95b420cb192c73e3e552148bcbae426f4d0dd7d75bf304177e889859d05ab18d

Sharing

Copy URL Twitter E-mail

General

Target
Updater_v3.0.zip
Size 161.6MB
Sample260620-tfk4hsfy4j
SHA256 95b420cb192c73e3e552148bcbae426f4d0dd7d75bf304177e889859d05ab18d
MD5 ef11c7b4c5e8ad1fa7dbd50b61d7129c
SHA1 bfa62c4e79f8e9f037beb5be54cf35a756b0899d
SHA512 8afab72067d9a0d82180de6fee0a0815ab548f1b00168a549a3c835fbb47e0ae5636dbc97482740821af2600e3bf4ec0d6c60e867b30a3bf589f79dfd0dbd333
SSDEEP 3145728:d61e0pQaMwHpwdliRcv+bwm7AoR2u2MR7+BkdujsV0VkwFAG14XYV:g1pFMm8li7bDL4k3oiAqS
TLSH
T13F88331E233EFB69CF2B757E15BA3B119607499981BBD5CD2EC1C040F1E86CCA638256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Updater_v3.0/Setup_3.exe
- Size 73.7MB
- SHA256 822476e4c8dda507d39f113e53f9e56569fed47e3f432e28ed21ec7184db8aef
- MD5 e50ea5731cde440c9d9992c227055290
- SHA1 ed13609350a041f16d9edc43bde343de36cb0b15
- SHA512 b50dd6eb92643226e3f458e24a94614e43f0b8b3836b83846fe82b510120f8dbae3bad6ea778f14f2317dcc913f8175a0c242a297e627444b9ba6233d1e274a4
- SSDEEP 1572864:ht9IKPgjOw4RWYSTM9sbVlMUc0bajJ5GcsGaP0SnQq7:hUKIjp4RWjw9srM1UEDGc/aPsq7
- TLSH
  T1A908331B0936EF1DE532BC3657102E47CA034BFAA479965DB3C4844CF6D85C22AAC5EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution themida trojan adware persistence ransomware spyware
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Updater_v3.0/apps/Archive/Archive_GetFileList_select.js
- Size 876B
- SHA256 7d221103f2c0d2821f79ee675cae12edbb247f4c0c2e6700b76d71886ace181a
- MD5 3f5f20372d98de2c91a5d2f7be1cd5f4
- SHA1 b524b19a5910e533c628067d38e6c51793db2dae
- SHA512 18c45fe329b3c096c3a79bb35405f13d524e428874b416ec0957f8120d9b166e5dee7eb79b533d66ba061622bbf2ed7d190fb3d5761c17fa8bbddc14787694b0
- TLSH
  T1F511AF27B3B06AD8B161B20201008909E5BC18E7690A84E5713D7DFCBF3445092E2EB4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Updater_v3.0/apps/Archive/Archive_Unpack_code.js
- Size 294B
- SHA256 0def5b5f427b76c62d6795877756c980d430241d639048493cbb131ad382a36a
- MD5 716e58569f8e4b11b9e369f7d3ff693e
- SHA1 eecaddc6ef2e0ada2ddebd40493c3fba723442e5
- SHA512 8386bd3b4b10a4cfabfb889dcadd8011b85354f5135e2dc8873f0163a6cbec8a8de65bf738e078938df7320cf3342b196f07d74273d8f2d80c2db18351c6bd16
- TLSH
  T1FCE0C271F0C1162A74CBAE230226144D203CC0D78801C4E04ABBCAAEED3998213E9E37
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Updater_v3.0/apps/Archive/Archive_Unpack_interface.js
- Size 4KB
- SHA256 6bb9a82c34eb22d088498d8d6fee024a2160d0950b8e4b9355d87a2559392f77
- MD5 1497d13d291b5cd18e17c8ad5e97d60e
- SHA1 58beb6652ffd0b77ea983d0c959f7ffcb20a8e7e
- SHA512 73486fe19a47dd229ae8b837af01f5b74d3a715cd331d9abc1256c3c0376cefeedf40edaafeecdd83fc3f9e57a1a8a6ae894163c66a84e1dc5fc6072a1f07726
- SSDEEP 96:1m61A24+50MdUMP61DqP6Vh1hTQ2P6XXrUBS2he:sSA284PS+PIfh3P0Whe
- TLSH
  T1B2912412AD0467322D5703D66E3D028EE335D6A9D7F3C0B0A8F983B41559AD385F39EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Updater_v3.0/apps/Archive/Archive_Unpack_select.js
- Size 1KB
- SHA256 b67ea3021f5b92ced8f0e845eeb672fe07425a03ebaa9e7dbfce0c5d5f8d6b8c
