318b16bcf20c1fe089cf34941441a2908b159e3890b48b3fda7b49b0a2f7999e

Sharing

Copy URL Twitter E-mail

General

Target
VpnInstaller.exe
Size 6.7MB
Sample260415-pg7xfsdx2m
SHA256 318b16bcf20c1fe089cf34941441a2908b159e3890b48b3fda7b49b0a2f7999e
MD5 3ac52ca5386234239ae8a00de39db7fc
SHA1 237a9e1926b2a8722fc8dd82fd46ef14631bca10
SHA512 14e2627305c2f8465da72d401e6b1fd92eafd46a775bb5feff62219b8306a417b7d8dee03ed5ee754e9464e1764f2c7252bed48d5797577f71deb346f8f66265
SSDEEP 98304:94K1aSBRkqjhbS6Cv2fGW+qE9ZsPWIRpYqHi52vKzPYb6vEHvmPceDCt8:9ZakvJCefGW+FgRubRgeMPdeX
TLSH
T1666633CF07A0A12FCF2B1FB7545F0947EEE32F290A62814C4AAD909D6C5375D6198B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VpnInstaller.exe
- Size 6.7MB
- SHA256 318b16bcf20c1fe089cf34941441a2908b159e3890b48b3fda7b49b0a2f7999e
- MD5 3ac52ca5386234239ae8a00de39db7fc
- SHA1 237a9e1926b2a8722fc8dd82fd46ef14631bca10
- SHA512 14e2627305c2f8465da72d401e6b1fd92eafd46a775bb5feff62219b8306a417b7d8dee03ed5ee754e9464e1764f2c7252bed48d5797577f71deb346f8f66265
- SSDEEP 98304:94K1aSBRkqjhbS6Cv2fGW+qE9ZsPWIRpYqHi52vKzPYb6vEHvmPceDCt8:9ZakvJCefGW+FgRubRgeMPdeX
- TLSH
  T1666633CF07A0A12FCF2B1FB7545F0947EEE32F290A62814C4AAD909D6C5375D6198B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence spyware stealer
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks for any installed AV software in registry
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 7ffc549e7f679a08c77fa230654b77cdffb3444296bb7c6b8b5769db374b61ee
- MD5 75e7351a0f836b8659e6f315683c29f7
- SHA1 66b733d1c978d68cadc245e7efbfcae32807429d
- SHA512 f03400798b07ccca5e12fa119a586ee9444deb0d2419aced24d93fd84a4702d66864a71b40a11b04b1dbe56e36481cd6a644aec0347bc82bc7375b27bc403fe4
- TLSH
  T17C71C56663A09FFED1A41330309E38176DDA703123BB66DACE3B761ABBE0081C835711
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/INetC.dll
- Size 21KB
- SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
- MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
- SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
- SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
- SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
- TLSH
  T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
- MD5 81e268e27dbbcadbf116b5a9402195ab
- SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
- SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
- TLSH
  T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/base64.dll
- Size 40KB
- SHA256 7e10ef2723a50b7346449f8bb39efab8a99e2815d33d311ecb8112734f91519d
- MD5 ac6fb776262b63562c00374392fe1c55
- SHA1 045dcad3edcd1c6865f5dea95ace35f4d9964b78
- SHA512 2c511c5f2bb265fd247e43c47046a3cddad2b72a0fd3b35fcb70ab53d7fbc070d36eadd93c279680306d30d6ef5730fcbfed01195a85761ae571e2d324416ed5
