c523ae24960cc08fa0601e5fea400a5c3294ca5618fe75da3729c2077f730ba1

General

Target
ronix-installer.exe
Size 6.5MB
Sample260628-vdh2taas9s
SHA256 c523ae24960cc08fa0601e5fea400a5c3294ca5618fe75da3729c2077f730ba1
MD5 d6f3f2eac5dd91b6aca851034563eb18
SHA1 ad067472e35d9acd978bac4f79829ba4c66e83d0
SHA512 70731780047bd1b234d0d1dbf4ed71104e67a18f5c4c5f45429772b4824e76875c3b7eda6f12174a6945e187301a5f8af8e3e8393006a98a0b1757ad043f7bcc
SSDEEP 196608:8XEA71CZw5o9D9iCgQSWZoayRxLbpMAbtlVtiUi25tCsfA1QEPf:8XJ/o9JsqWRNlMAbtftF41QI
TLSH
T1E8663332FB6088A2DC9D47B31372D351E53A56407F099CDFC1DA8A80A8765C6FF9B225
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ronix-installer.exe
- Size 6.5MB
- SHA256 c523ae24960cc08fa0601e5fea400a5c3294ca5618fe75da3729c2077f730ba1
- MD5 d6f3f2eac5dd91b6aca851034563eb18
- SHA1 ad067472e35d9acd978bac4f79829ba4c66e83d0
- SHA512 70731780047bd1b234d0d1dbf4ed71104e67a18f5c4c5f45429772b4824e76875c3b7eda6f12174a6945e187301a5f8af8e3e8393006a98a0b1757ad043f7bcc
- SSDEEP 196608:8XEA71CZw5o9D9iCgQSWZoayRxLbpMAbtlVtiUi25tCsfA1QEPf:8XJ/o9JsqWRNlMAbtftF41QI
- TLSH
  T1E8663332FB6088A2DC9D47B31372D351E53A56407F099CDFC1DA8A80A8765C6FF9B225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
- Probable phishing domain
behavioral1
- Target
  ronix.exe
- Size 16.5MB
- SHA256 ebbe0d7424bb9849c13e722664a3e779e17d0369947b0b6c054a551a63271f3a
- MD5 1d433bbafe249a755d52c752f481f467
- SHA1 7580dcfe914452f0c56fb418392f08ff5ae33959
- SHA512 569037b695d70dfd09cd1ed016ac78762647fbc4d44fe56ab479be9f1526d652b39f3c936606ee66ac34e37f1922d8b9e9748932f1e34277b2e8b35e11921045
- SSDEEP 98304:ByK4LsF99E+MuTmxkf4fPZbhx/TVkHbXpy2jpTxAL3Y/Z4TmUlDeIwpKgfL2EM99:P4LxbuTmHCMIPQ6V/TwA9gV1AfdI
- TLSH
  T162070720BB5B9AACD05BC4B483474A66497170CF0B39B9FF449492382F6DBF52F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence spyware trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral2
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
- MD5 acde70f73d3b71b1c4222b763537780d
- SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
- SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
- SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
- TLSH
  T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3