61deaeefcb24a9610fd41d23359ef6957f7b767f8d9d7181bab07225425cb55c

Sharing

Copy URL Twitter E-mail

General

Target
Norton Suite Executables.zip
Size 43.2MB
Sample260420-apxdcset4p
SHA256 61deaeefcb24a9610fd41d23359ef6957f7b767f8d9d7181bab07225425cb55c
MD5 71a20d46a98e15ac9e6567b83bf596d7
SHA1 fba4267ae91490b635f9b8a69f37c4e3254349fb
SHA512 70f81fea09d552ff9200f3a12a08b92b4679adc3ed0b23dcafbae1b4fb36fa53df747388a32c27288a50a8160e60e02a949f7f7040e7bc8d2d729f0f6f6a6f74
SSDEEP 786432:U3MexQhwHF2Kx6l+gM44n+tLwDz91famG7Nf0veJNmtT7Mo+od1TjthWR9cWhIRQ:VLqxEM4A+tLwLfam+56eJNq/TBVpwh+Q
TLSH
T128A733B4F36C9ED8C363523DEA996F2BE7C9DC244589F36B1C99D522C0856184E0B3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  Norton Suite Executables.zip
- Size 43.2MB
- SHA256 61deaeefcb24a9610fd41d23359ef6957f7b767f8d9d7181bab07225425cb55c
- MD5 71a20d46a98e15ac9e6567b83bf596d7
- SHA1 fba4267ae91490b635f9b8a69f37c4e3254349fb
- SHA512 70f81fea09d552ff9200f3a12a08b92b4679adc3ed0b23dcafbae1b4fb36fa53df747388a32c27288a50a8160e60e02a949f7f7040e7bc8d2d729f0f6f6a6f74
- SSDEEP 786432:U3MexQhwHF2Kx6l+gM44n+tLwDz91famG7Nf0veJNmtT7Mo+od1TjthWR9cWhIRQ:VLqxEM4A+tLwLfam+56eJNq/TBVpwh+Q
- TLSH
  T128A733B4F36C9ED8C363523DEA996F2BE7C9DC244589F36B1C99D522C0856184E0B3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  AvBugReport.exe
- Size 6.2MB
- SHA256 2b149f11ec969ce162463fc2991a1e18be3f2059efa3ff733b91a06e586e708a
- MD5 8ba000cc7232c7b4cc707b49e75a2d3a
- SHA1 3496dcd5615ae1a171e2ee83d66d3a88b9eec874
- SHA512 bb45e13ed9a5a50e19ce4efbf30e48600e82661f3543329593483f364ba8a84e3a628c1f6f698dfa5aae7704440bcc0f1aa91e048a7380f6d2476f334e60e799
- SSDEEP 98304:OcvpcloFoJ6EtRZpnugpmgK2re6rUE13:OcaS6xRZpnugpmgK2re6rn
- TLSH
  T1F8666C1EBA6E00E9C1BFE1788A47950BEAB17855033597DB66E18E550F13AF09F3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral3 behavioral4
- Target
  AvConsent.exe
- Size 646KB
- SHA256 04f9f7a27319854c10f61df31da295440970b36c4323cc8082218765aff2e105
- MD5 fbee4b0d7d3b33bd06855e911246a0fa
- SHA1 86507af59f5d32b090c9fad300dd6fa97450d97e
- SHA512 a28d337943b0a827b77f1830fa0dfa53289e35a35d967ea3299815e74f47147230882f2512ced17de11a7675764321f1b8b94824d8e8b3f0705a1b5553b10a24
- SSDEEP 12288:0/cFp/rafU2tCph0lhSMXlid9Ta0oMskQV:0UFIs2toh0lhSMXlm9Ta0o5kQV
- TLSH
  T1CEE47B9A7B9902E8C15BF47884574619EB727C204F6292CB67F0CA650FE36E05FBF601
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  AvDump.exe
- Size 3.8MB
- SHA256 843cc3d2168484e2a44f37ebd171a32759aac7c2a77767e2c0988c1423cc2010
- MD5 ee19d1749bc40499ecbd956eb6e2c830
- SHA1 302ef73821c71784767a325509a0d44fbf2045ea
