834fa3816e364bd59aa98a70bdaacde8922d414e5aa151396825592ce295facb

Sharing

Copy URL Twitter E-mail

General

Target
Norton Suite dlls.zip
Size 178.1MB
Sample260420-ds91eabz3y
SHA256 834fa3816e364bd59aa98a70bdaacde8922d414e5aa151396825592ce295facb
MD5 8e8a96055786c043e0a7c272c912f980
SHA1 1bc1d8cd405aa956eb6b27033f962e49e5ad7cab
SHA512 d5da81a22b2a32c26e6472ea925a3e1df71e2369e68f96dc8238ebd0b22e51e83cc520f7ea1c05ac71dc8e02a554ca041abcb4d3e8e5c6d74e82b9c15cb6607a
SSDEEP 3145728:lOW66v1WN1IQFqPymnf9GTQdIqLgU4HygLoZzufXA3OfGqcZUPO1sxQ6ByODgSkZ:ga1WUQAPDnfoTIIqLr6ygLnXA3hUPO1T
TLSH
T10098339DC1C46994E60F5470CFA9D1BBAB131A9B5E2738810AAF1755DC8F827806FCCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Norton Suite dlls.zip
- Size 178.1MB
- SHA256 834fa3816e364bd59aa98a70bdaacde8922d414e5aa151396825592ce295facb
- MD5 8e8a96055786c043e0a7c272c912f980
- SHA1 1bc1d8cd405aa956eb6b27033f962e49e5ad7cab
- SHA512 d5da81a22b2a32c26e6472ea925a3e1df71e2369e68f96dc8238ebd0b22e51e83cc520f7ea1c05ac71dc8e02a554ca041abcb4d3e8e5c6d74e82b9c15cb6607a
- SSDEEP 3145728:lOW66v1WN1IQFqPymnf9GTQdIqLgU4HygLoZzufXA3OfGqcZUPO1sxQ6ByODgSkZ:ga1WUQAPDnfoTIIqLr6ygLnXA3hUPO1T
- TLSH
  T10098339DC1C46994E60F5470CFA9D1BBAB131A9B5E2738810AAF1755DC8F827806FCCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  AavmRpch.dll
- Size 757KB
- SHA256 a01069cbe104864471fbe910800a237fb24f9f12caedae2cbc51243a8d5c80db
- MD5 92607dff3068383bee133b3d72d0cd79
- SHA1 ac07f900e7b5c739ce73727b389d83d5488da781
- SHA512 119ed127393fdfd1270812c3e8ceb268a38a8daa6552831d45612e7ed98076b4f29bcb5ac45cae6258917f2477fa7b881238e759b756fc6bae6929daeca2aec8
- SSDEEP 12288:ku3KtxVRcDOgWGph0lhSMXliHoSFvw53+AHyCbGDwfsdmMualsMtqV:kjvejh0lhSMXl4oSFvw53+AHyCbGDwnJ
- TLSH
  T1FBF47B3ABE6D04A9C0AFD1BA85975519FFB27860434193CBA6D0CE254F536E46F3EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ArPotEx32.dll
- Size 128KB
- SHA256 41dc21464c351a6bd5c85344bae2413f594f5dd34c9883121e167af8ca7fab02
- MD5 3393458e8e55510a21e86a75fcfe3aa4
- SHA1 c66d5cbb9fe3779add2ae0fe9c05e9bc4de4b463
- SHA512 4adb7ba5a395f908432f154d729b5181f0047d9eb50649313534de194bf4a106e747b9e9b00b28dcd174e78f9b1df521d757649286e4a80822aa4f6a8ab14d34
- SSDEEP 3072:4qLjvXgE33rcrcme3Sgks1+MZvPuJPQIukt4Cu621lvM0ZCUV:vX93mc5iu11n9jlvM0oUV
- TLSH
  T19AD36C05F5D09070EABE85BB49B865B4473E79A0DBB18ED7256A24BC4F382C1AD30F17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ArPotEx64.dll
