164f1952f2c7d03ad878fbc367ba1adab611072a2cbb62faad8f2d21bdec27d2

Sharing

Copy URL Twitter E-mail

General

Target
PBOManager-binaries-1.10.0-248.7c250eb.zip
Size 13.2MB
Sample260622-e8pj3shw61
SHA256 164f1952f2c7d03ad878fbc367ba1adab611072a2cbb62faad8f2d21bdec27d2
MD5 40e1e23f0cde9c39870731a6ccd6cf15
SHA1 7b2d0fd84bd1ba18f833bcf010a5aa946239fd20
SHA512 c4d21bc0df8bb17b3dec0e409fce9d8c6f82d24205c4ce37af14e66bb1322e312f60132eba4822d9c86549407b0fc9cffa2ddcc67f3975fc2664ff8e1b349abb
SSDEEP 393216:HbdnJdhJAddmsY5PACBHWTntKaO6+bx+bfAJfHT6:HbdJd3+djY5CTntC6+VafAlz6
TLSH
T12CD633DB73A32B8A710D31A827B8808FA15C9F1359FF932C7335D2CB45131EB299A595
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PBO Manager/Qt6Core.dll
- Size 9.6MB
- SHA256 9fbea00b87ceae5f9e319c23010eacb903ed460c661b9b1b17bcabd02bf1eec2
- MD5 6dd8a0805ef99c97af6273582aed1611
- SHA1 d7679af06c805c8a4230b01887f946bcb1694dc2
- SHA512 3f633218cff977fead550447a6e3d0389a6566a4bc8ea7f78e4ccee232d36b2d8fdab8d8fd71e858e67fcd8eaf2d223d57231bd4eb746d952cdf45dff0ff6522
- SSDEEP 98304:HmesKMUytgJH1KFdu9CwJsv6tCUDo1cs5Ami7fFbW9/3PO:Hm2f1KFdu9CwJsv6tC3OC/3
- TLSH
  T181A6290766FA0111FAFBDA34DAB71242DBB27C466B3496DF025861185D337F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  PBO Manager/Qt6Gui.dll
- Size 9.1MB
- SHA256 63c31e9f79faee8e6ac3919f13be59d293c4fa5f091d200cb683c9f1ea4e6ae7
- MD5 33fab1e02f2f9152f565d0e37e078f6f
- SHA1 4d47ff143e4259480a7b4b381e52e686514911d6
- SHA512 2af964620e4d1a6f26858482c701bd737b30f7f731d61b802e2658f4ef28f4e25a923fb33100281a7f78f54a86f3156afd2a119bbefcc6affe82f97ab70b8145
- SSDEEP 98304:0v0fimOnRKCT7G93vbkmHUJkz2YHH9RTSrYfTuLRN:nYKC303vbEJkz2YHH9d9E
- TLSH
  T16EA69D57B2A901D8D57BD13C8B5B9507EBB2700503629BDB02A4CA562F33BF12ABF711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  PBO Manager/Qt6Network.dll
- Size 1.7MB
- SHA256 e94b61c2ebbaab58db6b525b79cdc78072723ea9bd8f838cd79ad850f25cc275
- MD5 df60528c2d7679fc8f1fcf011f10a739
- SHA1 60477a6cb86c16615b75036f899c4ed496c7f5e2
- SHA512 44442acc7b7d5068439ea314006e657680d27244d1eb75a24192df77ebfb29a95f161ada4469e74528cd94b5fa90a66ff73d150cd8c2167e9857852b09b370d3
- SSDEEP 24576:Y8oSlEOMtSlaPmvCKD74lRE6ckNaPvhzQgLf15+:+S6OMZmvCKD7KKTqgLS
- TLSH
  T16A856C57A3A442D6D46EC17CCB4B8A0BEB72700493669BDF02658E152F73BE22B7D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  PBO Manager/Qt6Widgets.dll
- Size 6.3MB
- SHA256 6c139cf501fd4a4cf2b690520df79dd02687df061d51eb6b3c91757d503ef909
- MD5 f8fe94ce6e3b33f68a02b2168f0d329f
- SHA1 1fce468419f3b83b5640f492d3593023979b618d
- SHA512 730fe9e801f3d9705cb9f7285ad7fa379b9475b85220498a7ada7d7d6caa1c056a3d943923f5dae60c0bf6e6cab0d39513c0fbc62307cf15bba746f6ef2eb2dc