- SSDEEP 768:h0lTvjkgjp5vVBFTKnebbo1QiB9PfdkMClc8o4CJh1o:evAgbJTKnMo/dXY3ohp
- TLSH
  T130036D22349181F3E1AB82761595CB1F9F7EEB1403D218C38FF4694A6F256E1A53F24B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
- MD5 13bd8e89dc79004d85ab02626e08c3c5
- SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
- SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
- SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
- TLSH
  T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 70KB
- SHA256 8f80ef429ce7c8a1ac7958ab36ec177f732dc924d14b21230da045e5ed1b255a
- MD5 9c452d3cb1f2b06c16467849755cd724
- SHA1 35f2e9754e9dc226baa8b0cbf21db2b523248a73
- SHA512 438e406a18db363008776172e20f6422db71c5b1eaeb63f0a8100f05c5365f52ee177851c7710985b529e1b5fb2be2ac8142cc6e0ca08628054b6eabe063fea2
- SSDEEP 1536:8Z6GdfXw+kpgUfswHfQeMVYOsW+ocd3q8DsRUClo:8ZgGURzMVY73q8DUi
- TLSH
  T1EF635C10B2D0C8B1E1BE1E391434D6616A7E3D214FE48DAB3B99012E5F741D2AB36E67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsisXML.dll
- Size 12KB
- SHA256 77aa1a74a556f00f16baf9b94637fa997bd4085695ba81bf496223644e43e815
- MD5 9f3d5344e7ede1f41f99d8fc37fd01ad
- SHA1 d0322ce3ba30a924daa1c9e322846a3d8ccda878
- SHA512 2849b261b77fa2abf0d0efc7604ccce7f502d20a556eea9877cfe1cbc6d515d8fe41986943081629243b81987cddd54613ee01fc7859ae16eab57f6ca2cd4bfc
- SSDEEP 192:EWauH4FuPphUmX1VGsGN2kmQNJnm1ilWnE:EWasoMphljGs4NJoil2
- TLSH
  T1D242C8033EEAD8B7C94A0278AF977389D6B4630524810D06A3564F0B6F3199EFD7D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/registry.dll
- Size 24KB
- SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
- MD5 2b7007ed0262ca02ef69d8990815cbeb
- SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
- SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
- SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
- TLSH
  T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  App/fonts/ionicons.svg
- Size 326KB
- SHA256 a627d9068c1235d9b3c95c405eb6ecb64a290b159cf5e926c0d96d89b24cd5fc
- MD5 621bd386841f74e0053cb8e67f8a0604
- SHA1 3f1ca28fcb042d2bcc6ee6a4e3dd817e5132eeea
- SHA512 37c77eccaeca00e005cf5b7787ab52fb1a45c5a8fc0b9e176e5eaf12fc080089a0e634f8eeeb7fda2b55c83dcf6b7b6a40281bad0ed9f248968e8725e627b9ef
- SSDEEP 3072:VuNxDz4hYeM1hf0xiEcY3YP0SJZYF63bCGiN7XR/H2WnlhzvXrdPwRJrdfh2CUG0:VuNxDkfRIZYQ34N7ZHrPwVdfhgG5/MvJ
- TLSH
  T1FF64F428D8A65478CAEA03C18A7D1EE4473DC2DF1A2D3875596CA2B00E0FF6D579FB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  App/index.html
- Size 5KB
- SHA256 954e696f9ef29f1756d187852965d8736460887481aed0cd7134d997d1e32c85
- MD5 0ad729fcb114555b3a93951040ac03f9
- SHA1 baea1f70f9730ff0be86953dadd1bc53bec3164b
- SHA512 a6fd6675797f084312593c823a409efd244933aa5dc154f6ba82bb5c7435b27b469ab9efec60a54dbc99f3ac9f8288510ebf1fd05cfd15a8628e0528765da0ac
- SSDEEP 96:ZtUZXjcMVMa0B9s4BH3JfJYqJql6bCcd5IP2k2ylDHe:3U1jcn15JDl6Le
