bb0fe40a0778da3f490ca74351c68f042faf8641e73813a0dcf051f33356a6a7

General

Target
adamxpatcherbundle.zip
Size 23.7MB
Sample260629-v7m8macv9p
SHA256 bb0fe40a0778da3f490ca74351c68f042faf8641e73813a0dcf051f33356a6a7
MD5 fee94f39f94fd9ab5b786c591e48c7c4
SHA1 5ae12ee7579711acb00251ce2092baea9b418808
SHA512 f666b09141ddbaecce280314c6fc586b701112ea703789e5bab5c0ce7afb3b77f6c882df0ae44a492f0e29a20a94b28b8393cbb4de8d98f5ee8da04600cf524f
SSDEEP 393216:p7GgaRXrupnWIcy9i0JxIpCvEFePXfqRXVBGkppbd3fPPnun4AfEcqcu3E+:YgnRWV7SapU/KXVE4pbdfuffu3T
TLSH
T1884733EBD8293D291848A2FEC78151F54381B60B2B0B5A41F57ADFBB0564BC05786B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  adamxpatcherset/Adamx_Tweaking_Utility-Setup.msi
- Size 23.3MB
- SHA256 5d8822924c4d3a209921e450dba8c86f2469aafefe57843466f3459e95ff67df
- MD5 b344e75df44e83b9b702f869531ef866
- SHA1 585fbe0ad9ccbd48c9b062423762b0352bfab38e
- SHA512 738779efc276e0c9e6796c147ce991028d5fbfaca89dc026413b7491d693e289857a74f230092552272adfe4cc5ea8c9620b1967630e657329c8312019574ba2
- SSDEEP 393216:eNY4pvOE5/U8aZs2lyur0RSmIT/Vu9aR14o/lbBlSZsOTv7Pxje0:vbMXvYPrxLIaR64lbBHqbx
- TLSH
  T12D371217BE86586AC0D8CC74C37797A3462174D71A2AF5AF01C90519EEFABF04B193CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence privilege_escalation ransomware themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  adamxpatcherset/adamxpatcher.exe
- Size 1.2MB
- SHA256 697e5f445b5ca6aa8fee03b7f1e2666767b154fcadf78e3f7ede24340dcc7513
- MD5 f1733eccb410c965cc40ba363b763325
- SHA1 c36764b17f7f90adc97d2ed06b4d0469a2c04949
- SHA512 e9c3d8f5c7522db1851d3c9cfddac7d67c39a769795b7740c2ff9a5e3efdef6d9b074e0f0546a1a3aa3e8c9e53a94ce81c7d00dd880392ae6d326415dc29238d
- SSDEEP 12288:oQkVyHWbdPPKMHBek10vAmVyIk2JHi6d1JHi6d:b20k1MVy1ISI
- TLSH
  T104455B15F59884D5C09BC4B68A72C85AE6727F984B3C8AE337F5BF6E1E325D06239D00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion spyware trojan
- Drops file in Drivers directory
behavioral2
- Target
  adamxpatcherset/app.js
- Size 361KB
- SHA256 64e9c9ce577f8d5656ac9cb1b369934d9f072a06b81dd98e6f3661a4e0a6006a
- MD5 c50ee0ed025bddcf278fb08894930bac
- SHA1 215b6f2cb0ca25c11f9e13138035b7339703dd5d
- SHA512 db4802203dee412295027857003d49dea8ad03b0ea22437354f120b121968e8c5112cc4f4e4c3eeb688bff6c84bbd36051ecbb00a377e3e9a7b3a63c3dcf1773
- SSDEEP 3072:YmeVwN2jBF+KaK+/Sb8/4P09XVjUdspGXJcQ8ELfz1635:BeJ+Kab8c9XVjtGXJX/LLU35
- TLSH
  T175743C667154253A883353B5EB4F2225FB2A8113E20981147AAD83581F7BC68C5BFFFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  adamxpatcherset/libcrypto-3-x64.dll
- Size 5.1MB
- SHA256 5f641d2b52f2fa1b780304bd2bc6a8da15ac1d74e6e6f528d026f268f0c1cd7b
- MD5 27bd81171322cc8a9a7635f33970ec1d
- SHA1 e7e3d2daf76473fa75a7dd578d741760e9a8439f
- SHA512 44016ee4618164671198155e99cbd9a778406a7b8cd3bb7c2dbe860925584e8c28bc107d2fba4fde2368617e952a3f0d32abb19c3ad99f8b4e85442ea52a3159
- SSDEEP 98304:+TBb3f10KvbjT8znlQuP298+xYsV+1CPwDvt3uFlxCz:IBTf1HbjT8znlQuOSIYsV+1CPwDvt3u+
- TLSH
  T10C368C69B6BC0045D87A81BCC2876227E771B82657F057DF2A6846F90F23BD42B7E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  adamxpatcherset/libssl-3-x64.dll
- Size 851KB
- SHA256 cba9bc4f2378b9811ad926c44d79bfc6c7400328901d824eb8a366166451ec98
- MD5 63b5bee41900e3703aa158f78e34b4fe
- SHA1 df19e09026a8e1ac03ae64927060ec2d108b7b4c
- SHA512 b101a1929331a35b0f452d5460879cc350af97612f081a1f331f80df2b1bba6b1a3c8d75137566e6069ee2eadb4784d3084db70e381763a8692982bb5a052100
- SSDEEP 24576:as5pbsG9HRYWCwgEqlen1Q0EGO2NOUAPJ:asDokxFZz+2NOUA
- TLSH
  T124054D65BBB801ACD862D17CC6935213D2B6F4173370ABEB0B648A792F637E5263D344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5