Extracted

• • Target

    Setup/Setup.exe

  • Size

    37KB

  • MD5

    e3383ba53ecebb2ecb7063fcccff17dc

  • SHA1

    cd1384e86f194f95c8939418d30c80c56c412645

  • SHA256

    07eaa040d73e39f53851533c8c09d92cd3228d099236e3995b19b4c8a1c15ada

  • SHA512

    563f952147c529230824ae6feaababb3ccbe7eca324d71892d2d4f68ffc0eb6eaf1edce29662c63563cd1f7c6de6e4468b35e2b96a7eb43c93aa7367c2877d34

  • SSDEEP

    384:LpRWUiDZblmJEpRGyEff1PNN0CYSmkhrAF+rMRTyN/0L+EcoinblneHQM3epzXPL:9R6HpR9Eff1P0Clm8rM+rMRa8NuxZt

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1

• • Target

    Setup/hidserv.dll

  • Size

    56KB

  • MD5

    1969d81e14152856fd487a773740700d

  • SHA1

    fe8c2191fdedef664807a8dc42fd675985e262a4

  • SHA256

    5794a44a7c0236090f9a3eaabd4d3981b7bb36aeb65efcec8e096ffafe49d3a0

  • SHA512

    e67b65b0be445241d89629ae17f053ddbc4414429e2fc1c1f533781102928895583dbdccd3a201f146bb9268e86905745bcbc5fd80e50dc7028b8c8fbae3003b

  • SSDEEP

    768:D1wpKL4nq5QJXMvhaqJuzX8I8S2cpODc6cBS+4+9rK:hAnAQXscZvpOwPwIu

  Score

  1^/10
  behavioral2

• • Target

    Setup/hlink.dll

  • Size

    160KB

  • MD5

    8342acb306d837da7627f58159ebd910

  • SHA1

    90d84bb0b369d13c38d30e40b6a7c83481e330da

  • SHA256

    4aa272633cf76867a6029fb54c8de50441b8df3b5e11cb956edacdc0cbb19e78

  • SHA512

    e38e174b508c43531e497d8c48dcbc7121cc4744c2680b5f17164f4340032f9336cd1ddc3049a5b33bf93663ebc9d71262b84cd73a298514bf6fd4871879a406

  • SSDEEP

    3072:SkvtlaOK/CxHHUpvA8Yk/j+eI6CbiMLPdJSKsQkfzB+PlhjPvp41h9dL0s2Ko2IG:SkllaOK/CtHU5A8Yk/j+eI6CbiMLPdJq

  Score

  7^/10

  persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral3

• • Target

    Setup/hmkd.dll

  • Size

    80KB

  • MD5

    258daa23beb5c5a06f87a3ab88462102

  • SHA1

    b974e56114aeecc3abd0c6a97449e6ddcb186545

  • SHA256

    74e20a558bc612f9aafa3d2a38b15015429816fbb461cafa1bc79d954448153a

  • SHA512

    ffc0f3b8836609cedeca27311750395cd75b1b18d9b0a31c6f28573f2a4e33718814e0f2e4b34be06042526220cc2bde25130025f62591b175dd733258c1e909

  • SSDEEP

    1536:p5Ch7DaNQg1ut82AA8Sr3S+vDpj/8SY9O4:p5ChHaWuSrC+Fj/8Sj4

  Score

  1^/10
  behavioral4

• • Target

    Setup/hnetcfg.dll

  • Size

    497KB

  • MD5

    3d3632994a7f06aa528e203b98982f0d

  • SHA1

    4602f4a7793ae16cb96e69d73a11639524cf5262

  • SHA256

    b71ae6f590a0db09fdcf16671c78da41cfa2a3f52f5893a0a9345e618b69942e

  • SHA512

    f67e758491a0634b6c195ca6d00996ff1ae886706d178e6ddc1b8bf7d01200c3b3e2353a0274f781b37717583c6d3cfa642be732fc9bf289cab4acccb98fbff7

  • SSDEEP

    12288:KBRqMSP8ZQHlazwS77KxebbeHXDjXrOrcebhBo5zQc6GiNql+2kOkyFLCHzw9cFN:MRqMSTHUzwYKEbbeHvrOrcebhBo5zQcQ

  Score

  1^/10
  behavioral5