e40c001c3b01af79e2f8f23376ffa66d5c8b6d030fa0d60e2300c4c9da784d92

Sharing

Copy URL

Twitter E-mail

General

Target

droidkit-de-setup.exe
Size

19.5MB
Sample

240616-k5a56sxfqc
MD5

b40b694ae8d059f37d321138b015ee94
SHA1

c3ebac7697836a4e9edf03e385ff620cc91592b2
SHA256

e40c001c3b01af79e2f8f23376ffa66d5c8b6d030fa0d60e2300c4c9da784d92
SHA512

9124f754b403167a777db28b9eab31c8da3adef4e9fecab68f95e7520e9c3ca8445adf2659f297d68a4581d251164592febcb0e57b14aad1c5d863621af120cc
SSDEEP

393216:OciVQTXypl8pBja9MnNQLvcjjUUIsBwb6XYbTkrXDTNiDRUGJwPAEWXQ:OsTC8pBjMM6FeYUX3NiDRUGJ2YA

Score

7^/10

discovery upx

Malware Config

Targets

- Target
  
  droidkit-de-setup.exe
- Size
  
  19.5MB
- MD5
  
  b40b694ae8d059f37d321138b015ee94
- SHA1
  
  c3ebac7697836a4e9edf03e385ff620cc91592b2
- SHA256
  
  e40c001c3b01af79e2f8f23376ffa66d5c8b6d030fa0d60e2300c4c9da784d92
- SHA512
  
  9124f754b403167a777db28b9eab31c8da3adef4e9fecab68f95e7520e9c3ca8445adf2659f297d68a4581d251164592febcb0e57b14aad1c5d863621af120cc
- SSDEEP
  
  393216:OciVQTXypl8pBja9MnNQLvcjjUUIsBwb6XYbTkrXDTNiDRUGJwPAEWXQ:OsTC8pBjMM6FeYUX3NiDRUGJ2YA
Score

5^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1
- Target
  
  $PLUGINSDIR/BgWorker.dll
- Size
  
  2KB
- MD5
  
  33ec04738007e665059cf40bc0f0c22b
- SHA1
  
  4196759a922e333d9b17bda5369f14c33cd5e3bc
- SHA256
  
  50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
- SHA512
  
  2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/CheckProVs.dll
- Size
  
  7KB
- MD5
  
  62e85098ce43cb3d5c422e49390b7071
- SHA1
  
  df6722f155ce2a1379eff53a9ad1611ddecbb3bf
- SHA256
  
  ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2
- SHA512
  
  dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e
- SSDEEP
  
  96:iqCVh8iNqVgRudZczLiJp2tvgaJOnT/323x3XQUPVAm6yBBECtu7ZyvN:9IhJqUudZkLi+bOni3x3X3PVR6yBBfj
Score

3^/10
behavioral3
- Target
  
  $PLUGINSDIR/GoogleTracingLib.dll
- Size
  
  36KB
- MD5
  
  d8fca35ff95fe00a7174177181f8bd13
- SHA1
  
  fbafea4d2790dd2c0d022dfb08ded91de7f5265e
- SHA256
  
  ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
- SHA512
  
  eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba
- SSDEEP
  
  768:IWXV2fVEC5h9KclMCumc6plPHY4jq7rOZkdhKZV:8Smh9/BumTlg4kOZ+Kz
Score

3^/10
behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  ca332bb753b0775d5e806e236ddcec55
- SHA1
  
  f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
- SHA256
  
  df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
- SHA512
  
  2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
- SSDEEP
  
  192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
Score

3^/10
behavioral5
- Target
  
  $PLUGINSDIR/dotNetFx45_Full_setup.exe
- Size
  
  982KB
- MD5
  
  9e8253f0a993e53b4809dbd74b335227
- SHA1
  
  f6ba6f03c65c3996a258f58324a917463b2d6ff4
- SHA256
  
  e434828818f81e6e1f5955e84caec08662bd154a80b24a71a2eda530d8b2f66a
- SHA512
  
  404d67d59fcd767e65d86395b38d1a531465cee5bb3c5cf3d1205975ff76d27d477fe8cc3842b8134f17b61292d8e2ffba71134fe50a36afd60b189b027f5af0
- SSDEEP
  
