ab5fd5b542977645488e296770bbb76137d4893ecb9eddaf3e492bce5f5aa6ce

Sharing

Copy URL Twitter E-mail

General

Target
bd8ebc8a73354d912d96648c0a4924ad
Size 1.2MB
Sample240310-d37yssbc74
SHA256 ab5fd5b542977645488e296770bbb76137d4893ecb9eddaf3e492bce5f5aa6ce
MD5 bd8ebc8a73354d912d96648c0a4924ad
SHA1 341395c5e8160febd846c8e45897d60e5d73c985
SHA512 4b4db5d676b158b7861ffaa9ad5287d0315d61f0f8c44ece5abb2572047ab3729694b6fec55e3a581fd23cb3447e476d6299b8e9dd176f1f40b0cf9e08b184e7
SSDEEP 24576:ZB51ZMgyuhpuwvq8qLduQgfbZi9jnv5GtWKjN0:p1ZbhTvq8qLBgjZsjKWK50
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Targets

- Target
  bd8ebc8a73354d912d96648c0a4924ad
- Size 1.2MB
- SHA256 ab5fd5b542977645488e296770bbb76137d4893ecb9eddaf3e492bce5f5aa6ce
- MD5 bd8ebc8a73354d912d96648c0a4924ad
- SHA1 341395c5e8160febd846c8e45897d60e5d73c985
- SHA512 4b4db5d676b158b7861ffaa9ad5287d0315d61f0f8c44ece5abb2572047ab3729694b6fec55e3a581fd23cb3447e476d6299b8e9dd176f1f40b0cf9e08b184e7
- SSDEEP 24576:ZB51ZMgyuhpuwvq8qLduQgfbZi9jnv5GtWKjN0:p1ZbhTvq8qLBgjZsjKWK50
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
- MD5 c7ce0e47c83525983fd2c4c9566b4aad
- SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
- SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
- MD5 SHA1 SHA512
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
- MD5 4ccc4a742d4423f2f0ed744fd9c81f63
- SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
- SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
- SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PROGRAMFILES/foler/olader/acledit.dll
- Size 8KB
- SHA256 727b96dca0363f7cd5767f94bf72e0655ef1d00f44b27d496deb733eb32be12b
- MD5 8d96cb171b4138f43a754317be9e982c
- SHA1 3c2975e7904486f39be0455a63afaa063064a93e
- SHA512 ab58bd28169042d9502f64410e78aa41d219753d998ad5309699c57b50ce343b50aeb42dda8ef6a52f8057dcd1bc2b4b6e0de52819285dd3517ba3fa032e6ee3
- SSDEEP 192:peH8gcV+GQqYTBBBAkvyMQ0F3OWYTWPGP:YH8gcV+GQqyAMD0WYTWPq
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  $PROGRAMFILES/foler/olader/acppage.dll
- Size 45KB
- SHA256 949fd56c5a63d3f1c20769bc2285ac5517c4ca84250c807f18247a2d93efc1a4
- MD5 290075961dd4856211078377d14942c8
- SHA1 ad7f6dfd89a253daa70d5bbb46e819dae7eb3f61
- SHA512 b431198324315e172fafb062fce93c5d5b18e691150e5e26dec30f150622c38ce4342b9e9f5d4d847860a55e7fb75411bb8765a0f0ae87c99e0dc30f1bc42854
- SSDEEP 768:ppb1tuabwj1WVIlaFKuIJJPclXkxAc5J9UaXotuM5Uqw2mom:Uj1WelaFczPclwYtuM6qw2
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  $PROGRAMFILES/foler/olader/adprovider.dll
- Size 48KB
- SHA256 338287ddb5fdbf0f7540dac8ae8a3f02643f7b45f3b401a9dfa6447e39043049
- MD5 f981199c82a40cf638d313c4498ecab9
- SHA1 9f2ba1092a90b048aaf51304d139018e13144f3b
- SHA512 09b33588e58c50036614e0fa26ccd8d94ae810f63d95c8464ae74cb9169f4ddcbcd8c019d656cd313ed65f8bb92b9782cf319866ce2a9ba1c003bd62a1bed171
- SSDEEP 768:Amge8Q4UsMhIrA1pifdlIGHmizKO6EjjKRyGlqesRtgjEDy:AG548IrA1pifdRHmizKiWRPlqPjy
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  4.exe
- Size 356KB
- SHA256 eebd782f6612da1133b0e130bf751578de50cadfd0268b98ce4a31815edc636c
- MD5 63298373ec0b3d06cd3b6e9cffd4ab79
- SHA1 2f6482a9d617e7d0bc21e78258cb08677de52e69
- SHA512 3948a304b82c055e37082948668c11b39cb3c47adc729cb2d7018fde5b78441f84420b101122360906f03c5299eb543082cc55513bfc84513042416faa5276a1
- SSDEEP 6144:wcNwDljd8nQCbKRgAs2EPwGTfJ7ahjJFKVV1:qBd8nQ9RgAs2237ahjGV
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  vpn.exe
- Size 1.0MB
- SHA256 b317a4e36ea8c4f943d6f1d3f933bb96d29aa6ba16c48a7b5c9db07b5a17bbd2
- MD5 c947291b42012d2f82b7d9896630584b
- SHA1 0854ce780aa21d642d03269fb6977370af1a254c
- SHA512 f74987266c2df4acfb2c02a162e0028ca2a7b3c611ff041531c34d3a0cf5bcd4f458f846713e1384731087848c42a84b6b51ed6e6f6ead6a75c14845e808276e
- SSDEEP 24576:MjgtWQjp7VvOpqsnuPhKbDxMfnv6NsoZ:Mju7j3vOpqPh4D634
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops startup file

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20