381407ece209408d8a57571656c43b3d768b8f4ce81298205f8ed626e4fc5b0b

Sharing

Copy URL Twitter E-mail

General

Target
fsdt-gsx-pro-202X_4.X.X.rar
Size 38.9MB
Sample260623-sgxchady8t
SHA256 381407ece209408d8a57571656c43b3d768b8f4ce81298205f8ed626e4fc5b0b
MD5 339d1765ea065db71aaa04d94b527281
SHA1 17f3cd4a2f847ab90abda6fb6c5debe6288038f8
SHA512 4d68b8f121cecf3e21c43fab79a496feb35c69c39c331cf9409252d04f3f80b5248e759dc4f585d25c48d450688d290e7382fc0ca1528e63f24c183ca0ed5da3
SSDEEP 786432:+ZkYbunfCK8ukeLxjo5g3Guv7b56yi37583F3+L+2sQMmDOB04uU9:+ZZSfCHteLloq3jb5rK83+LPsQwu4uU9
TLSH
T11F973349AD0E3BE978560D997721B048863F24D76478E30EAED12B18179E486F374CFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  fsdt-gsx-pro-202X_4.X.X.rar
- Size 38.9MB
- SHA256 381407ece209408d8a57571656c43b3d768b8f4ce81298205f8ed626e4fc5b0b
- MD5 339d1765ea065db71aaa04d94b527281
- SHA1 17f3cd4a2f847ab90abda6fb6c5debe6288038f8
- SHA512 4d68b8f121cecf3e21c43fab79a496feb35c69c39c331cf9409252d04f3f80b5248e759dc4f585d25c48d450688d290e7382fc0ca1528e63f24c183ca0ed5da3
- SSDEEP 786432:+ZkYbunfCK8ukeLxjo5g3Guv7b56yi37583F3+L+2sQMmDOB04uU9:+ZZSfCHteLloq3jb5rK83+LPsQwu4uU9
- TLSH
  T11F973349AD0E3BE978560D997721B048863F24D76478E30EAED12B18179E486F374CFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  fsdt-gsx-pro-202X_4.X.X/FSDT_Universal_Installer.exe
- Size 61.3MB
- SHA256 92ff4c09f2ddceb91a0286bbacfe9713f4be8fb9d8a9009181a241487ea8770d
- MD5 9b872895b7fec4c5bca93d90ccdd3ffc
- SHA1 364b9432864a36b8a61a3a61568e535b372929a0
- SHA512 e1b677fcade51f2c1d71c7e324dc8a043be84ca5134d776483ad41cda62a68ff53ed9646fbeabc46969173a3720bc43b9efd9398abb62b01cb7d734b66f7fdd0
- SSDEEP 1572864:jZ1CA8s2AgDaPVo7RYZGDf30R2AgDaPVo7RYZGM:juA8szBq76YDcRzBq76YM
- TLSH
  T119E7333F7228773DCA2F4B35563E82A098373A6521558CAE97F4490DCF764712A3E3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery installer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  fsdt-gsx-pro-202X_4.X.X/QlmLicenseLib.dll
- Size 3.8MB
- SHA256 dbd498683cc78469dcad1aa86f3e83bf857f1cea45cd77bec35139b1561c44cb
- MD5 e807c547a32e75c2a44c6343c1c9e703
- SHA1 cdbb22e196fa359cd7071b63777c63bbf1e6484f
- SHA512 2ee30b488c074fc151b5a4913829e50ad5ab315af64e0efc64068cc1d07585352e985e0dd132bca0a5334a1cfd8897a00a3769fef0f0242b8ebb361504e624d2
- SSDEEP 49152:LiVRcTiWkpNsEyeeZKeYI0Hsx5oVxCQ4mcQNtHjiWWoolQ4mcQNtT:2VRcTiWkpSERGnY3HQ5oPeWWN
- TLSH
  T1AF06294437C7BFE2C64D063EAD11842077B0E0858766E39B3FC9897E5E493447E92A9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  fsdt-gsx-pro-202X_4.X.X/README.txt
- Size 1KB
- SHA256 98fa3e2383b7df1be8598fea6b30f83f59e3f97df87bb06a764ea00359530697
- MD5 170067661c8b5ec9544e74d1bae0082c
- SHA1 f7b5cae0e33a028dbf20352aa9500c16715013fb
- SHA512 8480152be8c2db0084355014f07e98191a4ec1ea0e24db49a2b341df960308121085c8003b884d9cdda64c80d275f7a01d3546aa31d5270ceeece24834f94a6b
- TLSH
  T17F2165AF6B17537C3AF1635B2A4E3EE8F321E0A8E7446064356C405E3223434536B1DB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  fsdt-gsx-pro-202X_4.X.X/sitecustomize.cp37-win_amd64.pyd
- Size 210KB
- SHA256 fb2ba3a1f174d7f3e98c1bbaef253e603cd22c9e1d3f193792fe6ee29aeb83b2
- MD5 66ce773756cc492bf29467664df88a88
- SHA1 d5fa6f694f97c613fa7a641f2720f2e848cc7418
- SHA512 12342240d3e45b2c5537cc1745f4912518d152f14804b522cf8572cfc59c6119c3b37b9dda1ede15809e5a9487d92b69ba980380c84daf498db654d32e4e2212
- SSDEEP 3072:rOsNwtbnl6uxKZBIGtmWKiR5v9Zo7lHZ8WmmqOMTestawkVLUOj3PaAkkO:jNwtbncuxBniRewCmw35kr
- TLSH
  T157242A5A63F44013EAA280788E5AA965FAB3748D3B0456CB09E4DFBF2F439D572BD140
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9