General

  • Target

    TotalAV.exe

  • Size

    68.3MB

  • MD5

    574b058eecb6cb4039778cab4d49f764

  • SHA1

    e15136b4eead530705178f1892f517aeb35700b4

  • SHA256

    1d152cb544822ef4e0facc7622d8726c812cd27b05d2483aa009ce6410ec5a7f

  • SHA512

    17e60d50c91ccbb65155e80a095c865a4469852580f48006af43ef21b9a6277d611fb8c42318bb74cb2feae433c442de67808b5512d4d3c0a2c181e508ec89a2

  • SSDEEP

    1572864:IKuAjYvOsFibt6h9DbJcJz6KIKr0KFCW2KCzmozd:IKu+YvEbt6hBbEIXKgbJzd

Score
10/10

Malware Config

Signatures

  • Blackguard family
  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • TotalAV.exe
    .exe windows:4 windows x86 arch:x86

    ea4e67a31ace1a72683a99b80cf37830


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/SysRestore.dll
    .dll windows:5 windows x86 arch:x86

    a4814f13f35bacb060420cabbf9e8154


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    ebc2d915841be8afc8fa1ee9f6850960


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    e269b6260a93a17ceff5184b3982ded8


    Headers

    Imports

    Exports

    Sections

  • API.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Accessibility.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • AntivirusLibrary.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Brand.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • CacApp.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • CacApp.exe
    .exe windows:6 windows x86 arch:x86

    1accf73e88d828d33d704bcbd721fd92


    Code Sign

    Headers

    Imports

    Sections

  • CacApp.runtimeconfig.json
  • D3DCompiler_47_cor3.dll
    .dll windows:10 windows x86 arch:x86

    7f269ea2d96d8d376f2c7642ddadc7bc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • DirectWriteForwarder.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • DotNetZip.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EndpointProtectionClient.Net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • EndpointProtectionInterfaces.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • EntityFramework.SqlServer.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • EntityFramework.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GUI.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Google.Protobuf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Grpc.AspNetCore.Server.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Grpc.Core.Api.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Grpc.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Grpc.Net.Client.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Grpc.Net.Common.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • IPC.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • LICENSE.txt
  • LiteDB.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MessageRpc.Net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.AppCenter.Analytics.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.AppCenter.Crashes.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.AppCenter.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.AspNetCore.Antiforgery.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Authentication.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Authentication.Cookies.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Authentication.Core.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Authentication.OAuth.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Authentication.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Authorization.Policy.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Authorization.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Components.Authorization.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Components.Forms.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Components.Server.dll
    .dll .js windows:4 windows x86 arch:x86 polyglot


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Components.Web.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Components.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Connections.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.CookiePolicy.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Cors.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Cryptography.Internal.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Cryptography.KeyDerivation.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.DataProtection.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.DataProtection.Extensions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.DataProtection.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Diagnostics.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Diagnostics.HealthChecks.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Diagnostics.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.HostFiltering.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Hosting.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Hosting.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Html.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Http.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Http.Connections.Common.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Http.Connections.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Http.Extensions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Http.Features.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Http.Results.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Http.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.HttpLogging.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.HttpOverrides.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.HttpsPolicy.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Identity.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Localization.Routing.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Localization.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Metadata.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.ApiExplorer.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.Core.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.Cors.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.DataAnnotations.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.Formatters.Json.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.Formatters.Xml.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.Localization.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.Razor.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.RazorPages.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.TagHelpers.dll
    .dll .js windows:4 windows x86 arch:x86 polyglot


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.ViewFeatures.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Mvc.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.OutputCaching.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.RateLimiting.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Razor.Runtime.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.Razor.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.RequestDecompression.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.ResponseCaching.Abstractions.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.ResponseCaching.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.AspNetCore.ResponseCompression.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections