2ed07671f08444192d5823fe8ff5e786685666d2c3d94fcebfb9f12b46ad1941

Sharing

Copy URL Twitter E-mail

General

Target
RevoUninstaller_Portable.zip
Size 12.5MB
Sample260628-vdflpaas81
SHA256 2ed07671f08444192d5823fe8ff5e786685666d2c3d94fcebfb9f12b46ad1941
MD5 abf3c430f119c63523fe99de19915896
SHA1 d8be99ea8caf06266ed96f4a8985534d90d48f2e
SHA512 97d78020dc4a9bb71ada393b419dad4b46b42ca0afd1d6ada7535751bb39bd6253f59f48c4bf1789bebffe11b16c785bc02bc30e3498afa2a5b3be9ae6ce29ef
SSDEEP 393216:zEMVxW2i0vAWmzK21Ej7JeEUoSnNQIkIaeWaxd6bHlDPns:zEoW2iiAWenoSnS7I+axQHxPs
TLSH
T1BBD633F163E61867F191EA7B814D2F21DEC2A96D8F10D326490491D83FA27E75C7228F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RevoUninstaller_Portable/Revo Uninstaller Help.pdf
- Size 1.5MB
- SHA256 f11a0150d87ef69a5509348e91f761358b0bd8c3bbefd8c8e7686b4dfb792dee
- MD5 c53ae171fc61832b2d853a5ceab8fdbd
- SHA1 201f5475bffb3beca8d34d075e0991788065e094
- SHA512 b4ceb7fffe101b9a3110a7cae79aebeb0e1cc99abff229cd62e643752b33b10c96734d0d468645555c35ddf0ed029747a2bf902e0ffb8058dd73016de3bafdb3
- SSDEEP 24576:HknE1JSdJcVqoFw7kun2JzF2MWYdkLyZpXDh4SzLj4CNnza8DnF:l1JSdF7/2uHneZpDG8pWo
- TLSH
  T10B652340C51289CDD8F144FEAB5B5D32F376B00294C7915632BCE68FA750EBEE983626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1
- Target
  RevoUninstaller_Portable/RevoUPort.exe
- Size 204KB
- SHA256 e873f2a974ce93740358eb5523575e943bc67c973bec4fe6855c92ebfbbebf32
- MD5 a364104fd9965fa4907d219cfa7bfafb
- SHA1 dc674796b8843f63c1cd50f99d586b857fcdd044
- SHA512 78bda5bd9793bae91c9a0939ed1d748cbe8bb225f09bd970578553cde52a9bc2f08814ef5c765dc9c852b29dbea37cc8ffc90c24bb0f1f471e662351aa0c0710
- SSDEEP 3072:lkLnAdeRbvAZpoKIIn9xg//XHTfq2M0W30L/OHQ4HFs3qMGrfv8Rx/:CLAoYZCIn9SzsFwWc
- TLSH
  T1C414CF47AB60D83AC8066E709DE2CC9A6679BC213FA10E9B310D72778B313477D5E25D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence privilege_escalation ransomware spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral2
- Target
  RevoUninstaller_Portable/x64/RevoSrp.exe
- Size 347KB
- SHA256 10c7163dcde61ae176d68130b2665be75f61aede5638b84734648f93563b36c8
- MD5 0c8f45001b4967350318e19a074a3ccc
- SHA1 1b2a6bd4192e32b0b7950aa7974a81bdbc1aa4e9
- SHA512 43146495bdf7f3b54ac5eee4c7763b63ab6c098c973b222290fd48599491193e53fdd8334e16dae2a70eb5883db1bc7642cdf0527e30bf0ac819f81e892500fb
- SSDEEP 6144:TNTiAREhsF74rjY7wMsUVds8Njp3TXp5IK:TNvF+c7vVds89JXjp
- TLSH
  T1EB746C16EBA510F5E5BBC138CA82551AFE717C564370A7CB23904A972F237E0AE3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  RevoUninstaller_Portable/x64/RevoUn.exe
- Size 21.1MB
- SHA256 c2112802a7b9fa470a1de6d2c5185d2fa322955825dd11b813aa5cb6be76dcf2
- MD5 b92e7d007096da4a17b5ed5df6e49369
- SHA1 dec3d8117947247d8586fdc933afbd6aeaffafed
