b625fd9059386774f2952b00c679590b0b6c628e58da1fa6ed65b1a6d8026439

General

Target

avast_free_antivirus_setup_online.exe
Size

243KB
Sample

241001-v467bssanp
MD5

2a1972531c60c349f9637a364b73af05
SHA1

eadae5b76f1335a0e090dff8c81ff58f7ffa3975
SHA256

b625fd9059386774f2952b00c679590b0b6c628e58da1fa6ed65b1a6d8026439
SHA512

cfebb736a966e4fc64fbe89d1e993e03f41374a3efbc44c20679bc5db7b6dc5176f0bf5cbb02a2d291f4ebe38a2c5425ee17ed52e9c1f6dece9afcff6fd77ede
SSDEEP

3072:+eJbDwLibLaZ/S91gxiJPU3qtmQv2cthYSdqMREwPLr6VsOWPGWynVFGQMeJquu1:+kDOZargxSHmQv2+B9EwCzGQMeQBqq7

Score

8^/10

Malware Config

Targets

- Target
  
  avast_free_antivirus_setup_online.exe
- Size
  
  243KB
- MD5
  
  2a1972531c60c349f9637a364b73af05
- SHA1
  
  eadae5b76f1335a0e090dff8c81ff58f7ffa3975
- SHA256
  
  b625fd9059386774f2952b00c679590b0b6c628e58da1fa6ed65b1a6d8026439
- SHA512
  
  cfebb736a966e4fc64fbe89d1e993e03f41374a3efbc44c20679bc5db7b6dc5176f0bf5cbb02a2d291f4ebe38a2c5425ee17ed52e9c1f6dece9afcff6fd77ede
- SSDEEP
  
  3072:+eJbDwLibLaZ/S91gxiJPU3qtmQv2cthYSdqMREwPLr6VsOWPGWynVFGQMeJquu1:+kDOZargxSHmQv2+B9EwCzGQMeQBqq7
Score

8^/10

bootkit defense_evasion discovery execution motw persistence phishing privilege_escalation spyware stealer upx
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Drops startup file
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1