d0685e397486bd9f54eda33133e87e3970dedf5038ef0e4d058de34d796d72ac

General

Target
rbxfpsunlocker.exe
Size 488KB
Sample260503-rcwpqset5p
SHA256 d0685e397486bd9f54eda33133e87e3970dedf5038ef0e4d058de34d796d72ac
MD5 52f46ced3b06b19eac3369fbdb4ee2ee
SHA1 1bc549fa770b1bf3925248a3853a87af9948381f
SHA512 d65a7f73a497e18d0123306c3e940cdd5b22f61ad88fcd9a334c95bab0db665a8e61d11c9c78a656cbfdd7a691e782351fa712aa97c6f38f1d641ae91e3d23af
SSDEEP 6144:9nsLTb6hU1R1IDT3nn/b10WyIZUdA8CQ3mAg0y0Noh+p9NWRzbX:6TbgrDT3n/b6qiA8CQqvYogp/6
TLSH
T1D2B405D5E6EC30F4D36681388876C52FE6727C5D032186AB23E46E1B3F266E05DFA611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  rbxfpsunlocker.exe
- Size 488KB
- SHA256 d0685e397486bd9f54eda33133e87e3970dedf5038ef0e4d058de34d796d72ac
- MD5 52f46ced3b06b19eac3369fbdb4ee2ee
- SHA1 1bc549fa770b1bf3925248a3853a87af9948381f
- SHA512 d65a7f73a497e18d0123306c3e940cdd5b22f61ad88fcd9a334c95bab0db665a8e61d11c9c78a656cbfdd7a691e782351fa712aa97c6f38f1d641ae91e3d23af
- SSDEEP 6144:9nsLTb6hU1R1IDT3nn/b10WyIZUdA8CQ3mAg0y0Noh+p9NWRzbX:6TbgrDT3n/b6qiA8CQqvYogp/6
- TLSH
  T1D2B405D5E6EC30F4D36681388876C52FE6727C5D032186AB23E46E1B3F266E05DFA611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Patched UPX-packed file
  Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral1 behavioral2