- SHA512 57dc7a96e3b2661c2a67a8e3ddfc8856ba872ea76611c8df3fa5cab95a2a523952c7a32c1c983cbe4601d9937f2f1c035ab88aa38cf733608dad0b4aa7c8e594
- SSDEEP 196608:5Mz7LON7NA9Tz9WnwwlLVhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIIIIu:5Mz7Lm+9TmbBVhlqPWpyR1pxM
- TLSH
  T1A42729B2D95185CCDE2CA6B5CE1D89FDCEA27C1AAFA089AF41043C11ED736C09D3D259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral4
- Target
  RevoUninstaller_Portable/x64/WinAppsDll.dll
- Size 37KB
- SHA256 48397f262055097e06ae5c328f6d866f19301c7807e5879ed487d9770962fb78
- MD5 c059c8f05c7c8c00fbc324eb15563d03
- SHA1 0a75dc7a1631043aedca05116bf0b93cc7eef5b0
- SHA512 dadcd3d8a7281546f95e019dda10197d68356e8a1675bef20dd3abc2d1267a5046784600e87bd04fc1a7396f4cd44cb8dac2df341ff919778bd147f7dedb46a4
- SSDEEP 384:gLgmHXXwfuhf4bNHOXysRKQ1TDsnB9GBdjzRBUOuBSGNyFIYi2mL4/y8RYoMfRIX:IUfuKghDLzMBSQYiDLk5utuYih5ALs
- TLSH
  T1FC037E93D5845C45D8779930E8D29936EEB2B1851B90D3CB7238C25D4FA23C23BBE3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  RevoUninstaller_Portable/x86/RevoSrp.exe
- Size 273KB
- SHA256 d54bf92fb1c7ec47b5654abc8987fb2053504342b8fb4aecadc76f686295a2ea
- MD5 621a2f69123eac653105a37fdadb0c2b
- SHA1 8ae6311dee74392c55c05d0ff958a1c515f66625
- SHA512 84c77c86afb97b5c7d4e2adee54026313f865fe19cd4da9f63e6ba6317595005b166b0c12da02b7df181e02fe5a80484fa6ded3b3f54aa1ab95973aa52691c65
- SSDEEP 3072:SWz64sZP74qht90jR7nvkJkBHWTcsZVvNiVDRrT2dpoULDTtqDcK8do/YFiKvcUb:S+1E82wF7HgDFoDRop7ztqDcjpdz
- TLSH
  T1C9547D017981C436E97719728EBD8A29DA3DF8500F61A5CB63C41DAFCB70AD1BB3171A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  RevoUninstaller_Portable/x86/RevoUn.exe
- Size 18.4MB
- SHA256 d0ceb97a31a2fb167063852a5e476580859fafcacbcca09bb32d12d4f966b8fe
- MD5 09ad4ed823b71eb98cf6fe8589cf4e93
- SHA1 23e5c93e02fa9bc9039abde1e7dbeb53b9cb5c36
- SHA512 b39e012f38a961a6108611f5209b2a74e65fac616a568fc71fab76eb9ea0506821eead5dbdbe1ad1f180bae21482dfbf4edac7078d8b885592eada400e56819a
- SSDEEP 196608:Ri0hbAjPro6fNYB+bge0hmQh4MaDYl9LVhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIL:Lm86VYBmgzZVhlqPWpyR1pxF
- TLSH
  T10A170972ED01C95CEE5C2BB1CE1D8EFC0DAA5D6AEF9058AF91443C10E4B26C1693D64E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  RevoUninstaller_Portable/x86/WinAppsDll.dll
- Size 34KB
- SHA256 fe1dbba0a8014c54b5b386377008d45df990f9c2ce685bb6c3282b20d173ecdc
- MD5 aaa37577cacb36e2ae0da72430dbcbe5
- SHA1 fe707afa506e1e08e373f84cf64d3419a4f525fd
- SHA512 2c5473931fcb118e6c170a91d0b20fc5e7fad0908be0624316d78f5b7830e49f7a51bc1a213e6ea14c924f232ad903a5479cc700ea2de340a009bf74e8d49574
- SSDEEP 768:ZrcsMs5OkWWNxRWQ2SYiDLk5gf1rYinL5ALS:ZYsMpkxPRWQ97Br77
- TLSH
  T151F25C53DA804C36DD575A70B4E0D437ADBAB6511FE086C73359C2154BA03827FBF2AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8