- Size 518KB
- SHA256 1e88a7fe08a6a59eb196f866bb374188c9cba21b7110fdd9cc68485f937f3f98
- MD5 933fbcb76a75448976bb080d573c8c38
- SHA1 44d65ef1131168f56233822eb3f47e79b1150c18
- SHA512 56a95163b567dbcc6673752e4824d65e346321eb596c51acbd75c66af88e10b60015ccf98ff4afd2f0eb9f3bcc9b8ebae2c47ddd1f256473b233d4693eb65a30
- SSDEEP 6144:X26D6fJUhLZXh5KwnznfxuzgabA3zyMdQuen4vvACsaHokV:0fJUhLZewnznfxuzgKYvQB4vvckV
- TLSH
  T194B46C17A3A503F1E4B7D239C9538A56FAB6F8540724A7C703E455AA2F237E09A3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  CommChannel.dll
- Size 1.6MB
- SHA256 3c2d3c0021a5eb258bcde5de3459f86b5f9a864e9bfddc2230456d9d105b2539
- MD5 f7fa934bae8c8a249ef5820e19f26f29
- SHA1 0566469ed4ae178a7cd3bd3ee88924f51f7ee280
- SHA512 237004951bcb43798eb6a789c1291a27b508ca8ec542166d76f50538f53edff9b8d96d85cc2839370ae77d1189c7680c4d06d7bbcd6d374c318b408eb40b8110
- SSDEEP 24576:IhUQ6D7tSQ73vdshl9PTQFE5BMGgNXsu7irAM0tnPsh0lhSMXlQyVYE2COtBDeSc:ISQ6D7kQjYF0FE5BMGgNXsuCs5xY
- TLSH
  T1BA757C1B7AA840A5C5EFC078C587961BEAF170611B2197CB66E0CE5A1F53BE16F3E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  CommonRes.dll
- Size 1.6MB
- SHA256 b2b8d1bc901908098b941eb2ad5cdafc6e6a2afe100d96fbc4a695a4b18df0f3
- MD5 8c378baf8b4904c97fc19c237abd8359
- SHA1 89a075019c6e84b64eb281b5b8e8697028f09249
- SHA512 9ef61c4e90eb547d35791f988866f97ca6b7ae7f5269c3ebc445b6b12f3c434acd15dc1da0eef109f070fde26ae7fa4f32d7f47e28b1ed98f75307dcec98b94e
- SSDEEP 24576:Xw4xw0Y4X50ToBj0Mklc2UnWXMgiHMEVAbV:Hjp0ToBjXr2rMgiHMEV
- TLSH
  T17C75E05EFAC0780AF27BA1320BF74245DB27548782436B3939CD619F9FB05619E234E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  HTMLayout.dll
- Size 4.0MB
- SHA256 c455012057e9621a8e65c8336e4b950e963efa2594b6352f1153bf71f0754644
- MD5 85c32eb176cdc978aca928a258ac67d7
- SHA1 df65a8d3d154b0b6f98eb49f19e911bbe4d7d124
- SHA512 e0ad4e4716cf43bd78489cfb7946db99ce42312dc2f94314b4d6492df4f74c4cbd15cdb55ab704635a4098736ed390716a59eb63f3ed7b8e5c02cc6d2e8c58f6
- SSDEEP 49152:xOwJUg4x8wunDKG1KDvOa4x1AanEpWDAbXU0CQWbpw6U7lHQ4kMtVuh6SGRUSrqf:xugRSk9QW9w9xMQvrqN4Oh
- TLSH
  T1EE167C067AAD00B5C5AED0388697950FEEB13856032897DB66E58E1E1F37BF01E7E314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  afwCoreClient.dll
- Size 829KB
- SHA256 79ff0d05baefc4c8c2ea3d396ca926decd846dbd0f071c7717f3fc389aad6d86
- MD5 935ab316e77fe3e589342aa61f086b70
- SHA1 5b0059093ec2846fb2cdba85d7c9c60690d3caa8
