3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925

Sharing

Copy URL Twitter E-mail

General

Target
3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925.exe
Size 1.1MB
Sample251009-rjnmpseq4v
SHA256 3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925
MD5 e685e6f33cf4ca3aed82f3b10105ec83
SHA1 dd2150c9db3e773fc0e59fd4617577541d1cef71
SHA512 d3f8869c0f3154b5399b7442190ed885c52fe1c9360f0942300a69b1337d815e718706d8927fe4fa8cf328c3ed5f4dd59f10d29ef29f16fc991ffc8c58a7c527
SSDEEP 24576:5BSEjWm/SkPCyUOFMySAy3eQ5Ricod/10zfWed3NkHAU/m:bSEhXlNCeQfG/16fF3Em
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925.exe
- Size 1.1MB
- SHA256 3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925
- MD5 e685e6f33cf4ca3aed82f3b10105ec83
- SHA1 dd2150c9db3e773fc0e59fd4617577541d1cef71
- SHA512 d3f8869c0f3154b5399b7442190ed885c52fe1c9360f0942300a69b1337d815e718706d8927fe4fa8cf328c3ed5f4dd59f10d29ef29f16fc991ffc8c58a7c527
- SSDEEP 24576:5BSEjWm/SkPCyUOFMySAy3eQ5Ricod/10zfWed3NkHAU/m:bSEhXlNCeQfG/16fF3Em
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
- MD5 ca332bb753b0775d5e806e236ddcec55
- SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
- SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
- SSDEEP 192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 a7c5516478ab02b5d6c1684b3c2b31ee03331712bcd9f9a8ef8309d2b72c8ec4
- MD5 904d8313031ac05e2bac3dd329828833
- SHA1 6c8322f76e5c38bc24b0bcc057a510c92ec40b43
- SHA512 9d524ebc965f224e1a16f537f71df0963c586fd548cb9a901f8afb1951416dd656d5493cc5e304157dfa6d70d69bcd4c5a5b140fceb3736548e71fe7086b6de8
- SSDEEP 192:oR8cxzvTyl4tgi8pPjQM0PuAg0YNyAUIFtSP:IBxzm+t18pZ0WAg0RzIFg
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Konterer.Uds
- Size 52KB
- SHA256 26754641b4dc327f5c5aabb22bd898a3eca1cd65160d90e1570cd2b1a9de45bf
- MD5 b2f85e85680c20cd60375118c67d705a
- SHA1 a90a85f3cbee6d7a33ea92367d5aca5e326c4fd8
- SHA512 b6302a4b34e604fdeaeb2cb7bff5012b8c19a42a5c77ee2abcb2c2a32bf8cfe289eb95bb783a02659077d8f3a68badf9023c0f74816d67ae6851d8d2127cba95
- SSDEEP 1536:8fkzBUSsGUA6/JbyCd9jBLlls24ezfGztYbGcwrxZaI8e3ERCUe3v89mANQ:+kzD7
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware execution persistence spyware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8