4d520ba4df04666acedac089e40729a5b52daa0f00361a8b17ff8fd7c58ba40a

Sharing

Copy URL Twitter E-mail

General

Target
The Boys Ascent Installer.exe
Size 345KB
Sample260602-x53lmsds4x
SHA256 4d520ba4df04666acedac089e40729a5b52daa0f00361a8b17ff8fd7c58ba40a
MD5 b2c35798debfccc957501c08ca9953ba
SHA1 35607b5d67932585c2cd4e0ca29bfa46c97c6d04
SHA512 11461436f169bd08b6507c64b1f2f7a5b6ccca58ba9725c405de7870ccf85bcdb12aa01fbc73a8ab4a6cd56b26f1ef467bb29f342eeffefebfc8d8bf4b06ddfd
SSDEEP 6144:DVGdx6xmkCO01HAARiyet+MvR3DYxC5UmTrX6jC+2t0EyL+mcRIlgvf:J6N1HAARiyiLvRR6m3X6jCqRKphn
TLSH
T10B748CA8AF9A920FC3B22B7935D5F73021BD8FD0BA96014257D17F8BB9B190D0ED5580
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  The Boys Ascent Installer.exe
- Size 345KB
- SHA256 4d520ba4df04666acedac089e40729a5b52daa0f00361a8b17ff8fd7c58ba40a
- MD5 b2c35798debfccc957501c08ca9953ba
- SHA1 35607b5d67932585c2cd4e0ca29bfa46c97c6d04
- SHA512 11461436f169bd08b6507c64b1f2f7a5b6ccca58ba9725c405de7870ccf85bcdb12aa01fbc73a8ab4a6cd56b26f1ef467bb29f342eeffefebfc8d8bf4b06ddfd
- SSDEEP 6144:DVGdx6xmkCO01HAARiyet+MvR3DYxC5UmTrX6jC+2t0EyL+mcRIlgvf:J6N1HAARiyiLvRR6m3X6jCqRKphn
- TLSH
  T10B748CA8AF9A920FC3B22B7935D5F73021BD8FD0BA96014257D17F8BB9B190D0ED5580
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution adware defense_evasion installer persistence privilege_escalation spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/ExecDos.dll
- Size 6KB
- SHA256 91d5481f576382164703e4ac244052265769377838ac30233ad79c983ed9d454
- MD5 774e3b33d151413dc826bf2421cd51e8
- SHA1 ab2928dcf6fa54bb9eb16e5f64bfcffaaeee90fa
- SHA512 3cf955b13e81e4b6edb292df751ce7f64b0cf30979f57b1609f002859b4e68adc046b6674f76f7b7ce7144382316c344c11fed02d638e62fcc8464c32795a365
- SSDEEP 96:38IgHUv7jr2GJ+dfuitjFVsDtwC6OcgHl7cFi1cyMV7WhWuaW:dCajridfjR6tw1OjHl7cE1KyhWua
- TLSH
  T172D1C639B7F40473E2FE16343EA1522357B9FC120B2686BE865329CD2CA1D50DD24B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
- MD5 40d7eca32b2f4d29db98715dd45bfac5
- SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
- SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
- SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
- TLSH
  T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 86cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
- MD5 3dd80dff583544514eeb3a5ed851a519
- SHA1 56f7324d9d4230c96d1963e7b3e02b05a6cf5c24
- SHA512 955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d
- SSDEEP 48:S46+/p2TKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mhofjLl:zf2uPbOBtWZBV8jAWiAJCdv2CmwL
- TLSH
  T1ECC19470B3C248B9D491413368A733D36612EE746784500F9F6311AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- MD5 75ed96254fbf894e42058062b4b4f0d1
- SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
- SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
- TLSH
  T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
- MD5 ca95c9da8cef7062813b989ab9486201
- SHA1 c555af25df3de51aa18d487d47408d5245dba2d1
- SHA512 a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9
- SSDEEP 192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
- TLSH
  T16312F793E5A820B3C6D3523F35BE2B2EC7B95335B0512C0487738A497A6947A6E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6
- MD5 3d366250fcf8b755fce575c75f8c79e4
- SHA1 2ebac7df78154738d41aac8e27d7a0e482845c57
- SHA512 67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094
- SSDEEP 96:cjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNG3m+s:9bogRtJzTlNR8qD85uGgmkNP
- TLSH
  T10DD109BC36C10CF3D54E46743E22381753FEE4761B7542A18B972AD61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 23KB
- SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
- MD5 f4d89d9a2a3e2f164aea3e93864905c9
- SHA1 4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
- SHA512 dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
- SSDEEP 384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
- TLSH
  T1D4B21746A6B054F4F57B55BAB4322E232E7EBD08286095EFC73319196860913BB3D333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/nsisFile.dll
- Size 5KB
- SHA256 a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
- MD5 b7d0d765c151d235165823b48554e442
- SHA1 fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
- SHA512 5d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
- SSDEEP 48:a+guelvxkcuEkVy5wM4zL5stbmaN0QpUFdAwsj1gAtl/lSFc/H9UhV0n:3CBxIEkVQwzR2300URs5ldSFcv9c
- TLSH
  T191B1D83B69A097F2E0044673177B2EC76CB2A16433C9012F4B531A207E51937EDAEB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22