7fe3048320dac1cc1688b9138114a4243d447532a1b7731e1c320dda7d80a97c

Sharing

Copy URL Twitter E-mail

General

Target
01_iPEK-Studio_V6.30.0.zip
Size 8.2MB
Sample260625-xpbszsew2v
SHA256 7fe3048320dac1cc1688b9138114a4243d447532a1b7731e1c320dda7d80a97c
MD5 9ce31896c2faa1c22f2ceb4c44c70ec9
SHA1 e3a091b860041d00a24995084518f9e2053f0f56
SHA512 bd127bd26c4efd723fa2004df23c36c33e2b04ee305fad27a1fc2568c776a257e209534206a47b7a919c049d547736b275798d10036caeba1ba485102c475411
SSDEEP 196608:intxMcp49c6RbL2d703zGsvHnXFjilY/JwjKwmkFrfuxjnzVy1/TLetfAH:intxZK9eH2HVjCKwFFrfM1y1/TStYH
TLSH
T13E86332BC1C8B4F2F84F8135FE5A2C95CED5A5B82ACF04766CC4E1814466C5F2A6FE94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  iPEK-Studio_V6.30.0/IpekStudioInstaller.exe
- Size 6.2MB
- SHA256 f675520a3310e80916189d65986b4b2757f831df29b3d0e89b30f9cff7ce66d5
- MD5 9e9cd5506fcae39470770798761a690b
- SHA1 d24785efa837b3c8195c3e44e87b995670efbac8
- SHA512 cbd2538280d1f491426624da50a95cf4135517cbd6b63566f50adaa509ec801192cb35e4c6943fd5a98df0f55a3dfac4e9e48226a5f226dbcb790b12d86e554b
- SSDEEP 98304:gXfb8XBpUbYBBtzBd47+x1ORvr54uOY74t9d91K/ELBrsOfdFDNrucSgK6NyBU:cgXBpUbYntNd4ax1cF7E9dmsL9nhRyK
- TLSH
  T10366336E82C0E0B1E56B833265B62D0D37357D393C75E64FEF89B20A6771CC39526928
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 15KB
- SHA256 3948484bc6a6e8652c2220be411cdcabab73eab46578faca8c0bd01d3ea290ab
- MD5 f894e7068ee5f5b4489d7acdde7112c9
- SHA1 79ec857791ad4ac76673b05e6fc44e55315424ef
- SHA512 e85b2bdc27b9721425bb03393e8aad897647053c77d7862ea541e03dc896173af6eaaf182514d46464d560d15c6b9d4652690885426ac1c68e2b9dd8d632e816
- SSDEEP 192:VUmFdGZ2ESi0SGlIO1yn3B+boYt0/SNFdTmUJJimGf/5b2xlUqyWWKCi1wlLjck2:FdGZ2ESnTqkddTm43saIvy
- TLSH
  T17762B6524FF903FEF0B166392BF9256747A6B90025B1C10E4B518E8A2C31B9A9C78733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 6f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
- MD5 ab1db56369412fe8476fefffd11e4cc0
- SHA1 daad036a83b2ee2fa86d840a34a341100552e723
- SHA512 8d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d
- SSDEEP 48:S46+/zTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mxofjLl:z5uPbOBtWZBV8jAWiAJCdv2CmAL
- TLSH
  T123C19474B3C248B9C491413368AB33D36612EE746784500F9B6315AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  bin/IpekStudio - Kopie.exe
- Size 5.4MB
- SHA256 5e8cf23524ea8ab9b8587c88cf11fe7c82b18d91c01e6e063795f563968bacc8
- MD5 db569b022567e8a8064444d0fb115078
- SHA1 5f2d95d9edaee4cf304515750879e914f0fd3a09
- SHA512 942b854be053d4d8b34051916103ef13ee327612bd1e30efc00550fc619190053e35c3938a78f4e02ca39f7b3c24109ce9a27f4329caa32d0672d569a5f468d8
- SSDEEP 49152:R1WPuDIEeDeGg0qqrZsK/TxWeJmKp5le15JYhSu5DwZfbXL8RY5S8tpqZSe2VVeR:qTY150D6DQRkZ7e2qpc+lQAb
- TLSH
  T1E8466B61A3008433C1520E784D1B9B9AA87ABF6C6DE0674BF664380D7FB0791BD663D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  bin/IpekStudio.exe
- Size 5.5MB
- SHA256 aa9e4f7ab47c99a1d50e300cab218cd9fd01438cdf5be5df29548e33d3a5af81
- MD5 bd2bf8f29008a467293781184a304ac0
- SHA1 a625a99c2b1d843b058257962389a73dad06f338
- SHA512 4d1b81be2f14edde6619ce319341af5e1a285101e09adde50bf0b4697ff72fa5d7cabdeda93518e0483f65396b76bb119614da4f780e339a470c0bf40cf35fdd
- SSDEEP 49152:wIKDzFEkV3WApsyTovqZLuJ/+lIfl5KumGPj7Sban9hvI6kxOFM0lsy/NCE8gYA2:ELPumGFn9hADxOCwL8atpc+RdV
- TLSH
  T106467B21A3048433C1530E384D1B9B9AA87ABF2C6DE0674BF264794D6FB0791BD563DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  bin/Uninstall.exe
- Size 720KB
- SHA256 05031099166163215ad0fd865de66f272d1083019d3c16c492d72ca2683f36c0
- MD5 92ea03afa354399971b976af2551c181
- SHA1 2cbdc6d3f65bce59dc823d3bca1b86ef11efc7af
- SHA512 bb25132fcef04f83e1c7e551bb0b061b7b43f8346a9787e109038873b35bb06022a916fec4c850733f04df9fdb5fbe4ffacde584823e5c09e110aa5b1c95f218
- SSDEEP 6144:1mGIh62szTRflTTT2X1Yzf5nKMzT2f1gDjTEkSUaJOipJ:gu9H5Nbzf4MS1gDjTbSfL
- TLSH
  T1E6F41C84A6A94290CECB07B0B661CACB4F01BED41A73585EE7EB758BE5B3153BDC504C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 6f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
- MD5 ab1db56369412fe8476fefffd11e4cc0
- SHA1 daad036a83b2ee2fa86d840a34a341100552e723
- SHA512 8d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d
- SSDEEP 48:S46+/zTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mxofjLl:z5uPbOBtWZBV8jAWiAJCdv2CmAL
- TLSH
  T123C19474B3C248B9C491413368AB33D36612EE746784500F9B6315AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  iPEK-Studio_V6.30.0/iPEK Studio_V6.30.0/bin/IpekStudio.exe
- Size 5.5MB
- SHA256 aa9e4f7ab47c99a1d50e300cab218cd9fd01438cdf5be5df29548e33d3a5af81
- MD5 bd2bf8f29008a467293781184a304ac0
- SHA1 a625a99c2b1d843b058257962389a73dad06f338
- SHA512 4d1b81be2f14edde6619ce319341af5e1a285101e09adde50bf0b4697ff72fa5d7cabdeda93518e0483f65396b76bb119614da4f780e339a470c0bf40cf35fdd
- SSDEEP 49152:wIKDzFEkV3WApsyTovqZLuJ/+lIfl5KumGPj7Sban9hvI6kxOFM0lsy/NCE8gYA2:ELPumGFn9hADxOCwL8atpc+RdV
- TLSH
  T106467B21A3048433C1530E384D1B9B9AA87ABF2C6DE0674BF264794D6FB0791BD563DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Deletes itself

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24