General
-
Target
threepole_1.0.1_x64_en-US.msi
-
Size
4.3MB
-
Sample
221026-a925caece4
-
MD5
467e7522db238856e51e71af85bc1675
-
SHA1
f580cd7df3568a76337a1094e2a24b65db9dc0d7
-
SHA256
4f22cd1ff5cf6b521983bc4f6664adb9747b45e17fddb4ea5d7bcab0484d9241
-
SHA512
df9e9cf39a446bebfa563140e26801f489415a4d6acc642aad1071cf9024b076bbae1ce8bf4b3c29322b7867b8811354dfff2a2e14cae87ba5db8f67a79a66e6
-
SSDEEP
98304:1ADHZdKsTUW8sWQyLU6jLSRc7DmkwSt6bZyJyhMrJlG5Fi6:1aBQTsWV/Wc7yhbGwMrJM
Malware Config
Targets
-
-
Target
threepole_1.0.1_x64_en-US.msi
-
Size
4.3MB
-
MD5
467e7522db238856e51e71af85bc1675
-
SHA1
f580cd7df3568a76337a1094e2a24b65db9dc0d7
-
SHA256
4f22cd1ff5cf6b521983bc4f6664adb9747b45e17fddb4ea5d7bcab0484d9241
-
SHA512
df9e9cf39a446bebfa563140e26801f489415a4d6acc642aad1071cf9024b076bbae1ce8bf4b3c29322b7867b8811354dfff2a2e14cae87ba5db8f67a79a66e6
-
SSDEEP
98304:1ADHZdKsTUW8sWQyLU6jLSRc7DmkwSt6bZyJyhMrJlG5Fi6:1aBQTsWV/Wc7yhbGwMrJM
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Registers COM server for autorun
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory
-