- SHA512 453b5d17cb04c096b007197fb2c0b155c863b689c2732e5706b98a76eb12dd41bc87305d18dd33836a6735bcbc5bc7e75def2cb9c06c77878d780aa293c9a982
- SSDEEP 49152:qbkA1wsT7W1vAQ4Zmn3OQP5tdZIfsT1lmvKnp78h0GCl2StNtMteAlJv+D0Cc1yR:xA63btr1C
- TLSH
  T167066B4EBA2D00E9C1BEE17C8A87950BEB713895477597CB66E08E150F53AF09E7E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  AvEmUpdate.exe
- Size 5.5MB
- SHA256 8eb6170fa73ee93a8ea393101eee234b8d6af5aeae3fc735adce933dac241b76
- MD5 0617819d2b47c6b8e885d408dfe87d21
- SHA1 d1d439d9b2075f8e9020845ec36745fa89f61b80
- SHA512 23a1d4538fecb24f408d79162655bae0dd7707742ddcd68a835aa29e89f08a7eb1004d5fa6a0b1fbc5610930a813f0de6bcb3ce816624275492157b646e06161
- SSDEEP 49152:K2dnHZl4y/U4zbCyhhqU+h58XCYJfmyk3Wd8etGdgJELVfIKrxPim98WVTgH0JH1:vUCCyhhjL7xuzcNnndq
- TLSH
  T1E9467C1E7A6D00E9C1BFE1788A97950AEFB13895033997DB66E08E150F53AF05E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Checks for any installed AV software in registry
behavioral10 behavioral9
- Target
  AvLaunch.exe
- Size 995KB
- SHA256 dc9cdfcd4a52b95828f53274f4751f97e928aeffe6d3851a964dea1c034e4f5f
- MD5 bfb4b83df31a42afa6cd924564902078
- SHA1 3af4d6063c4c2246d087018c6b1da2781c6b4286
- SHA512 f04c0b2465af26e62a28be2f61ce21bc797215926f1fecc1d4a2570ced1cdbe5c6711d4ef8cbd639d2a0958de9740d1a216fbd79984eaca414d81d27350e982a
- SSDEEP 12288:i0gSoF7aA9VkKXEu5n/4jph0lhSMXliwfJYrpWcfJ+VjV:iJ7a0VkKXEc/4Vh0lhSMXlPhYrB8VjV
- TLSH
  T10D255B9EBA1C00D8C5BEE0794967950DEB717C960B2196C7A6F0CE193FA79E01E7E301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  NortonSvc.exe
- Size 1016KB
- SHA256 b3311bcf0905ec359e1d93a09bfacf0a1f9a2cc1b3ab7627bfd0e5bcb9114e09
- MD5 a5fdeb1672449657be3aeeec4c7d99d6
- SHA1 d022b020ed33176a678d377dd4f9853a54f3cac5
- SHA512 caa8173be60d6af54ceefef1aed4278e9b6aced96d386cccf896c5a9829b42aff6021a380a4ff617413cb2d3049c8ceaa0e2d584bf30ffa8bf5bcd575609a2fc
- SSDEEP 24576:4IQ5D6yLjqR42vGZM0Yu2sXWh0lhSMXlmPMEjhmP5LjV:bQgGMoqsXjK
- TLSH
  T10A257B4E7B9801E8D0BEE4B48963550AEB717C950F2592DB66E0DE152FE3AF45E3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  NortonUI.exe
- Size 21.5MB
- SHA256 c3bc51c3331b775ec25be8aa9f134e58659fc23840d7dd73170c52df730e643d
- MD5 a1e70ce1a3a57c9f8c39a7eada6ecbe9
- SHA1 89f43720b9ede5dee2d817f783fe3006111fc0db
- SHA512 4ed6431beb65e69d6cd2c5cd18e7fd94dace030498a6f141f6db7fdbe77f7a5723a503fc9b2eff27ec9806118b6c4f9546b21267810474cf0733c0d257810e9e
- SSDEEP 393216:dgyAHupB8mvjD0jIiqtIBoZ4c/XbQqGTyqsWgZ5:uV2h
- TLSH
  T1BA37390EBA6901E0C1EED4BC8657652ADF307CA107289BDB6DE1BD560FA79F15E39300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  OobeUtil.exe
