26cf2541feddc024cbb8ac5694c2ccb2cf8ef42c5c9dc3438a4260e1b003cbd3

General

Target

26cf2541feddc024cbb8ac5694c2ccb2cf8ef42c5c9dc3438a4260e1b003cbd3
Size

1.3MB
Sample

221125-d8ty5acg51
MD5

d6b164d6d895f766e4ab937d4bc723c5
SHA1

6931bc7bba4825c1557a6ab7686ec1f70af762ad
SHA256

26cf2541feddc024cbb8ac5694c2ccb2cf8ef42c5c9dc3438a4260e1b003cbd3
SHA512

537856fa6c01e2e103b70e8afb948912c939d9c47fb76e861a31688a595a28af487fb4dafe9e475e1d6d852b775dfab3dead758ac930559dd58750ef7bf92adb
SSDEEP

24576:CPUDry2y40QilebGY7h9TmIrptaorPu2JwSWtlevW6K72EbEmKlD:CcjyKilkR7hB1QordiAXrEomKlD

Score

9^/10

Malware Config

Targets

- Target
  
  26cf2541feddc024cbb8ac5694c2ccb2cf8ef42c5c9dc3438a4260e1b003cbd3
- Size
  
  1.3MB
- MD5
  
  d6b164d6d895f766e4ab937d4bc723c5
- SHA1
  
  6931bc7bba4825c1557a6ab7686ec1f70af762ad
- SHA256
  
  26cf2541feddc024cbb8ac5694c2ccb2cf8ef42c5c9dc3438a4260e1b003cbd3
- SHA512
  
  537856fa6c01e2e103b70e8afb948912c939d9c47fb76e861a31688a595a28af487fb4dafe9e475e1d6d852b775dfab3dead758ac930559dd58750ef7bf92adb
- SSDEEP
  
  24576:CPUDry2y40QilebGY7h9TmIrptaorPu2JwSWtlevW6K72EbEmKlD:CcjyKilkR7hB1QordiAXrEomKlD
Score

9^/10

adware persistence stealer upx discovery exploit
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Drops file in Drivers directory
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2