bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be

Sharing

Copy URL Twitter E-mail

General

Target
bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be
Size 5.2MB
Sample240606-ym9snscc32
SHA256 bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be
MD5 8934b92a1d075aae29e2ab5ea5189c49
SHA1 8129c3d444561ec6864d7583131f443d6fdf69cc
SHA512 5523c60979b88938910d46c871ba2103f8f46d06a1017d01bb34a83fd46b105fc7a9f5c9a8879d0be54215bec943d71579dc57ba2a0c879b13e1b772a44c9c95
SSDEEP 98304:/+pmqu8JVd/7u7kxm+YcTjlKOxbqZcZkHOus1DgAtZRixAHAILz1IimEMh:+g7kKcToOYIku1DtbbgIHDmEMh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be
- Size 5.2MB
- SHA256 bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be
- MD5 8934b92a1d075aae29e2ab5ea5189c49
- SHA1 8129c3d444561ec6864d7583131f443d6fdf69cc
- SHA512 5523c60979b88938910d46c871ba2103f8f46d06a1017d01bb34a83fd46b105fc7a9f5c9a8879d0be54215bec943d71579dc57ba2a0c879b13e1b772a44c9c95
- SSDEEP 98304:/+pmqu8JVd/7u7kxm+YcTjlKOxbqZcZkHOus1DgAtZRixAHAILz1IimEMh:+g7kKcToOYIku1DtbbgIHDmEMh
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection discovery evasion persistence trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  $PROGRAMFILES/RF_L/skin/$PROGRAMFILES64/RF_L/RF.exe.new
- Size 2.1MB
- SHA256 4a9cbc43a828d42f338de79cceef9fca668f3c7c3f226f020e2b83044e9888d6
- MD5 de2c67787ee96b5422383a879b19b738
- SHA1 13732a849bd2f194a9da3c22cbd4c440f1d3782a
- SHA512 58d30a17e0f3b23b1625a6c26e81f038c405b159d6b7d5153b85f17267d177ac1dcd3f8aca1e6be70e7e2c37a61bbd399a6fc2c80d742ba7d0d655af321ba368
- SSDEEP 24576:rRMgod2XcZhMGDCLEji0427vkxoFbZNYwugsvliQEeiROiGM9zivuVpZZx/n6bOb:teREoN6vlqei1GBvcRzL2M5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  $PROGRAMFILES/RF_L/skin/$PROGRAMFILES64/RF_L/TC_AD.dll.new
- Size 713KB
- SHA256 634c881c8070a781ea2e62bfeeca856f19b19b98ab959eae98d3b1d590de3f54
- MD5 f79e96ad602858944fa88980120af3ce
- SHA1 9e2077e50765efe43dcf91ede392f9efe8ac8f41
- SHA512 f34dd501cf619b492f7237d2660b59045740b29221b8eaf3a4232d7de658a226e8ec6c37278f524be950488c8e5ad476fef06743c10c000cc4d957b1f6ce4cdf
- SSDEEP 12288:mjWfAHInFgUxYECrUPRzZ83H2xBAy3G6cZR/G:mjW4cFgUxnCAPhZ83WLAJ6y/G
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  $PROGRAMFILES/RF_L/skin/$PROGRAMFILES64/RF_L/tc_sign.exe.new
- Size 287KB
- SHA256 218f10bb140d90eea9ea8355b3fe59d1e902b0be960a318ef84e02315ad0ea98
- MD5 070fdb11b963bd4644eb8da5b68d7af2
- SHA1 d5405737e9b69608f47b8752de77849b4550a9e8