- MD5 545da5eeb04ce993ca972576db963965
- SHA1 fa97b62c858fb8f737e070569ffd3f4a9a759919
- SHA512 b7fce334023a44df8a484e607794b5445f53a2b056dbaec031e155683b79319e3f1a6d53f984985f1ee527a619834c444be72b6801696ea4ced3dfe164120d7e
- TLSH
  T1DB2112357171AAC9F532F3130240460EB2BC58E3540A88D1B27EDDBCFF7885082A2EB5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Updater_v3.0/apps/Archive/engine.js
- Size 2KB
- SHA256 54ba5785d079b047addca915f290dcdb5f97e4fb100c487dffbc0ede00b6986b
- MD5 6133226b16d85e74c504f7503b44db93
- SHA1 78699765940671ca7ce6ea5ecf69122e277aef7b
- SHA512 c3ebeab57d51e5f13b3e3641fa0213b10a237f1f6037b9562d66bf2c6031fb6c58bdeb7b29adc4363c72a51dd04d6bfce165ca915c50f81ff675c182a376277c
- TLSH
  T157510B4A3C8966CBBAC364B5133E1D4C9779A0C16D48DCE0D87A9BC56C38B8BB1C1538
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Updater_v3.0/apps/Archive/manifest.json
- Size 28KB
- SHA256 a6ac759041556f76c030c0faeaa2b74258aa78d607fe741bb57eccbbecbcb39a
- MD5 78b0cbbd79910d5e4463033b12417a4c
- SHA1 9535c215a6d39642884f77327edfd1ed0cd91873
- SHA512 e98ecf1921d80997769335f73fff62637177028085b0fd430b8a5f7a40cdf6cd3dcdfdaea92b8e4459c0bdc139ddded866fd666abe18f9594fc7c4028ead204c
- SSDEEP 384:4Qdq3gEHTA6YGux7JEaSJ+aWTxrCj8ThtS8oTqQTrTKXIz85UTAM3:HCrH5WTxG8ThNoTqQTrTKm85UTv
- TLSH
  T1ABD2B6217A883A3B1541F297ED2A1009FAE591FF2AA615C1387C582D7FF7871C2DD3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Updater_v3.0/apps/Checksum/Checksum_File_code.js
- Size 431B
- SHA256 86272628af3b2ad41d8b23ffd4239027ce9b135f9f1febe1dc2d563d85502eb0
- MD5 8999124f2793839d24e8043a7dc5b2cc
- SHA1 9fd61864c2b8c98d63e37e15d9ba2e6768210a54
- SHA512 7ec6f1c66bc1a7dfeb0d9168be1c1d5e4eebb7a405fada070bfb9614b507df5946b67507480a02a1f3fdf16b627ebaac886bb8c81b006f0fb6f7153da05ec083
- TLSH
  T1FDE0AB9487B029547BC3BC300A1B409DEA2D709882206D820C881E6A0B44FA085FEDBD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Updater_v3.0/apps/Checksum/Checksum_File_interface.js
- Size 9KB
- SHA256 09ac4dd877475cce25255536d1d588bf345d6b79089e2c0b2b7d454e52b0a345
- MD5 6bb682dd22b24064eac6291a85f9ffbc
- SHA1 3dba46904de0e3c795b0f6f895906027397587f9
- SHA512 86bcd91f390b9ba35fdf0dae2034e0dadff63764c8d5da9c61160678ad6f190954fec237f0ee36e9ed5abe063f19c63fdf824a5b9335eff91ea8422486766474
- SSDEEP 192:sXVl24Q0vG302iOSuqX/ksAyTIjx+LQmTos0CvY8q/k7bcf4CbbiBNYJhWW:sXacG3F4/ksAyTIjxm1i8W
- TLSH
  T1BE121E127E48B13D20D7A39A1A75D2CDF63CE79AC63344709CE8C72A444ADC6A5737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Updater_v3.0/apps/Checksum/Checksum_File_select.js
- Size 1KB
- SHA256 cd3a3dabb18ddd4ee8635d2a90ee5f72548657ec4ca756bb63c39ead9ede8d8d
- MD5 f22cad510ead2a397f7d3bce6039d01a
- SHA1 c02ee5785b53961c4247841dfba1fe6c79938091
- SHA512 107030c083c4af2a06306d6f5148b40801d2d29f6c2718c43c7621dff7c2a2f4d0c995e6309d2e78af58f8f3fd2158f14c7dba2a4bb1087e9814c3e42441f1bf
- TLSH
  T1F821CD3AAB74B984D2B2B1110640C506E1FC28E314094D45356C7DBCAF68D60E1E5EFC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Updater_v3.0/apps/Checksum/Checksum_GetAlgorithmsList_code.js
- Size 87B
- SHA256 30a22f54b53074df4cbd0215f1a96eb88fbea98504d951f9d0713d0ada57942d
- MD5 5f154259326b929195d98a0adc7379a4
- SHA1 e61cf561821a14ccfc0f6cc3dde0a3b97e47b18a
- SHA512 1fdf151d97604b81c063f37bf5aaee1c5cab7610350671bafd71e0c80b89e67460c737eebff422922c68dfc25495cea2bb43562761fc6905949313c6c44985d8
- TLSH
  T11BB0128938112A9825C178B81EDF4A045A32201884A43C9000444F9F0C11484620A8AC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Updater_v3.0/apps/Checksum/Checksum_GetAlgorithmsList_interface.js
- Size 1KB
- SHA256 ce2473c1eb5742aac7443586012a42a1746b1ce04d33465c00b2af4b5a41ec03
- MD5 c93debf47425de5a37e967650c39fd63
- SHA1 44225170c33aab25b0d86e33423ffb8e0944a1b4
- SHA512 c6cdf1782c138dc1ff7a95876b2adb42deed82d29f65a3af1bbac5501b84ad43ff2589db35eadf7f8c53248b597ab2055fa2e344c824fb5c4ff1d8a8585b9639
- TLSH
  T10B210F222518737711C702CF197A6782F566D629C3F3C02065DE43AA0742C83A9B38D6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Updater_v3.0/apps/Checksum/Checksum_GetAlgorithmsList_select.js
- Size 365B
- SHA256 a94a29a5b29ef83ec6da85ba481bcd53d6891ebe7970c8a263151987295575eb
- MD5 5043bb3c2fa113639c70f792f0172001
- SHA1 08472e1a67a4f25dd31ec6894372f58ea02eb0d2
- SHA512 77aaa23203d7533e26739b89921ca5c2e3d18ad6b86a8f8d9c9210859c086ac179aa7112470cfa1b5cf390034866d7c481aa6c54112a0551a6a6e20be5cef526
- TLSH
  T15AE0C01295303DDC93B274161551CE04D07C25DB908800163E0EBF6C9F30000E3A7CB4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Updater_v3.0/apps/Checksum/Checksum_String_code.js
- Size 486B
- SHA256 b7175882ae8966bd2feb99ce0318d28a5e185e76154c9366166fce069424e1dd
- MD5 740688c26ac8b30f32d8beb5c4cdf44d
- SHA1 d0e1970ecfe3896b9d901bdde4ff03a774741c4d
- SHA512 69b2c0aa0a05423740bd3ec174a261dd7df82de752269bb1e705d573edbfaf8fd002989c5fce9b752d384ffe6d974a5ab15e40b19b9a46378f51cd42b28c59fe
- TLSH
  T1F6F05CD49BB136542EC3BC70595B406CEA3D30598371BFC24C940E6A0B94AF046BEDBD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Updater_v3.0/apps/Checksum/Checksum_String_interface.js
- Size 9KB
- SHA256 4ef62541cab639009543bc0d31f954bd4b5923f68e2b8bc2feb338d1a267cba1
- MD5 fe0f3223126c0877c64feb0773014b23
- SHA1 d8ea9055c2ed9739c0df2627b4a8d81f9c5b00de
- SHA512 fd08b45f35bf8ea4bd5c3486bcb4693529af65acd7a006fd489040fff3f6f5799e9ea8ae13db2af0a951b9808d0ce792b0ad64b0581a718cbb96ea49de60e294
- SSDEEP 192:NV7usvG302iOSu2X/ksAyTIja+LQmTos0CvY8q/k7bjf4CbbiBYNJPf:NjG3FM/ksAyTIjamxPPf
- TLSH
  T12C220C123E58B13D20D7A39A1A75D2CDF63CBB9AC73344709DE8872A4446DC2A5737A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Updater_v3.0/apps/Checksum/Checksum_String_select.js
- Size 1KB
- SHA256 215325b4158d43cb181b24cd03bf619bd762ebc524aae5edce484690896977f4
- MD5 d9d3925440c6b2121c208a12c8fd396f
- SHA1 ca636a8183d7ac486edde1cd19cb8fa209493d96
- SHA512 7be3182655dbb7afe7c05a4698d99959734d87d76b45a5d554ce3da0d171d3917d26eac4c1df542e4b11700b8bc47241ebe1ce7a7d5b71f2f1f86608f9771236
- TLSH
  T12E21AD3AA735B8C493B2A0710684C505E1BC28A311194D82746C9DBC5F68D50E6E6FFD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32