88dbdcc09677a2f94a70bb55d701911d539e4070dd786fb3483a94e1bc2217b8

Sharing

Copy URL Twitter E-mail

General

Target
RvUnnstlr-Pr-v545-sft.rar
Size 21.1MB
Sample260429-l4869aev9k
SHA256 88dbdcc09677a2f94a70bb55d701911d539e4070dd786fb3483a94e1bc2217b8
MD5 56d023f5cd013271e27ea75f09e024c7
SHA1 177c39d279514f6fc9fbd3bc93658c165de95fff
SHA512 4627eed33f09f9bbf11f001089372611507bfad22125663af888d5d3bb772b941b3ab83e824f58cb54980bd8f19c8e4206267a5c4508c72fea3c6b261213deef
SSDEEP 393216:/Ok0MJB2EaIz4T+Qewub3SZ2YlIsUBsbRK9wMvw+RVxZoVi6T20T8kIzOcJOrg17:/X0MD0ItQenbk/dFvMY0roriUkOrg1l1
TLSH
T1462733624DC4BBDFFE525EFB8F1B5F08B64D1BA88052F627614906E2B012656C83D43B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Revo.Uninstaller.Pro.v5.4.5/Crear_portable.cmd
- Size 193B
- SHA256 dfdcbce7befd5416c8375b75b3a5556260f84d351515c22051ed4dcafde7ecdb
- MD5 e2ad73cdddda9be02f173e7c00d9bfe4
- SHA1 e608a071d169e77bc1f951171b61342ec3555912
- SHA512 b36c47219e84f0cbfbcf97dc89e5bc03c5cd518adbfc05228c585839036c5717fef29b53d61c3235a3c9c1a20d26fe955375c5306e5b9501bbc7da107263aee6
- TLSH
  T16AC080117320D990DCD64D491557845D3861319315804D5078DF415277995CE742AED6
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Revo.Uninstaller.Pro.v5.4.5/Revo.Uninstaller.Pro.v5.4.5.exe
- Size 21.1MB
- SHA256 e5d67f902f50caaf4b0fc60d765ae7dce2d2b87ade0e63fe740291b1ad25d298
- MD5 f0fe78ee5bdbae4d7da362c7c1d23d5c
- SHA1 d4270a0b1c39c3dc510d1257a6b30a72caacc31c
- SHA512 72aa4ce8754c1f8f13408fc921e0ee2a332a7fe1cb3079cb698152f948d90af3897c0dd99a1ba6f9ff2e5e3426eea23b72054c8292d232f6c4f630e6154dbf21
- SSDEEP 393216:fOk0MJB2EaIz4T+Qewub3SZ2YlIsUBsbRK9wMvw+RVxZoVi6T20T8kIzOcJOrg16:fX0MD0ItQenbk/dFvMY0roriUkOrg1lA
- TLSH
  T1F32733624DC4BB9FFE525EFB8F5B5F08B64D1FA88012F627614906E2B012562C93D43B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  $EXEDIR/RevoUninstallerProPortable/x64/RUExt.dll
- Size 188KB
- SHA256 46d1b809e2b76858182de1efa1e71fd2bc30767d2bd94322b36937ec81ab7fe2
- MD5 da34eb78000e53cbce43a5e58525dbb7
- SHA1 adfe7061495bae245ae5d4e7b7cbf4c4f616d6c8
- SHA512 dfd7f2f7bf5d5a6a233c93536d1011a2fe305360cfb3775d94f01651392e02d52df6a83a8344da64d990eaae27c11c121500540620f57f02aa7de0f20bdb5b42
- SSDEEP 3072:xoEsHmpaBhl5TMNL1NEu0IzInds+oUBUoujjwu3nbzoSSm6b:x2HmiXwLrE3MAejN3u
- TLSH
  T1AB143847B6A440BBE137863589530A06E7727C912B609BDF1368537A1F737C0AE3BB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Modifies system executable filetype association
  persistence
behavioral5 behavioral6
- Target
  $EXEDIR/RevoUninstallerProPortable/x64/RUPPrestore.cmd
- Size 4KB
- SHA256 b61c15d6926238656afcfc2a819223cc61d89a9316c40e85edf033db789bd7fe
- MD5 23c9fa1f20916f006c3bed76d62d965d
- SHA1 23c4d4ec3b1d01355458c8ea74fdf4b516659326
- SHA512 738e10fcaf659cba93167a2e83eb822fbd35011d92311d1b1688d8f4c481d8676d0ae322086ed254108236425e13511c3cddc2a88cdd003f1fd0976ed4c1ce3d
- SSDEEP 96:vFro3r0Y28YA6VFTiy15ggMfb0XP6odMfP0ZSb7WSsHPiBOsHP0KWZ3ofnW+0:vh2RZYAggg0MJ0f7aaFl/S
- TLSH
  T1DCA12269A24C2D7AC5923E6976F406F2113FD6703D36104ABC6C689CBB4239942F45CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $EXEDIR/RevoUninstallerProPortable/x64/RevoAppBar.exe
- Size 9.3MB
- SHA256 ad78267fee608646f2ebd2c5974628fc799bd798b7b74b8f3e70e450ede39dac