- SHA512 f56ab0385c5a700d5b932ab403ec2918e0de5a619724f26f729480232960ca543546c3f86edd43f17d08006dda654f5a78abb82cd4381b2dc826986636923788
- SSDEEP 6144:yYSyhc6OgfoAy1i/OSejpO1errvAcDRvZpQdM/6myEN0XLO:Kn6OgfoAyZSekerDr4mwXq
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral4
- Target
  $PROGRAMFILES/RF_L/tc_8SR.exe
- Size 30KB
- SHA256 2a1b2a5e9c6745fa02ce6dc4dd11b144a589f56d5ecc14ac4182c6ba2e28ee15
- MD5 659e01fc421fb0a39befb98c9a2eaca2
- SHA1 d1678e80ddc39a83930e246df416aaf59633a09a
- SHA512 18e12619df3392534988db623ae05c96b6f7b60c349a46eba75ddf1e3758156b0f1fb167fefc0f950be00db9d380e907d3009b3da299a005cbb74360765f8bf8
- SSDEEP 384:NCObmns0Jy9fDh41HZDKPu7BtKu/KV0YfmogD6uSK4HR24J8b9dUtBNMK2oKWkjd:MQ0clDu5D7hO+VUtBd2PL3h3h
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5
- Target
  $PROGRAMFILES/RF_L/tc_Prih.dll
- Size 107KB
- SHA256 0d94db6573325be0189e4fca361d7010b062232518359ed73c2c51c057723cd6
- MD5 cf3700abd3bd07e6ba075ae723d99d52
- SHA1 ca4b847739e5d0eef0e95e9e3439d42fb7184644
- SHA512 ad65de3c93f5e003d991778937dd29e7007efa61cf605e0bbd34b0d0bd1f192d446da58ed6e9ca877434acb94f4df23b4e238ee9db0181585e03925d37a95b5d
- SSDEEP 1536:/lWZTEEcP623D6dVzfTHNn2G68n4zdHP33n2+seJJW5LlYs+nLbx3h/U:/lAEDOJbuRJNJJW5M/XU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  $PROGRAMFILES/RF_L/tc_svr.exe
- Size 14KB
- SHA256 7cb4017abe287f516cbbd05a8d0476d814fc58167fc08c3203f3df90d8efd118
- MD5 3a5c91b35b82654e1a3acfe40183e382
- SHA1 f287faeedd777312a1b1f7a1911c635bc604ffe2
- SHA512 598b65db64316efc6858a9583495def1b670ea9bc28189f605df598eb2e0c491cb9cf2a3fc69b15a8ee55572e961b794de53792382320244e0e7824c6e5c0d0d
- SSDEEP 384:SMkSxFdfc9yDK2cKS8y3S08JN77hhBYil:SSxLA/2rQS33hDYE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  $PROGRAMFILES/RF_L/tc_un.exe
- Size 380KB
- SHA256 d6eea2ba76205f0e82c46be402ae43d8ec4baa3cc495f0d4bba7fc6366508433
- MD5 c47c5c46c60e5ce46d401b4a24d40aca
- SHA1 892271c0979073fc194b19933c3f4e8cb5ac0dea
- SHA512 3b38eb60dfe61a91db21c5382c63d72a70b26d8cfe02201b384b56b067c32f40c39756b9b34dec389900a94da47ccbb1f32e45c39d01a4c48188a7c020380a8f
- SSDEEP 6144:uIkDx9cYLo0ClbGyu+UbyznqpqiY02UecETNv7iWy79fFfVPEGcFiX4:uIy/tyuukqiY02cETN2379fpI
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral8
- Target
  $PROGRAMFILES/RF_L/vcomp90.dll
- Size 53KB
- SHA256 ffc774f6f055b1a9a899ab76dac3e141f582ce19dae0b3d4dff9d93916b42d09
- MD5 f6a85f3b0e30c96c993c69da6da6079e
- SHA1 84f53ad5f1a01e1fa1c4d26b3222e10959debd25