- Size 1.3MB
- SHA256 192ac38820198ca769e21a7037477f49b61fa1130e3ede97297c707b142255d4
- MD5 67495f6c65877fd19d8040061afa4073
- SHA1 ba94bec6da3287f19ab7aa7a81f476b4c0d89f7b
- SHA512 4fb4cda96bb63bdc93b20308fa548758d3df9d977591095bd76c66b901553cfc98fb97a301f3a80c404b266494bcbb6dbb6a99a6d8cf08938a1e52a4e7904cad
- SSDEEP 24576:8Vgmr8u3OQX/Ms5NvEXNKo84VMh0lhSMXlhH32zn26R3zV:agmY94/35Gx3
- TLSH
  T165555B1E7A5C40E8C6BED0798557990EEEB13851037597EBA6E8CE091F27AF15E3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  RegSvr.exe
- Size 4.3MB
- SHA256 efa891940139a84a4b83cf8e5e407cc1074cc2630d7c22101d7e6e4cc563f0e2
- MD5 388ba93e3f52a99b88234595b3767199
- SHA1 09567c11947c9a60aa011b1dce4cb408b7c73b1d
- SHA512 7594ffe4d47902eeb48b428aacbb41c6c78e21401789306b3212b33033636ab6d7369b2edcf9cadcb6ac9dcdd068b9cd7c7dbc2cfefe8043ea2395bdd84116b9
- SSDEEP 49152:Q2dwHwl4s80tl/vzCKUeTE0U+ubxfr+lZIUACrzYsXP3NlrtehtNt1+bcTy1cy2b:NE0UXpOy
- TLSH
  T1D0266C0E7A2D00E9C1BFD13D86A7550AEA717CD94335A3EB69E18E150F53AF09E7A700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  SetupInf.exe
- Size 4.4MB
- SHA256 bca6964f30e7bae45a64562a63152ea912110ac8b9492d9d7d4d210ebbabf8a2
- MD5 be2c01e9cf90a0e87fa4c0aae9945fa9
- SHA1 3bf423816d3e9092af7919df3cf622dd68c66084
- SHA512 bdc969a25570379f4b95e1189e80109a87e45d69a6ae0f5167c544f21c8037fa6dcee6aebf5c056eb8c66a1e2d8c58660d686d6b92c9a9f442cf75c7687ad2f0
- SSDEEP 49152:I2dRHjl4y1Mfi3pPX4mgBxDtv1h1QW6CDxJroKGvoq1xtkAgtMtetu+bGcE0Oy+h:b/MHtNIgq
- TLSH
  T154266C0E7A6D00F9C1BFD17D95A7541AEA717C994339E2EB56E18E050F13AF09E3AB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Checks for any installed AV software in registry
behavioral20 behavioral21
- Target
  SupportTool.exe
- Size 11.8MB
- SHA256 ee9641c862b67bfa0e07c53e014b6703dbf6d5ab29d81c2d7c0947f5ff9f03a8
- MD5 aae34bf23935b92fa20677308674e19f
- SHA1 a69e676a9e4a4068da430972665abf0baf20a663
- SHA512 8d4d4d8894f9ec085f796eb076bcf0b1327eb3bb0dad18ee72fbcb8c5cbef35204c364a36042ed0feeaf276efd72afd485824c780535214ea2cd6ce6043128a7
- SSDEEP 196608:b7iDQPCRrzXoeE7Al2gQGNdRATUwRICBRkNLDbd:b7iD1RXXoeE7Al2gQkRATUwRICBRkN/
- TLSH
  T159C69E1EB6A900E8C1BFD17C8A5B8906EBB23855033597DB15E089562F63FF49E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  VisthAux.exe
- Size 529KB
- SHA256 8bcaa503ea86175c8ec6ce340d31f96d9833ca47b3b2fd2c2730c948dd3fd5fd
- MD5 c09c509ba8865a8e8af37b813fc6f462
- SHA1 921ea03764222c1e361f192f26f87cea12868645
- SHA512 f66da59138cbf02f8da627db214d6fbf9825406dea18f5d33c66065ccb7ace62c57afdee4b3efd5e022a92f699974d1782ce2da60521a34b109301f1bacf04dc