- TLSH
  T170C1AE509580212492B792B14D609B5EFFB3930782DA9221F7FC12DB1FF785AEC07AE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  App/js/vpn-1.0.0.min.js
- Size 314KB
- SHA256 b12538b1053afefca545732f429d944ceb6d84a786e6fcf68c20bbfff51de846
- MD5 e337f5790d7d1892802c27220d53f247
- SHA1 70d31ff02bbc55f91941c7588bd4f893e9f3cc8b
- SHA512 bfb4584ad5e29eb705829b6312d93ebb5ed633273e109bcb0b7c929814b59b63612c096cd1d3987f6979eabfea4356d4bc8947db8004a98934faf69256521e1d
- SSDEEP 6144:bp8UnCMeh/G6Wwz+CUHdQIrUM2a85M5GByQbwh9J3yDegYk/DkjaPM:bp8UnCXWwzgL/3xGS5
- TLSH
  T189645C0DB28034760BA31165781F621EB37714AC36498079A97DC4A93FF898DD277BED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  App/js/vpn-vendor-1.0.0.min.js
- Size 317KB
- SHA256 696393aa261c0980dac558ce58fc30e9806d8b64f65c28c572b282ebf2a04f56
- MD5 fd6679775b921878549ef80e6d9d59d3
- SHA1 fb89bc2eb33f47cc56b00630ea79818d61fd678d
- SHA512 66976a9b0002f1d32b6c7618a7a7c6ccbbc373ffc565415448428eb75fb60251b3b1934571b6bc725ec5ce456f5adaddfc994595cc3b1d87ef02ba3478ed7e34
- SSDEEP 3072:VGMY+N4J9ipUoGj4d2A/bFnQlnFjs/qDFY6appyX7onLjSfNWvQPQo2HxyF+xDc:VC+N42HGcdLJLc7oLO0j7Ru
- TLSH
  T1B76429CD72C2B02243A730B580AF540BF23A5999780D4854F278E8E67C79A5D927BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  App/views/directives/collect_diagnostic_data.html
- Size 3KB
- SHA256 605aa3bff8bfa2a2216bca5e310a6e37ed745825f48b617ab0ed7877d120621c
- MD5 2e362fd49a06ac58699d59af17cb6ff1
- SHA1 db10e0007e89d4260c9c72a157b3057b2cbf03b0
- SHA512 69f101ed6c5d8c13f84544fb69de029fe733d59ed2e1ed5b394609df397b30e98b9220f4f6e6bba33b1fab93be25dd8a0560216d84f527e9e9b9bb6ef262320c
- TLSH
  T18871E521D0F4181C9162B080B9605E9B3FE6474F938B5A70B6AC06A6AFCFCC7DA1784D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  App/views/directives/confirm_sent_data.html
- Size 3KB
- SHA256 cb68ac82bc79b0e9bc9111cae92732a46e3b429f0b28419f2f7e48105ee748fe
- MD5 7d4e206ef8e1cce1e69c559aebd81760
- SHA1 8ef4bb7007bc3649529913b67227ade68e8ed5d4
- SHA512 3499617c320b7e0ec7faa9d661f44c99ac90df2bb54ebd7cf5b6e1a48a979c11a396ed0e810b5bdbbd5fe89e4fbf3e560f89f5b50484df65c9189e19fac013ce
- TLSH
  T11C71F424C1C0151A4476E054DDA26BDFEF15030F934F8A947AAC17E37FAB8A6CA63848
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  App/views/directives/data_usage_popup.html
- Size 2KB
- SHA256 9d7d002bc2f12fb461ec1da765c1393fc7a4b31e97002c2c7ea3a78c89939923
- MD5 5bf528c5f84b3317958617377cda3825
- SHA1 a5eaee4e464a1f3514bcebe9998d7917e233f584
- SHA512 1e3c14df9ec9668d356d56db800ee238d419a86be536c8072430af9a47f39f04bec4eba39527c32cd6c3563c94b7baadf24dc99805b7b3e251749662ad999050
- TLSH
  T1ED51783050D1182A4073D1C37AAA9B5AFF958247C31E911173EC5B97DFFBC60E94B29A
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32