- SHA512 b28748abbcb3c9ccc96de2dbd240448247f295a67f24e862a89c8dfe8aa4989b5e4270ff5cb4f96f0de88b2e6b8c9dd4a375baf47a8277777e83fb5249f8f2a6
- SSDEEP 768:uPSKLA354st0Ha5FvLgUz/g0f47TsvyVkpfL2jmPGjNy/TYAU8Cy/j:uqIAca5F1vO0LSZY/I8Cy/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral9
- Target
  $PROGRAMFILES64/RF_L/MFC90KOR.dll
- Size 45KB
- SHA256 21a75faaff69d68fd4d7e568ed9cafac7cf7dd43ecd8b46985be0a5a9ad3eb78
- MD5 e51c4dcda00da254733430492fc9c84b
- SHA1 9917f2ec17a64796bbb439bcc973cf1feda5030c
- SHA512 dad4f1162b73e62e19769633c1aa9d6caf4aa1b351f747dfc3cd63c190805e7367dd2327857f854671f0edb3a3b72e07794673750fcaccd69f6f72b3c4dcf5ed
- SSDEEP 768:LbRSP1iAGDUNvM1raHn9v8U8HafdjIafdjcjQ:8sAGDovMsn9v58HafdUafd4E
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  $PROGRAMFILES64/RF_L/RF.exe
- Size 2.1MB
- SHA256 4a9cbc43a828d42f338de79cceef9fca668f3c7c3f226f020e2b83044e9888d6
- MD5 de2c67787ee96b5422383a879b19b738
- SHA1 13732a849bd2f194a9da3c22cbd4c440f1d3782a
- SHA512 58d30a17e0f3b23b1625a6c26e81f038c405b159d6b7d5153b85f17267d177ac1dcd3f8aca1e6be70e7e2c37a61bbd399a6fc2c80d742ba7d0d655af321ba368
- SSDEEP 24576:rRMgod2XcZhMGDCLEji0427vkxoFbZNYwugsvliQEeiROiGM9zivuVpZZx/n6bOb:teREoN6vlqei1GBvcRzL2M5
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery evasion persistence trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11
- Target
  $PROGRAMFILES64/RF_L/TCCr.dll
- Size 36KB
- SHA256 be9a6ecd197103ab021ca7995c4c63fcb4bb976c74565987d2721b8cb2e19ab8
- MD5 8ac4cf2e05540ec8be1068a3d95a7e0d
- SHA1 d73e534391d8a2626cbc3402bdb52a3cecc9bbfb
- SHA512 27f0b69465bf19a8eaa5b6876b705c30b2bfd3b65acc7cb0aba1468c5945574843a3d4fa31269667cd3eaf4b0661f5f9c4c7e8d270f8e9ea0a165699cc89abc4
- SSDEEP 768:nxNBOCmACE+x283QK8+5UzOpxZ8SgUb32PBx3hXE:nPACmAqtizOpISHm5x3hXE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  $PROGRAMFILES64/RF_L/TC_AD.DLL
- Size 713KB
- SHA256 634c881c8070a781ea2e62bfeeca856f19b19b98ab959eae98d3b1d590de3f54
- MD5 f79e96ad602858944fa88980120af3ce
- SHA1 9e2077e50765efe43dcf91ede392f9efe8ac8f41
- SHA512 f34dd501cf619b492f7237d2660b59045740b29221b8eaf3a4232d7de658a226e8ec6c37278f524be950488c8e5ad476fef06743c10c000cc4d957b1f6ce4cdf
- SSDEEP 12288:mjWfAHInFgUxYECrUPRzZ83H2xBAy3G6cZR/G:mjW4cFgUxnCAPhZ83WLAJ6y/G
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  $PROGRAMFILES64/RF_L/TC_AU.exe
- Size 611KB
- SHA256 64a19a40d07598833d2c7b8a4e9d0d01bb955623da37c202b0319ac28957b1f9
- MD5 3dfc6c1ca213a60db124901955f61e34
- SHA1 fbeb932107eb05c7fd4213e163fc6aa422d10db3
