4683b541af3899a591d31b58879c6c2c8ef5d3708c6f17af1cf9d7d9277e19dc

Sharing

Copy URL Twitter E-mail

General

Target
ccsetup631.exe
Size 82.4MB
Sample250120-rj642stjer
SHA256 4683b541af3899a591d31b58879c6c2c8ef5d3708c6f17af1cf9d7d9277e19dc
MD5 bcab19a821e6d89be9f352059b741f9f
SHA1 58d5357c3c0e60fdf552200d2600853767a06543
SHA512 4c578a7fb0f1f56835fc564758d9c8d6c5afde84d690b1a31f22d04c76a992462183470575721a0bbf11972a6d509650245806dbf88627d337ffc8bb2116bbfa
SSDEEP 1572864:3jO0YjB9EHfOmHsHiGYLSgTAJPFkjbPkmomYljBAbZMPC0CX01CoDTAJO3HWUJjK:3r4g2osCGCD8pyHPkNmYljybZT0CX0dK
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Targets

- Target
  ccsetup631.exe
- Size 82.4MB
- SHA256 4683b541af3899a591d31b58879c6c2c8ef5d3708c6f17af1cf9d7d9277e19dc
- MD5 bcab19a821e6d89be9f352059b741f9f
- SHA1 58d5357c3c0e60fdf552200d2600853767a06543
- SHA512 4c578a7fb0f1f56835fc564758d9c8d6c5afde84d690b1a31f22d04c76a992462183470575721a0bbf11972a6d509650245806dbf88627d337ffc8bb2116bbfa
- SSDEEP 1572864:3jO0YjB9EHfOmHsHiGYLSgTAJPFkjbPkmomYljBAbZMPC0CX01CoDTAJO3HWUJjK:3r4g2osCGCD8pyHPkNmYljybZT0CX0dK
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit discovery persistence spyware stealer
- Downloads MZ/PE file
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 23KB
- SHA256 5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
- MD5 7760daf1b6a7f13f06b25b5a09137ca1
- SHA1 cc5a98ea3aa582de5428c819731e1faeccfcf33a
- SHA512 d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5
- SSDEEP 384:l4Z8sUAUNuGGsPVPEZ+OLkCnFJDhgvZwcRa9h9S4y4fO:lG8sUAUnt88CFJDhmajMA
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
- MD5 675c4948e1efc929edcabfe67148eddd
- SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
- SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
- SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $_135_/lang-1025.dll
- Size 252KB
- SHA256 e05eacf950506d9b333f577ce27ddf377f68bf1221abdb6b3b966b51c32fa5b2
- MD5 80227a5979749da4b1a6e13d75767ba9
- SHA1 10435ad7972d3c036367d1bcad5bbf7e6e297d44
- SHA512 3733f4d7266c1e5d6fd64f9d76997d7c083e7605f9fcc25ab487b506ecf6e5b8349936ace20c0ee7363c54beb2b3713ccfc688514d428eb9abc1f0155bf84882
- SSDEEP 3072:eGxnpwJ5WckrG4m4xyOfF3VForEml34/s2O8sM10dOR25VvxXMn+TOq3EK5zeDxz:bLiEsU51M7q
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  $_135_/lang-1026.dll
- Size 301KB
- SHA256 ab014c6e209ae350463d4d90c6ec41d33274010c0fbdfc72857e22974f29d941
- MD5 9ed91838f2c94cca62e9997d6d8de485
- SHA1 45bc682ab79da280483acb075006aa8e14ba5bcf
- SHA512 0cc294970b414f2da4ee0c7970958dbe18e4f0ecec8fc8196c49f1527e6e0a77728818361596d5d5b6ecec1ce2ed02fe276d7e7966e6d9e17c358174e4457579
- SSDEEP 3072:pGqlPYLFo0y2mxyNRtQdjtTyUDph4ai4B7m:P6m4yWUDJP7m
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  $_135_/lang-1027.dll
- Size 303KB
- SHA256 346e4e3efcfbd1af51a4d5d2ce052223f725b93a8fb41e8dd775016f44517274
- MD5 da49c5b096108ab52124c4e2b8e244c1
- SHA1 4ba771ba6c648b194c9cdd358c581065a85e3a78
- SHA512 feabd210b5793fd5b4c7fbf63d74956a7a74a1bba5f520a3afef2b8b75a5fc57fd69de92cf34eea7cdecd9ba46152e50e1e31e5fda06e11172ede0294cc494bb
- SSDEEP 3072:RGVrruphzAmGC0MUmqvn9vQ2iYHzNb2SlTwRPM36qWFnZY2W572sCEswwm4U7M:lbAK0MUmqVNb2SlEqWsv7M
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  $_135_/lang-1028.dll
- Size 118KB
