af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Sharing

Copy URL Twitter E-mail

General

Target
FFSetup230.exe
Size 36.9MB
Sample240612-mn9zaavepr
SHA256 af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30
MD5 6740a750d79cd3d1e6c6932a7a2a6c73
SHA1 621cdfbbace55bec19759f3418c2b1985fdb626d
SHA512 f8d41136c5fe03b3fe0bab5f4841541dcd5da8288aee9d11618633341c7ac5fb1443510745f04dbb557a64495debd7121e3a5682908dfa54e272d5381a60cbfc
SSDEEP 786432:kv/L52JTvcX/Fp0yvRYlcvhrXavf7AoiFehZ2T/0oBL8xBp2ez:kvTckPT3RKyhrqvfEoMevho9kprz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  FFSetup230.exe
- Size 36.9MB
- SHA256 af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30
- MD5 6740a750d79cd3d1e6c6932a7a2a6c73
- SHA1 621cdfbbace55bec19759f3418c2b1985fdb626d
- SHA512 f8d41136c5fe03b3fe0bab5f4841541dcd5da8288aee9d11618633341c7ac5fb1443510745f04dbb557a64495debd7121e3a5682908dfa54e272d5381a60cbfc
- SSDEEP 786432:kv/L52JTvcX/Fp0yvRYlcvhrXavf7AoiFehZ2T/0oBL8xBp2ez:kvTckPT3RKyhrqvfEoMevho9kprz
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery stealer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  FFModules/RMCodecs/tools/rmtools.dll
- Size 332KB
- SHA256 b26405738feb2fa2685c94d6d5472fd8fac066055d4ebb20d064ef8b32305b70
- MD5 ee9db024f9483ba7b2804b4da78fbb4f
- SHA1 c22f0f74fde925f9c4ce17ea90fd318bca7211b7
- SHA512 19dea24e6bac1d77d3ff27bd4a18756d79809cdf03bba13f3ac7b9d42e72d9b4181b567442dfffc814ddee43ccfdf87e7941004819600af43a3ba89038f2dc01
- SSDEEP 6144:FKI/6m+ZCqAbLcyKrn2QdOjF4dI4nhKRwSbqWl7Dg+PKbjjBbk3Ccs0WMkBsla/U:FKI/6m+ZCqAblcn2QdOjF4dI4nhKRwSc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  FFModules/RMCodecs/tools/rmwriter.dll
- Size 248KB
- SHA256 101691ede8135aaa507fefc3a26f9bd9c100e3c6a6ea7ce2387cfcf0662cc75b
- MD5 57c55ebd23f09a24cae5c89efeaa9d6f
- SHA1 08bfe3868064c7518b400fb0613ef21b37617c78
- SHA512 867ba02d4b100393629d1f9427bbcbd7ebbb4ff569c07bbdc6defcda805dbafc8b19413810704bd3da7f588dbeac9e4dc797f5afe89cba3b3cff26ec0f7c044d
- SSDEEP 6144:gks1kWo44SWmG6hwHRhTKRIQVvc2W/jNc1gac+P2PRazG:gksVo5mGwOTxQVverhL+Py8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  FFModules/RMCodecs/tools/rnaudiocodec.dll
- Size 72KB
- SHA256 dc30b1886c5cdabb6d9fcd3a196738e505bd8eacdbe8860964ff9f731b28a958
- MD5 3347f019be533bf341e5083e121b6b5e
- SHA1 a81ce388ec9923b6517ee8b13f3b702ea312322f
- SHA512 432e1ec3f658e1892d0d43c5d17490002c266b92a7f3ce5797b77dc12996536e223b1d43e53b2a2270772ffaf2268947c54084d3815bb4ac9455bd3e2864ae7f
- SSDEEP 1536:B/JpLC//4ruybdIm6jo6fzoFlztKugTq5/:B/Jpj/B6fkFlztUTq5/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  FFModules/RMCodecs/tools/rnaudiopacketizer.dll
- Size 84KB
- SHA256 840ec92e7114930c40f0eb7aad637abcf7cb8bcd7910453f50ec51bdad8a73ef
- MD5 f2fbe7e788946086be1b863d7e6a33af
- SHA1 2e03fb2978191339fe2a23b9f48e2eebd69446b3
- SHA512 cf2c5fa5fa966455d101cff98940c9da38e1ca3bcfbe885c5516e1c29adda30f93fc5dae8a6d5556f19fb6d1dfc3237d16a87337f1b84a44d1b23c7b7cea3462
- SSDEEP 1536:2anxp8/bZeS6W1F08R48YeZUSs6wPAC5NRnjqgw:LczZBOO48jnaDVnjqgw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  FFModules/RMCodecs/tools/rnvideocodec.dll
- Size 104KB
- SHA256 51e45073d1b0969ebcec53b66684f7d7818642b4398dfefb8c22ac44c8a5c324
- MD5 9db7e494069aa2281063c796f90bad95
- SHA1 1be17bc2a806215e5aa2cb76cbc8f5d3e5852c3c
- SHA512 0a16e0174f5764d710f977397a28f5ff035000f2a11ca1232981582738f24c2ef179e7da1e39c69c1e23c89cd96bac9cbc82112afe60a9b73b5bbba35cb3f4eb
- SSDEEP 1536:96jbk/mYTEr3K0+BNXSzmCemRyXtv/eVpqg4PM/3kcY9ewDeTQQCy0BhxbKBmLeN:UbkZ4r3+Bo/IdXnM/UNvKTIxbKBmLeN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  FFModules/RMCodecs/tools/rnvideopacketizer.dll
- Size 29KB
- SHA256 7550e57bce1d84203296e43ea33d68b75d8015743e3e1d093c2ff9e95a6e00ed
- MD5 5a75d9266b5a6b63487a559f0cdee019
- SHA1 a39d79c4addadf5e3b518b208f764f983b376065
- SHA512 c656af319f7eba674bb910a676cb20d049dbb777dea0a7fe0e19861ad9c9404a938419ab36af5d683dc78f28f4123fa9c13ba689e219a073a2bf76f8492e09f1
- SSDEEP 768:x9Z98z3cPLA2vLT9BwrBTY94hNtk8xjeF:NA3cPE2vLRCrBE9yKMe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  FFModules/RMCodecs/tools/videocolorconverter.dll
- Size 48KB
- SHA256 b4d1f20d09fcf4213ebb28146b6b7c4338e4b90bc7ce591c63f1d8da32ece504
- MD5 c4f57934af6e24b0b38c687f26d69a5b
- SHA1 081bcb7c7af92b8e66e8c407206529b4c61ae4e5
- SHA512 8e2a76361a3fd5492ee8234ac6c23da6afeaa5f36bc3d2ba5ec5504c5143cc1dab69ca537bd13f195f298db21bcfb88620668014fc47da29765721ab9063072a
- SSDEEP 384:AvXVwuiDO7qHkrsUPkepkcutospv2nRf2OEULm9Yx0n3rMdSrM8g2TN03SXPTz51:oXVwui67CAsokNtFvaf2+mAdSY8JNjs
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  FFModules/RMCodecs/tools/videodupframedropper.dll
- Size 31KB
- SHA256 51ba8b7c111a32b5d4e03e6eeb6815a3e6ad72fa1b13f2bc86a58c02d89e951b
- MD5 dd373093dbb401946d75ed7820f1e3b3
- SHA1 eaa9fa0202142d00434f786393cf1eee686c72bf
- SHA512 d42750b4a16835edfdd7cbc13d135a9f0f07d48aabffb2f5fa64bc20d57d37175058b7969e1ea9cdc7fa783be0909e0f43eb4803605748873f60b8c008730de2
- SSDEEP 384:JYWIkCMjb5i9kLYED/z56FK90vJh8h6wR0yIi0NLPVAGlcuwN0o3PTz5ogcaGruK:qCb4983/d6490BxyclVz3wNua8ow
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  FFModules/RMCodecs/tools/videolumaadj.dll
- Size 30KB
- SHA256 8a39dee42fca022c0730f9eba106f3b9f018f13cf4122b56f48ef1e869b7b0df
- MD5 f7a26c4ea28eb97500ee6c7edd99444b
- SHA1 66717750d853ab4b89bfe97e9d9d3ab8d7b74724
- SHA512 f8a98652d9565eee6932c7e5899a9e9cc64f1fbbe4bdab4f32a55f9398ec4b593ae1a77b9bfc5eafc556d865433790498af0f0cc358b7ec03793455f6944a851
- SSDEEP 384:/chHGNdcxQ2wKq8xglRwUUQqID0Bo8OqgtxjN0vnE3PTz5ogfGruNN7:3d0RwKBLQnoZO7hNQE98k
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  FFModules/RMCodecs/tools/videonoisefilter.dll
- Size 40KB
- SHA256 b05c3bb90cd1a61b0e1d824d52c1115f5517b2492bf754be63fcf2933db27c4a
- MD5 74904e8f8f23b7ff1efc1ae5e3883ca7
- SHA1 05b623ce3bb0d67e17dcdeaf0af90dc87f611153