- SHA512 2816ee54d95e8b88020043b06c144ed54691604529f776312e5191e09e639254530be0b8658eece304a99fb0d58afcec6e267770101476b9929c9245706fbbbb
- SSDEEP 12288:uqTurqz3reds9tq2oA4ql0l5BVogtmytoWzib5M0O5ANK:uGurMtBV4ql0l5nXmyfziK0KANK
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion persistence trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral14
- Target
  $PROGRAMFILES64/RF_L/TC_EZH64.dll
- Size 303KB
- SHA256 caaa7d0b5b8be3a35158b1d0ee0d4cafb28991ef6d497ffa3757c92ab78bae19
- MD5 8962190eb8a69b5be9dd6071c43ed286
- SHA1 cbcb9d18517f9553bbcb62b42239568773a30843
- SHA512 d34c465ddb5e9469f92b90f23131332e25b71bd94c929f051eb94ee09892786d564ca9e9c338a63d0daef3ebeb70f3b50c61158749bc7a77cf038f14fb3385d8
- SSDEEP 3072:Mv2aNPhAJTvp///PgixvbhK2MX6jNPZIKC5x2BQiZUIpB5gHMOirUBZdYY32k9YT:Mv2BTvpH/oivlK1KtZVCWyiZEsEZp3D
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  $PROGRAMFILES64/RF_L/TC_MH.dll
- Size 474KB
- SHA256 0214d120c399d83b8344ee43992eca27fa525d25d840a378f9cd3da38ba774f1
- MD5 be4b28622530518a10c1bca9dfa8c56f
- SHA1 9f40d0d113930f0831569398b77833e23710da57
- SHA512 3dc7e3da1923d78d942710b2089b3514db4bb91635d5d9ce8f059c8e8d8b4dda4ebef72431f7081d3c4b48702d4358343af0ff29cde496553e591576a4089352
- SSDEEP 3072:ieEvjJRPZ9zhOsdG/XSmq9/RNsgkrPraTH8NLbQf7BhdRBxEscL3YL9ER0wiW58q:ik7OTH8xbQfFvxpL9EW3bizXYM/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  $PROGRAMFILES64/RF_L/TC_Menu.dll
- Size 149KB
- SHA256 6914edcf72f07b74d270f6e94a2929f3f690c0ba94a318839f1d25e5e087210d
- MD5 b3b052d8f0548a4514e173dee89e169a
- SHA1 230a21f93a8abc5cb178396d0741ce43324b7263
- SHA512 c79ba3a10593ed1a7758800fa8a1c0f074d66b714509152540da3f83039251d754124f58e920ccbb73ab032c233c39759d599a29efc1ae9ba488e7731173bc04
- SSDEEP 3072:jVZI8G0/7/kIcr//SvX/LkuL6mACdEUOfzXPoYbf3RzuxG1/V3b5AwrgaKn:jVZI8G0/LkIcr/SvX/AuL6mACdEU6XPa
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Registers COM server for autorun
  persistence
behavioral17
- Target
  $PROGRAMFILES64/RF_L/TC_OL.dll
- Size 172KB
- SHA256 26f621f35d7450ebbd3a299ced07047c5608ca814b2a6386c2ec45a6f5e2c358
- MD5 06910e3f673abfa38a6e49bc858fc2ed
- SHA1 49f07050c19ef1ab61c9cd4f84cf1e0f131f836b
- SHA512 ec3fdce407e42e0e63599d03b3775075f18a659652fe26750268706d56643c94d738ac395f469a1e3701b0c207bab3a9adda666b28d68fc83eae6ed007234a84
- SSDEEP 3072:V/YNqoGsHCvUpq0Ldwk5kLnD7wg9W9ilwMGjYMaFSijEeNItD2D8f+CFneTNtU4r:V/YNqoGsHCs4+/kLnD7wg9WWwMGjYMa7
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

