8554134af5bff5ce0ded7b59df4ba8fdd5817bdea0cfc4885b9e512b1c503c6d

Sharing

Copy URL

Twitter E-mail

General

Target

8554134af5bff5ce0ded7b59df4ba8fdd5817bdea0cfc4885b9e512b1c503c6dN
Size

776KB
Sample

241108-p8zp6asgje
MD5

8266de60dee21cf8fdd9995c66da4d00
SHA1

bdd1c5c6b8e508dffaf0ee6ff43f7a33c79edea8
SHA256

8554134af5bff5ce0ded7b59df4ba8fdd5817bdea0cfc4885b9e512b1c503c6d
SHA512

53d91cd9ec7da2aed1c39a39fcb47d4e3750c2e0c0a427d70a6f6d4e6fb4091bae21423a0a86a8c827d116b6180f2f37e9c46fe314660118be760986a3fe8935
SSDEEP

12288:C5Tn5QBJTU+o8PQe2J4qPtzbAW/rZZyo292fI8hHP0HFd7GOmDks:ClyDTUaQf4qzbNDyo294rHPy7GO9s

Score

7^/10

Malware Config

Targets

- Target
  
  8554134af5bff5ce0ded7b59df4ba8fdd5817bdea0cfc4885b9e512b1c503c6dN
- Size
  
  776KB
- MD5
  
  8266de60dee21cf8fdd9995c66da4d00
- SHA1
  
  bdd1c5c6b8e508dffaf0ee6ff43f7a33c79edea8
- SHA256
  
  8554134af5bff5ce0ded7b59df4ba8fdd5817bdea0cfc4885b9e512b1c503c6d
- SHA512
  
  53d91cd9ec7da2aed1c39a39fcb47d4e3750c2e0c0a427d70a6f6d4e6fb4091bae21423a0a86a8c827d116b6180f2f37e9c46fe314660118be760986a3fe8935
- SSDEEP
  
  12288:C5Tn5QBJTU+o8PQe2J4qPtzbAW/rZZyo292fI8hHP0HFd7GOmDks:ClyDTUaQf4qzbNDyo294rHPy7GO9s
Score

7^/10

adware discovery persistence stealer upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/DLLWebCount.dll
- Size
  
  32KB
- MD5
  
  248536afcb6f59c1797f079a0da15b63
- SHA1
  
  7fa238f871b357c66168728ab1bb38addcfba3f8
- SHA256
  
  9c5f4eeadc9c2881bc02b45d757b35d3bfd2dc7d917d2e8fde2917fabf48908f
- SHA512
  
  b82accc8530650ebae8d4f8752002c2d23ab7b29e958e6c14731ad186a0fcdbbab937723a540de62d58f4659580843191fd53cb415e07167d7b55cd174a79652
- SSDEEP
  
  96:jos0e13nQHmwy5PFlufG/cg6TGkB4iuzJFGA98ONfeZEWVCxCSvONfeZEWVArmdj:josH1XZwy5NbgB5KPdNeTYgNeT6dba1
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/IEKill.dll
- Size
  
  28KB
- MD5
  
  090f0ab18996feae6c0a62d83b2149c6
- SHA1
  
  5292898561ad88630088ae22fb877dfc7146ee77
- SHA256
  
  914536dd97645de7789666da5dc03d02f4fbe0593214678e6e1982a02a8a1c4d
- SHA512
  
  2fccda2cb95583fdb184b7edaa7ae088ca484e06d020159bf9776e36b660c6672812b7e821b111fa52d63ad5e2ce70602dc117edc2eba3c46029653c5ef5ffc6
- SSDEEP
  
  96:HBEL05pgkwA+EW+wo7zn2Ul/yUola6a3IQReb+4fuYrlA98ONfeZEWVCxCSvONfg:H20MzwL2siQ3Yg4fidNeTYgNeTRsc
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  32KB
- MD5
  
  83142eac84475f4ca889c73f10d9c179
- SHA1
  
  dbe43c0de8ef881466bd74861b2e5b17598b5ce8
- SHA256
  
  ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
- SHA512
  
  1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
- SSDEEP
  
  384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/SelfDelete.dll
- Size
  
  24KB
- MD5
  
  ddc0d6806073a5b034104c88288ca762
- SHA1
  
  9663cc10c496f05d6167e19c3920245040e5e431
- SHA256
  
  2f4767da9dc7e720d910d32d451674cd08b7892ca753ec5c10b11fe85e12f06b
- SHA512
  
  545ca797a397cfcbd9b5d3bd2da2e3219ba7a294e541831655c5763a7f17480fd0b990d0c2e58ba8c71f81d85472b2da6d079b8211b44c40c8c36d21168ec054
- SSDEEP
  
  96:kloL9cOmJnnH/4zN0TZquBog7OzRN5wmglWFq7PJv7PJaGvhWf89WrTXEGNR9j:klQcrKR0TDBFcN0lR9hvhWEAEYRB
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/UnProtectMode.dll
- Size
  
  200KB
- MD5
  
  d37323d733078a8da425ad71a51d1462
- SHA1
  
  7061f1f388c6fa0159d614ded01251da4e4b7e4b
- SHA256
  
  e1a0b1168a87ac0d140b3a394efda23148a8907093898e0a2549079009d318e3
- SHA512
  
  f7e0780aa18785c1402d7233b67fabb61cefa8568e71cd4ca37405eafc7a340053836b16fdebc2ce351b7ddeac28d17a43091904ba443269cac1e7e4f46bd929
- SSDEEP
  
