Overview

overview

10

Static

static

10

PCProtect_Setup.exe

windows11-21h2-x64

8

mscordbi.dll

windows11-21h2-x64

1

mscorlib.dll

windows11-21h2-x64

1

mscorrc.debug.dll

windows11-21h2-x64

1

mscorrc.dll

windows11-21h2-x64

1

netstandard.dll

windows11-21h2-x64

1

nfapi.dll

windows11-21h2-x64

1

nfregdrv.exe

windows11-21h2-x64

1

ovpn/libcr..._1.dll

windows11-21h2-x64

3

ovpn/liblzo2-2.dll

windows11-21h2-x64

3

ovpn/libpk...-1.dll

windows11-21h2-x64

3

ovpn/libssl-1_1.dll

windows11-21h2-x64

1

ovpn/openvpn.exe

windows11-21h2-x64

1

ovpn/openvpn_down.bat

windows11-21h2-x64

1

ovpn/openvpn_up.bat

windows11-21h2-x64

1

protected_...am.sys

windows11-21h2-x64

1

protected_...am.sys

windows11-21h2-x64

1

pwm.dll

windows11-21h2-x64

1

sni.dll

windows11-21h2-x64

1

ucrtbase.dll

windows11-21h2-x64

1

urldrv/tdi...er.sys

windows11-21h2-x64

1

urldrv/tdi...er.sys

windows11-21h2-x64

1

urldrv/wfp...er.sys

windows11-21h2-x64

1

urldrv/wfp...er.sys

windows11-21h2-x64

1

urldrv/wfp...er.sys

windows11-21h2-x64

1

urldrv/wfp...er.sys

windows11-21h2-x64

1

urldrv/wfp...er.sys

windows11-21h2-x64

1

urldrv/wfp...er.sys

windows11-21h2-x64

1

vcruntime140_cor3.dll

windows11-21h2-x64

3

wpfgfx_cor3.dll

windows11-21h2-x64

1

wscf.exe

windows11-21h2-x64

1

x86/update.dll

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PCProtect_Setup.exe

  • Size

    54.8MB

  • Sample

    240113-fc3bqsccdn

  • MD5

    87cb9284aac0aa4112c153a5bcd89e99

  • SHA1

    3b724ce214652b93d1a5fb5fd5de29c24f69c3df

  • SHA256

    99c2474f5bea6e3955d1002aa98678c32e9c0e9f2fb6d0c35d3a428ec279d103

  • SHA512

    d171d56548a43f57241cf0431b7ce8d5fcb243b4bf9d7785c7f356e449cb6b8da9135231e012bb948293f1eac86cb893e1061f13b4c203a3bb60c9be986fcd67

  • SSDEEP

    1572864:pJf8FOQTBHUoFkd07b9M6jok54D9xlYVCL:79QTBHPFJrExl2CL

Score
10/10
blackguardpersistenceupx

Malware Config

Targets

    • Target

      PCProtect_Setup.exe

    • Size

      54.8MB

    • MD5

      87cb9284aac0aa4112c153a5bcd89e99

    • SHA1

      3b724ce214652b93d1a5fb5fd5de29c24f69c3df

    • SHA256

      99c2474f5bea6e3955d1002aa98678c32e9c0e9f2fb6d0c35d3a428ec279d103

    • SHA512

      d171d56548a43f57241cf0431b7ce8d5fcb243b4bf9d7785c7f356e449cb6b8da9135231e012bb948293f1eac86cb893e1061f13b4c203a3bb60c9be986fcd67

    • SSDEEP

      1572864:pJf8FOQTBHUoFkd07b9M6jok54D9xlYVCL:79QTBHPFJrExl2CL

    Score
    8/10
    persistenceupx

    • Creates new service(s)

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

    • Target

      mscordbi.dll

    • Size

      1002KB

    • MD5

      0f5287ccf46af868d472a16dfada82f8

    • SHA1

      96f9943dbdf240205de2a17c1c413ca3e0ac9b45

    • SHA256

      776150b3c8008d9ef5d931ec871fc00638d81e3f5f37fe6cd4988353d6eaef25

    • SHA512

      d0e993348577b7fa526d046bb684e449d82a40c0a1964f1714474d9711660eb9f83ef34e01c5fcf1089ab7c8400afce6d0e7946b5f278a08226cb46ad0afd2fa

