Overview
overview
8Static
static
7e692a90143...18.exe
windows7-x64
7e692a90143...18.exe
windows10-2004-x64
3$PLUGINSDI...ad.dll
windows7-x64
3$PLUGINSDI...ad.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
7$PLUGINSDI...ll.dll
windows10-2004-x64
7$TEMP/Mail...te.exe
windows7-x64
8$TEMP/Mail...te.exe
windows10-2004-x64
8$TEMP/marker.exe
windows7-x64
1$TEMP/marker.exe
windows10-2004-x64
1SkyMonk.exe
windows7-x64
1SkyMonk.exe
windows10-2004-x64
1english.dll
windows7-x64
1english.dll
windows10-2004-x64
1filter.dll
windows7-x64
1filter.dll
windows10-2004-x64
1russian.dll
windows7-x64
1russian.dll
windows10-2004-x64
1uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ad.dll
windows7-x64
3$PLUGINSDI...ad.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
126s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
08/04/2024, 03:51
Behavioral task
behavioral1
Sample
e692a9014378ac46f150b9122698776c_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
e692a9014378ac46f150b9122698776c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/md5dll.dll
Resource
win7-20240319-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/md5dll.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
$TEMP/MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral14
Sample
$TEMP/MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral15
Sample
$TEMP/marker.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
$TEMP/marker.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
SkyMonk.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
SkyMonk.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
english.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
english.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
filter.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
filter.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
russian.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
russian.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
uninstall.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
uninstall.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240319-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target $TEMP/MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe
- Size 3.8MB
- Sample240408-eepyraga24
- SHA256 da0e716af146e66e9e5aeeafc46ab2c2b81bc29fb800a2ac2816af537b03b240
- MD5 d04de47cbf06e4e9322ea1268bc77c43
- SHA1 0b396c9e758f7105ac583f76098127cc0e01257f
- SHA512 97bfb09df4d929d2877dfd6636fc224437d0ae9843a58f5958792bcab63d5f22585fb5f341a8899c9736b340c4e92afc8ccf43f18b80dc204228fc0d2349b7ea
- SSDEEP 98304:zn9tKv0LOG2APYwMrexUIk8wNDFmpvntLfs1I0:bazTw5xUIPSDFivntLfE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1712 netsh.exe 2344 netsh.exe - Executes dropped EXE 4 IoCs
pid Process 1996 SputnikHelper.exe 2100 GuardMailRu.exe 2972 GuardMailRu.exe 2848 GuardMailRu.exe - Loads dropped DLL 10 IoCs
pid Process 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 2848 GuardMailRu.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Guard.Mail.ru.gui = "\"C:\\Program Files (x86)\\Mail.Ru\\Guard\\GuardMailRu.exe\" /gui" GuardMailRu.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GuardMailRu.exe - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8984B388-A5BB-4DF7-B274-77B879E179DB} MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8984B388-A5BB-4DF7-B274-77B879E179DB}\ = "Спутник@Mail.Ru" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\{dcd48218-e972-4d0c-9e5f-43462bc13e3b}\{9bed5ee2-0547-4706-8600-d3897629ade0} GuardMailRu.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\{dcd48218-e972-4d0c-9e5f-43462bc13e3b}\{9bed5ee2-0547-4706-8600-d3897629ade0} GuardMailRu.exe - Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikFlashPlayer.exe MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe File created C:\Program Files (x86)\Mail.Ru\Sputnik\MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe File opened for modification C:\Program Files (x86)\Mail.Ru\Sputnik\MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe File created C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe GuardMailRu.exe File created C:\Program Files (x86)\Mail.Ru\Sputnik\MailRuSputnik.dll MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe File created C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\URLSearchHooks MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 