  3072:q508dyAOKh/OEim3+cuk14mD3RHOLxIpCri3QQcZbozTbq:M0W97h/Ov2NN4S3p8mCrI4Z
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  acc2b699edfea5bf5aae45aba3a41e96
- SHA1
  
  d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA256
  
  168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- SHA512
  
  e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP
  
  96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/version.dll
- Size
  
  22KB
- MD5
  
  fbe588b15eb1bd86defade69f796b56f
- SHA1
  
  2f63cf44039addddb22c2c0497673b49e6b3ad7a
- SHA256
  
  31144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
- SHA512
  
  e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
- SSDEEP
  
  384:6Qx38r8QfiLpVjOXf4Rrd2IpZn8LI2EdGZ5D6PDo3rsyfyC8n:6Qx38r8Qgp1OvYd2zqGZ5D6PDmXf98
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  
  enumerate_gt.dll
- Size
  
  212KB
- MD5
  
  f6118553c91b465310c9bb4518df7dc2
- SHA1
  
  8ca6eb680435d6d295e3aa3d448b6e5f98619650
- SHA256
  
  a12457b93fde731d24eae3361ab9ff9a1b13fdb5d81d08df4af4bcd88823d3c1
- SHA512
  
  7f3d40aebe63484ba9a8d641967adf8e5fd54d4ec8bf0c8ef3ad0626a8d15ca13960a0842dfc4e38f4100f26a6cb2636ee9f760289c8818a41bb7c430e3aa5e5
- SSDEEP
  
  3072:EttvceCQb7jhmPXK057o74a0lw7BB24qCMDZCVQ/QwHb2n1i:Ezce92Llw1g4qCJeQ8q
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral19 behavioral20
- Target
  
  enumerate_gtu.exe
- Size
  
  952KB
- MD5
  
  90bcb9a27ee951a4c14aebfc9e1705e5
- SHA1
  
  3813d0878b2df1fe54050ea2280252df5bc15969
- SHA256
  
  ec70c5810a29a6e4039f47d969896a64cbf926682cfa8b7c5da080918575f0a5
- SHA512
  
  2676fea3be40fedd3aaa67db585f867ada3ff111eb892652d83dfea0404fb0107e3388b651d09ef4cec3c899699e8009ab44a88b4abd33a273728642177f8bce
- SSDEEP
  
  12288:/5E2jmrKcGv4g60GQM336KavWhSUzUcymV+VAPYL2xIUlL2f:/e2pcGv4wMiWhzIZbadlyf
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  enumst.exe
- Size
  
  1.2MB
- MD5
  
  5d9dcfde4bf008764a64951b4b6b8d4d
- SHA1
  
  3880a422e0ee1b62038e01b3147108a3c4fa13f6
- SHA256
  
  3a4daee62a78f3fd0a6ce92037071ea49680d682ca5c3fb353686bd4f962126f
- SHA512
  
  902408c56aba96743839aa7bda79cce48b5710fa190454a0edfb5f8b528fdab02151b60223c129d9fbbeba619b88889f3053ed4e7e518e3d5367668af6043dfb
- SSDEEP
  
  12288:tMcGUxk4RCiYG6nKZbQgl9WefN9XYqgduMIPoUHi7ud4kaO6zhs5/Zjru4F6/9BO:tMV4RFYGi8WefN6HA33Hmud4FOoc96FU
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  uninstall.exe
- Size
  
  86KB
- MD5
  
  967351c220f514656d716f962f4cf1f6
- SHA1
  
  2247bcfa468baf7537fed865aa7f36320a656d52
- SHA256
  
  197457eb687df4a75631b429b8486ffda1b734893d0b76633db8f86a63edb9d4
- SHA512
  
  257854d6438ba6142b1368da656f4f6e0cbc61fb80e568af8a4547d4ac50a406b7195302cc3ca5eb787e09036728616f58477e376e00b78deeeaaebcd956c5c7
- SSDEEP
  
  1536:1QpQ5EP0ijnRTXJc36DMGjR0uNEchEXyvvSCzfZZsE25gJSu8wzwk6yt9:1QIURTXJcUM8R0uNElAvinubt9
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/DLLWebCount.dll
- Size
  
  32KB
- MD5
  
  248536afcb6f59c1797f079a0da15b63
- SHA1
  
  7fa238f871b357c66168728ab1bb38addcfba3f8
- SHA256
  
  9c5f4eeadc9c2881bc02b45d757b35d3bfd2dc7d917d2e8fde2917fabf48908f
- SHA512
  
  b82accc8530650ebae8d4f8752002c2d23ab7b29e958e6c14731ad186a0fcdbbab937723a540de62d58f4659580843191fd53cb415e07167d7b55cd174a79652
- SSDEEP
  
  96:jos0e13nQHmwy5PFlufG/cg6TGkB4iuzJFGA98ONfeZEWVCxCSvONfeZEWVArmdj:josH1XZwy5NbgB5KPdNeTYgNeT6dba1
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/IEKill.dll
- Size
  
  28KB
- MD5
  
  090f0ab18996feae6c0a62d83b2149c6
- SHA1
  
  5292898561ad88630088ae22fb877dfc7146ee77
- SHA256
  
  914536dd97645de7789666da5dc03d02f4fbe0593214678e6e1982a02a8a1c4d
- SHA512
  
  2fccda2cb95583fdb184b7edaa7ae088ca484e06d020159bf9776e36b660c6672812b7e821b111fa52d63ad5e2ce70602dc117edc2eba3c46029653c5ef5ffc6
- SSDEEP
  
  96:HBEL05pgkwA+EW+wo7zn2Ul/yUola6a3IQReb+4fuYrlA98ONfeZEWVCxCSvONfg:H20MzwL2siQ3Yg4fidNeTYgNeTRsc
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Deletes itself

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Installs/modifies Browser Helper Object

UPX packed file

UPX packed file

Installs/modifies Browser Helper Object

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32