persistence
behavioral18
- Target
  $PROGRAMFILES64/RF_L/TC_Patch.exe
- Size 100KB
- SHA256 cec13ab5d8c48ff17871a9c721bb8b48ad59e3867e5248d155a2ae320434d0dd
- MD5 5f2795b2cd063429803b497d657f2938
- SHA1 6bb378f206fed83016acaa2e707c4594d165189e
- SHA512 2e9cace87c588e752ded017d1661097d2e9a5d74685d55b343ed142a20acb6e53d2c75d6364108f1de16206d43c287d4b043a97bb7161ee4f4a2b11512dfd2d4
- SSDEEP 1536:W7tu3sfSbsKW20iKml5K+b4IwTPZW0/aVr+JOcIW5H3sJ+cKI3h2Lt:W4sfSbwiKAKvv1/aVr+JOZW5H8pKRLt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19
- Target
  $PROGRAMFILES64/RF_L/TC_RA.exe
- Size 29KB
- SHA256 c54c1056c263b9bc5b86a80a05d15101b3f6a995c0bb0d1f7d2beec301968a3d
- MD5 6c377c001729eab9028cfc7bb663cb4a
- SHA1 2eeabad565f2f48c115bba720536df766ea52188
- SHA512 b5f491f59d427d7c754444ccced4dddc40268ea5ade5c4930c5cbcbccf1e9eae443cd039a3b983f2d1d8bd4628f5a812f0b82b0dc1f06775e929842225967871
- SSDEEP 384:nd6DAo3dc1HZW8Pu7BtKu/KV0YfmogD6uSK4HR24J8b9lUEHK2oKWkzFm8JN77hH:n8Drd85YhO+tUEq2Pp3hxl
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20
- Target
  $PROGRAMFILES64/RF_L/TC_Sign.exe
- Size 287KB
- SHA256 218f10bb140d90eea9ea8355b3fe59d1e902b0be960a318ef84e02315ad0ea98
- MD5 070fdb11b963bd4644eb8da5b68d7af2
- SHA1 d5405737e9b69608f47b8752de77849b4550a9e8
- SHA512 f56ab0385c5a700d5b932ab403ec2918e0de5a619724f26f729480232960ca543546c3f86edd43f17d08006dda654f5a78abb82cd4381b2dc826986636923788
- SSDEEP 6144:yYSyhc6OgfoAy1i/OSejpO1errvAcDRvZpQdM/6myEN0XLO:Kn6OgfoAyZSekerDr4mwXq
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral21
- Target
  $PROGRAMFILES64/RF_L/TCxEZH64.dll
- Size 197KB
- SHA256 1227eeba133f875f9948a57a74e3fafcc178618135670d80a3ff0d4d09a40e1b
- MD5 c01d90988f7ee7ca3e3945da60928cf4
- SHA1 d68c5f67f66bda6b9e397e4ceaf5e2d645af1288
- SHA512 ea58a872fef3ec84fbac9b55d5c7605ff3dc5a09d8f479732fbe7306d7d0a6738db02c5d422dd9837b974a4d3fcbb1573394070466c48b256a360582dae7fa9f
- SSDEEP 3072:Lp1uTeLfvOF5jgROLAr+m8KO5YRKGwFeMtler:LKTOfmF5joOY+mw57ll
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22
- Target
  $PROGRAMFILES64/RF_L/mfc90.dll
- Size 1.6MB
- SHA256 2a527eef7d5cbc295e5b3ceef5c5e1c34bf9fba51335102b44d73b67f5dbbe86
- MD5 60b030677185841817fa38bda0da6473
- SHA1 ae45372b4ce19c773d627f9df829fc16702fe840
- SHA512 ce1a560e372e2e35e092a7c6f823cace40d38a96246a27e5025172d418164471b0cba0319c8e83a6ff4d693f9d9250cc9d279154acf0ae9d5f9a81cc2c4f9bf0
- SSDEEP 49152:1/DtPxTK+ZnGfnpYuLupNdadHuDg2QhZg5mPwkn9n83dyMCwb7L6QXBiZj2KOYSf:1/DDNnGfnzS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23
- Target
  $PROGRAMFILES64/RF_L/mfcm90.dll
- Size 65KB
- SHA256 33174be770ead05787933900b07be4598985bf9350790c47be77a56e5300ae0c
- MD5 8278d44f988acee82073fa33332289e7