1300000000000000000000002000000010000b000000000001000000810600004b000000060000008100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e80d9009ca1d3f44924326ff581438af0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{055B34DB-D661-49ED-B9F0-67F3EDD63ADA}\AppPath = "C:\\Program Files (x86)\\Mail.Ru\\Sputnik" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}\ShowSearchSuggestions = "1" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}\SuggestionsURL = "http://suggests.go.mail.ru/ie8?q={searchTerms}" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Low Rights MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{E88E0043-C9D4-4e33-8555-FEE4F5B63060}" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}\FaviconURLFallback = "http://go.mail.zru/favicon.ico" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{055B34DB-D661-49ED-B9F0-67F3EDD63ADA}\AppName = "SputnikHelper.exe" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{055B34DB-D661-49ED-B9F0-67F3EDD63ADA}\Policy = "3" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A0C793B-29FD-48D5-A97E-2A798784B886} MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A0C793B-29FD-48D5-A97E-2A798784B886}\AppName = "SputnikHelper.exe" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060} MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}\DisplayName = "mail.ru: Поиск в Интернете" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}\URL = "http://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar GuardMailRu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{09900DE8-1DCA-443F-9243-26FF581438AF} = "Спутник@Mail.Ru" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{055B34DB-D661-49ED-B9F0-67F3EDD63ADA} MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{09900DE8-1DCA-443F-9243-26FF581438AF} = "Спутник@Mail.Ru" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A0C793B-29FD-48D5-A97E-2A798784B886}\AppPath = "C:\\Program Files (x86)\\Mail.Ru\\Sputnik" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A0C793B-29FD-48D5-A97E-2A798784B886}\Policy = "3" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main GuardMailRu.exe - Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mail.ru/cnt/9514" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\ProgID\ = "MailRu.MailRuSputnikObj.1" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\Programmable SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\0\win32 SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\ = "ISputnikHelperObj" SputnikHelper.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj\CLSID\ = "{09900DE8-1DCA-443F-9243-26FF581438AF}" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj.1\CLSID\ = "{09900DE8-1DCA-443F-9243-26FF581438AF}" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\ProgID MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\VersionIndependentProgID\ = "MailRu.MailRuSputnikObj" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\TypeLib\ = "{D9396DCA-81B4-4C62-8C48-619573A3C4E6}" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj\ = "SputnikHelperObj Class" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\LocalServer32 SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO.1 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj.1\CLSID\ = "{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\VersionIndependentProgID MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\TypeLib MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7} SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib\Version = "1.0" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\ProxyStubClsid32 SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO\ = "MailRuBHO Class" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO.1\CLSID MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\FLAGS SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\HELPDIR SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj\CurVer MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\VersionIndependentProgID\ = "SputnikHelper.SputnikHelperObj" SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj.1\ = "Спутник@Mail.Ru" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\InprocServer32\ThreadingModel = "Apartment" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SputnikHelper.EXE\AppID = "{BFD1C493-BE73-4660-9924-7C23CF34C11D}" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj.1\CLSID SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO.1\CLSID\ = "{8984B388-A5BB-4DF7-B274-77B879E179DB}" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\ProgID MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO\CurVer\ = "MailRuSputnik.MailRuBHO.1" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj\CurVer\ = "MailRu.MailRuSputnikObj.1" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj.1 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj.1\ = "SputnikHelperObj Class" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO\CLSID MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO\CLSID\ = "{8984B388-A5BB-4DF7-B274-77B879E179DB}" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BFD1C493-BE73-4660-9924-7C23CF34C11D} SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj\CurVer\ = "SputnikHelper.SputnikHelperObj.1" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529} SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\VersionIndependentProgID SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\0\win32\ = "C:\\Program Files (x86)\\Mail.Ru\\Sputnik\\SputnikHelper.exe" SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO.1\ = "MailRuBHO Class" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\VersionIndependentProgID\ = "MailRuSputnik.MailRuBHO" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\TypeLib\ = "{D9396DCA-81B4-4C62-8C48-619573A3C4E6}" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\ = "SputnikHelperObj Class" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\TypeLib SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib\Version = "1.0" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\TypeLib MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\InprocServer32 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\ = "Спутник@Mail.Ru" MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\ = "SputnikHelper 1.0 Type Library" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\0 SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\ProxyStubClsid32 SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7} SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB} MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Mail.Ru\\Sputnik" SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib\ = "{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib SputnikHelper.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2100 GuardMailRu.exe 2100 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe 2972 GuardMailRu.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1996 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 28 PID 2240 wrote to memory of 1996 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 28 PID 2240 wrote to memory of 1996 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 28 PID 2240 wrote to memory of 1996 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 28 PID 2240 wrote to memory of 1712 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 29 PID 2240 wrote to memory of 1712 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 29 PID 2240 wrote to memory of 1712 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 29 PID 2240 wrote to memory of 1712 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 29 PID 2240 wrote to memory of 2344 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 32 PID 2240 wrote to memory of 2344 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 32 PID 2240 wrote to memory of 2344 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 32 PID 2240 wrote to memory of 2344 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 32 PID 2240 wrote to memory of 2100 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 34 PID 2240 wrote to memory of 2100 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 34 PID 2240 wrote to memory of 2100 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 34 PID 2240 wrote to memory of 2100 2240 MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe 34 PID 2100 wrote to memory of 2848 2100 GuardMailRu.exe 36 PID 2100 wrote to memory of 2848 2100 GuardMailRu.exe 36 PID 2100 wrote to memory of 2848 2100 GuardMailRu.exe 36 PID 2100 wrote to memory of 2848 2100 GuardMailRu.exe 36 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2240 -
C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe"C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe" /RegServer2⤵
- Executes dropped EXE
- Modifies registry class
PID:1996
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe" "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe" ENABLE ALL2⤵
- Modifies Windows Firewall
PID:1712
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" ENABLE ALL2⤵
- Modifies Windows Firewall
PID:2344
-
-
