General

  • Target

    iobituninstaller.exe

  • Size

    25.9MB

  • Sample

    230322-zhk47abc29

  • MD5

    777651fb67b8163c2e9aa22afab66024

  • SHA1

    40f07eb7df50d2cd30232600a3bf852ba8ff7ccf

  • SHA256

    8e36f365aa367d174901b6add2966f4cfac58039a4c6724b3dd07c57b001c8d0

  • SHA512

    743b7742ef12657001d8383fc3898ca9fbba2c58a06105293ca86590934c52b11fa5ca63f4d8a0b13bb6aaf3680f6d8a556eb900672351524c3e25feff8b491d

  • SSDEEP

    393216:8jmh3HbzBd6CswobDSfUZfxu5Z7nM4a12ZlZGHBmzgsgigtuSHDzNTkTVq2AHG:GmhXbziCcSfUZfxYMcxgiuDzwh

Malware Config

Targets

    • Target

      iobituninstaller.exe

    • Size

      25.9MB

    • MD5

      777651fb67b8163c2e9aa22afab66024

    • SHA1

      40f07eb7df50d2cd30232600a3bf852ba8ff7ccf

    • SHA256

      8e36f365aa367d174901b6add2966f4cfac58039a4c6724b3dd07c57b001c8d0

    • SHA512

      743b7742ef12657001d8383fc3898ca9fbba2c58a06105293ca86590934c52b11fa5ca63f4d8a0b13bb6aaf3680f6d8a556eb900672351524c3e25feff8b491d

    • SSDEEP

      393216:8jmh3HbzBd6CswobDSfUZfxu5Z7nM4a12ZlZGHBmzgsgigtuSHDzNTkTVq2AHG:GmhXbziCcSfUZfxYMcxgiuDzwh

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks