7213f30970c9764e1e0f85f15125f9241cf2619fb4724d322b5fe6f8ee3d9da0

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 2.4MB
Sample260529-xmd6bsfs2k
SHA256 7213f30970c9764e1e0f85f15125f9241cf2619fb4724d322b5fe6f8ee3d9da0
MD5 d1be561690e1d91e515faf9581cf81a6
SHA1 9fed9a02c3845ca78bd72319bbfcf5140e64a36a
SHA512 919e7bd14b65bf4fc778ce3409a92fdb5a59516cdb43d5dd3626ff2d18be9389951a289afe7453aeb6f8b9e314007c007a6f3bb7137f4fd167ce5688cebf28f5
SSDEEP 49152:Ytavs+rX1wXzrf7XC4yY86lG8mFMRkoma4ftd0B8K4QH9SsmHFDTWU:Yn+j1wHzyb38mORkdtdCzdSsmHRTn
TLSH
T17FC5339039C4574FFADBA4BA05D5E61F83E1A2A06FB069D30E014DCF45877A2ED71893
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  setup.exe
- Size 2.4MB
- SHA256 7213f30970c9764e1e0f85f15125f9241cf2619fb4724d322b5fe6f8ee3d9da0
- MD5 d1be561690e1d91e515faf9581cf81a6
- SHA1 9fed9a02c3845ca78bd72319bbfcf5140e64a36a
- SHA512 919e7bd14b65bf4fc778ce3409a92fdb5a59516cdb43d5dd3626ff2d18be9389951a289afe7453aeb6f8b9e314007c007a6f3bb7137f4fd167ce5688cebf28f5
- SSDEEP 49152:Ytavs+rX1wXzrf7XC4yY86lG8mFMRkoma4ftd0B8K4QH9SsmHFDTWU:Yn+j1wHzyb38mORkdtdCzdSsmHRTn
- TLSH
  T17FC5339039C4574FFADBA4BA05D5E61F83E1A2A06FB069D30E014DCF45877A2ED71893
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence privilege_escalation
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AdvSplash.dll
- Size 6KB
- SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
- MD5 13cc92f90a299f5b2b2f795d0d2e47dc
- SHA1 aa69ead8520876d232c6ed96021a4825e79f542f
- SHA512 ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
- SSDEEP 96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
- TLSH
  T137C1B837B7C216F7C35600F12916375387E9943263A1946909B3EBCAA6A185BDD34703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
- MD5 a4173b381625f9f12aadb4e1cdaefdb8
- SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
- SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
- SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
- TLSH
  T102F1E8BAF7C109B2CA4B5A302C177B178F66E621032561B3CA6356CAB5C15F3ED25712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $SYSDIR/frapsv64.dll
- Size 103KB
- SHA256 bf12399f4e00cadf27c1207d20ff7be2a8895a5f8385caa48a75364ed3b75796
- MD5 2e5bfef71637ac61c0b96c4e1b5ef2d8
- SHA1 56af94478781b036161c5c5f7fe27d483c62ea48
- SHA512 80615b8a4e62c3d9875d79652831abbb3f17df0122b50a5c9857d8f13062475ef3e3e4f5bb19cbfa4cd75b2d19e82b229e0702b12a0876473bb8cd9a7f38c16c
- SSDEEP 3072:qf8rrdZ7TMD0ms8Drf6FGOLWT483lMYbN0h4sf:jTHmrf6FGOSU83B0Cs
- TLSH
  T1F6A36B8773E540BFE073A63889A35A16E372385616709B5F179046AA0F337C19E3DB36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $SYSDIR/frapsvid.dll
- Size 92KB
- SHA256 9246354e999750b19f8e16314d7e64f072a705adb03dc2aa55742c03454761de
- MD5 88be8fce67c977fa48e0105990779137
- SHA1 f6785cb9d91f125704b69807e3bd17e18d1695c5
- SHA512 a71dd611f7e13ef56c2f6365a5ad5a632e4351a2ac8efeeb9c6344b9348032a3dc52e2cfe9eec1db10fcb2595ce89cb86be40089eb34f6b3a9a7344cffb58b7e
- SSDEEP 1536:yxOxmRqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq+9H+3mKwvmAiUj9IIyQMjH2LNkdT:yxOxwqqqqqqqqqqqqqqqqqqqqqqqqqqh
- TLSH
  T131938C1177D0A170D0BF063908795A66073F7D22DFB49DDB67A00A9E4A70AC1AF39B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  HELP/help_fps.htm
- Size 546B
- SHA256 b1419a421ea79de26a910c941c72d8eef7f97f42e55c28e8f7df9d31be3a0889
- MD5 f335e9e4e8a45c7dcfc30b5b8b61d838
- SHA1 cbaa325097d7c203d7c875325a79de76f60e4d3e
- SHA512 4f7d27ede6eb61ba7d656d44d1c442e1ac9db016f1278c67afcf6f4674ea3786d1f77f0cef1930f0f07e0db587c11ba79f652916b96b2e1995ed89f27762290b
- TLSH
  T109F08B5B97044F5EC923323C43B44AC452B2C80B82A1435FB82A6523D4151E98655C7D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  HELP/help_general.htm
- Size 550B
- SHA256 731aa299a4024b9574282c12ff9385b6bc972a360d327633259c5bfff7bd8b86
- MD5 ca2111dcbc54a05e596894f3b0b3e453
- SHA1 4f22bd6da136ed717e06cc7abbb7d4995fbcaa02
- SHA512 83a76b771711ef883de7808f0f5e9143614554bb6b82f810e3ffe0b936bb51ebcadd14df725869beed3cfe5dda122f57412a10d114eea79821d84c12c9bbb2cf
- TLSH
  T13DF08B6B97048F6EC923323C43B44AC552B2C80B82A1435FB82A6523D4191E98A56CBD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  HELP/help_movies.htm
- Size 549B
- SHA256 241da611a040ed0d1b9e51d92eaa7ef7f9821cd1bcbfcbc6759db2babc4d6881
- MD5 28ae0688b33354b80e4d29d980d648a3
- SHA1 69fa776c403f75ce5961f04f9ac2b25479d6a17b
- SHA512 d9e00c72a1bbfbb5376a65fd98335346593765bea0a7c7739d5b927e863ee54cc7a93b397e8c745a48bf9ef51cd9b56228ed0f3f76844298c7779dc5459397be
- TLSH
  T1ABF08B5BA7044F5EC923323C83B44AC552B2C80B82A1435FB82AB523D4151E98655C7D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  HELP/help_screenshots.htm
- Size 554B
- SHA256 b2bebc38395e4678c78af793b1c5ad214a3f832fbe860dedb0d8db36118350fe
- MD5 834e553c909b7600700f25fcdfe8046a
- SHA1 3d8a844cd24e519f73e6e14c83464ca801188aa5
- SHA512 245dce23051e67dc786ef07bb0dcdc2c98bcad859bc4b4bc522a64b72db28a7d0fb657df7b27a7d0f3ab7612a11275ba04307847eb7836917b39d25517221205
- TLSH
  T117F08B6B97048F6EC923363C83B44AC492B2D80B82B1435FB82AA523D4191E9D755C7D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  README.HTM
- Size 1KB
- SHA256 68030a6f628f860115432c4ab704d8a8cd6b7a511b09c63f1c0c59e35c38a00d
- MD5 5d333847ea3381ede70b2e44ee020416
- SHA1 ac04265c3e1af4222c417216282ce16a7b63c5a1
- SHA512 a0fd61dd88d9961903f53c82adaae503acce8c1ef8e8505a07b0245d629ec8eedc946961bf8ae6d9f631f2f9ef950a7cda8ab697c2102451807185d7d4c23bec
- TLSH
  T11941505FEB909B1FC0331BAC446614E69B79866315BF436A34AF56130B21289C753CDE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  fraps.exe
- Size 2.5MB
- SHA256 da7f61f2b04266a2ae897a0b001e721f1920cb579d5e08a8e5930a79c5d2fb80
- MD5 0ff5b5161a78bf5721811779376db71d