    • SSDEEP

      24576:O1tPRQ/bWmM1hPu16JeC2KInVt3qwUk/:bamM1hPu1meClInVt6wUk/

    Score
    1/10
    behavioral2

    • Target

      mscorlib.dll

    • Size

      38KB

    • MD5

      c53ff6de7a243279034e8ddbab23325d

    • SHA1

      f846e0a35c768188769e9fd08ed0b69ab7fffa73

    • SHA256

      3e7f86acfe925900814e0f57828a9b437b108e50315a2d4e87654ac7dc39852f

    • SHA512

      2baa9be32ab750e91ef174fc1d6db764bde37b9400040fa80b702b0989b5053afd9645a2242861548f092a6dee6c76d47f63ee5597cddc5035a07e14e5e9ca38

    • SSDEEP

      384:fniCq6HTn8KR6WdUtox5q64O3HZhB52YtUBVT9yaDbcZN8dV0IaohKuirRkvx9AV:/n9RzF5J4yklDbcZV/Cq

    Score
    1/10
    behavioral3

    • Target

      mscorrc.debug.dll

    • Size

      175KB

    • MD5

      6552055346ddd6cfa8fb05bef8f26cfc

    • SHA1

      4b6b93bdaa00fe2c3a8a8f313cac140ce04c785e

    • SHA256

      4681c02858164bb8cb210238fde27c7099dfd34d6150e9706da8845a3706b8e6

    • SHA512

      fdcc771b0d7f43c8a808da1280890c721b47d6412a28c53acadd7bc3ddff9c4eae1d3a141f99f1b183bacbcc501fce795d9199581a597ff748792914872ec9f9

    • SSDEEP

      1536:lJql0Zzb8IVAkR1RhQi/s1PzHvh7xYSmUlMbcCV9jfnw5RVvZ48MSZctpoEXtVH3:lJql0ZzgASHlMbrhnYDAS4SGB/VV

    Score
    1/10
    behavioral4

    • Target

      mscorrc.dll

    • Size

      13KB

    • MD5

      30041ff905e8057be55fff732f8de1bf

    • SHA1

      b783bff2e6b2fc182d6a4345c6a33323b8eb7a53

    • SHA256

      ac84b2497a3875aa104e2a18e0dd49a43ea38dc505c57d836f368d8443280e78

    • SHA512

      3daf4b0a481b93c3ad2d078cccd2e185506f3607309c1b11799b15e958137d51528638263281f7d0152751fd4ab301d0dce8705166f05820cd9eaab50beec829

    • SSDEEP

      192:hcWPqdwGiWrdwFuzLeWvcuyjS7HnhWgN7aMWhfRETTbbrmjX01k9z3AzsCnNz:hcWPYXiWRiA7HRN7MRE3X+R9zusCd

    Score
    1/10
    behavioral5

    • Target

      netstandard.dll

    • Size

      72KB

    • MD5

      671ed9d6e873ad29ccff10bcfaea6021

    • SHA1

      49507f0040c27249e209be9ff92ea4c143575873

    • SHA256

      de0ef6c3af1c9b8199ba4e16c1392d3127a4a30dcc4cfbf96bcc463fe0a5d27d

    • SHA512

      15649a0a37d1e26bf3e670ee1986a6f6d991a6821868f2e90c1a1986122c4cfa78854f5f02c7d5ec1354837126f3226da09f8c89823496045644b48fc4e80f6e

    • SSDEEP

      768:y5x6TGSoxq/iImVvMVYd75IXL4bObKZbc6NtjSPU5gBkVb7TikFlnQrOu:AxFwiIU6Y15C4bObKZlNAs5fukFOf

    Score
    1/10
    behavioral6

    • Target

      nfapi.dll

    • Size

      334KB

    • MD5

      82cf3571fb6b98d3a7a7b5c7c34fdca3

    • SHA1

      9df1dfe570518369d365d21495cf4c50591ff342

    • SHA256

      eb59bd2322dbe8e289c35e304ebc4633d0298890fdbdeade2b35f32bed2e6b06

    • SHA512

      5eebe58cd25bacc861e3ea5c89ec4c470cf6c41dc28f2597190166b3272db419c55ea989a60b2f6e822738e500846f5570d491082ee8dfc4e03924f200bb767d