- SHA512 62f5e613d4fb03f4684e8df4804a4d78cf42c524fb9ab82b18bb328a7fd75505835035f1411001e1e7a14110eebee280d5b15c292581f2f4a1d47291854a48c3
- SSDEEP 384:IHLoaZ96AfeEtKCN7IdWNePljSEWbVxzhbPDQVzJ0yIW09YSSuWlQ16yqhFfN01v:IrZoAZuWEl4bVxlbyobSFQifNk8/va
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  FFModules/RMCodecs/tools/videoprogressive.dll
- Size 60KB
- SHA256 41e1ee125e4c3847e08b66562ce6cfa53a1995e2a716ee57c627ddbb56aac8ca
- MD5 6e8b4a521f63ac0bc09557be686f33ba
- SHA1 a4f81ca35373304e5ae06bad05da5f0960626b00
- SHA512 613682de2c6e648b7bf1bcf8ae4d5cd06aff55c12aa3c31aa6e11a8807b01bfe1f18b1fe71b6e8328a3221f3c4fd5822c210f7ce5dba5d17e764c6dddc5053ed
- SSDEEP 768:ongLG7JYj2Ezz+kxsshJKLSHCDMMmf+u1bicXDIb0TNyPW+c:xy7JYjPFjRCDMMmfjb7Ub4yu+c
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  FFModules/RMCodecs/tools/videoresizer.dll
- Size 40KB
- SHA256 c30302fe3fa73efb4632f50b3362258b2645001f704b52325d93212b97d4bde3
- MD5 8c58da0f2b44f43c2f0518b881e9df28
- SHA1 09a1670967fe1baeedaaaca49f519c91e4cda302
- SHA512 27f5c43238d2dffe54b6babc102f3553016aac5caf183ff0e4d0446aca38f6161ae91e7293a8207706664e6da203c720f29f7655ccaa47b965629d748101e9b3
- SSDEEP 768:/oksyLBMaHOZe6MRCA/aG2IW1QL4qNfasCPaya:bzFMQOZZMUMx2HaL4YfasC1a
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  FFModules/RMCodecs/tools/wavreader.dll
- Size 20KB
- SHA256 eb4c6549d576aecd6479790bd72c8fe5ffa8491ad14bf0fe8384d064b9e77e5d
- MD5 774697721777bcf839bfb77aaa74ff94
- SHA1 e3063a7aecd469d322b80ff7f273595680f017b6
- SHA512 ae60949422c74dce446a19c3178eccafe3b580b84b0c8343d1f404ed49fbe059d44e3593a19815de479e5d6fccd16475b2cb97ab9a596f3bf06c149ad3ab03e1
- SSDEEP 384:v3ehW3u1wkOKix/3TvlhCFgt9G2nN5OPPO5ixOaTN07dy8FV1:v3h1x/3TvlhCFgXtqPQwPTNgdV1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  FFModules/RMEncoder.exe
- Size 84KB
- SHA256 e6a497291af10c09cbf3285c577107e9e4f7d186f8bc1998c83bcda6ef111a39
- MD5 a75d797adfb65f5aef6c204e3427fd57
- SHA1 628e0984f89e03cd7918bf423852773f88e11447
- SHA512 3479cf942ef9db7a7f590910768d685ddaddfd7b7cccf2ff3dc2c331cd3492386959cafd3def0ddf9cc64675c6b344e090df5415dd4cf622df6ee562b864e8c8
- SSDEEP 1536:Naxp13NH5r6ykZ3ZbX+MEeX9DuF48JHiinWfLE3+/pdICNoLtM4Li+:NmnNHB6DbXaF42uPICNoLtJLi+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  FFModules/avcodec-52.dll
- Size 7.3MB
- SHA256 84ddc7e62dfc9d53303f8529c7cd18a6dfb903319dfe5eb76c9fb29a5276cf7a
- MD5 6a19de42841e5dd62bd134a68f9a6438
- SHA1 1973e9f19d2855d33a0faffc5edf0b00ec84ca27
- SHA512 85f8a4b2189bf4ad93fecd45bdd33c7ca77e167e61bf10e4086c4fa24ee49d7a8b1cde9f408ab2d44871661e1febdff2554a828729897793429e84d74a9cac86
- SSDEEP 98304:qIHTgq5gTXcwExx8mahrUW3ExjVRV2SW0dBU7y0AHKBUGjkvSABpPgDanqlNwfpV:XhmEvHRnjV/1BKHkvSABpPsanKy7
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops desktop.ini file(s)

Enumerates connected drives

Installs/modifies Browser Helper Object

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32