ed666a1c06ac8aba9faf8b0b744cc4958f9e520aa9dc5a821acf18fafdcdc6e6

Sharing

Copy URL Twitter E-mail

General

Target
ABDownloadManager_1.9.1_windows_x64.exe
Size 66.9MB
Sample260620-rfpqlagx71
SHA256 ed666a1c06ac8aba9faf8b0b744cc4958f9e520aa9dc5a821acf18fafdcdc6e6
MD5 f3954c0468c32f4e7e1aefadc1b4c5b0
SHA1 950804d314d4a4347153bf39cb46e9dde9ad6a94
SHA512 d8c9b63f28c60ad6f4a8a769debb26e15179e172985794a3466d12ad42c55e73f2576c28ba61558bfb13bca284fae1dcdad44d8da40e517828d6c93525013d74
SSDEEP 1572864:2ru0Ple+asoa4oyUspZTyViNgNaiIZby+01RxDm82au0w:2rZPI+9OqVT8iSyB1zzw
TLSH
T122F7337C6EF9D4EDCA2C0D38F3F66253B200329B356FE661E3429AE5D800758F652649
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ABDownloadManager_1.9.1_windows_x64.exe
- Size 66.9MB
- SHA256 ed666a1c06ac8aba9faf8b0b744cc4958f9e520aa9dc5a821acf18fafdcdc6e6
- MD5 f3954c0468c32f4e7e1aefadc1b4c5b0
- SHA1 950804d314d4a4347153bf39cb46e9dde9ad6a94
- SHA512 d8c9b63f28c60ad6f4a8a769debb26e15179e172985794a3466d12ad42c55e73f2576c28ba61558bfb13bca284fae1dcdad44d8da40e517828d6c93525013d74
- SSDEEP 1572864:2ru0Ple+asoa4oyUspZTyViNgNaiIZby+01RxDm82au0w:2rZPI+9OqVT8iSyB1zzw
- TLSH
  T122F7337C6EF9D4EDCA2C0D38F3F66253B200329B356FE661E3429AE5D800758F652649
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  runtime/bin/api-ms-win-crt-string-l1-1-0.dll
- Size 26KB
- SHA256 e71d517e6b7039437e3fc449d8ad12eeeca0d5c8ed1c500555344fd90ddc3207
- MD5 aacade02d7aaf6b5eff26a0e3a11c42d
- SHA1 93b8077b535b38fdb0b7c020d24ba280adbe80c3
- SHA512 e02fcbcb70100f67e65903d8b1a7e6314cabfb0b14797bd6e1c92b7bcb3994a54133e35d16da0a29576145b2783221330591526f856b79a25c0575fc923985a6
- SSDEEP 768:96S5yguNvZ5VQgx3SbwA71IkFD7RwL9il:9l5yguNvZ5VQgx3SbwA71IEVwL9il
- TLSH
  T1B9C2D88346F82E42CA8B5BB216F9DBC72D384B86260012758477E4DC38827D6FE6791D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  runtime/bin/api-ms-win-crt-time-l1-1-0.dll
- Size 22KB
- SHA256 c3a70153e1d0ecd1cbf95de033bfef5cfecabe7a8274cafe272cc2c14865cd8c
- MD5 0d9afb006f46478008c180b9da5465ac
- SHA1 3be2f543bbc8d9f1639d0ed798c5856359a9f29b
- SHA512 4bd76efcb2432994d10884c302aee6cadbc2d594bbbd4e654c1e8547a1efd76fd92e4879b8120dfacb5e8a77826009f72faa5727b1aa559ed3fc86d0ce3ed029
- SSDEEP 384:WTcWfhWNuLm0Gf02zlxCHp98xlZWWkipDm:6CuR9Xi8
- TLSH
  T1EDA208C396E8A943EA972B7113F8D7D77F3853C21A9061654466E4A83AC33D1FE1242D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  runtime/bin/api-ms-win-crt-utility-l1-1-0.dll
- Size 20KB
- SHA256 af1e1b84f066ba05da20847bffd874d80a810b5407f8c6647b3ff9e8f7d37863
- MD5 9b622ca5388b6400705c8f21550bae8e
- SHA1 eb599555448bf98cdeabc2f8b10cfe9bd2181d9f