    • SSDEEP

      3072:/KpHwC6H+AYYYxYYYYYrs/NAWOZFvyfaP710WkYsf+6pu6v3tgHf+dNUxJcGtHF7:/KpHMg61ZFvyfKLkzfrnvGHfDcGtrF

    Score
    1/10
    behavioral7

    • Target

      nfregdrv.exe

    • Size

      48KB

    • MD5

      01b5780505301ada6dc102fb77b2298c

    • SHA1

      328c3931a54af2d7adb88ba4c4c18ce1af8d5a72

    • SHA256

      aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812

    • SHA512

      bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947

    • SSDEEP

      768:2/1x+sxHjR9Q9V0nczMWkL/zDJ6kqsEtm:YjR8VfRkL0Jtm

    Score
    1/10
    behavioral8

    • Target

      ovpn/libcrypto-1_1.dll

    • Size

      3.2MB

    • MD5

      b9eb6a8ac15e8eee936d994bc87f9d5e

    • SHA1

      b432473b753f371bb2415eb63d178e560455d4c8

    • SHA256

      548c59044738554e6fd8aee9e1cd0e6cb13ee7b6f4f71532aff868e771eb8a7d

    • SHA512

      83688bdee057964072215de15039e27f0e3188fc32856183f9de3484f11d6cbd633f36c0f0abe7ec6f3eb17dd467c59e8cc8517a371091279270c6c2bb5c631c

    • SSDEEP

      98304:+mjNt5deg7yCsF4Qd/CsIhu2w0ne8nB5U5jOmp9P1CPwDv3uFfJl2xEcFiuW9MZe:+mjVpGCsFldKsIhuSne8nBIjx9P1CPwE

    Score
    3/10
    behavioral9

    • Target

      ovpn/liblzo2-2.dll

    • Size

      193KB

    • MD5

      bd9eab80f953d1674d71c315e050292b

    • SHA1

      7f0d391e1d7b4dd455359ca1381bc5b90a23c84d

    • SHA256

      22c1a7a44308ff6aafd80caa6fd53c93df7696c99feadf9ae700f26365c0986f

    • SHA512

      baedfe72d58711ce95ad5ab2010f99d1f42825b825eae48c72add6c2cb8c8f756eb8d1f8c13b78d4cd6cc2a3cfeb920f4188ca47dc6f59aa1c66b0d83b0ebf4e

    • SSDEEP

      3072:xyJHcFYd6nLF3XRAXqXKGfyI4yaIw4QBkUgPQtRfG/:oeF3XWXq6GK14CVgIvO

    Score
    3/10
    behavioral10

    • Target

      ovpn/libpkcs11-helper-1.dll

    • Size

      123KB

    • MD5

      5e12d4d264ba957604e80ebbb436c61b

    • SHA1

      50ad9a622518989a80355d226b77c5c57aecba64

    • SHA256

      6f0e5fbeec6474e0cc2bd0536aed3ff47fef4588fe28625ce2b3eaacb5f0dead

    • SHA512

      e4dbb5e094b48bb47a30dc5782b9a5b58dd039c626922cc7884c00f2bc24ae4c457b11e2889ff373cc592c47daf1511ca4ab10a6f26f7f2f745efd9e64a5f002

    • SSDEEP

      3072:tACv01QslFoJiU4ixhvt5hTQQU7kVTAHluobjrf1Evu5g8V:tPv01rI3t5hTQQU7kVTAHluobjrf1Evu

    Score
    3/10
    behavioral11

    • Target

      ovpn/libssl-1_1.dll

    • Size

      924KB

    • MD5

      d6d65e0a4a7706a90e328578251f43ae

    • SHA1

      5a34a15fd21f345b3f6c1876df3503e0050e7428

    • SHA256

      89d49df485a5c33f0ebef4a78f6ceb63e60c08113fe21a911cd2c196bf9393fd

    • SHA512

      2f524f1f9281a643ca3dd657e8136828fbb4c58b259c717bd05ea964379ad814fabd9e47d129ff1866dd92e8d5cadbce38b66c8daf2aba944c57368e7c1d8273