- SHA512 6d1279b4d576f1dd87ae9cb9dc141212e5326bb5d76595c80ffb9bc5d84cb59d5b2a40290ec4f33ed15bb8c62ccbeb11003034ca5a66d10311aa717b9c664a2e
- SSDEEP 24576:/GgIfFUQ8Tmy1oh0lhSMXl/sPJyogrbXV:hIK5zU
- TLSH
  T11F059D1EBBAC00A5D4BED0798997950AFE72745103559BCB67E0CE6A1F63AF02D3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  afwRpc.dll
- Size 420KB
- SHA256 3726789aa7edf8cbc04e90eae34fb4a7800babcff23a219ea997dcf8d79be289
- MD5 3cb1e67a0d09f74b51eb4ff6fb7db443
- SHA1 706cc0df7a5caa27bcddf4d2302b8b233ff17a9c
- SHA512 4d31e5e4007c66c47551e90d410c00fcb7abf91eeac56abdf190ac19fc4c3d920857faf6bd7b4cd6b4fb85398f8fb0849fb98d59b713b1a80968544ba4103ec3
- SSDEEP 12288:tc0KDn3F2ph0lhSMXliqvzEtznckQR7V:ipVch0lhSMXlrzgzncDR7V
- TLSH
  T19D949E1BF79880E5E15FD178487B4A0AFA3274A9434193DB27F4DA261F636E12E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  anen.dll
- Size 2.3MB
- SHA256 d4f1de74fb3d52e447f72a17cd39c14e1aba140c18112544339b05d18c5206ec
- MD5 7dbde5551a4ee07ef30b09c1a20d11ed
- SHA1 2995e6f0d49ddf1597e25355cbb8b0b9328b792b
- SHA512 57bcc2cd70212f4778232930cf24c2bbded37078a4b0320db27cc50c70bdd8ee982396f690312c77fc0791bc365dc453834d435d27dccbd614f7e6de75442381
- SSDEEP 49152:lG1y9zLtcRfW5MZd+GOZwLDvjxjtHl0xFEq:lLzzWZd+GOwLDvjxEFEq
- TLSH
  T1DDB57C2B7AAC00E5C5AEC07C85979A0BEAB17451032597DB36E5CE591F23BF12E3E341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  ashBase.dll
- Size 952KB
- SHA256 1265e742fa83a7c105fbbf127804f0ee060817a42dd3487c43919e88e88458ac
- MD5 98d8af3d9b3f0daafd31be7698e32f6b
- SHA1 7463e61aebc71ffe475bc45ebf81cf58b16fe76f
- SHA512 12ca574a3bb9b30a1f76a6fe134ee76d1b6adff5320f621d9f82c89e7bb5ef16dc50ffbad2d3a71c8f65b02ae77fbc62a54fb3842ecac1b2dac720011a676cdb
- SSDEEP 24576:AogagbfK/ckAEh0lhSMXlUkgkAbkq+o6V:ngFCG7gv
- TLSH
  T1F2258D1EBB9841E4D5BEC0788A67551AEA7178DA033197DB67E0CE453F27AF05A3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  ashServ.dll
- Size 25.0MB
- SHA256 c3ce3a26517554c01cf761bef09ecfaf739b15d7c3a2047e1f8b2c9de94cc3be
- MD5 5598b2197d4f978a3d5efc53cf15c677
- SHA1 383c81e84681b9c7431342fd234dfd4072129959
- SHA512 9bf5e28d3b348114d27c7c23477c516799acd21e6cf0c7488dfd7f514c2f6d2163a10f75a1acb3357f936b41eae71f8438f69e7f2d10c7b34fa7af4eaf6e04ea
- SSDEEP 393216:Q/fqcuY5A4Km/lsquHet2Wh+ROH2uZeUxkxtHv:mfqq6HO8tH
- TLSH
  T18E476B2EBA6D01E5C1FED178C647551BEE727891033997DBAAE18E450F13AF09E3A700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  ashShell.dll
