0b83fde298439071d943c88d590c904e61a3a17d7a072e2d44692b50d725b0b6

Sharing

Copy URL Twitter E-mail

General

Target
Buff Achievement Tracker - Installer (1).exe
Size 2.6MB
Sample260623-hrfgmaaz3m
SHA256 0b83fde298439071d943c88d590c904e61a3a17d7a072e2d44692b50d725b0b6
MD5 d85c400db703cb74004e9fe106b77614
SHA1 960c279d36a76add3750273c10661e0cf67b8907
SHA512 2e700e05c19a22a611d46f37fc23f8edff4444a0cce0f5affe35ca021f3ba7d8a3d760f07ca1ce8c3450e071ec5faaf5cb5312f259ab889e7b18002c7164fc03
SSDEEP 49152:nZxSThxE87vxpsrFpIvQugIpwGkisFYzIw3UhsooAFhR8MxYHzc:nyDPN+TIvPcGtDzrkhsbc8MxYT
TLSH
T18FD53360CBBCA56AD703493179F1CA6B955BDD4293770EB6F788E4603928CD2324F43A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Buff Achievement Tracker - Installer (1).exe
- Size 2.6MB
- SHA256 0b83fde298439071d943c88d590c904e61a3a17d7a072e2d44692b50d725b0b6
- MD5 d85c400db703cb74004e9fe106b77614
- SHA1 960c279d36a76add3750273c10661e0cf67b8907
- SHA512 2e700e05c19a22a611d46f37fc23f8edff4444a0cce0f5affe35ca021f3ba7d8a3d760f07ca1ce8c3450e071ec5faaf5cb5312f259ab889e7b18002c7164fc03
- SSDEEP 49152:nZxSThxE87vxpsrFpIvQugIpwGkisFYzIw3UhsooAFhR8MxYHzc:nyDPN+TIvPcGtDzrkhsbc8MxYT
- TLSH
  T18FD53360CBBCA56AD703493179F1CA6B955BDD4293770EB6F788E4603928CD2324F43A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/app/cmp.html
- Size 5KB
- SHA256 6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
- MD5 d7b8b31b190e552677589cfd4cbb5d8e
- SHA1 09ffb3c63991d5c932c819393de489268bd3ab88
- SHA512 32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
- SSDEEP 48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG
- TLSH
  T114B1EA1A2D9924690173F3380B6BA204F72AA1A72105CE053EACDE513FB152BD58FFCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/app/index.html
- Size 25KB
- SHA256 a01c397205cd5c244d251e2d45c4ba0defaebb65e46b19dd41c374aa57845609
- MD5 5e1eded62b16e51764c2caca1d573cd3
- SHA1 aa0a80b807e05e221c3a1a9d97b995e999afbaf2
- SHA512 8cff142861fc840ac516a146ab92ec6c09ffc45b7a88807e610c184e92d105e0d035aee81b4a3e268809a762a60200d712b41b6dc7e43e46aada1e62914e4475
- SSDEEP 384:H3JlhPswS3FMev2v7JgjEc2asN1vnYBgfZZ285+mppHL:HOwS3FMev2v7JaEBa65nOA5thL
- TLSH
  T118C2A611DA36102DB237462EB5E1BA5E3024C117E5538A7FFA5C5A35CBDB18B1E13B8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app/js/app.js
- Size 23KB
- SHA256 80c73fa054dc523403bac4ce9cb4b80243e4d8d768e37e0d4d9e2fb0b26bf8a3
- MD5 22b5a0e6b59bece1ee52d613b2948ea6
- SHA1 ec174cbd58e227e7ccb74ce0c287a4b4defccd15
- SHA512 589df0bbe16a959e184f2c30999f366477f71dab5b24013bb91ee53080ae1409333d117befe3a3ca5e381d9011c4ec2031874441cafacd358e729eca8ad8a55d
- SSDEEP 384:4X+ycDQrczkyKdLGb9pBg02wjI3A4nzwF52xxYRifG6wBEoR3FGHWdeLj8T:0+ycDQYITdybKH3A4nzIAnGifG11R3Ym
- TLSH
  T171B2748E96791228E572633DAF1F4A14FB32162F15058A273AFD45C14F714128297FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app/js/block_inputs.js
- Size 789B
- SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
- MD5 b5b52c92b90f4283a761cb8a40860c75
- SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
- SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
- TLSH
  T14301D2D864D3A87A597DA328536BE748F7391964905A1054F0DC8C64BAF003BC16EDFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app/js/libs/cmp.bundle.js
- Size 391KB
- SHA256 039d5d4e442cc360b6f54923c53cba5432d80727b8d614a3ee99f7c70307bcae
- MD5 48ccfc31db67a9e9d6decd5b18df96f3
- SHA1 2086877b894bd0ddec2ae80dd853e47fcbdc638d
- SHA512 e369682bbba708ea66797024bc2885e85a4e2b4ac6a4005cc648a7a81d8a4b1c3691c5484408bbd847c40ee80d12e72c5d9722950da020b284843c10d05d0963
- SSDEEP 3072:iyUYM9z8F+GxPMqbOISP88WEAtvgnnhLCVJkNO7Z6BEFltnxKg8rq0gU:LrF+GxPQWEDLmkNO7Z6BAly
- TLSH
  T13D842B8D7991B0E617D722F1802F900BF33A6458784CC490B660D8F1ADF96AD927BF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
- Size 90KB
- SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
- MD5 44e3f0db3e4ab6fedc5758c05cf27591
- SHA1 2d408aa1d35661019c95adcc60b78c0727ed25b4
- SHA512 4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc
- SSDEEP 1536:O4mCgi8DyCuXXFiJ+L0kJQsJVPEKuQRZdC/RAfDknv+p0WzH/Io9Z7qABZnu0JFV:OGsKYAI2p0WP9bDrJ7fak
- TLSH
  T1D493F8DDB2D1B06257BB21BD006F540FF236195D280D8850F129E8EABC74A499277FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $PLUGINSDIR/app/js/models/notifications.js
- Size 5KB
- SHA256 c32495d55eed52f47dc7268eeccb90fb6bdc5686135ed089416c6bb8f703a578
- MD5 911451f65b2503d23bc27c6a6aa6af72
- SHA1 01d3654b23ef7f5adeb4097bd851e8c100a7b2ab
- SHA512 06edaebb0bb2980a7b6d6baa31a9c0894a9bb5f14a91468ffb8f182d98f04bb811df2a4c37f0b56d612603528aa21f390eaa7cf885874ae770a24dce2f9b249c
- SSDEEP 96:sOr8u1s9FHYYdfHsW/GZwzpJGf8mui+U8QrGjqTxoOxoYsdfHsW/GZwvpZGNjINU:sGu9GYl3rNQ8K+JQC+N5Rsl3rxeEYIo
- TLSH
  T1F5C1AB5F90BA00A7057293A819370342FA5753AF49408CAF737C5EB40F311A6B4E5EDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $PLUGINSDIR/app/js/utils/analytics.js
- Size 5KB
- SHA256 1b7a51f60f9104c8790dab1556e4ce1b31e89372688e3e179f1d8c50a849dd21
- MD5 cd174d47c7d45655226f17acb386fabb
- SHA1 b6c91ff15f297a59a95d919e38482e10e3b92a1b
- SHA512 61e46e4d43b02431145d9b1c3719a2ced4d215cf8b46110f0c4c8faace1d4ca4c19e75a08c17a2672be403ba4dceaa8b5d7bf94908c2f58fec3e28f92d9b0126
- SSDEEP 96:LlYkmHqqVHlnZ4JGvt+QP2EvVkuko3sO2Ld+gObNSPgPgzauV:AHq1GV+kodNObNSPvzaA
- TLSH
  T106C18829246A719068B373B68F5B1519EBB117233144E9223BBE87416FF6D02C693FCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $PLUGINSDIR/app/js/utils/commands.js
- Size 14KB
- SHA256 cadd2cef20dfcc04296d9cef6fb747966eb3d059d5c0eabe65607c4094d803cd
- MD5 5987718e473fbf0ee77eaeef1c9bccd2
- SHA1 156e240876de09d7813f8855610d90140d5330c8
- SHA512 0783dfd010da0a0b0eef36fec23f06fed6d040dbcf1fb78afadca8bc79eca83558a36bbd7e1560042a5efc6bd1c0c15b13e79903fe15fc570ba3ab6c9741b8f9
- SSDEEP 384:2Ur5HB8cDe1uUvULQq06W8tusv5qEWOnvAUF:2VTsh
- TLSH