C:\Users\Admin\AppData\Local\Temp\GuardMailRu.exe"C:\Users\Admin\AppData\Local\Temp\GuardMailRu.exe" /INSTALL2 /LANG=ru /GUID={3EE97002-F692-4364-9CF9-14804FE1A29B}2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe"C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe" /gui3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848
-
-
-
C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe"C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2972
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 ab8b9a31aa545022214f03809b3010540fd940dd03f0fa93659830135634497b
- MD5 9542de49decde940ce27cbdcf46833e7
- SHA1 756763cf0a0dd66b483cc30f482eb79a2022d71c
- SHA512 a489bda386f21afd915d92b160a977218812249d2c4789e349207b5838f7aed682cc26396a33a3b543dc0994a9a8fc24cb5cf3508f34c420c9aa1a3443cae897
- SSDEEP 96:xmVmYP5jWiio8mUhOE9HzlN3BV2YJLcKCjMRRViRY7MGO:AVmYVhibmuOuzBF7Uy7MGO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bm46du9w.Admin\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\thumbnail_bg.png
- Size 162B
- SHA256 539e5288dc16f987a223f3bb76a6ddd01a7ce75be796d679b09bc29c5cd85b4a
- MD5 ad36c6ca74cff600c24045a33008dbf8
- SHA1 83b42f8f0e387f8070720f1d79d586566af7fa0c
- SHA512 16cae3a50ac15616930fa0c5be2ee432f044ef5fd42caa0b314b196514a314de73812cd2f000a26941376abd6ebdfe17ef4827fc0c91f07ada1fd4d24a41d956
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bm46du9w.Admin\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_10.png
- Size 3KB
- SHA256 c7660d24b1239cc4a2a5d176a2c135ad104bbcbb904362297bb336de9f7a2bcf
- MD5 66676ce550952516a52a0f20b4955688
- SHA1 9ca79a604b5bacf97a8f10ec0ae0efabf6bcb51d
- SHA512 f81ad47ba78fcc7bb67510b8ffdf27d2d599dd4850805f95225ee91e40e72a3f833a59093fc6088b7f9939f561b2be84f5c3bcfa945ae5b7abf805038954f256
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bm46du9w.Admin\prefs.js
- Size 69B
- SHA256 b31be1373b73fa6a04c5c1c51dea2211f016d509a7fbef6d2bfac1015449ac4c
- MD5 44ece0de86917754a9752d858054860a
- SHA1 db3ffab1d118741b97e315f4b8a966b727468a68
- SHA512 b4ecd0351e70fff5c9bd0daf9671953fe406b74520ba92dce1c2db5fa655cbc69fb14666db85fea23990292cba8e9813c44d96bd6f5fce173e3e26818658d954
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bm46du9w.default-release\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\install.rdf
- Size 1KB
- SHA256 be86314e913facb86bcb10add8daba8a51208a5c82f77100fb8ed7b33cf89f05
- MD5 f04206a96732be8744072a657c1cb2a1
- SHA1 c5db152e53ce60c49acbd63a687caabe6b893c11
- SHA512 0f26c123d4dfd95d8acb13084d71e2191093234e033548c224f3799c938ebcea87ceee78c9e366dce26b230818863efd700b21c66934f91e00686bb10de2d0a0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bm46du9w.default-release\prefs.js
- Size 6KB
- SHA256 79f63f6787e744f68ec52a2925bb259741777fe5b1749f6d058570c85d011ab6
- MD5 f29f593318366e8181b01f017a31401b
- SHA1 3ee4c3d1de10759d93dc65517289b4a58f89c019
- SHA512 2b4fbbc178805a0d16727fb7b1eb27938a493351fe663bb089146f078fefe08dd6e961ec0d000633e2a3b48ff98d6c9f00aed7f9893a22c49cdb10d5f7ae16db
- SSDEEP 96:xHS5nUTeqGqBudeegeOTzSRPXAnpjNH3NYVeH11JBw8VGhj:M5nIRcdeegefPXm3NYVeH11JBw8Vs
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Mail.Ru\Sputnik\MailRuSputnik.dll
- Size 1.5MB
- SHA256 460d1ec2f2019db2ab0c91f412c9ccda30d5266d9be3b8be8b0a9ccb9f2bc513
- MD5 e9ac4d216473678ef95ca52717119d29
- SHA1 051f1cbf0e0846a7919422aa6351e3e5d4a88cea
- SHA512 ac07d1d07372784ef143f87b7531c493ecffdaee7e9e4692edbcb773524e721a9add70ea3af21c206c90eb7572482d978970e71c26496b4a26b7cdc89d17604e
- SSDEEP 49152:4/Mfsw5xn2zjYvMw9k2lvm4eF5bst9TdlAs:BswCzYvm4eFe
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe
- Size 263KB
- SHA256 0ebe401d1115c3d9568156f24e40843b0c710b18b54f2ee20627e72cf04dca9e
- MD5 b8f48ab2b3f67b71be73fe5748047ab6
- SHA1 b4c4b2a64299f6c40b2d1aa954a496d99b3cb631
- SHA512 43d592bdbe9828ac229877d9266569d81004ccacf4669070930b7dc551f3d24550f76cb58f0798b69311977b4e42ff8e59203720f08a8645fc34d3046dfe97df
- SSDEEP 3072:Jc68s7C5qgjHTt91rtVyW4VlZaWppNLb0Wp9m51Kb11riEYcaZdLBL1k4UUU02Nw:Jc6idFrWW4RaELvsGh1ridciQg2NUb
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\GuardMailRu.exe
- Size 1.7MB
- SHA256 2fe206942c8bb8789b19ca663dbdeb5a57eae513f5e8e6264902099bcfdc7bd1
- MD5 bf813176eae3ebfdacd69fbd09d13f56
- SHA1 14e6a698109c584540bb204feac298dc55c0d2bf
- SHA512 d6ff5b952cf708148c07f631f3e8fa0c366c8f8d381c04d47bfedc8485a6bdff124103a8d8e209e3cb9331ac7aba3691bb1af010f158c4aafc994b549b08b359
- SSDEEP 24576:PXYUGNAnQnXALtKwBjWKFO4BkPWgJ+sO5E7cC80+9j1g5GAXThw6GVMNNpKNbMUE:PYUEAQmiK7s5XTMVGKjt2c9N9A
- MD5 SHA1 SHA512 SSDEEP