- SHA512 9872f54ac744cf537826277f1c0a3fd00c5aa51f353692c1929be7bc2e3836e1a52cab2c467ba675d4052ac3116f5622755c3db8be389c179f7d460391105545
- SSDEEP 384:WOf9WfhW3Lm0GfZE8xlZWWkiJ1zw8xlZWWkip//7:1faeRviIiN
- TLSH
  T1889219D78AB85443EB936E7153F8DA837C3D97C72910826104AAF5E82CD3BD6EB1052D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  runtime/bin/awt.dll
- Size 1.4MB
- SHA256 6dc3d3ef3871bb5b7e2c34513ec4dd9137e7fb0fe4763364245be10287756fe2
- MD5 a8fbddcc96519b6955adb4ae93388eba
- SHA1 354a9780e9ec0c7d54b08d2fa04c1192558c0f00
- SHA512 1a84740d842c3f6510ead72d9d41da514665974afa821c97f365e51138c7e29607ae0364b93223093a04c756931a02a44f0939dfbcbc203c9b6fcd889c6420a2
- SSDEEP 24576:6fW85VlashKsSPCOos69NSUIqmntHYGKttBX0jKPNVFv70yAtLTtxIIdY:6e85Vl5hKsSPCOos696qJGgtBX0jKPbx
- TLSH
  T139657C06E7A80184D5BB82B8C95B120FEBB0741513509BEF52AB875EAF77FD0623D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  runtime/bin/fontmanager.dll
- Size 971KB
- SHA256 5eaf32ba5685cc322e079e5e7e6464358efa1ee2441ce351d42687beb3b9bec1
- MD5 6e4598fbfed49ad56171b6160426ef92
- SHA1 3022bfa7539138ef2bcefd8f7f482febafb43608
- SHA512 f7f74a74f15223ac4da8408a3da73383b04cdc21a64e226765ce9589ffc226160a5da3ce328ad4f1a8d3ff32583f7a460c2a74b9bf63e46150917a5ffae1f5f4
- SSDEEP 24576:3E6HPtMHg8gcmA3aHbY0xBXRv20geq0xVrDON+9pxH:3E6HPtMHg8ghA3aHbY0HKefVXqMx
- TLSH
  T187258D49F25754E4DA3F9074D6A1C007E7B9B40203099EFF96B0A649BB27AF52D3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  runtime/bin/freetype.dll
- Size 539KB
- SHA256 002a773d7f60049505d26682d96ec78c0300d52a373eba2383aef31dc721cea5
- MD5 6bff74ee15496d17c8066f3ea5ddae8a
- SHA1 36ab9562360a5476d554807ebd250796d45f924e
- SHA512 6f1696f637fd7c26cf360b3e70ed5dc61a1ba6ccaeb6a4eba1c1609a10e3183132b8ff672e09683c4ced2f9a44517f27b2ee542b6f9e8de72c550d3677248b6a
- SSDEEP 12288:m7XaxuQC9gIkl8x9WskYR35uCWk8ZKvZuhfEWmcPMJ2F:0XakQWUshnFdZnZkF
- TLSH
  T1B9C48D82F7A417A8C6A7C13C83578717E775B40913119BDB22E04B6A6F23FD16B3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  runtime/bin/instrument.dll
- Size 41KB
- SHA256 970cdcf1e4b961531b9f3922d1183430f0f31a263d2fe69f5b2df705af67462e
- MD5 b9857ac96eb7948f5114d5ac8508643f
- SHA1 904b9b9b9891c07dbe0c8e5e52bea3308e39438e
- SHA512 c19240045232ba4fff7628d1fffd427775b7b963d390ed27a2f91fef0aaf9951a9c0f8f20e7642d3d4170f3a22ac0345ba12abdc490ce0b84fe51787408bb618
- SSDEEP 768:73jTtBB9R0xQ4wuFadVPQgTLm2tHFrFmUMloeNTPP8mHkeLc8thi:/Tt9R0mP9jbM6eNDXE+lthi
- TLSH
  T1F8134D9BBB5104E6FA23817CC571421BE4B878017B61A78F07E792C99FA7620753EF42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  runtime/bin/java.dll
- Size 107KB
- SHA256 c69aa2aad13b17b8e7e505dba895dd5573118b784d1af9cc594e71d536ac1386
- MD5 368945c05e5d8c15355c34622a0cf009