  T1A962CAAA68A721651933B73DDB9B4215FB33083B11465C107EED86917FF6802C2A6FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $PLUGINSDIR/app/js/utils/cookies.js
- Size 1KB
- SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
- MD5 6c60e675f8c8c68c0174b644d3a63a2a
- SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
- SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
- TLSH
  T17721E0087580D81EC5725739AE286778FD30992611C6D54DB88CA4F02F30C169DBE9FF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  $PLUGINSDIR/app/js/utils/modal-events-delegate.js
- Size 1KB
- SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
- MD5 117e4fdbdb0ecf211c8bd909efd337d1
- SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
- SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
- TLSH
  T13C31D54D36FD173AE5B7172B5B2F5F8CAB72120B09054A26B2E69A804F354241196CFF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $PLUGINSDIR/app/js/utils/strings-loader.js
- Size 5KB
- SHA256 96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf
- MD5 9c94eb933d8a43dd3825e67a7e30c980
- SHA1 7ec7b16af6f399219209ba5967d377040486a11b
- SHA512 a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5
- SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6WfwkUlx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6Wme0muXDK0W
- TLSH
  T163B1FD58289314118C32B764CD935264ED6A4917023996F3FDEEC2686FB149E82F8FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $PLUGINSDIR/app/js/utils/utils.js
- Size 118B
- SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
- MD5 a0952ebeab701c05c75710c33d725e7e
- SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
- SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
- TLSH
  T1ADB01274B7AC73A2D315377AACBF6C1DF0375C368414B099B19034E19572D04519DCD4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $PLUGINSDIR/app/js/windows/cri/cri-controller.js
- Size 5KB
- SHA256 051f1d8fd41a0e7a6727c628885be179fe3e390c5b431b18a03911fcc710c601
- MD5 222a3efccc749b1442f012aa64757753
- SHA1 f0f13e5e3e3bda57f0662032c700a6bcd4aee807
- SHA512 292e0413dc9f821b934ebeaa988a6b9cac8cf94053af27e7a01cc47f9e99104b2f5a7ce250098426a9400f3cc188efa3f3c1c79340e959114454f5da472b14b3
- SSDEEP 96:u6CeVFfOhETv5T6ToY/aqBb2WCtvKqKLANwGy0keErsvwn:u6jVtOyl2EY/aESWCqANu0krsvwn
- TLSH
  T158B1CE5C3CF9866158B7277ACF261518E73742172241AA2A7AFE47804FF5F00461AFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  $PLUGINSDIR/app/js/windows/cri/template.js
- Size 1KB
- SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
- MD5 2f82acef2d339db31fab5c73edf8af19
- SHA1 d9138de6fe1320cd232fd6e1971fbbfdb9225bd6
- SHA512 90311035970edf2c1d0175c9b718c731fad4f58ad5a0b43a2588e2e6132cc09deff1d49328174408c51fe3082d62612f7a2a6c25179ac474101468ab68c2abcd
- TLSH
  T188212E24441C90331B7B979BDA13276CE9519301D80B7D3871AE43A82BF3B828E62359
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32