to receive updates and upgrades to the software that will be transmitted by Bitdefender automatically.<!--END_TRANSLATABLE_TEXT--></p> <p><!--BEGIN_TRANSLATABLE_TEXT-->IMPORTANT NOTICE. By using the Bitdefender Solution and accepting this Agreement You consent to receive, install and use any updates and upgrades to the software that will be transmitted by Bitdefender automatically. The functionality of the Bitdefender Solution can only be preserved during the Subscription Period if all received updates and up
Emails

[email protected].<!--END_TRANSLATABLE_TEXT--></p>

URLs

https://www.hotspotshield.com/terms/

https://www.hotspotshield.com/privacy/

http://www.bitdefender.com/site/Main/contactForm/

http://www.bitdefender.com/site/view/legal-privacy.html

Targets

    • Target

      Bitdefender Total Security 32 Bit/Bitdender Agent.exe

    • Size

      10.6MB

    • MD5

      e1ccf539751fb399960220f475725edd

    • SHA1

      20a8e844ebb5a5c023a348de5758fef0deb8cc4b

    • SHA256

      5333eb068d17ef113b01d3fea740f11d6d09cccffc702d15a078cec88310d005

    • SHA512

      91cdacd8a3bf531ed0c6cd2d62c921fb991455c919cbc7310d56a8ab730446d3e74a3ed50f04e2a3c13c4a8d211e2bf3cf4e557c198b1b6bfa7bc01bcb37b4c9

    • SSDEEP

      196608:53/HJAmrGVOkbrtjAjf7/joi4tpruW6koOE2ihnXCIZgpxUZGvV3Gh8Aps8:5fCmr0OWjA8i4tofkofXCI0zvV2h8

    Score
    8/10
    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

    • Target

      Bitdefender Total Security 32 Bit/Setup.exe

    • Size

      427.8MB

    • MD5

      30d084751e47a354fb7ab292c70f1bed

    • SHA1

      c178b789ce52eec4bf589d6cfb5e1045957fbfe8

    • SHA256

      9874d351b5b4a94e1db9b77f81d02460f603c1eb68b1f67f50d7b1fee1b351ca

    • SHA512

      476af7a327bb2a343b6c9b88e0caaa88e6c268891cf463d22f67a56296514f479b0d05767b7e8d439f29609c4ecf3bc6a754c199638e12dd499b8c9dceb62b69

    • SSDEEP

      12582912:GrmFGDIgTMDUsdjMU1wVGbWmBtrzXOVEs:GrmFGaDUsC7EbH/rz+VEs

    Score
    10/10
    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks