1296d7e7a3e52444aec8cae2c855fb971e86d0684342382e38d2349bc0045d8d

General

Target
Samsung_HARD_Downloader_SM-T585_ITV.zip
Size 11.0MB
Sample260622-t7kxtset7k
SHA256 1296d7e7a3e52444aec8cae2c855fb971e86d0684342382e38d2349bc0045d8d
MD5 13e4c7a0b7b76166180284b40343f0c6
SHA1 2242f5680d93b0a52648a3aa13eb3cbf7f7ea0f2
SHA512 261107d36e72b56f935398ba1023247f0b3c781433b143b04a7c340d5d30e61fb4c04b74fa2ab56b9d2169d3aa70fa2f9dee015d10414cd651413b2e1aad64ec
SSDEEP 196608:Vtdn/izLsuw7wq1W6HqULS8djZDTaNNeCKVP5ORsgQfeyrZMt9CzrKqaHQH1Pjbu:Vtd/sIuw8qU6GOjQoxasPmyowzrKdwtu
TLSH
T10DC63342F342C78AD2176E758BA1D387096CFD192F17D71BA05E6A11E8831B01DE6BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Samsung HARD Downloader/2008.exe
- Size 1.7MB
- SHA256 c6a7e484f4d84883bc1205bccea3114c0521025712922298ede9b2a1cd632357
- MD5 b936f0f378b9a35489353e878154e899
- SHA1 56719288ab6514c07ac2088119d8a87056eeb94a
- SHA512 acdf7b464a258b3ae3015c808d0e08a697ba3209662faa9b18c1aee882bf236dc725f6c3425cb6f9e10d8ab5cbb82ac118ff947a4b9ec6f91c2e150b0beef70f
- SSDEEP 49152:wQixbpVndRcpfqwYO3u2XoKNLlMDEe/pmVS/F0jD:wtdnfnwp3oOLuB/3/uD
- TLSH
  T1CE8533428124885AF1C52A30ABB73E5E8EF9D651743F87BB314B8543E65B770A923F34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1
- Target
  Samsung HARD Downloader/2010.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral2
- Target
  Samsung HARD Downloader/AgentModule.dll
- Size 2.0MB
- SHA256 d46f87b767dc82bf9a180bb2a981058909ff65cf0de6edfbc917cbac0f719f67
- MD5 73cfc7a409101d5635e8042bcdf5c6c7
- SHA1 cf5cc36776c8ec4582bd356b6833aa0905430a92
- SHA512 4e823b31f81aa3f6ad22b26ec55389764867b6e66daa73d17c4d5f501d6a817be520edd49e7dc7c1cee43caf7eb533c456ebfef021c528edaeb9a099325fe12c
- SSDEEP 49152:kylT3MFWj4LouEfF7Mgi4kpCzrLmq064lTRQCyqjc:thcFetTfF7Mt9CzrLmq0DltQLqI
- TLSH
  T19BA533C066E20167D583DDB7F6D2CA8A4EABA39D6F9EDC39440C42C24446D419E09F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3
- Target
  Samsung HARD Downloader/CommonModule.dll
- Size 1.5MB
- SHA256 44d33f4dacfc4bac2d56a49194ca4d40bc3e3f72478cd20ed696b1d3f110cc96
- MD5 eda386546817f68607fc7f3361c89eac
- SHA1 221b78ac990d558f0565d6cc8b7d16786d4afa10
- SHA512 b51f0fe242ef0fc300163b6e56364a43f8dd26207c22be4110fa42aa291ba324193b795c548646c98644a8670449a54c37009112c10832f54a4a932713100680
- SSDEEP 24576:xdigP0DDbamB99f7yxucOzg8mhkF/tlDkF5enYkHEPPn2a2IJeARStTzzn4CwcNx:xdizv9f7yxucOzbmOdtlDrkn2fMeak2g
- TLSH
  T18C7512F43A67DACAC217EB7D1959920B99A4B2C50DAAC315500F8E125D01BB47F3BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4
- Target
  Samsung HARD Downloader/Download_SM-T585_ITV.exe
- Size 769KB
- SHA256 146b70780ec04d998e9946e6eac2a3598e864fcf9751958ccd20aee21c4581ba
- MD5 10cb5c725559ce7407c8b5fb0086b2e1
- SHA1 1c10c9c7688ea912a58c1923231d7c0d1d9bd15a
- SHA512 31ce17a9b0105701ec621d0144277f2ae46413f347a16cdf769badfc92e8c236eb02a69052a104bf82ccbc615e123d8e614a436b959e41e4ad45cf6c20af3375
- SSDEEP 12288:gTtkAiWUnYFIuUWq1dXWWPE+F8tH7Szv9J0DiKrAXBmqAdQEKVsXx3cywspuM96:gTTr1MxBib6
- TLSH
  T1C4F4AF0BF342C74AE6261A758FF5D392125DFC2A2D57E79BE4DA3E25E4930A00CE01D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5
- Target
  Samsung HARD Downloader/GlobalUtil.dll
- Size 84KB
- SHA256 b485839fb3ff94a9e47c385c01b0d463ef17228dedf9aee7b3dd06e5510b00f8
- MD5 e067119015b8c3b03bbb2d0e747ff4d7
- SHA1 29da2adeca0835cae0303ef9bb7adf907405a353
- SHA512 4cc6f3c56212fb71edd32a91f13e571f27e704ae477a3e9b21685aca0732574a270cef2b145911586a871ff358f8eb2beb050d526178891853935baec7cea448
- SSDEEP 1536:eqh3qc17S8nBbgP9CFfECC21ulzTAikD4+hs2fVWl+w6miNAK3:Fqc1pBsFCDj1u9MH3fVG+w6miNZ3
- TLSH
  T11483D0C24B792C4BCE13DD7E569181275CA8FA9892ADC172605F4B138DC0BB4BA8F71D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6