d4006e160854c5ca0b78a1d27c95f5d27c77547de819d543fecef9d5abd64c18

Sharing

Copy URL Twitter E-mail

General

Target
ABDownloadManager_1.9.2_windows_x64.exe
Size 66.9MB
Sample260626-jmh8dsav9r
SHA256 d4006e160854c5ca0b78a1d27c95f5d27c77547de819d543fecef9d5abd64c18
MD5 b1a977172e114d1f7143868400f7da24
SHA1 68794aa78051704a5fc7a464cd34eb3681fab468
SHA512 4ba2c80779610574e31c1d968c48e7e4869334f47e444da3f0797a3d0d7a097f0f2c0a48c39205ee08f5d87b76a83d52d33b6affb161ed2ed47d1f24bcfc24e6
SSDEEP 1572864:2Gwjo3RS6DkwJy9ZQjW0vHmXr24B0i7dnYHbgSl+BVlU30bp1PrVh:2Gb3R49ZQjW0vHiq2RubgSl+B3UQp1Pz
TLSH
T122F73373EECE6337E511FD3EA16304A22504C6D9A39FEF34289A753DF896EA011016D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ABDownloadManager_1.9.2_windows_x64.exe
- Size 66.9MB
- SHA256 d4006e160854c5ca0b78a1d27c95f5d27c77547de819d543fecef9d5abd64c18
- MD5 b1a977172e114d1f7143868400f7da24
- SHA1 68794aa78051704a5fc7a464cd34eb3681fab468
- SHA512 4ba2c80779610574e31c1d968c48e7e4869334f47e444da3f0797a3d0d7a097f0f2c0a48c39205ee08f5d87b76a83d52d33b6affb161ed2ed47d1f24bcfc24e6
- SSDEEP 1572864:2Gwjo3RS6DkwJy9ZQjW0vHmXr24B0i7dnYHbgSl+BVlU30bp1PrVh:2Gb3R49ZQjW0vHiq2RubgSl+B3UQp1Pz
- TLSH
  T122F73373EECE6337E511FD3EA16304A22504C6D9A39FEF34289A753DF896EA011016D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH
  T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ABDownloadManager.exe
- Size 541KB
- SHA256 61ad36f768a7668f54262a6ed52645bcaeac8f295916a1d6d94109577e2af9a1
- MD5 aa29041d5a2bad8a1e920093cdf4237c
- SHA1 d20d2295afd9f66f98f6bc14aedac25a086f7374
- SHA512 71dd96630bfd0962bc814073a69669c48c2fa8971a28a6860bbb4059f63bce13dbaaad48056870bbba57922d0d81e5a9a588fa10aed171750166307da19ddb73
- SSDEEP 12288:GpyDcGs+09VuYUY6kP7B6aCS2d2Sopm7E:rcGM7u9Y6kP7MTopR
- TLSH
  T1EDC48E16A7E842F5E077C6388B4B4543D671BC59037D932F03E2DAA59F27370AE2AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral7 behavioral8
- Target
  app/ComposeNativeTray-jvm-a7f8d1fca19e8e18ddd74fe3ba639a2d.jar
- Size 685KB
- SHA256 17c075d9fb0b37e6be909a0d27d6c7ae1c26f8ac44154cce2f741b4c8b1b7732
- MD5 a7f8d1fca19e8e18ddd74fe3ba639a2d
- SHA1 d46ff96b70f9e5394ea37f6c3629871b5d0d4bf8
- SHA512 b35c678a3a17f5d6eb15614000c14b601bca2e77c36b23f9fbf497b671caa5f66d87b8de54ad79f3f7cad43f92e7cc578b2271af9651ada53c9772eec9e2622e
- SSDEEP 12288:yuhqEbAJyykYx/dUyMglPaCVWbFM0+GSlntpNEaJjFHs9DHEPybce:yu0kYDJJtau95xEaJjds2abce
- TLSH
  T1D0E41236365CC979D873A37863390923F85D1E6CE993E12B13A841774AF24732F45AC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  app/aboutlibraries-core-jvm-225ee93bf4d2373655a49ac991ca0a7.jar
- Size 56KB
- SHA256 326cd92f7e1449f8e5ff6c17e6b7d81f5329099efd44004562cc7a98ce0e7ab3
- MD5 225ee93bf4d23736055a49ac991ca0a7
- SHA1 b8e95006711859ac8c92d4315a30abe98b2a70d6
- SHA512 94cb1da78d5479eec7c3b77a78db89843a8b2637ab48a6a9bf683cc64627278a7954a8694b48e2b90065e5ef1e79f582fb031d04b0de4f0eca65548ab2bfdd4b
- SSDEEP 1536:gTB+t5ikufEyJknwf9hyhiW/lpZ+LtNVugHFcwtf5D:O+v4fEFnaihiWtp8Lt9lca
- TLSH