- SHA256 0a3d128953bdac4927cd38d2cc2420d4eb7f3e9860846a3a031788d6a675241a
- MD5 59ff6883556271c7cd84501625cacc25
- SHA1 7480e318d514cce97a39e05c8543ee30a4398326
- SHA512 bab44ca78677d829767153934200b88d35aa66eab73370a594965e521fc72c545e80d44fdf716b8bba905c097cbf9580eac99b5e0a81aa6fcd287a6337248664
- SSDEEP 1536:SkG0/0G14AsGyGT9bdfTMY4JUtAaV0zEwjHhAEIS7kTN7v5:jG0sMhTTMY4JFdLHRd4TN7v5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  $_135_/lang-1029.dll
- Size 267KB
- SHA256 69c7a2055f1cfdcdcd7c5b31fdbcb76d50d53bd0b293f05234897c3900801d48
- MD5 7448e3e1614e38ee9e2b16f298577767
- SHA1 fc1a02a0b44a0c9410044929ea2a62cdf6aa95bc
- SHA512 e459e6a889b22343b0526557c2593bfd177bc3b9840c88a307c0ad37b895763c89eba0a629b5bd354c96e3fb102817ad54e0064a47c6ecc386f62f9c82e21d20
- SSDEEP 3072:PG1TV8w+1kxQxrTjEuqMmR4l0V13hcIYt80BJ0wonymZq1Mb2gxcK4XyN7T:cCO13rYlyN7T
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  $_135_/lang-1030.dll
- Size 263KB
- SHA256 e5eae23826a2500f945b51ae207675cc0cc0bcbe396323121926b8d3f46a3f38
- MD5 6e8c5c1a5b18f7e780168f83131faa39
- SHA1 8c73f2ae58c222b45cae6c82e8a11bf2103012f9
- SHA512 3a0e5292c85ab59b015ef422f7c0bdfd88a4d201d85f3d87824cb0931b80a3533541415b3c4fc32208b639e078c46b0aa53a318e8854a9fbce72d353ee0175fa
- SSDEEP 3072:tG1VUUPjdtlpsCPH02R/CCzuo8JqT1oSo4amSZtNFgCI1linJMaQ4r7y:Ytrlphwm44lzaD7y
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  $_135_/lang-1031.dll
- Size 298KB
- SHA256 a54b0285fc1d57cff4a8ba9d7e276f8c011d2b784a2f2ffa7da62e7d77b976f5
- MD5 922e87c1d447e8f894c7fb102d5d03fc
- SHA1 c68de47b35a2d6bf44b58dfb2dd95064f76feb19
- SHA512 ffec4c0492832ce0311f01669953d8bf87ffb6a12285dd62d7ca2091230fe670d624a0bb91dc0f9977a0bc1dfa5c267551767d26118d02ee6e10066f52e641d8
- SSDEEP 3072:xGZjJn9KvgjvyvvWTChegDQhK7JUfRtR+ga9hI7AlfbamVXuNdIEhpg8XVLZkwLI:qy/jFmEFzdaDvpXFPni97J
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  $_135_/lang-1032.dll
- Size 311KB
- SHA256 7d3f03930a3db4fe8134ce28fb6430f44b89d74e769ed7d8fbac6ed15ff4afaf
- MD5 1585dda981a8a0411b23237584a244f9
- SHA1 0a8bd9e7c12af85dd18db671c620a31722312900
- SHA512 4af1b28741631d018760406eb4d4161f2f713c9e15b6129d255ba2ed67f13609c3a1bff793f154425a6482d0fae3b509b9eb239a94225446628ca44f4ebff884
- SSDEEP 3072:wGYlBkC3TgkU7Z9vMQZO3MnoWX6r85dWORIq64adqLDBBlKKSUG8UYi9rvxVJzAq:qqvMqk6Gyv7i
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  $_135_/lang-1034.dll
- Size 296KB
- SHA256 01dd0c2f161769fc8e3f148cc29942214c3ba82857e35fa1d4bdcb870600845d
- MD5 11f04cc4559701e7707451e5b67ce4b3
- SHA1 83a77f139caebe2628bb52a2d444aa50006676e0
- SHA512 cb28c8bfd8ce58c41f360832f4fef74bbdc35a7cc0a6041ff1b35581d79572fb070807f6548b7cf8c8b9c22755d6b9586d53f5eb82fa93888471f3663403e201
- SSDEEP 6144:2yx+c99+JqLYLRDFP5ivkhQH9haWChslwW7s:bd+s7s
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  $_135_/lang-1035.dll
- Size 275KB
- SHA256 98e9fbf664c765fad57af063c4d470f8987911dd977cc73e38cd29f34eea37a3
- MD5 254bc711966827e1df9c9b073def3478
- SHA1 50f193eb8413c0a68d499c992f99c683bf360c67
- SHA512 1773e154bea53bd8835f647c2c70954b9164a72c55a8d08fa7f38fb8e996522803a760e9fc3de1bd2264b60ae58d4b911dff0f61ce464e573fe805279665f770
- SSDEEP 3072:NGDm0iYKzLFQCBRLAEmW6WJM8LHxaMevPHZR/m2lki2/eqLyJ801IEaI88RTr+vI:jLFa8zx/2xW2nziBZp3w/sIYWnYuP77D
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32