- SHA1 35308429117b514237d34bd8015bfe4efa8e7d55
- SHA512 d701440fa49f287a9631c8fb98cef5ea89b4f135901519d3ff3c45d0a7b8c464901514078bcf5ea8d2ffd23dbc7e30816ec0beaf06a531af045fdd1f5aec0204
- SSDEEP 49152:FE2Bj+HwlrUcObnP6q8m7X3wYdurAFfCUOvtig+wf0PUVKje/rJFz6:r9+MrpObnPH851rNUOV/+wIngFz6
- TLSH
  T112C5F1E1F68A87DFC30A0470C892CEE699A85FB1DB3056C3D988BC767932DC91176B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
behavioral23 behavioral24
- Target
  fraps32.dll
- Size 263KB
- SHA256 e800f37cb2efa8ba13a25278cdd578dae4a2c86d23d4247349673160b0301e4f
- MD5 6328007efe11f2ad0a50f122367ce743
- SHA1 3f48580a32d0c5cd2551dcbcbce885c9337ce044
- SHA512 67d38b4dadecf020d1dc1e567327b5c0ebb72391448956e3e5a99943b6552851a94236d407da47c70abeed841898d2681382d78c522a40f28f22bbb654f7a8ec
- SSDEEP 6144:4DOK/Uddz0HzTLcy2q5lylI/QkvD8q6LkWhFOlHg:bK/Uddz0Hzncy2q5lylI/QkvD81kWalA
- TLSH
  T141447D412E929186E2D374FB8CB4765DCABCBCE15F9448F312F8559F86EA9C10332A47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  fraps64.dat
- Size 112KB
- SHA256 a62a9241f3bf39176956d6fa45cec7a9aae12908c7156e4b533b81d35e902a9e
- MD5 79856998086dec03fa34a614708ae1e2
- SHA1 f858dd68780063527953aeccdcbfc955b3ea2cb9
- SHA512 ca63ea0f8f269b957efa65faf4c836133c93cbe38b76f5c0117bdb3e9a1719ef1b1943a9a3f2f7e51e31e08fdc0a02b24233baaa12aa6087112db9b4b7bb7f48
- SSDEEP 3072:XcH4TH6vYjeTtyvsfGIBrYUYAv4tYRfNNgS:XcYTyYjUUKGIBEFE4+f3
- TLSH
  T167B37D5B73A430F9E863DA78C9E19A06EB71B8B546709F4D1350419A0F223D1AF2DB37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  fraps64.dll
- Size 224KB
- SHA256 6acebecb8934508832a44fdd92823e8026ea4878c81e6eb18ae03eaa7b5b5c6f
- MD5 5fd7bee98d14dacdf2f206dad278a621
- SHA1 03181ad2c9ff23f679f4276ed6c34bdcc7a7282c
- SHA512 12886a63450ed203dad5f4e485ae8cb0bad97e2d4ab76e136c37e4679f2fd83918786dd5c2c3b593766835447c9d4e320f8d82161281c097c5b852b741c13f56
- SSDEEP 3072:Y1WDoRcIUA27g3nH/38b6ehJiyrOzpMrFMinDCeTvFxCczKwL1fD35D3PMBPIAgB:Y1PV0b6/Z+DCeTv5/B757LFpyW
- TLSH
  T1F0243A4672E022BCF9F3D1349EA29141F8B27C915B6917CB163099BB4F277E0693D722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  frapslcd.dll
- Size 170KB
- SHA256 1376f53554c5977a627a7e749dd147cd10e7735ef4b860fd69b7ae31a7b15e74
- MD5 895c32a4eefd648d62e92201e4954cd2
- SHA1 5d7753f95ab95176da45473eaa0d7de29ca02973
- SHA512 76823f00376aff72b7ddf7fad259a43cdc5feec5486e3d79f6d63758f7325059d8e83dc10beb9447254501fe606b9f17fa6ed4d54f98a59dd4571453ff58fb35
- SSDEEP 1536:sa9292/UraStXim9/GcE1oVCGuTZgoOcj1EJsWjcdnnsf70:h292/UraStXuHiEC2nsf7
- TLSH
  T10904160172D1D070D96E0A36CCB4DAFD076A7D12DEE588973AD53F4F7930190AA2AB36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Identifies Wine through registry keys

Drops file in System32 directory

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Identifies Wine through registry keys

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32