  T19543D0AB27CC4063F7338871A520B5A79D1B2FEC895F51672092498987F6CCA43463FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  app/animation-core-desktop-1.11.1-3ec8687bba1c875f4630e7c99d49defc.jar
- Size 380KB
- SHA256 1b3af8d20627b01101d827f72e26dbadccc8d212c0ffc0c02ff2a6fc967a6ca8
- MD5 3ec8687bba1c875f4630e7c99d49defc
- SHA1 1bf633ecd1a38a1cf7a41630bc56cba0da9cc25b
- SHA512 2b3e5b13c763a3b44c2f56ea7901c149119f0698fa248fc2c07a6015824a26ca78df368b639a21f9f2cf641ca233c657c0ed8897bbf7dde7eddfc796a1bacb20
- SSDEEP 6144:cu2t0TXKWKCt4aRDjOFEwvJvaLcetVoE71FNGSF5AJHyh8mHCZaXcdcfSKQP5aO3:r2t0TjKCXXqJI5PDWSF5AJSh8mHCZaXi
- TLSH
  T16184D0B029C48111C67FD372A25C0052FC394AB8D967693E3964069AE7D6A0B477BFF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  app/animation-desktop-1.11.1-3b1636eba8fac16d053e567d9b91df8.jar
- Size 403KB
- SHA256 bb41c6c550a471c68c51185c3bb0458482a4e803ee074bf215adc8832e2007e1
- MD5 3b01636eba8fac16d053e567d9b91df8
- SHA1 f873fb28f1a08d45a4dd20a0130b3da8cadf383c
- SHA512 7da6126cdf28e7319aaf99891cece708662422d0927211edba38ca2e250566100c5343e61d2ec7b5348fff523b23507d2e1708d2b222605009621ead9341b845
- SSDEEP 12288:CvquJF+oNpe4YKOJzsJBUgfcyxSX032rg:KFJF+oYKJUgJYX0mrg
- TLSH
  T1BC94F17225C18160CB3B9332626910A2BC3509F8606B192E367505EBA3FF95B57B3BF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  app/annotation-jvm-1.9.1-1d6a04b3b9847638d0529df8ef76a.jar
- Size 59KB
- SHA256 1e343917ebf27ba96fe4dc52b1cad7fd32b738fbc6355bb6cd5b3b305d7212d0
- MD5 01d6a04b3b9847638d000529df8ef76a
- SHA1 b17951747e38bf3986a24431b9ba0d039958aa5f
- SHA512 ee8cceeb09d0231f6de4015f078e8cb0805de6faf383a9653d5f3763c43bb137e5346c2b177972b1f70d2f648f6f32047051c0f3183bdb50dc01de41931f265a
- SSDEEP 768:v36+rKi6fsRc1cdqMMoslWggQTcAbcU6xV8kc+0Ebxe+nom/3lvv2FdYIDDlv5mf:vrKSRIchsfg7fk+5s+oU3lWbDDzmf
- TLSH
  T1A5435D7EABC88460ED3FD0B375582823F82E25EC8015A26B34B50587F8F542963F7E95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  app/annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar
- Size 28KB
- SHA256 7b0f19724082cbfcbc66e5abea2b9bc92cf08a1ea11e191933ed43801eb3cd05
- MD5 8484cd17d040d837983323f760b2c660
- SHA1 8cc20c07506ec18e0834947b84a864bfc094484e
- SHA512 cb82eb0aaae88e3283b299929173296e30c7b078105e0fc5ecfbcd4eb230026f9a7cc46680832d036e6c1ff036ad99d4c50dc296d4919d223879081ac1616944
- SSDEEP 384:jHDe0/WMt9iLf69hMoNTYbyuGXoPhsPmSBfGYsnr:jiMtcf6MgPXiYsr
- TLSH
  T18AD2D9EED7405335E92F9137B0A25816743EB0C970C13302EBFA46C6A5758266F9BF86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  app/app-2e695b23323b612d93a738780ad.jar
- Size 2.4MB
- SHA256 336ed5064604792b5e54cd427889c4b2fca2aed56d39d6cb1d6b8f6799113be5
- MD5 2e695b0233023b612d09030a738780ad
- SHA1 1379d8ef039519a8cd230b71e4bc1f67a2582429
- SHA512 ad2c2c239ef8d48da7a4997f9d42cf13137043c33f2c484b9b23e7333c85d1aa8243ab1fdaeb5210a5945d3c6820724999bbb65afde25b3ac30f786a4de96882
- SSDEEP 49152:15vVxwcRFO9+s4EgOxVW5UXYbaGhqsVnwha4uVrQE2NEX3wwZF5BrWgCamQykVjC:11z/OcWCU1GAsVnwhVuh2NI3wwX5tNaX
- TLSH
