0577ada4871e64c61659a7d5a3d84074a40cfcef27a61eec48e5d19f78d3b127

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare-00c7e24b52d0f69c114772ed0a27f912
Size 334KB
Sample240202-2wk3fsdafl
SHA256 0577ada4871e64c61659a7d5a3d84074a40cfcef27a61eec48e5d19f78d3b127
MD5 00c7e24b52d0f69c114772ed0a27f912
SHA1 25e09824323c31d4fb278acb57a35e65c753ec64
SHA512 93485e74dd1c17f1a0dbede36d76825a0b74683dc5f50e13f6d4fe078eaf9de7071d7ff20ba710d4a9920278aab8e906bfe954060643a24e70a2a0bda8b71946
SSDEEP 6144:0e3446lL8yVZolmUyMGYXFrlSdjsFodY+qTOO8g/Xb/PmQKa3dAtnJls:D6p35FMsOozqT7/L3FKa3dAtJu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  VirusShare-00c7e24b52d0f69c114772ed0a27f912
- Size 334KB
- SHA256 0577ada4871e64c61659a7d5a3d84074a40cfcef27a61eec48e5d19f78d3b127
- MD5 00c7e24b52d0f69c114772ed0a27f912
- SHA1 25e09824323c31d4fb278acb57a35e65c753ec64
- SHA512 93485e74dd1c17f1a0dbede36d76825a0b74683dc5f50e13f6d4fe078eaf9de7071d7ff20ba710d4a9920278aab8e906bfe954060643a24e70a2a0bda8b71946
- SSDEEP 6144:0e3446lL8yVZolmUyMGYXFrlSdjsFodY+qTOO8g/Xb/PmQKa3dAtnJls:D6p35FMsOozqT7/L3FKa3dAtJu
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

adware discovery persistence stealer upx
- UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $SYSDIR/$_1_.exe
- Size 49KB
- SHA256 70d43e3594e461b1baa0574668fcd7d9b2ac7741d3245b8f4f868e5ef07ed986
- MD5 154274f2095724e826822bc695dac0bb
- SHA1 bf6c7eb599a7039ae6d18a24f120533842a006ef
- SHA512 fff766cc90ff31b47019284d62fdd168977ec199261b93421e0316172324164e718597833f35790ee0e8e050e6e4bf0c1cf136f1ff8948450e2692c814c1fb03
- SSDEEP 1536:upgpHzb9dZVX9fHMvG0D3XJn5wFsVSf2J:0gXdZt9P6D3XJn5qqSOJ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $_5_
- Size 282KB
- SHA256 4af4544a7186f81c4a0b6a77eb25540824ab261bd75db18874003498a04edaa8
- MD5 3f2d4a9f33af3e0d07158391f141fbac
- SHA1 49cafcca1de589fcf2906abf4d39769f36cd6e30
- SHA512 597896131750dd276d4d2c5ec84dffdad0d5c65507a18fd616ce841bb8ee3ec7ffcf27698b4f419a89d1805b796c675698945186202958edb977aadaf20a0650
- SSDEEP 6144:N1t6YbbVlodjTzW19I/4GJJ7ZFHEIFlN5GrT5a/q1hv4cbaiEjC2:N1tVbRqdLIIPJJ7wIFlN5GZOqv4cbXUV
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

adware persistence stealer upx
- UPX dump on OEP (original entry point)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral11 behavioral12

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX dump on OEP (original entry point)

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

UPX packed file

Adds Run key to start application

Checks installed software on the system

Installs/modifies Browser Helper Object

Maps connected drives based on registry

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

UPX dump on OEP (original entry point)

UPX packed file

Adds Run key to start application

Installs/modifies Browser Helper Object

Maps connected drives based on registry

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12