- SHA1 8941772b6cc7001afe86f9886d943746f82945d8
- SHA512 48e1c58123199e002043e18f55dd7c254475f6b79d30695a75c9dd4d2b25dcabc466dbb7c00cd4ed3a2b67332c0257c10a3aa3ec87ced6d2fd5dce355aeda795
- SSDEEP 3072:aklyhyL3yWgtAajNfuDQOJyX+G+lHNnsrV4h:FyhOil4
- TLSH
  T17AB3181BB6A58042F92AB2BCC427550FD37274601196A70F03AAC69E9FDF7703D0DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14 behavioral15
- Target
  runtime/bin/javaaccessbridge.dll
- Size 293KB
- SHA256 d107189151c7d9c9be2f34e56045993b92628783e02025820216b1122c4766fe
- MD5 c18ae8d2ed046456d58b42853b4018ed
- SHA1 63643ada411e2f2bd1c4cbc9c71fcc80b519e55b
- SHA512 238c212bc405b720ea9645383d3af3a15efb1ddb82d42dfa8d56905d20f90822d2d83de6641997aa68e5696aeba7dd20ed7e61d669732abbbf5f6413f25c8524
- SSDEEP 6144:N5NUa5danDx0TxZukBGHW3KvjUFHQdnIp:Noa5onDcnukAX7UWdnW
- TLSH
  T14C543B22B6D1B179E26F913CCC928108DBF174355232CB6F8FAA515B5FA72014C39E6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  runtime/bin/javajpeg.dll
- Size 169KB
- SHA256 027db3919f7af31c6a1b67057934f5016bc9d7cf6d085d96eae13e7754b46817
- MD5 9f1dcf2e7894574f4530c98ccd94afb7
- SHA1 0642cf692076844b2873a8f68ffdf77af344f669
- SHA512 d83e86b235f6a03911202d99b50301ebb0bfdf9088cb54e10cd67181a2f04ad2aa0be430a1ed464b401fd0576d344903177e3a0f574892d6ec73dc546a0c992e
- SSDEEP 3072:ThxTMBsNE6Q/DiOrxXXo7wtP3CAfBpLbUK3zCosqgkSPZnWbxit48:ThxABsNE+Orxno7MaAfrHU+8LPQbxib
- TLSH
  T1ED044946B6F01098D96BC0BD96A7565AE6F1740013049BEB83A1C3B72F67ED03E7EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  runtime/bin/jawt.dll
- Size 11KB
- SHA256 46f7561d002c4f49e8b75f84ff53683f6ffe3e585d214026836b4645703d483a
- MD5 4c9a30f276027cda9529d8772af0630b
- SHA1 a28d74c385d267a7bf3266167945c45ff9597b0b
- SHA512 eb90a55b944dd4f490aadf6044b63f41526177389560b6d0b2205dab07d8dee5e420dfa1bd5329d2286824995844f0a97690acef9da576bded066d9d66f786c8
- SSDEEP 96:wJw1QSgFdFiVFUtmvOKLMkpHJ88xAvJ3GtNviVhUcqbP4k6fczOSt1cj0:yhFdFi6mDsgHvcA8fczftT
- TLSH
  T13F32290DF76449FEE56E8334CA3F0E4B923AB7202712738F43B5551C1D62396A12ABC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  runtime/bin/jimage.dll
- Size 23KB
- SHA256 abd392b03d9390b49a400e28b08d18b0e9f42796a4632643f6ad3bec06f3dd83
- MD5 78c48b33fdab87e5c044da0fcbbd0f85
- SHA1 51459fbe25a13470a02d9b24a9d48964112e37ea
- SHA512 e6f8b7ed5a9268070acecfba956303bbf4777fffb4a4e2122d988f5f91b42e5cfc8f1564e8f99d859011d54011e1f92d19970424e7df3c76202ab9b60d739ab7
- SSDEEP 384:0QMdRPhYRrWg31dlWSXzYQ198uNG3ajk4hDGvhRnwe4ZOt0:WOLfMSXU6Z9jk4havhRwea1
- TLSH
  T18CB23C49F7944998E57AE57CC86B5E5FE2F2F9519F22834F0B60039E0E333907629B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  runtime/bin/jli.dll