  24576:3idS2cRQNb9dUcyezFSja7zEwA2BH6SEUVGDKX68zuQm6wwr5mAPepC:SQ2cRQh9GexmCxBxVV56CmWQax
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral6
- Target
  
  $PLUGINSDIR/msvcp100.dll
- Size
  
  593KB
- MD5
  
  d029339c0f59cf662094eddf8c42b2b5
- SHA1
  
  a0b6de44255ce7bfade9a5b559dd04f2972bfdc8
- SHA256
  
  934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c
- SHA512
  
  021d9af52e68cb7a3b0042d9ed6c9418552ee16df966f9ccedd458567c47d70471cb8851a69d3982d64571369664faeeae3be90e2e88a909005b9cdb73679c82
- SSDEEP
  
  12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/
Score

1^/10
behavioral7
- Target
  
  $PLUGINSDIR/msvcr100.dll
- Size
  
  809KB
- MD5
  
  366fd6f3a451351b5df2d7c4ecf4c73a
- SHA1
  
  50db750522b9630757f91b53df377fd4ed4e2d66
- SHA256
  
  ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5
- SHA512
  
  2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130
- SSDEEP
  
  12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1
Score

1^/10
behavioral8
- Target
  
  $PLUGINSDIR/nsDui.dll
- Size
  
  10.0MB
- MD5
  
  368841af8b0074e348418f106716e603
- SHA1
  
  75469510665b651b38e3b4fb7c4240722c756126
- SHA256
  
  3be54dea5aedc0d8d16d6c4bd4e046e2d93bfc550a1a035a94768c2d5901e327
- SHA512
  
  3804afa3930a90f258a2b4e7106e1d0211e5d4ca6a7f5ba23da11e3908b4e202295ddbcb1ecf1e15215bc9a0aece1a46efad07ad94feddd4f316b0de674c50d5
- SSDEEP
  
  196608:H1YWSpeHkab9WLMhJuH9E7QfqV9BgtBx2Tr+Z/iYyEuOyWoqeob8VvW:eWBfbQcJudLqV9ByBxP/1o0b
Score

3^/10
behavioral9
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec62e1a8d16d8f1b0eb792aa26e5de5c
- SHA1
  
  faa219618aec99cffb81c312728dc56c1fdc5798
- SHA256
  
  193d396fc7be5fed9d585de3c43e23d640c1dce725499f0274b3898c248545aa
- SHA512
  
  cb3f3458cf734ab7b964ed25cac87ff2938292eed9caae1305b2e5975bde885f4d8b06d05d4099ef614982cd55d97e9ddc0f13bbe2cdd9fb642d008788ed3017
- SSDEEP
  
  96:O7fhZwXd8KgEbAa9PweF1WxD8ZLMJGgmkNp38:/N8KgWAuLWxD8ZAGgmkN
Score

3^/10
behavioral10
- Target
  
  $PLUGINSDIR/nsProcess.dll
- Size
  
  4KB
- MD5
  
  f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1
  
  b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA256
  
  30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- SHA512
  
  f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP
  
  48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
Score

3^/10
behavioral11
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  313KB
- MD5
  
  06a47571ac922f82c098622b2f5f6f63
- SHA1
  
  8a581c33b7f2029c41edaad55d024fc0d2d7c427
- SHA256
  
  e4ab3064f2e094910ae80104ef9d371ccb74ebbeeed592582cf099acd83f5fe9
- SHA512
  
  04b3d18042f1faa536e1393179f412a5644d2cf691fbc14970f79df5c0594eeedb0826b495807a3243f27aaa0380423c1f975fe857f32e057309bb3f2a529a83
- SSDEEP
  
