43969208a13fcdabcde9dbb6cbea3333cf41047b9456ab2776385638b50aca54

Sharing

Copy URL Twitter E-mail

General

Target
FileRecovery_Free.exe
Size 5.5MB
Sample260623-t4c3taes8q
SHA256 43969208a13fcdabcde9dbb6cbea3333cf41047b9456ab2776385638b50aca54
MD5 6df5387facf07dee76ed1b0d69a2c2c2
SHA1 f4638755909c0762b6b6cd6a87861c3ca221a942
SHA512 9091157dc68228997bb34c587b20869ff27a29ec9e9f41426ad4709690a405a965bc63d237e5707264bb2f356a3099c1d57b67ffd6e7b12d90765c662ce643c4
SSDEEP 98304:VFQ9UamGadx4AtzwK9ltrNAGNs1DgAtayHKHikNcU2ercubj63GDs9tzbIETe5bc:V4AymefDtZHUUerbXZaoET8ra+hWn
TLSH
T11F463391CBE398F2C77FAB30663AC93B96B396148D6085FB67D917BC1C64384B540227
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FileRecovery_Free.exe
- Size 5.5MB
- SHA256 43969208a13fcdabcde9dbb6cbea3333cf41047b9456ab2776385638b50aca54
- MD5 6df5387facf07dee76ed1b0d69a2c2c2
- SHA1 f4638755909c0762b6b6cd6a87861c3ca221a942
- SHA512 9091157dc68228997bb34c587b20869ff27a29ec9e9f41426ad4709690a405a965bc63d237e5707264bb2f356a3099c1d57b67ffd6e7b12d90765c662ce643c4
- SSDEEP 98304:VFQ9UamGadx4AtzwK9ltrNAGNs1DgAtayHKHikNcU2ercubj63GDs9tzbIETe5bc:V4AymefDtZHUUerbXZaoET8ra+hWn
- TLSH
  T11F463391CBE398F2C77FAB30663AC93B96B396148D6085FB67D917BC1C64384B540227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit defense_evasion discovery installer persistence privilege_escalation upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Windows Firewall
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- TLSH
  T1AE717387378506B7D08006303089BCAA3B9E9A350F5B59BFD6DBA99F7C641F4E134706
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/KillProcPath.dll
- Size 21KB
- SHA256 9c488b18a112f7edff08d9b35b15f457bacb7a95c2d1372b456b47937de5c6f9
- MD5 03c8c0479c6ecad8984c185b5e915a59
- SHA1 49113dba3cd1a06e45339db5b3c7a5ac4e96bc71
- SHA512 cfe9f3125f53c56e9757319a716708daa6e4c4f3c5063d66325c906faa29b9c1fde913ab42f40c8510df0e9207bff5cc66be04fb93d03f4bf8807611ab8caa35
- SSDEEP 384:s96DqvQWcWuChjhU1MPioxxV1DG/37h6:s9DvQWHNhaMTxV1DG/rh
- TLSH
  T1BCA2F5A6CA511C52ED2A8E7131D4D926AF7977827795C0FBE319C0A08FC1782B4FC17A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/MachineCode.dll
- Size 302KB
- SHA256 8736d520fe2e867153b4c7d48657ba0e99061e82d58de80356a2b406c36be882
- MD5 c1acbfea24181b66abf4d6236aa42ac5
- SHA1 82fee2f2f1da872e9e1a8b272afecba396a10553
- SHA512 dee2751f3e1a87d73eb6488af2d924c5575e92b07bd3aee1b24ee4fae0f400e65ae0e23f8515bd12a60e72aff33bd74e00a94249bf4e32a5ade0c8b74018018a
- SSDEEP 6144:tigS2EefhHic7VnfCHkYNEFo7KLSJI1cBrreqYz:tTEeEGCHkvWKLHcE
- TLSH
  T193647C11B781C472C69E22350556D37526F9BD609BA1C2C7FF903B6D9F326C29E3834A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
- MD5 b0c77267f13b2f87c084fd86ef51ccfc
- SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
- SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
- SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
- TLSH
  T162324A1503904AF3F996C13C14263ABF7F792A218BF14E939FA39481BE2D5D96D39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/modern-header.bmp
- Size 25KB
- SHA256 8c5598d780ddd0229fe8d8c6727b7575ff26b953f824e33cc82e7dfa69af7a21
- MD5 ac656ea12e21eac257916149a7277957
- SHA1 3e094d5ff4ede65e17acad5e2918952ff3828182
- SHA512 1c0136ed8c214f1320afdba9a3ac8d638e5ca49f4e456abc3c73ec09f6f4ca5d03de73b70102ad9662708037136ac2e53d36f718d9cce9cb803286c858a12112
- SSDEEP 96:eFEDjqiOu3yDA70zmRudpPRwMoV1UsrItsjKkWBcEFA:eFoBOsyk70zmRudbwMoVmsr00zEc8A
- TLSH
  T176C2968DB663E1DD96541228ECE396BA4060BF24AC6EDE772F91739EF17DC437042209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 149KB
- SHA256 36058c03b9f5c0e345dd8d07cab9fa86910c6a4604b645458e15acbf86313616
- MD5 9b25fe6e6d4275b30169dc8b1e5d45ff
- SHA1 b17007b3d530d40d9c45f197c717c0efb7e09adb
- SHA512 868eda87fd06e91bd3726d0e27ca37aab254e0b8b8616fbd4eaa2d32a54eb2e6943585b48c8a71146a71e0587b7a71f4ae9feca7d3d41fd2ba026587b3722db4
- SSDEEP 1536:ku1KAoef9r/EY5+dCMF9s5GZyj5+UcTUydqathaHoR/TOF1a2Bl:km2of
- TLSH
  T11CE320DEBD4F5A74E7D23454E088AD3E5609AE327027ED385D07A208EE13E4B52B7D90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3
- MD5 eac1c3707970fe7c71b2d760c34763fa
- SHA1 f275e659ad7798994361f6ccb1481050aba30ff8
- SHA512 3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09
- SSDEEP 96:oXHqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4AqndYHnxss:oXHq+CP3uKrpyREs06YxcdGn
- TLSH
  T108121A635A4455F3D5D7223A216A2F2FD77C9324A062BC0287779E462BF431A7E3A341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/tips.ico
- Size 17KB
- SHA256 94fd288aaade1a3255ef08d09b8dce2fd8d5173c9283bb1b0594c3a7ae1ebeef
- MD5 611e75b4c90e2a93a95eaba2e69c5b56
- SHA1 2afceadc0a7be9212373eaef85c32245113eb57c
- SHA512 d56559ca95b646d1264d54c9f98d3a439da0bac34116971a9166e5a3988ddfc8516742097c94f58bcc44a36f60f7394fe2793190b7c89f2f101fcff55041d889
- SSDEEP 96:T42F752BJi9URaHo7dfNFD7k0Mzepe01NcPK7+:Dp5UJi9UwIJrPHmesje+
- TLSH
  T1D27286267785D250C391C6318FE2D26921990DB0DD51AB1AC5BCBACFB97CC4E3E32D89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  MachineCode.dll
- Size 302KB
- SHA256 8736d520fe2e867153b4c7d48657ba0e99061e82d58de80356a2b406c36be882
- MD5 c1acbfea24181b66abf4d6236aa42ac5
- SHA1 82fee2f2f1da872e9e1a8b272afecba396a10553
- SHA512 dee2751f3e1a87d73eb6488af2d924c5575e92b07bd3aee1b24ee4fae0f400e65ae0e23f8515bd12a60e72aff33bd74e00a94249bf4e32a5ade0c8b74018018a
- SSDEEP 6144:tigS2EefhHic7VnfCHkYNEFo7KLSJI1cBrreqYz:tTEeEGCHkvWKLHcE
- TLSH
  T193647C11B781C472C69E22350556D37526F9BD609BA1C2C7FF903B6D9F326C29E3834A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20