- Size 72KB
- SHA256 301643e0bc9490ada134d318d44a957ceb51a5ef7621f356ed41233c7a281756
- MD5 9f8f0aa6a4176007bac879ad961c0450
- SHA1 47cfbdcaa642e80b75f19205da3ce8c758802fc0
- SHA512 de933342799f510a1e14827eba3acd5f1e882bda3dc28f106c2b5397dccb13d04408dca774467634450b47ea4b8aa6bd635e05039ff040d2224ed7df5f55c70f
- SSDEEP 768:W1O7FLuXxzsJg6cn1ePdXR920wdWLNyaAuaVe3GNVgWLblYxE3nVIOZSP+En5qsp:YwyxzygdEPB205DueSNflhIOF3NzhcJ
- TLSH
  T13F736B8A63D011E0DDB69078CAB1561FE3F2B0622731939F037846AA5F737617E09BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  runtime/bin/jsound.dll
- Size 50KB
- SHA256 10d0c65cb35a29418f99d75eabb617e8e9eb425e9d338d9bde6c34f2293bc36f
- MD5 2771c33024e06f59dd93f2e68252a747
- SHA1 57ff069f938237428a6237798d9420b8c227390b
- SHA512 bb792ef59152307f772b6cd11af9d3c5cb113558959994ca91818f2c5bee6a387bbd0e1ac6276ddab826f1ded9498c2574e592bbc5e6228204d3230eb1dbcfb4
- SSDEEP 768:6TBjAUn/WpUC4c7blErhWkG5SwWVvm4Lxk/w+jfAZUNLsruRpb9me9W8e0oZd:AlAUn/WpUlc7blErfCxW1Eeup1/e0M
- TLSH
  T154336C97F691E1DAE09F50B5CE437317C3B2382107159BCF8B65472AAF2B322592AF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  runtime/bin/lcms.dll
- Size 245KB
- SHA256 0fa43b6fec80d26904bddc79150c3b43fe10858f5d1f5ad6c5f9f6a2125920fa
- MD5 0c698314332c2b09c474b94a685998dc
- SHA1 5e7630314b7a4f452b4a88fa778929523d9f13f0
- SHA512 0a5594805f916f121e9a2ab65f23423e4284d6b48a3c75bf07a2ca76ff348e95859ee940b3a1e8ea83893067349cfdb4e54fecb1ae6ffd0e48fc53d24babe734
- SSDEEP 6144:eX+r45Vormq76jXXthlxmLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwL0ZwQRIp:kU450NejXdhlxmLg9uP1+74/LgHmPr9s
- TLSH
  T15D344846B2A81CF9E477E0789197A10BD7F178140321CAEF47A08E9A5F17BE5693F342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  runtime/bin/mlib_image.dll
- Size 500KB
- SHA256 3ab9cd7941e661777fa1e250e9f7f406d20f3d8ef2f38af8f8fade589a7b5d26
- MD5 5a8316a0a71d488dde8f95d389fd3941
- SHA1 640a1b02f06576afb333e6f9fc86fff00e1e910c
- SHA512 c7693af221c8ca5312e61932359769265f603e2d49a94a762e0d8da0a7a477093ff4b10ceaa5d9c5b2270cda97a46d144686a86ab2ee65e5e5b91d865fe4a35c
- SSDEEP 6144:p+4L1OAXzH8wdJ+ydZtyYmsZq/b/zTxTwogGONK+N7TD0Hq+VlzEQe/Q:p+4L58wZh+xTw8+kxWI
- TLSH
  T1F2B46C43F5A617DCC06AF43156BD7297F921341902285633DBA2DD683B26F11AEFB30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  runtime/bin/msvcp140.dll
- Size 544KB
- SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
- MD5 bc88b387cafa556068b5c5d6ff3ccc8f
- SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
- SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
- SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
- TLSH
  T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32