- MD5 8e675c851ae424cbde39764acbde479f
- SHA1 fce2d4f6246dafa4d277c21b687aa8fcaddabea7
- SHA512 fdd96731c761b622d32a43eea21da6d64927c690c90f4261117da64f7c1379d4105c164241e836e84821347afa1c4841405661ffb409e2d7de5f897bb5cb2f79
- SSDEEP 98304:GkAoBAF03JI4Dv1yicUZ2BDk53dCWA0p/5chEuuZkJaI:GkASZYHBI53dehbaI
- TLSH
  T12DA6D6B29C9689CCDA6CB7B1CF1D0EEEDAA5AC166BD0452F81243C449E729C1CD3C25D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $EXEDIR/RevoUninstallerProPortable/x64/RevoCmd.exe
- Size 186KB
- SHA256 2e12259943cc0d2ed09081904cfbad21b5a96f83d4190abdd6d856aee4b9782c
- MD5 35937f4ae4d6d19fbc4081b6d7099167
- SHA1 1dd46478dcbe9d27cce7dd9132cedebb406f54c1
- SHA512 0af85246730c9f4b1b829f3441f71adfa3591f1416e947006a5a007a5fee9fcfb50b5e9cc4b660eea94e778a48b5b24db04cc6283b1944afc2074c1f27d51100
- SSDEEP 3072:XS0+N6jJr3YD3phrKByiY11R/Duks5/wqqpo6CzSMPGeSbrqtZIxu:XnO7XI3u/ykC6EX3WrqR
- TLSH
  T13D147C56B29424F4E1779639C8912946F77678221B70DBCF0368837A1F337919E3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral11 behavioral12
- Target
  $EXEDIR/RevoUninstallerProPortable/x64/RevoSrp.exe
- Size 51KB
- SHA256 8b94af60bb58bc1629edb3b4f6a86ccff5769bb9b96d8826f06686af2d7fc55f
- MD5 f5116556007dbf3fef5fb13f8a0ef18d
- SHA1 dae322d2c8675cb39fc96a44acf39d8f9445383c
- SHA512 3e8541586719ac7eb9b7cdb7f20ae78c9637031b717fb1ecf5fc50a02c0f636f015e70dedc2ed1a95fff9b0059063d4f0f19bfbc683dcf9d4d99a8c0c1039b3b
- SSDEEP 768:WnPj8ZtfjZ/26C/11BV4/eYiv37H/35o9lsEpYi6s4OYih2E4:WnQTjZI1P5LHBo9ll76sz7hO
- TLSH
  T1FE336C138BF40898E5AA9375AAF14D2AEEB178465B60D7CF0351C0290F717C07DBB7A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  $EXEDIR/RevoUninstallerProPortable/x64/RevoUnPro.exe
- Size 24.4MB
- SHA256 4787d0d805c2cfd3322b2d751c4c76535a4ecb4a1887d1f61586a46fe93ea1fb
- MD5 337e96cf870372de27e6d5c2d9f717cd
- SHA1 fa67e8d768833448f24e535cdc3b7b98097e7a6c
- SHA512 8d5f1da5db9720fd3dc85883e36b629aa79b4e8bf5e5201ffdf5902e28c0e2f57c0ddeb2afef6853093a2b9c70c5a45c1e526725906d0e41d3629bfccd38d54c
- SSDEEP 196608:HBypPgQrqm83vL7efCpkFgfhvuPTehbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIF:H4pPgQrqm8/L7efwiXqhlqPWpyR1pVD
- TLSH
  T11C474A72E94184DCD92DA671CE1D89FDDEB27C26AFA089AF50143C11EEB32D09D3D249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral15 behavioral16
- Target
  $EXEDIR/RevoUninstallerProPortable/x64/Vista/revoflt.sys
- Size 39KB
- SHA256 23cb784547268cf775636b07cac4c00b962fd10a7f9144d5d5886a9166919bba
- MD5 498c3d4d44382a96812a0e0ff28d575b
- SHA1 c34586b789ca5fe4336ab23ad6ff6eeb991c9612
- SHA512 ce450128e9ca1675eab8aa734dc907dfc55f3dacd62503339080d6bd47b2523d063786dbe28e6833db041f1d5869670be2411a39c7b8d93d05a98b4c09cad1a1
- SSDEEP 768:5UKM0N2alRO3gpeBJNUG+ML1naP6IXW0hzbhL7bCEMmo2ocAhu:DX+RtTL1naP6IzbhjCEDo2/Ahu
- TLSH
  T11F035B5F47101065EC968A75D6F2E3A7AE70F3806B5452CF0275C5913FA2BE02B7D38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  $EXEDIR/RevoUninstallerProPortable/x64/Win10/revoflt.sys
- Size 37KB
- SHA256 25667717bf4691957f07a6363585e2c7eaf22e5fd7229bf32c91ea59ef4a2edd
- MD5 ec8e58e6b58b4fcde77431cda3a24c0e
- SHA1 ebb474009b2a2fbce648adff4b8b797fcd00c997