- SSDEEP 12288:PiZJUGEqTPeph0lhSMXlirOsMjxle0BUV:PdGxch0lhSMXlkOsMjHBUV
- TLSH
  T107B47B967B9954E8D06BB87444674609EB327C204F2293DB62B0F9391FF35E06EBE701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  VpnSvc.exe
- Size 14.3MB
- SHA256 e212fd6e52f6e663ceeeaefd470de900126c869c07bb3a2da81e88c3e8d585df
- MD5 bfa53f3c859d967105d60722d1288a5b
- SHA1 efae1bf73b4cc9957b8dfb50472901889a81b12e
- SHA512 45a3fa2430fa2907db71f83f126eadd338340818092cd197c95b53fd0d2989fda89a838dd6f9e2b9c0ba5a9f84cca6a518ad6ffc650b292d048b6b698a90ee21
- SSDEEP 98304:LrajNsjvhFlNyLziwSaKlFhrS9j3rug1CqDHCShNkvCagvBkQAe:nahWZHNyLzi3aK9rS9j3rug1Cq7s6d
- TLSH
  T12EE66C1E7A9D01E5C1BED1799647650FEE7178850339E7DB6AE08E060F23AF09E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  afwServ.exe
- Size 2.6MB
- SHA256 31ee1cc388c7372006f37bc30e656e3478cce5fb84233b8eac43ed1008bbcabd
- MD5 1a224d1dc23d886640d160d8d8846c84
- SHA1 716020eb010c8f3f879fba76483e4a1fb2ebac8e
- SHA512 bda81ae2c69b0df8f68c7e28e3338bdabfb17f38de4e52232b401b70ef4e3c9e18bc83ea44b89e24687e3c7ffaad1464caac40c641bf0cd0cc5395c52184982a
- SSDEEP 24576:Aw5AlQi/Si6trQbn9o65ITaqPOra6OMzEVau9O9bnPs4sNRw2h0lhSMXlcYkWnSn:YlQiai6trQBo6SdO5oDcTGwDXkN7/P
- TLSH
  T14BC55B5EBA6900E5C1AEF0788547640AEF713C850B3996EB66E0CE550FE79F09E7E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  ashCmd.exe
- Size 755KB
- SHA256 f46b6c80c6f616df7af147dd8fc703cfcab615e5b7c7edf9943aa757108529f1
- MD5 a6aca920a459ac6671277b666247f8d1
- SHA1 c54b92bc3f2563a7f0a22b226ff847fdf2cc1a04
- SHA512 c2bfa8b7dfa9c837e69108ad1888878a5266bcf99d7b784726665884e3835f595d8096e0c80eb0850b7838ce67083cd30ca4ecafae22e1a0d63f411a80448e2e
- SSDEEP 12288:RC+MuC49uLmJnUIVdph0lhSMXli2Y23opovmV:RCdM9umnUs/h0lhSMXldY23opovmV
- TLSH
  T1C4F4AD1B775C13E9E16EC1B88853851AFA7278A5036697DB26E0CD560F23AF02F3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  ashQuick.exe
- Size 551KB
- SHA256 baca8d98b504c71d0f4280fd5abdd474d7605687df7eecb3a278ebe68bf9ba7f
- MD5 c08ccbdf4a065f7d0daa9ac5d0be6d19
- SHA1 77bc6bd24aa9f9763e9d198c2ca84567ef1cb6e1
- SHA512 7690a20c62cb95b9fcd857f27c6eba208a2c499fec72a9db33a6517f1fcfeaf3460a66a72f8b915f857c7f2beaa71f50f9d6dd70c096da6a039d4038f91daa8d
- SSDEEP 12288:RW3C821tTnZ89ph0lhSMXliXuNd77JpGJV:RWj21Fn6fh0lhSMXlkuNd77PGJV
- TLSH
  T1D1C46B9A3B8504E8E06BB87844634609EB717C204F6293DB62B5F9351FF36E16DBE701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Writes to the Master Boot Record (MBR)

Checks for any installed AV software in registry

Checks for any installed AV software in registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32