a49a364b7394a70e5bac73917bd825b703aa9f11b66848069379b01a595ca307

Target
TLauncher-Installer-1.4.5.exe
Size 22.8MB
Sample240610-v2s7pathjd
SHA256 a49a364b7394a70e5bac73917bd825b703aa9f11b66848069379b01a595ca307
MD5 b4c335fec6bbb46bc5e8dfd74be77a78
SHA1 da6aeca92a7b0e562f1db8e83d73386046b1beb7
SHA512 caca2ce1edbbdf04b1eb0ad2eff2f5c73f2d51db5b49612a516325b27329f4ee7db86dea0e2fa8df264b40557d0167112a22440bc4ef513089ba11e90720a15d
SSDEEP 393216:025KNJux8K2E+Q5JIkc2rr6of5MJ7ZWqxPAIgtMIMlFRqH0fHbS1K8kn/rbhQyD0:RKNJuIMJIArrKJBH5lFRqH0fYk/pUJ8a
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  TLauncher-Installer-1.4.5.exe
- Size 22.8MB
- SHA256 a49a364b7394a70e5bac73917bd825b703aa9f11b66848069379b01a595ca307
- MD5 b4c335fec6bbb46bc5e8dfd74be77a78
- SHA1 da6aeca92a7b0e562f1db8e83d73386046b1beb7
- SHA512 caca2ce1edbbdf04b1eb0ad2eff2f5c73f2d51db5b49612a516325b27329f4ee7db86dea0e2fa8df264b40557d0167112a22440bc4ef513089ba11e90720a15d
- SSDEEP 393216:025KNJux8K2E+Q5JIkc2rr6of5MJ7ZWqxPAIgtMIMlFRqH0fHbS1K8kn/rbhQyD0:RKNJuIMJIArrKJBH5lFRqH0fYk/pUJ8a
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

adware discovery persistence ransomware stealer upx
- Renames multiple (58) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1