    • SSDEEP

      24576:jN/UGlfUX71WzUoh53Xbj9Vku1UYaN4vlMAUBYSwF/mbsgEKQG7iiHh7xqwg:x/61Wz3534u1UYaWvlMAUuSwF/mbsgpc

    Score
    1/10
    behavioral12

    • Target

      ovpn/openvpn.exe

    • Size

      1013KB

    • MD5

      d62e7bd8fcfc550f4c664eb7f6933186

    • SHA1

      0c1434e0afc5abb50e4fc266a83b7d412a23c280

    • SHA256

      1c704ce36e37384692d4e9d111be69665fb2bfd3edc614ed6117ed6b934b736e

    • SHA512

      36f8d5c714108140134d0e1d6852e2ef78da186d75fe6d6134ae7cbe43b79e451762f9e070004b13c0ccbb60e2c5ac12d34664381b7ed2187be57228861c815c

    • SSDEEP

      24576:AHLo6iymW1bTJJf+mae38OB8s1k0yu3z3di6YT5WPYsrUFuyeAToym:YojeP+8828YYqp68

    Score
    1/10
    behavioral13

    • Target

      ovpn/openvpn_down.bat

    • Size

      475B

    • MD5

      08bae2de82fa4fb579f707376d440056

    • SHA1

      33eaaac6f01f017affb58b68636cffa6ce30b157

    • SHA256

      6cab17fee12d3a2c43eb4d7c3a790cdbd7fc9afc6b0c6d60dbbb61594f6cec74

    • SHA512

      67bfb8a995eb12b5f995860472a0817279ff2acdbdc19e7ee38a0a91eaec67a870dfc56ce39cf4bb5d29c227809cb35b16635d1fe1c0bbc64429079e5aada6f0

    Score
    1/10
    behavioral14

    • Target

      ovpn/openvpn_up.bat

    • Size

      784B

    • MD5

      cd4d223acddbd08101a159b17022324b

    • SHA1

      510979a24584898281d7190c9981a1f7aa5b09ca

    • SHA256

      6ed4c6d1ba69e5aad84434e40f97c39432be10b903652860f8f16d7861ea79d6

    • SHA512

      8516ff62ecf818db7f794d66a2c479ea549444ed718f519b297a0723d78e191466d8f889f4f544a3e3324d6ce9002ceaa3d119b2a5fb63dcb8a2fd324110e1c7

    Score
    1/10
    behavioral15

    • Target

      protected_elam/amd64/protected_elam.sys

    • Size

      18KB

    • MD5

      e9806e894443f95671064755f9663a18

    • SHA1

      ee77dcdeda8f1c8f81dee89ae3924c1ef5d6c69b

    • SHA256

      119bb976356fac1cc0b81e2cdc8d1135c1f57c1d06b631a1814796e1601c2bbc

    • SHA512

      7a52c467cbcf80ec10e8e4656bf57198a9ee4b28971120ac4d47de3f3b20a5acd4199366d7ebe6920c9b4232768c000a9bae66905313016037f46a64f62f0cbb

    • SSDEEP

      192:DGCPcD0vWi7GszmVY84WVDi5f/VWQ4WWtd7JAh+Il+jX01k9z3Aalf3N:DGUcDfLVYIs/aN8EjR9zl53N

    Score
    1/10
    behavioral16

    • Target

      protected_elam/x86/protected_elam.sys

    • Size

      17KB

    • MD5

      cf833a28b40ab93655f342a9d760d224

    • SHA1

      d03ec91202f85970e4a24124bca36d7b4e262a16

    • SHA256

      0b0d0898257846c320f7ddf30771126bbdf9edc7f9afbe1fb3d4f0925680215b

    • SHA512

      3332f2eb60a422124628c749ba43a140ae6bc8c753019ba78edbbf0a390efcccefa15f3eaa192e7bb5b2d3195cf58def64bae42a844f5fbbde741d3c465a5e3a

    • SSDEEP

      384:fV/MVnhyp3DiyZbV0VYjt4s/GpQtR9zusP3:fVbVbGeRMQP9zuG

    Score
    1/10
    behavioral17

    • Target

      pwm.dll

    • Size

      30KB

    • MD5

      885a2706ad5cd98c637a9d02a6712d56

    • SHA1

      7bbe52a527efc084516c512372c8102749bd3746

    • SHA256

      58ea66beb9fd07738a6a05622e04cc14bdea6e2d7628c3ef52e9960ff254ceba

    • SHA512

      f966d711ffca055354ee68116032d818ce857237c7c27d92ddbb5f5a6a4b8dc3d17637e22532e524dcc72a428aeb60ca534150f41648e59c842a804b89790d63

    • SSDEEP

      768:0ymFTYwH+5FUraxpcn0CLRGgFxZZjQZ9XIjFDqrdtUn5k:mH+5FUrfbAojQZ9XIjRqrjWe

    Score
    1/10
    behavioral18

    • Target

      sni.dll

    • Size

      133KB

    • MD5

      c62a83f20bc23aeface70ec13003c4c5

    • SHA1

      35553cfcdcbeccdc49710e68aec495c16880f0bd

    • SHA256

      1446d6b26da49a5a9f366972f89f4e236f916955f31ddc38ebb96217c1cace9c

    • SHA512

      4dda44fd5b538f5da9e8cb46a3ab1bdc14b43425b9a61249eccc925d986af7b8b3548db9490238f14807909ecf479415117141ddb344119438a59f97e894ea37

    • SSDEEP

      3072:H3SGhrfrdqCn3bctzdGRX18u5e++dowahamD5/f+vHPoW:H3SGhbBqCnmzERyiepSUm9moW

    Score
    1/10
    behavioral19

    • Target

      ucrtbase.dll

    • Size

      1.1MB

    • MD5

      6343ff7874ba03f78bb0dfe20b45f817

    • SHA1

      82221a9ac1c1b8006f3f5e8539e74e3308f10bcb

    • SHA256

      6f8f05993b8a25cadf5e301e58194c4d23402e467229b12e40956e4f128588b3

    • SHA512

      63c3d3207577d4761103daf3f9901dd0a0ae8a89694ad1128fd7e054627cdd930d1020049317c5a898411735e2f75e2103ae303e7e514b6387a3c8463a4fb994

    • SSDEEP

      24576:Os974wcfeCepgb9qqu+XMO4nXIzvQVbe1SmcvIZPoy4/ZBVX:b96WghMOqI8Vbe1GZBVX

    Score
    1/10
    behavioral20

    • Target

      urldrv/tdi/amd64/webshieldfilter.sys

    • Size

      74KB

    • MD5

      21a332af5c8e929415dbde71db19b8ca

    • SHA1

      dd908daf05b0fa89de836110e68f97cc54859d21

    • SHA256

      b5ff1ea46318772e179c56e8e386f9b6c5831a304ebc4783501304aa2a9f8d33

    • SHA512

      c0dad463aa71c1cfe2cf7de1b605be36f57fc49028a68b37e823ab5449f985b07d4c7b66e828aecbb2fffd240bab3f51d75a2d4ba43fb14674c0af50684d40be

    • SSDEEP

      1536:9iwOws+rmFBi9rsWsZBey3EV+tj6scdDUfI:9VOwso9QHBeyEV+tj6scr

    Score
    1/10
    behavioral21

    • Target

      urldrv/tdi/i386/webshieldfilter.sys

    • Size

      68KB

    • MD5

      2aa6d30e357b9a3e63d178f244482150

    • SHA1

      44577e1a2fbc916fc8acca1ae5c7958ff64f8da4

    • SHA256

      3282e62445815de2e45092d9476f6ba5625dc50c96077845c2e32afbf8c9d2bd

    • SHA512

      57964eb6f0e36a4eaf41e7586d1fb37e36896fa26687767012443898c1b59f8bd4900da1f639251ae726e60be8df97812a9b700d5064fcccc0343e59bbb2e0fe