- SHA512 e2c667ebe97973ff27c1edf3e45ebf7950bc8d7aad1126da25290a2f590b21808654694cbe6a0ad1d3649566ec7645eb6b3379c7d7c0a650d5381a69e9cdade4
- SSDEEP 768:A1uOPkxgu01UuLjQL1nHSSdW7W0fz1Qp33u43gf:AQqk7HL1nO/Qtrgf
- TLSH
  T1B8037D1B97A410E9D96A85B4CAB5D653BA78F3425720A2CF02B4C1621F73BC0BF3D359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  $EXEDIR/RevoUninstallerProPortable/x64/revoflt.sys
- Size 46KB
- SHA256 4ba2879f2b82978110e4b3940ebfeb2ca2399660b0627998c6fea0bf33603b62
- MD5 0006295c6c5f7fad92484785b9c8fac6
- SHA1 7e50c90a91b92f943e951c1cd8809fe12fc75cc0
- SHA512 37f02befaf3b988676af4e556cba142dfef78fd771d4c68f7744e92e789a5c1fd72afe2bb38e297e190f962a6ccf58c161f80bec2a7aacaf024256f25eb7bf03
- SSDEEP 768:F1uOPkxgu01UuLjQL1nHXSdW7W0fz1f/BPKg9aUUf2h5:FQqk7HL1n3/f/Z3zUfI
- TLSH
  T14D234A1A979418A4EDBACA74B4F48627BE70B540A730CADF1264C0255FB3FC16D7C39A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  $EXEDIR/RevoUninstallerProPortable/x86/RUPPrestore.cmd
- Size 4KB
- SHA256 b61c15d6926238656afcfc2a819223cc61d89a9316c40e85edf033db789bd7fe
- MD5 23c9fa1f20916f006c3bed76d62d965d
- SHA1 23c4d4ec3b1d01355458c8ea74fdf4b516659326
- SHA512 738e10fcaf659cba93167a2e83eb822fbd35011d92311d1b1688d8f4c481d8676d0ae322086ed254108236425e13511c3cddc2a88cdd003f1fd0976ed4c1ce3d
- SSDEEP 96:vFro3r0Y28YA6VFTiy15ggMfb0XP6odMfP0ZSb7WSsHPiBOsHP0KWZ3ofnW+0:vh2RZYAggg0MJ0f7aaFl/S
- TLSH
  T1DCA12269A24C2D7AC5923E6976F406F2113FD6703D36104ABC6C689CBB4239942F45CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  $PLUGINSDIR/INetC.dll
- Size 238KB
- SHA256 83005624a3c515e8e4454a416693ba0fbf384ff5ea0e1471f520dfae790d4ab7
- MD5 38f2b22967573a872426d05bdc1a1a70
- SHA1 ecae471eb4e515e1006fce645a82b70c8acda451
- SHA512 31bc78bb4efc7c178c2c489b77d890b8806073180fbdd58156907c187cb73b0860701a9a2648da1da4930a8934c9a86b60ea5550315afebe833a681bcb4368e0
- SSDEEP 3072:NFf2FNF6iQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0A:NFfYCaqoDfb6mxk2LqHXj3if/Pa
- TLSH
  T14834BF457EA8D80BE65402F87A71CFBA1669EC20AC61C103E7E1BE5F3D79B56BD01381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  RUExt.dll
- Size 188KB
- SHA256 46d1b809e2b76858182de1efa1e71fd2bc30767d2bd94322b36937ec81ab7fe2
- MD5 da34eb78000e53cbce43a5e58525dbb7
- SHA1 adfe7061495bae245ae5d4e7b7cbf4c4f616d6c8
- SHA512 dfd7f2f7bf5d5a6a233c93536d1011a2fe305360cfb3775d94f01651392e02d52df6a83a8344da64d990eaae27c11c121500540620f57f02aa7de0f20bdb5b42
- SSDEEP 3072:xoEsHmpaBhl5TMNL1NEu0IzInds+oUBUoujjwu3nbzoSSm6b:x2HmiXwLrE3MAejN3u
- TLSH
  T1AB143847B6A440BBE137863589530A06E7727C912B609BDF1368537A1F737C0AE3BB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Modifies system executable filetype association
  persistence
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Drops file in Drivers directory

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Adds Run key to start application

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Event Triggered Execution: Component Object Model Hijacking

Modifies system executable filetype association

Checks installed software on the system

Checks installed software on the system

Event Triggered Execution: Component Object Model Hijacking

Modifies system executable filetype association

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32