- SSDEEP 98304:s5XLmsLgex105PXU0fr/NDTdxu1hnHTKiRk:s5XLmsLgeD05PXU0fr/NDTdxuLnzVRk
- TLSH
  T1F4667B57A3EA0185C5AFD13DCB1B8A17EAB2700443229BCB0169CE552F737E16E7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  PBO Manager/imageformats/qico.dll
- Size 45KB
- SHA256 a9f940f04e2511ec6c25e083635ca7e0c88518b33745ac84beb611c0feb8d497
- MD5 26ab073f06ff52d2ffeb4ee8331702e1
- SHA1 ef9f2024a4e8af371852be39dbd2dd8b2118acaa
- SHA512 0b08daeee76687bc907fab269b732574c77571da2d5823d360187fd35cf69455e541122ad4891984a60843340c80a617c9333470a4b584d983f968f56d61fb7a
- SSDEEP 768:wrYUBUjz9OXYC2psXtR74fXhTLXwjcgKxnVbGYJNh5ALiA:MBUjz9OI/sdR0fXhTLXwjcgKxngGQ
- TLSH
  T1A7237C9396790186F967C678D4878A33E9B6F260AB53C7CF0261861E1E733D23E78744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  PBO Manager/pboc.exe
- Size 951KB
- SHA256 55ca577c69d3fde2cd6e039efe4f4e3205a3f363edff86da00f6e740b0e476a4
- MD5 2236dcae49573d2b9855a37de589ad4f
- SHA1 dc81e1f6b0f1d9545ba10c176bdee49dd7bce4c0
- SHA512 2475badae9d64a07897e3c4d7e808faba726053c25c939c974068483fc2d196a3c0231929e8d56e99b7f1dc2cf0d6346807fff3c01e1a9c8ca6e9fd56f312782
- SSDEEP 12288:P4OMUZ0EYfGrWAIdrhFPLf9QWf7tH63ktldOsvY:mUZ8XAKrDzCY7sUtldOu
- TLSH
  T19D253926724441B8D166C2BE8A86CD71E7B27C4603518ECB06D3BE633E372D54F7A6E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  PBO Manager/pboe.dll
- Size 97KB
- SHA256 cb44d6111e2884264e2ebf37740c2fa358338d41546186d44d26f98ca2ea161e
- MD5 e17ef328f4a2b4823a693f3f57e0617c
- SHA1 7f86b868e5b5e3fdb107365de16b3db1b15062d4
- SHA512 ff85ae24e33b7e55ed2743e987e3b4116cbc78308047a5d7cfa4db8bd70913467a55b3fc079f772d9be982c2e07aa66ee39e8afa687777140ee1217b0200ae85
- SSDEEP 1536:KxR0hVyRHJIedhwjqDrWgEXekQbJ09dvgqCZ9MYPWXdlq:KxR0i5aedKjq3wekQ09dNe
- TLSH
  T13DA31917FA59807ED1AAC578CE838C45DB72B8978BA197CF53504EDA0D737D08E39222
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral13 behavioral14
- Target
  PBO Manager/pbom.exe
- Size 1.8MB
- SHA256 303df27f01ae2414e001fe778299caeb38aa6be5fba69bf23fce7809952a04c1
- MD5 a69972286782076fedf65fff0b15b427
- SHA1 99399b5a2f0dec1b14bd2b28e79c3e46970bc156
- SHA512 dbcb3cdef038b40eeb25e9bf2ef0e63cfcb45ef041277528a726acf1d05008ad6376f7d90c1dfa5f757670d4db68154214adaee7b12c593c4df7e25281b993d9
- SSDEEP 24576:r+7GJfXzP+7lyfZFtPXeKMwhfY7mmChyqXfcq6:67GJfy4DVMwhCMhXUq6
- TLSH
  T1A6957C77E21531D4D81682B98A55CB3195A16ECE121BC99B0DF0BD033E321EBD9E9F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  PBO Manager/platforms/qwindows.dll
- Size 974KB
- SHA256 d58c61f02c2c477fd8d423259f6c51f65ed8c57c6aa2df3dd98272d47974a38c
- MD5 bcbf760811214b261e61e8253707dc1d
- SHA1 6fddeb7fee9a43598f7169eedd106bcf83288b4c
- SHA512 7d9c297848ff6f5553ac3ab87aeaa7ca1a5739a7bffced5484de6637de5a1d6e852cae84780e1018cab5691568fd49dbae70997eddb99d109e0ef65c7c30f02f
- SSDEEP 12288:OljiOvSZbtD+60ITno5Gkjed5Yj8brI0jG+612YyJa0KSJ12:OljfqRUNIjKGkji5bvI0jG+Oel2
- TLSH
  T1BD256C6B63A80255EC3AC07ECE6B8713D6B3705903A186DB4161CD197F377E22A3CB59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  PBO Manager/styles/qmodernwindowsstyle.dll
- Size 219KB
- SHA256 138701f32f1f570f46f50b6779d35d0b52175ee7eba37e6f26918321daa65d22
- MD5 eb628fa495eaf7359faee3a1c30808f4
- SHA1 3783859c9373126b67611e1c21589ab68ea0e22e
- SHA512 c8aef5622af48153368803340eeb3047353e744237b1f52a74fbd801cf58c5403711f8fac8430bdc53d2726a2a65dafa481d2da1796a49c736c0861468543634
- SSDEEP 6144:R9polA1jCn82ZoStWdrZvieSDWH0s2LyNI7twoLKbRKmSP9toJ60vsv8jWG:R9polA1jCnnoStWd9aeORG
- TLSH
  T1DE243903729216D6C967C178CA1B4623F9B330981312D6FF45A6CAB42F633E2FD39656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  PBO Manager/tls/qcertonlybackend.dll
- Size 101KB
- SHA256 01ff5d839709e57c6c5be481e4f6e11b1e07667f3b6bca1cf1a1a3f878ca022c
- MD5 975ce6843f547f338b10dbd4a396253c
- SHA1 3c17860fcfd9b1da41f931b4ea36adba4de2a94f
- SHA512 b813325db6daa120ecbc6a746d31b434d076799551ed7203ee63d8962e0edec57d43dbf3c87b25d502376c8e1adcf7254c771d9384134f2f292ebc8c3f816011
- SSDEEP 1536:SBV2ODzyJnNUC8Qh3ye7zjmydnrWK9uyR47sPg3ZfAWt1XBF8jsUgKxngy:SB0q8V8Qh3y4zjbnrwsmBBgs9K
- TLSH
  T1D6A38C07629401D6ED6AD2BDC7138907D3B9B04957239BFF42A1CA660F63BF26E3D214
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  PBO Manager/tls/qopensslbackend.dll
- Size 309KB
- SHA256 a1534957350c095b6a51e03c5a25bb78cd24bdd5f96eddb824b610f6c15e5508
- MD5 8df63c945624180c0c764653cba98b73
- SHA1 6bd86776b291354aea66f01699c139c9951bcd65
- SHA512 2674996f01fc316b54cd48f787497d272183c92476e26eea87920cef7df45a6301283f3c97913165d909c17a1375991cca10820120e747bd9198f54b81c3b917
- SSDEEP 3072:Z3zDuweWQo+HGI7FSYxNHQuRAb6MqlPq/2oR4jv9HpbEsScoUTrdJfiZJ2vN7P66:dubW3WvjaqJjoqv9Kwrq8ETDQx7
- TLSH
  T1DA64085373D41D86F42BD138CA478843EAB3F4029792AADF0221894B2F63BF575B99D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  PBO Manager/tls/qschannelbackend.dll
- Size 257KB
- SHA256 1c975e9f59d4aff5ded32efa332cacf6a94d32519b13267eba99794b9ca83f67
- MD5 d5aaf0cb3c08fff9d7f731a72e302943
- SHA1 35207849ea74905e7c72ad78300a09328b0dfb3d
- SHA512 93ffbc43b6cad5579d77033176f4c8bb16bc0c6dd85c103af464b8881f67d6c9db25e0d1632dcf913145d0486b81648ab82ce389f4da37008a81471c82a700e5
- SSDEEP 6144:XKvH0ItfjLbIALmQUYTzmk3Kt1E2w6pNjG:avHjhjmYTzawWjG
- TLSH
  T1B844276722900E95FC6BC078CA4BC807E6B370955362DBEF5221C95A1F63AF2B97D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Event Triggered Execution: Component Object Model Hijacking

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26