  6144:rA9ssOlBrbYr5UP4m3mC/FvBbhQ1JzI+yQKiJGxdNtsm0:r2S165UP4mL/FvBtC8zQdSDmm0
Score

3^/10
behavioral12
- Target
  
  $PLUGINSDIR/registry.dll
- Size
  
  24KB
- MD5
  
  2b7007ed0262ca02ef69d8990815cbeb
- SHA1
  
  2eabe4f755213666dbbbde024a5235ddde02b47f
- SHA256
  
  0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
- SHA512
  
  aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
- SSDEEP
  
  384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
Score

3^/10
behavioral13
- Target
  
  $PLUGINSDIR/uninstall.exe
- Size
  
  8.1MB
- MD5
  
  8f38aa72cd18800c5d32b28f382f3992
- SHA1
  
  7c5ce2b711df4b1750a27c40b0f22bc3f1c7afe5
- SHA256
  
  f52158db0772365ed95657471fe5519838c01bc7e4dfb7b00f5fb68fd5320a8d
- SHA512
  
  cc2d10d3d8ea670d2ad2955388ab260f7c87c0a70ce2ad815cd3a041eae994131dd4e97c8d15fc515e7abe963f6a5d566fb84322b6eaf36971f09248bcc2e289
- SSDEEP
  
  196608:5Y18/QDobE0TSkJzTtpQF6ZBPTS8y5BFwGIR6ip2eyWzi+8LX+1ZxWc:5+8/1EglTvS+S897pgGiNLeZxv
Score

5^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral14
- Target
  
  $PLUGINSDIR/BgWorker.dll
- Size
  
  2KB
- MD5
  
  33ec04738007e665059cf40bc0f0c22b
- SHA1
  
  4196759a922e333d9b17bda5369f14c33cd5e3bc
- SHA256
  
  50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
- SHA512
  
  2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
Score

3^/10
behavioral15
- Target
  
  $PLUGINSDIR/GoogleTracingLib.dll
- Size
  
  36KB
- MD5
  
  d8fca35ff95fe00a7174177181f8bd13
- SHA1
  
  fbafea4d2790dd2c0d022dfb08ded91de7f5265e
- SHA256
  
  ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
- SHA512
  
  eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba
- SSDEEP
  
  768:IWXV2fVEC5h9KclMCumc6plPHY4jq7rOZkdhKZV:8Smh9/BumTlg4kOZ+Kz
Score

3^/10
behavioral16
- Target
  
  $PLUGINSDIR/SelfDel.dll
- Size
  
  5KB
- MD5
  
  e5786e8703d651bc8bd4bfecf46d3844
- SHA1
  
  fee5aa4b325deecbf69ccb6eadd89bd5ae59723f
- SHA256
  
  d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
- SHA512
  
  d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3
- SSDEEP
  
  96:NdekHUj5z13cPopei+Ml9PNDFbS7xg+TScrQ5:NdeuU9xcPopr+M9FbSS+TSE
Score

7^/10

upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17
- Target
  
  $PLUGINSDIR/SkinBtn.dll
- Size
  
  4KB
- MD5
  
  29818862640ac659ce520c9c64e63e9e
- SHA1
  
  485e1e6cc552fa4f05fb767043b1e7c9eb80be64
- SHA256
  
  e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
- SHA512
  
  ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
- SSDEEP
  
  96:lNM22eGbMlQMYbDnmaxn/nPm1Xe+KuAaK:D32eGbMlQMuHvqXe
Score

3^/10
behavioral18
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  ca332bb753b0775d5e806e236ddcec55
- SHA1
  
  f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
- SHA256
  
  df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
- SHA512
  
  2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
- SSDEEP
  
  192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
Score

3^/10
behavioral19
- Target
  
  $PLUGINSDIR/libcrypto-1_1.dll
- Size
  
  2.1MB
- MD5
  
  f2897d414a50674f58a0d1aa19614a20
- SHA1
  
  adced986562ed4a4e07fc92aff3d30797e2f83df
- SHA256
  
  c4372100431007321e8fb3b41eef740dfe6e1c8a694bea251f9637209d76f207
- SHA512
  
  a2760bcbb049e9f336802b9302115659bcae39c376ea05485fa3aa0da9bc695fc910f4c93348d4435d07b8448b6db2492dc3564ee94378be7e3b29dca5577396
- SSDEEP
  
