General
-
Target
2ab614788dc831acbde188b10483635f542ee4eaf9083ead1fec2789b883113b
-
Size
2.1MB
-
Sample
221020-z21nzsehh4
-
MD5
b05f20bc6106a9c7efa2ba7a401872cf
-
SHA1
5046e33331ede908b68eb24d7ce37689c70890b2
-
SHA256
2ab614788dc831acbde188b10483635f542ee4eaf9083ead1fec2789b883113b
-
SHA512
f4d8ba0ffee5bd05fa2e00b6c45c1f2eafeee0a97eee01390904ebef4dcd2ec011b0d2cb544471fc8ce169a0816c8573eade5ccb1d5558620073c241ccdaac42
-
SSDEEP
49152:VG8/c+58fgvCzzfOdmY7IdPBQXbXDo7qZ4pGOHiCdYHD9G/MaKw8:VMGtv5wY7mEoOZ6GOHviJcMR1
Malware Config
Targets
-
-
Target
2ab614788dc831acbde188b10483635f542ee4eaf9083ead1fec2789b883113b
-
Size
2.1MB
-
MD5
b05f20bc6106a9c7efa2ba7a401872cf
-
SHA1
5046e33331ede908b68eb24d7ce37689c70890b2
-
SHA256
2ab614788dc831acbde188b10483635f542ee4eaf9083ead1fec2789b883113b
-
SHA512
f4d8ba0ffee5bd05fa2e00b6c45c1f2eafeee0a97eee01390904ebef4dcd2ec011b0d2cb544471fc8ce169a0816c8573eade5ccb1d5558620073c241ccdaac42
-
SSDEEP
49152:VG8/c+58fgvCzzfOdmY7IdPBQXbXDo7qZ4pGOHiCdYHD9G/MaKw8:VMGtv5wY7mEoOZ6GOHviJcMR1
Score9/10-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Registers COM server for autorun
-
Sets DLL path for service in the registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-