- SHA1 cd342f09db07e884878caa5a90bbe8f3bd99abb0
- SHA512 6eeb0ac1197fdf7409a20f315ff3b6dc7835f53e91d5d85cd09a6788ad99e1562fb9eac265d75de3dd0db8eb20e8c3f9ed307e85e1774bbe6756aea20cddefb6
- SSDEEP 768:TR+cRN99XrtVmFOsRRf1y4COor1fs0enne/Um2VjFBUOFFVz+9XuIrWwlyQbAsJE:Dn9XoOdj1fJ/R2d+duIrWeAaTOl6QZ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24
- Target
  $PROGRAMFILES64/RF_L/msvcm90.dll
- Size 239KB
- SHA256 450dbcf05db9e23c4cf96707d729a61fcde8b80690f7e9a3685652eff30161a3
- MD5 aa6698ec95f726f6931f701047426bc3
- SHA1 00cd963ec834cc13d94b67a4f1872716486b010a
- SHA512 74a2ef668c8a45be3352114332ab46a4281995602efb84505a686fde1ab7b0d653e83365ae9fbf6179d4cc358d92c37cb0a5bcdbd7442ae794a481a53f596aa1
- SSDEEP 3072:fiN9bouk1i5Tar3x4VVqls+r4lV2j3tGQOIPS72Bs+DBOBkOpA5CL:fOxe1mVrqjdGQ7PS72B0BkOpk
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25
- Target
  $PROGRAMFILES64/RF_L/msvcp90.dll
- Size 831KB
- SHA256 10859f06f41144fa32cf5da223511f85fe349b1d76471ef65f0395dac606ef63
- MD5 f7cd95a47f9c2291db184c6c4ad7e120
- SHA1 67cba6f7fe2dd19b2640a7217cd968177bf100aa
- SHA512 c96e17345d5b893a56d1004227e37a6906ae6da53e7cb33679e00bb807c28f4016dd6f91a2c038fe843fea56d08a55cf54ec3ea54b3a77f6ea0a08979ab7c965
- SSDEEP 24576:zmhZBoQsDoq9TVosFV/wCCg6EKZm+hWodEEUTTfU:zmhZh
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26
- Target
  $PROGRAMFILES64/RF_L/msvcr90.dll
- Size 612KB
- SHA256 e11ce4b90db815359b2d76f95f623fc26924c5a254f0540224fa6feb623817e5
- MD5 23b134891c08c7f04c1747f6bcec06ea
- SHA1 26a77ccf0e62faa436255e47a0c3c8a818733193
- SHA512 30c89f058b3b9ddd39ed7a3e3c470c2df08940dbc3ea0cf72cf271fa76ee19d956ee503a3fa2839458fbd2a61658ff3aa7f8326e6eccae9c11ac78b4c2b84c14
- SSDEEP 12288:1y+a/N+bAH6nDjnBRsjZ6iIzKq+dKEN1WeAIYcPmqy7A0g:1yr0UH2DrsjkiC4L1WeAIzPmqy7A/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27
- Target
  $PROGRAMFILES64/RF_L/tc_8SR.exe
- Size 31KB
- SHA256 f22f2308aa0df6e1a695aeaeafbbe4862f86561c2633ad2c0190ace6cf1fdbf8
- MD5 ebeca6b8aa5fd9247ac9941d99d5430a
- SHA1 cebbc84d77ed0a133b812a547dabaa941e15e4a6
- SHA512 f05597d18832bd52ed14f37650bc48debccef61ae17333872463ce5941dd5886550f48f8283df8b74f39338e0654b7c4624ddc34d4b96035afe570839478777e
- SSDEEP 384:Wxe3qVNRvG8+u9fdB1HZlWPu7BtKu/KV0YfmogD6uSK4HR24J8b9dUt2K2oKWkjC:Wxe3qVAuldP5dhO+VUtV2Pq3hRH
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral28
- Target
  $PROGRAMFILES64/RF_L/tc_Prih.dll
- Size 127KB
- SHA256 fcddf410c7a44a28ed926b0b5deb8016eb56e890273ab8adfc403df3050f18fc
- MD5 3113c656cd43cfd9a99ff3f1fa7b05d1
- SHA1 e9143cfdbdc7f552209a4c00e65bc1d2fab438c3
- SHA512 9bab4b739840a0101be9036a158475aef0091da86eea2d3128d3603e43b96f77df750c7a81d7dc6a34acccc79d1413eac82d224eead4ef4bbf39f12e9cbbbe53