  49152:qNQtYgGEnfJG+wVv5kOZK1CPwDv3uF0j6BvFB:6QtVGQwbkqK1CPwDv3uF0j
Score

3^/10
behavioral20
- Target
  
  $PLUGINSDIR/libssl-1_1.dll
- Size
  
  389KB
- MD5
  
  7b155439f2fe287dca54370ace90d7ea
- SHA1
  
  c747c32daf2a7fd35e934a51c4b19a292ae2ca63
- SHA256
  
  08d6a4106d5a49658d776b50c5f99dcc244bebd8577eee6f445df0b70f4d758e
- SHA512
  
  a8f3b074d3e298f2783ea5aa3535d3ac452ac8c8c85fbd9c9b800294f91d3fc1315766cd8cd5a788b96753bc4177cf724c9c5b51067d71aef8f567d5da244d0b
- SSDEEP
  
  12288:N0TAOGU1UNckb9nBSataDZwg/ifWtHORNBHO0nQUDo5gXUwRfFDO2BrqW4e:N0Hcc7gXfRfFDO2BrqW4e
Score

1^/10
behavioral21
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  904d8313031ac05e2bac3dd329828833
- SHA1
  
  6c8322f76e5c38bc24b0bcc057a510c92ec40b43
- SHA256
  
  a7c5516478ab02b5d6c1684b3c2b31ee03331712bcd9f9a8ef8309d2b72c8ec4
- SHA512
  
  9d524ebc965f224e1a16f537f71df0963c586fd548cb9a901f8afb1951416dd656d5493cc5e304157dfa6d70d69bcd4c5a5b140fceb3736548e71fe7086b6de8
- SSDEEP
  
  192:oR8cxzvTyl4tgi8pPjQM0PuAg0YNyAUIFtSP:IBxzm+t18pZ0WAg0RzIFg
Score

3^/10
behavioral22
- Target
  
  $PLUGINSDIR/nsProcess.dll
- Size
  
  4KB
- MD5
  
  f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1
  
  b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA256
  
  30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- SHA512
  
  f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP
  
  48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
Score

3^/10
behavioral23
- Target
  
  $PLUGINSDIR/registry.dll
- Size
  
  24KB
- MD5
  
  2b7007ed0262ca02ef69d8990815cbeb
- SHA1
  
  2eabe4f755213666dbbbde024a5235ddde02b47f
- SHA256
  
  0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
- SHA512
  
  aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
- SSDEEP
  
  384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
Score

3^/10
behavioral24
- Target
  
  $PLUGINSDIR/un.exe
- Size
  
  7.4MB
- MD5
  
  839640ba4c87b4a0fbd4d81fc54f8f51
- SHA1
  
  0fdf3cf3685de715f8206400a232bf389ce319d6
- SHA256
  
  58b8642b2665efde3974c18c2613b6e27dcf31fbb4b048339f93b2019c26d6df
- SHA512
  
  14b97fd80c8b58422949b9d8db2660e93c6ee7c41873e8388cc9b62396e791f346346465527088a50a58d6d9a358e21a8652a0934149dd6ed3947841a7e59354
- SSDEEP
  
  196608:SypQHMyhZz21iDr7Q8WjqvQ80j1FA9Epvk5MABT/4l8mBx88w:SypH+gADr70Wv6DA9G85nrc5lw
Score

1^/10
behavioral25

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

ACProtect 1.3x - 1.4x DLL software

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25