3c9e3e8035a213d59ebf59fc8b3889f9af6d1bcbb4083064b6ffbca9a588fc4c

Sharing

Copy URL

Twitter E-mail

General

Target

Uninstalr_Setup.exe
Size

5.6MB
Sample

240902-kf5ngswelr
MD5

b58bcb319ee67f95f72a46d1f1664e38
SHA1

2b1f04fda8f0c009df7557eb6e7905bf4b6cb782
SHA256

3c9e3e8035a213d59ebf59fc8b3889f9af6d1bcbb4083064b6ffbca9a588fc4c
SHA512

532ed658a799d31a5f9a210d472bf14c8b89304b6963247a4a53b5427ef11e097ca6db8ed65ec8fb1450d532af3b7642707568d3a8afc6797ed7c952c9f0bf8e
SSDEEP

98304:bJ29qTBvHbcc7kEVeZrTUly4xWzyJDwPgx89ovXFq132Yfwl6/Vk2HlROU:bJ2y8n8yMWzEDws8Kvg3rwl69vnh

Score

7^/10

Malware Config

Targets

- Target
  
  Uninstalr_Setup.exe
- Size
  
  5.6MB
- MD5
  
  b58bcb319ee67f95f72a46d1f1664e38
- SHA1
  
  2b1f04fda8f0c009df7557eb6e7905bf4b6cb782
- SHA256
  
  3c9e3e8035a213d59ebf59fc8b3889f9af6d1bcbb4083064b6ffbca9a588fc4c
- SHA512
  
  532ed658a799d31a5f9a210d472bf14c8b89304b6963247a4a53b5427ef11e097ca6db8ed65ec8fb1450d532af3b7642707568d3a8afc6797ed7c952c9f0bf8e
- SSDEEP
  
  98304:bJ29qTBvHbcc7kEVeZrTUly4xWzyJDwPgx89ovXFq132Yfwl6/Vk2HlROU:bJ2y8n8yMWzEDws8Kvg3rwl69vnh
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  4add245d4ba34b04f213409bfe504c07
- SHA1
  
  ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA256
  
  9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- SHA512
  
  1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP
  
  192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  1d8f01a83ddd259bc339902c1d33c8f1
- SHA1
  
  9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA256
  
  4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- SHA512
  
  28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP
  
  96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  Uninstalr.exe
- Size
  
  5.8MB
- MD5
  
  7fd25adf2e51606e9c44b26bf32335fa
- SHA1
  
  0859dae2b2a8b7a7ac68bed3d5ab7b49e94b7001
- SHA256
  
  60814f455b04e8bf9b5c19aada40fe6838c1ca5b2b6c1f1e5ece8f5479b2b84f
- SHA512
  
  ad59f77cc8b05fa2cde584b6b701b07719f6cc7d99be543f24b9759e5a65b3d2d789aa1baec1b093732ac47479c1544a251bac4ddf730b2e9df21cbcb08968aa
- SSDEEP
  
  98304:31ZG/7+Y+ueg2G8QtGp3XdHGZzqbTg2T5NQiBClc5QO8cdB/JUldokgNvvNdIc2J:310/7+YYBNtGZQTpIiBClo8cdB/JIo1a
Score

7^/10

discovery execution upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks computer location settings

UPX packed file

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8