    • SSDEEP

      1536:8+wIzEJyjGTyUvtarIHl6v4Pm37sc6BUvCnUf:HwIzYyjA10IHl6gO37f6B

    Score
    1/10
    behavioral22

    • Target

      urldrv/wfp/win10/amd64/webshieldfilter.sys

    • Size

      94KB

    • MD5

      b797771c87184870eb95d2e50e17a9e7

    • SHA1

      b303acad4220542c3150bb979aa966c2640434af

    • SHA256

      c190a676d707f290a0f6fccb60ecbc4b3b5dea5ea27d552095acd4110aff51bc

    • SHA512

      60ced524fa3bb611b6a73734b7aa6bc30d10fdbf9914a8e4c79e1b79c6402a678fb4963a29f237418affba806ca39bdf766b229b7679d50431aa834e6fa99341

    • SSDEEP

      1536:WMd62uktOfNwZHmussJFDEI6rzztE3yT/hdf5YrSuuKGvq9Q:WMdNOf+FfQI65YluKGSi

    Score
    1/10
    behavioral23

    • Target

      urldrv/wfp/win10/i386/webshieldfilter.sys

    • Size

      80KB

    • MD5

      709ae7d4bb1817abf5b22bd5eb6d1943

    • SHA1

      4123eb3773d91e5294abb1d1ad3cac52a34d5a48

    • SHA256

      7a8748b1531e99f3549f579534e193fd9e2b1a96042313037d2aa6ad9c1e140d

    • SHA512

      dc1f66be19368e7c9325a4f52e47b9d813912d06257a670ae42ba26206c751918fdf3a61eb2e383230ba6bb6a25865e594c5df80cb244ae1137e517d4dcc24c2

    • SSDEEP

      1536:pHUU8fa7XUXG/jsc4CVkl5jpGt7xu6tKJp6NbUzWE3dlsl48jStEF:j8y7k4jsc4CM5jpKwAKJwo3lZW

    Score
    1/10
    behavioral24

    • Target

      urldrv/wfp/win7/amd64/webshieldfilter.sys

    • Size

      84KB

    • MD5

      36a5f7f6601d2427426588ffd415ea89

    • SHA1

      e69a5cfde38c82a6b0081e476fd83f1e3211337c

    • SHA256

      16399d8faf4a30ed463b8db7900fe0e67aa981a519d324f32349ba2abd779647

    • SHA512

      3379adcfbcb23cbdfc62390a0ebedde75810b1f90c19bb66ce142594994a11545090583cc9d71e4e28fb2bf875fd5798f9adb9e339ba9a146513734fb74693dd

    • SSDEEP

      1536:sGKnLHVUPDbU08dqnBtZ1ZPM1QubbE3CIXkuTtWuUf:mLHqDQZiaQA7IX5tW

    Score
    1/10
    behavioral25

    • Target

      urldrv/wfp/win7/i386/webshieldfilter.sys

    • Size

      75KB

    • MD5

      9508031dacfbbaf2595fdc9dacdb3b2a

    • SHA1

      7b85a2830535a53068a8167093de36a3d3176e26

    • SHA256

      3512260c75fe5ab584e7c072c38a9b17f4603c7b735d9e9e1e0b2f0ff901abbd

    • SHA512

      a27287409313bd084510f92677111b92424c6a39eaf20e53519f563fe5a8d3a339b5e5d7399713164b41e1e22fc6ad87f6161f602ebdc74f9785f87e0bafc01e

    • SSDEEP

      1536:heDMC9wA1lHT6pmrnPWxtbHoncn3Ii62NOtwFqGuPUfM:AqOMpmrPWxFonXi628OAhP

    Score
    1/10
    behavioral26

    • Target

      urldrv/wfp/win8/amd64/webshieldfilter.sys

    • Size

      94KB

    • MD5

      b797771c87184870eb95d2e50e17a9e7

    • SHA1

      b303acad4220542c3150bb979aa966c2640434af

    • SHA256

      c190a676d707f290a0f6fccb60ecbc4b3b5dea5ea27d552095acd4110aff51bc

    • SHA512

      60ced524fa3bb611b6a73734b7aa6bc30d10fdbf9914a8e4c79e1b79c6402a678fb4963a29f237418affba806ca39bdf766b229b7679d50431aa834e6fa99341