  T119C5F11B155DD22EE43F42B2E626A423E94F0F7FD4D6B05338F60CAE90B26C52605AD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  app/app-desktop-6db5fe5c71c24092ca11cfb686b5f81c.jar
- Size 2.4MB
- SHA256 d5d7452294680860f9a9b991c5d5d8c319ed5b2e50d84fe2cf653dbcfc76238f
- MD5 6db5fe5c71c24092ca11cfb686b5f81c
- SHA1 e2715da8e1d942b0a88092a4978c002a263365fb
- SHA512 ec0e925e62173e5604f75933536478cdbd9a1f0702fa38c96786fbe59386ddffc5b4a7b73debbbc51789195e0f18e55a720b509a0e08a48e430fdc9da6b47a71
- SSDEEP 49152:My5pskEPBKgHESxB7xZO9FtjMWwKzEERwzIOuEcWQhDn1INH:MUEJdkSqTdwSRw/uEcZg
- TLSH
  T1FCC5D03B624CD27EDD3F42F2774A1422B61B03AB98D7A41319720CAEB5B34C5770A697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  app/app-utils-2ad72a13e8942dd5bbb43ba6d2def9f.jar
- Size 191KB
- SHA256 0f4f1eb5befa480a76ad5c91885d036e7a76776df9b2f1a3b4743f12920a4acb
- MD5 2ad72a13e89402dd5bbb43ba6d2def9f
- SHA1 4d349c8d6a5311356a94a7df3c3b98e3f2492ade
- SHA512 2bfe803c5550fa71e847bf0664e0d168f6d60d78690dd46aaa284806e4f1a51f945d6a2cf6879cff5e788621f6d6ee170a96018d10dda4e62fbf48519b27b6b3
- SSDEEP 3072:/y7jTRfKWrriE+W+mMfPamYl7uzdVshpShTWSle6L5SoHpdRWss22n7kOik0:/8jtBrr+W+mMnabl7GdCioSlFHHvIxN4
- TLSH
  T1DB14E007513CA2B9C4BB46F1D74BB326E12B8F79D99A79071CB10CA9E4F25A793009D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  app/arrow-annotations-jvm-2.2.3-857c7f7cfc297b186c96f34ce36f1f0.jar
- Size 3KB
- SHA256 5db812b43458d694a2d676491bdcd6eca04a44f3ae6336db3c71fce67be8e1bc
- MD5 857c7f7cfc2907b186c96f34ce36f1f0
- SHA1 1435d135c995eb667a7ec91fbacc7189b87d614d
- SHA512 7640c44a7623885c9ba2318abd02702cb99eba95b7c8110acdad01eaeb517a32fd56e11008c3cd889f49b8734ab55ff423da503a22a8e075797be51c1697d663
- TLSH
  T1C281F731B7E4DAB2D27F71F152618A13FC4B5BBD640F2033F51249CA64F848AA21B0B4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  app/arrow-atomic-jvm-2.2.3-fcdd2aa54ac9ac7a64d0e0f2abce762d.jar
- Size 14KB
- SHA256 9605a129250898db4a8e1011fb6faab1f1ade1dea290dae467eae2e60289f755
- MD5 fcdd2aa54ac9ac7a64d0e0f2abce762d
- SHA1 ddc7942d1de8c29aa2f05ea5177a63a77156e90c
- SHA512 d62274592e3f307edb13483c10ad86a4434fcdd3e4e7615153ad324fb63ea641bd2e8a7eb588d05dcab907007c8ce52e60ffda54d238a3802c5f19a669a05f0c
- SSDEEP 384:hFVNwL6aTKWY07/PUlBTeyNggop6ni5qtLCuM8:hu6907nuesZRtLCuz
- TLSH
  T1C952AF323AFB8254F13B21B50A443EB7DE5A328C50CF6A97B04124A3DE6295F867DCD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  app/arrow-core-jvm-2.2.3-51f4cb361b521378e540d1a07c2ea0e4.jar
- Size 729KB
- SHA256 a2d334ad01cf22cc534ff254788d1877e4df1564fd2b1101736a6c0e8d9a7a47
- MD5 51f4cb361b521378e540d1a07c2ea0e4
- SHA1 c9a66de8efef8067800fab4ccc32a70bafd42dc4
- SHA512 4683892b19f54cd0df7a5c839929ccdd3d966b1cab8f7a58ce6d8eb1ae0aa042e5ce92fc773a468d3ab35487f8bfef84986d5e6ce672faf3cf03a3947493e310
- SSDEEP 12288:OY6JxU5RmJaNTlpOEIkk5IjJwYQ7wNBqbTtsAj543Qob7/qVPhImb5S3udiGfmB3:OYKxuYJadOEq5glBNBqbTOAjPi7/q7bO
- TLSH
  T1C8F4136AA4C59119D9328130A5113A17EC1D13BDEA657F1F38E24C26FEF395F870E2E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32