03c35fcb1d10cf478c0b9896699937e6e262daa4f4a4353a7cc56b238fe86892

General

Target
spsetup133.exe
Size 18.0MB
Sample251105-3x28sswnfl
SHA256 03c35fcb1d10cf478c0b9896699937e6e262daa4f4a4353a7cc56b238fe86892
MD5 b86b975448d0b27727ac9c849318cbf2
SHA1 938c2d249c9bf7978b4828b9028b95b122ceefc3
SHA512 3c82955edde3f45fb45875223253351fe1938f58a307a4f7bc85a3971a5a92cddecd3d2bef31ccc60e233eb8a532ed4ab0f1708384cc4db91c02255e832a698d
SSDEEP 393216:vAfGg4AOfBzN0sIPREFXSIqGiAINgIF/x5kfSY1PfMhKokebZyjzJ:vAfGg4A+NN0xWoI2g+S6GPfMwovM
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Targets

- Target
  spsetup133.exe
- Size 18.0MB
- SHA256 03c35fcb1d10cf478c0b9896699937e6e262daa4f4a4353a7cc56b238fe86892
- MD5 b86b975448d0b27727ac9c849318cbf2
- SHA1 938c2d249c9bf7978b4828b9028b95b122ceefc3
- SHA512 3c82955edde3f45fb45875223253351fe1938f58a307a4f7bc85a3971a5a92cddecd3d2bef31ccc60e233eb8a532ed4ab0f1708384cc4db91c02255e832a698d
- SSDEEP 393216:vAfGg4AOfBzN0sIPREFXSIqGiAINgIF/x5kfSY1PfMhKokebZyjzJ:vAfGg4A+NN0xWoI2g+S6GPfMwovM
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit defense_evasion discovery lateral_movement persistence spyware stealer trojan
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Remote Services: SMB/Windows Admin Shares
  Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
  lateral_movement
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Speccy.exe
- Size 16.4MB
- SHA256 34c7d84cadd776a8325807d6d1ae5f4d48d1559a01088972ead4a80de13f27ce
- MD5 8004097b0dca3af45935f81935c694cf
- SHA1 43ba3f72d5e68dfdea202e559a50417d4140446f
- SHA512 0e6735c3e8c398b9a44f92cf331a744513a2cb3e27a567466b155b98f0b58127dbd640b7b2c034e935c633c815b7a921bdee7716335890a9922dab57c2b8d875
- SSDEEP 196608:a8Jq5Uly3z+dpMJnTpPC2Nb2flkRIpzgJWhHHGUybPtkb3USyL:a4lI+HM1rb2flaIpzOWhHHCrgkS
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit discovery lateral_movement persistence
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Remote Services: SMB/Windows Admin Shares
  Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
  lateral_movement
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  Speccy64.exe
- Size 19.9MB
- SHA256 af7352096175a8e5bd4f78d0f22b1c6391d2f8d4f888cb1df120b1bd27b643c3
- MD5 2ca180dc33ac40d68290c310bc07b2c2
- SHA1 dc566cc0f653a27436ef32b1410e0d1109371d09
- SHA512 9248f4544698d7da2004595dcaafde4356f70366492e85b873012123b3c23784e5d0c4911d97564e8c04ea5cea72df1beb8f56674c0645a1a6c863bccff10bdd
- SSDEEP 393216:fQjaJggX5Fukm/HaH6hRIU3xlNH+iVLDG:fUaJgC5FoVW
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit defense_evasion lateral_movement persistence trojan
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Remote Services: SMB/Windows Admin Shares
  Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
  lateral_movement
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral5 behavioral6