    • SSDEEP

      1536:WMd62uktOfNwZHmussJFDEI6rzztE3yT/hdf5YrSuuKGvq9Q:WMdNOf+FfQI65YluKGSi

    Score
    1/10
    behavioral27

    • Target

      urldrv/wfp/win8/i386/webshieldfilter.sys

    • Size

      80KB

    • MD5

      709ae7d4bb1817abf5b22bd5eb6d1943

    • SHA1

      4123eb3773d91e5294abb1d1ad3cac52a34d5a48

    • SHA256

      7a8748b1531e99f3549f579534e193fd9e2b1a96042313037d2aa6ad9c1e140d

    • SHA512

      dc1f66be19368e7c9325a4f52e47b9d813912d06257a670ae42ba26206c751918fdf3a61eb2e383230ba6bb6a25865e594c5df80cb244ae1137e517d4dcc24c2

    • SSDEEP

      1536:pHUU8fa7XUXG/jsc4CVkl5jpGt7xu6tKJp6NbUzWE3dlsl48jStEF:j8y7k4jsc4CM5jpKwAKJwo3lZW

    Score
    1/10
    behavioral28

    • Target

      vcruntime140_cor3.dll

    • Size

      74KB

    • MD5

      1a84957b6e681fca057160cd04e26b27

    • SHA1

      8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

    • SHA256

      9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

    • SHA512

      5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

    • SSDEEP

      1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN

    Score
    3/10
    behavioral29

    • Target

      wpfgfx_cor3.dll

    • Size

      1.7MB

    • MD5

      52d8f7f0ab9d679209b707c7ebc8377e

    • SHA1

      7042a8788ea40f29b2fab2ec249dfd9e8c6ed7e6

    • SHA256

      69c03db89ad14cdf2c05db284d1452a517d7127bafd871334685d715f662d203

    • SHA512

      8617663d2292ca05d1873cbf9cf2397a0e56214c5bf5d66d5b1c8e95658a5604e1d27656ce853d1306c4a21575e3fe45934a0b8e5bb256644cd064b8d8269c87

    • SSDEEP

      24576:jA4+95hzAxEvPcYCUhGU6YVjfB458Yqj0ggwBklV3SFyyTNjnm81d1:k4+fxAxEvPXG+Ig0GFycND9d1

    Score
    1/10
    behavioral30

    • Target

      wscf.exe

    • Size

      289KB

    • MD5

      25330672ddf4763c86f65438ea2561d6

    • SHA1

      94a602fffe514fdc9d3824263f6491f1342a9cf2

    • SHA256

      266d4d9769b1498992fc953f2c82b9b6853b311f06adca63825a07c4dce72da0

    • SHA512

      0cb2aea5155843e9ba4a5657acb8451665a722720f0e1d4a66935752aaaabcb56b032f31a5dbf4e5f4f310f28ca0d9e597c2f3f12a9a162e56063338db018630

    • SSDEEP

      6144:TFb5y9XQG2/4xIdIevQiwhnFPEuEORXaRsRZKoAOWL8DYrS:TZ5GQG2/4xIxBhuEORXaRsRZKoAYYW

    Score
    1/10
    behavioral31

    • Target

      x86/update.dll

    • Size

      3.1MB

    • MD5

      8fcfabdf2458336b061a06d7362f1c37

    • SHA1

      ed669e2c73292d3a6510ed9d670bdf56cb7ca92d

    • SHA256

      fc85d8cc5fe0327be1253c1f69ca48eaa30d9aa583becb6f1e678e7960e33022

    • SHA512

      056eb2071e33efaa7ac52002a906008baf0f8c59f8fcc99c500510c327a6b2917922706c9ec05e12f716573d6d9321e28190f1a911f765d596fd4c0d4c882dec

    • SSDEEP

      49152:Clg4XDo+apyPH5kscRzpBvMXBoHI1LFQQ2W9gtxWhToexMX+tPTqH8dO0t3z6XJh:Clg8oskscR/MRoHI1L0tiTVhqHuO0a

    Score
    3/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upxblackguard
Score
10/10

behavioral1

persistenceupx
Score
8/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
3/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
3/10