- Size 4.1MB
- SHA256 609e4f26ebd0669619e7703c8760c5c8b697663a64201405fff6e647a903b5d6
- MD5 5e92a71cdc4c9318181959131532846b
- SHA1 4af119e4c30f5e971ee43c1070b8767ce1bdc067
- SHA512 907bd8713ce9e9b2feff164d1706625ea3304ce165605ff6a80c11a8d713d278b964ac19aa24752064ad983082e2d2fad7086b1527df2bc3b6c97a93458e89fe
- SSDEEP 49152:36Cr8XAqbWlQYOHF1egJhbmINInse9HAUjmKDD1as+w+lrtNtMtefdJ5Wq+cToJ5:idRHFiI
- TLSH
  T155167D1E7B2D00A6C1BFD17DCA569416EE713C8A4335A2DB5AE1DE150F13AF09E7AB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  ashTask.dll
- Size 1.3MB
- SHA256 9e7c35ae143c484f1b56dafdf0696a6c44e0b3b02814f809ae07cd477269fd3c
- MD5 87ad4edd34c7a787ed78fe57d91ecb10
- SHA1 8cac818189c756f84df4e508582a1b744aa89bca
- SHA512 89c63cff9cd21344b0394d60a639f1888f9197bfa611adbba7b8229368b3f91b08aa93def36cb7e5fd8a3ed4ec6e59a5fe1211dabd97418f8b9db4c2317bfe58
- SSDEEP 24576:d4ZXKGb2lQqyO0Z7Wr+t5Vdkcfgh0lhSMXloNntsFqvasfn5V:WZXKK2+PK+t5ryniFwf
- TLSH
  T109558C0A7B6D40B4D6BED0788997980AEE7278450375A2EB67E8CD051F63FF15A3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  aswAMSI.dll
- Size 984KB
- SHA256 4f762c665dc02b317ab4ecbfb6d9bbbdf2a9b73631cc1225688bc6f3c6498865
- MD5 2c287fd0558b7bddeac11ea4e5cb892c
- SHA1 9ffff9a07c5fd215c163915ad1569c7f6830ee3e
- SHA512 77800d0eb7376f2e9e96cbaee3d1168569ed518ce32fec0e69d5a61b2dc91f3b7dbe200c6d4058571acfeec1674f58eaf6c9663373794ba145ecceb1d8e3d5da
- SSDEEP 24576:Ow0WuhtzpBt6rbYl1PJcVR+th0lhSMXlOytJOcV:OLZt7t6Hg1PSvZbt
- TLSH
  T116259E0BB79C40B9D4BEC1B9896B590AEE727896036157CB26E0DE151F27BE05F3E301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence privilege_escalation spyware
- Checks for any installed AV software in registry
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral29 behavioral30
- Target
  aswAux.dll
- Size 1014KB
- SHA256 328989a58cc6dcd137e5f00e1b09f5f100b369f1da03b495593389d0430b9ea4
- MD5 ea5cd0cd7779e3a9422fbcb975bd58ba
- SHA1 bfc2a8cbc0a3693ef445fbed87341bd274d09382
- SHA512 d371a544ec4069ab7a6c87c3c9c0e3b9f2b41cadacfed10eeeef71bd9e3816e9016f76700d8309363a29b7ec2678240ba2e04ba91957d150c01a4bef7582d210
- SSDEEP 24576:Cqrf+gF65F77qF2HvNiew3IfnZaVoU6xSV:Cqrf+gF6D77qF2PJiIfnYV
- TLSH
  T12725075A765CC376C5ABC07888578F2AEEBC30560F2186CB25939A1DCF13BE4593960F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks for any installed AV software in registry

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32