- SSDEEP 3072:zRCgoifghp/OVzQQru2jsAkLCQHQ7D+ByDdHj9PCBY5BpBZRav:zg0fgklKCEfwH+By9RYWUv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29
- Target
  $PROGRAMFILES64/RF_L/tc_svr.exe
- Size 14KB
- SHA256 7cb4017abe287f516cbbd05a8d0476d814fc58167fc08c3203f3df90d8efd118
- MD5 3a5c91b35b82654e1a3acfe40183e382
- SHA1 f287faeedd777312a1b1f7a1911c635bc604ffe2
- SHA512 598b65db64316efc6858a9583495def1b670ea9bc28189f605df598eb2e0c491cb9cf2a3fc69b15a8ee55572e961b794de53792382320244e0e7824c6e5c0d0d
- SSDEEP 384:SMkSxFdfc9yDK2cKS8y3S08JN77hhBYil:SSxLA/2rQS33hDYE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30
- Target
  $PROGRAMFILES64/RF_L/tc_un.exe
- Size 476KB
- SHA256 f94b09757e03388984a6fc260a5228fa1d3a630b7beea0f95dd7fd31cf0f13ec
- MD5 5a124cf010db353d2cf2045d5f54c2b9
- SHA1 f79be201de9f58e22f0d914eb7928c43a742e899
- SHA512 44bbe0f2983558a5b2d0b8b37311aa1425b7b097f2427eedd4bd62e6e9540dfafccc770f16e969c9cb36a46f0ecb385e7bf409792bd1c91a5666ba5830f7c341
- SSDEEP 6144:0REJ8YiVp+Tqc506b9VkHKXhVMGpJ2XDxI6esd9SRlouDAPVC6cJnEd6kLhUncFX:0REe2qc506b9qqXh4I6E6umV01EJL
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral31
- Target
  $PROGRAMFILES64/RF_L/vcomp90.dll
- Size 58KB
- SHA256 5c3a317908bc4091bb74c276df5d7493a5fde93bfef1df73872523ab5df601a6
- MD5 63e472c8410a0e9ce25c35a0482bbbbf
- SHA1 cad23d1a666da6d6dd07f5e4bc5be2862c3d2171
- SHA512 16d323ce7e309073ace9fd8ec2b30728c8b3c9c336a1ec9e0257d972b248607b17a1b1526687ef39c74914e5a4432f027e70c273f53873a3e7174653e5a8090b
- SSDEEP 1536:QQJy/z68YJzvn86RqxattYLSLY/k8Cy/:Qh/W82vnDRqEtzY/k8Cy/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UAC bypass

Windows security bypass

Sets service image path in registry

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Registers COM server for autorun

Windows security modification

Accesses Microsoft Outlook profiles

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Enumerates connected drives

Looks up external IP address via web service

Modifies WinLogon

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Enumerates connected drives

Checks whether UAC is enabled

Checks whether UAC is enabled

Checks computer location settings

Checks BIOS information in registry

Adds Run key to start application

Checks whether UAC is enabled

Enumerates connected drives

Looks up external IP address via web service

Checks computer location settings

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Enumerates connected drives

Adds Run key to start application

Checks whether UAC is enabled

Registers COM server for autorun

Checks whether UAC is enabled

Checks whether UAC is enabled

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32