4abec83a9e28d4d1010d354e67a901228f82fad9c7edb8bf037f2846a49396dc

General

Target
IK_Multimedia_Keygen.exe
Size 411KB
Sample260620-1qa5maay4v
SHA256 4abec83a9e28d4d1010d354e67a901228f82fad9c7edb8bf037f2846a49396dc
MD5 4e4fbc2f974ebb8fdc07934e401408dd
SHA1 e66cc417345e6f7a2a6d6f0b3a2ab2f2a804c886
SHA512 4f1053e9c2a5a43b2ea97aae4e37d6ad3bdf211e339cea5b30f7b3935c1c45297072654ae5e06b0f5db8a8a17ce7f9d7a91133e392d2682368c632b976ee8200
SSDEEP 6144:a+MvoJH2nA8P9tlASRzKW3FLVhl6wd7vHnaRm3kr3qWfjOp1X0eAZwyylN1Iz6/D:a+tc9t2Sll15hlpJvaUUbx63klZ6/D/D
TLSH
T13C940251BEA4C4A3DCB2437558BB57A239FB7E218776114B77D47B3C39B3242810BA82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  IK_Multimedia_Keygen.exe
- Size 411KB
- SHA256 4abec83a9e28d4d1010d354e67a901228f82fad9c7edb8bf037f2846a49396dc
- MD5 4e4fbc2f974ebb8fdc07934e401408dd
- SHA1 e66cc417345e6f7a2a6d6f0b3a2ab2f2a804c886
- SHA512 4f1053e9c2a5a43b2ea97aae4e37d6ad3bdf211e339cea5b30f7b3935c1c45297072654ae5e06b0f5db8a8a17ce7f9d7a91133e392d2682368c632b976ee8200
- SSDEEP 6144:a+MvoJH2nA8P9tlASRzKW3FLVhl6wd7vHnaRm3kr3qWfjOp1X0eAZwyylN1Iz6/D:a+tc9t2Sll15hlpJvaUUbx63klZ6/D/D
- TLSH
  T13C940251BEA4C4A3DCB2437558BB57A239FB7E218776114B77D47B3C39B3242810BA82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1
- Target
  $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $TEMP/R2RIKM3.dll
- Size 6KB
- SHA256 f0f1bfd3c048f1565fd8c76a47c6436935ee5193448d042575b9a56bbe2f1cc1
- MD5 1fc74abff10c6f084f64ab48146081a9
- SHA1 39cefce27bb5d498ba01a7398a0e12bb4b93cc78
- SHA512 505f4c75174fe06aa1b652afade01c388449466ccfe591cd865c9731381f080ca3f98be73ca6050efc8aa201b5965b45ec42edaf0f0e5d3f7105dbf3a88f8ecb
- SSDEEP 96:twl2T3JwFj4WZ24CV3Xjrnq42JclnlpLxc:twl2ThMKVHvq42ilp
- TLSH
  T1E9C1B7B7D3A4CD61E3AC02F83597A62E7EDE62700B7057793B404D1E0AD0A66FD06253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $TEMP/keygen.exe
- Size 455KB
- SHA256 58850242367cc2478b83209a14b50b27464a36c1ba339c797a1f18a54331a5d0
- MD5 2c421891281da7faa43dc78f4a146dff
- SHA1 42c6ff5b6ae598933edbb3f60f5961bfb8099c42
- SHA512 d354388795891961c4f91e831a2f1eabe161517e61d4e4208bb2770632c4e7a0baa391d4ad4016aea95751154040dba0e7d379e031ddfb7d73e5cf9e079bd52e
- SSDEEP 6144:icmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOREnI9Kndp05JjoS:ic/kEPDonR6Y436vRYnI9Kj03joS
- TLSH
  T1CFA49042E222F4FFF9F9033D92463515C0102A5C87A6E9EFA7D7095A9C343D316A26DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4