f5111a55125fcc4223805a676963852e9cf238287a51e4caad46791331127a24

Sharing

Copy URL Twitter E-mail

General

Target
WireVpn_v3.6.0.3-6872e76.exe
Size 14.2MB
Sample260702-a17cpsaw4v
SHA256 f5111a55125fcc4223805a676963852e9cf238287a51e4caad46791331127a24
MD5 6872e762ad08e54a7158359ff92e61dd
SHA1 7d16a1e77c487364021673e4eeb2552852f53039
SHA512 ead4f48f1416f1487b54a8db92297882ff4ba064ce2054653e49394092df0e39e176df1c0c971bda17da1ac31c02bfbadea1d1bbb99246cd860f0f82c95f5893
SSDEEP 393216:lE2hyY0hSJPmvnuN0W5BiJunKvM+xD1zWjW3WjWX:uBQJmDW5BiQKhXG0Ge
TLSH
T1D1E6333C2626F846CF4669729DBCD047D5874B789E8E15E00922EAD330DF3EC54B8A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  WireVpn_v3.6.0.3-6872e76.exe
- Size 14.2MB
- SHA256 f5111a55125fcc4223805a676963852e9cf238287a51e4caad46791331127a24
- MD5 6872e762ad08e54a7158359ff92e61dd
- SHA1 7d16a1e77c487364021673e4eeb2552852f53039
- SHA512 ead4f48f1416f1487b54a8db92297882ff4ba064ce2054653e49394092df0e39e176df1c0c971bda17da1ac31c02bfbadea1d1bbb99246cd860f0f82c95f5893
- SSDEEP 393216:lE2hyY0hSJPmvnuN0W5BiJunKvM+xD1zWjW3WjWX:uBQJmDW5BiQKhXG0Ge
- TLSH
  T1D1E6333C2626F846CF4669729DBCD047D5874B789E8E15E00922EAD330DF3EC54B8A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- TLSH
  T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/setupdll.dll
- Size 3.5MB
- SHA256 8ebc5121acf8a6f3371ecab94961a67f8f6557b5ef8ab585d0729d396d9f4337
- MD5 bbae36f39600ae44409e7b26c8117f0b
- SHA1 0980d794d50054d448ac6bf17cd91cb40b2e8cb7
- SHA512 96e7ffc20f5e2bde4d31692887d42f91c854228d5f66cf1dabbb0b77765b27f158c310292a13b670dc06fef683ce8dd280c30ef85bf18e0f1af4dece243e9ab9
- SSDEEP 98304:MKdqLjI0yAMQV2R3c7QF34W7Nr616Ab+RX:aPIpF6nNb+RX
- TLSH
  T102F5CF11BA904072D19E02705A76F7BE8D7EEA105774C9C3BBAC166F4F326D0E63A352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Channel.dll
- Size 616KB
- SHA256 a64569669898736981b411dae920ee298e080ca625ab4ca18a6e738a967c343b
- MD5 f11bdf6dd71ab62c55315b393bf074c5
- SHA1 26a3570d30c8bdfb54401052c032d7e67aa52720
- SHA512 dc80f217ce86ecf6d03a03ff3b98cea29a139cdd325fbd19508920d3950cb490eae0d84e27770ad1eb7b5d5f5b216c83231b80befa8d13445cb90cb1a6247593
- SSDEEP 12288:GMyYUcgjfdlER+Jp1qF73C2eLKe5nEx05A2jqH4V:Gf3ayqLOKeJ5nw4V
- TLSH
  T1F5D47B10B501C037DE6D00700FB99BEA466D7D620BB144DBA7D92EFD99B11D36B32E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  Wirevpn.exe
- Size 8.2MB
- SHA256 68bad2fda125ec4c4e7c029f62756f83d6f58309ba484cfb151b6b3eea0f18f6
- MD5 6458265f48b9fb7f02ab3d0bfd335562
- SHA1 05c25a81f4b6032445d0e4e0e09b0ea14cad722d
- SHA512 6860acb0dca960e29be173ae6f1a93e33ca51b4de81ed3a5561ef495e1f479abfd73017c7fd207ca888478bfffa66e13771a6a9e692af6ac7a3b6c6f4eb37f44
- SSDEEP 196608:S60CKZ5v+xc68AwSRpbCi3CUMEMkhRvTO:lGEc64SRpbCK1MMfa
- TLSH
  T10596D0217E82C031D6520271596CBBFB45BDAA212B3481D7B79C162D8F305D26F37BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation
- Stops running service(s)
  defense_evasion execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  crashreport.exe
- Size 478KB
- SHA256 ef23426b1392cbb684eac0a501c303debee4be6fbe65c4ee205d65b46b2e6697
- MD5 ef7dfe875ff733e224a87dd0d03d5c3f
- SHA1 7c3076016d39ce5a7d0b10326eefab4fb0da698d
- SHA512 86727fdd7fc78de9331def4698beb4a688f152f45bc0b1a4de2186490c865af8263090cb665d3c2cd69ef05c9f9d325dd7d7fbc2dbcc23819a46fe0c314dfc5d
- SSDEEP 12288:wobXd5qP+/Yf9skCdXXs0vWi+qxtVVvOViiuwfTUryE/EdZbEMNx:woTdIrf9skCZXs0vpZVvylNfTUrFEdZj
- TLSH
  T1E5A47C21FA80C072D59100B59E75EBB69A7DBE715B2055CB73C02F6A5B302C26E31F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  driver/tdi/windows10/amd64/wvpack.sys
- Size 85KB
- SHA256 0049a6710d955d023f0f4df17595372068248bc0075a91ccc2bf02eac5bad3c8
- MD5 f5ef422804d6de2fb51dceeb325d0c53
- SHA1 05c19f77186e8bc11f4311ce6b9cdc662b2235b0
- SHA512 0524b2fb44d2e595b2dc0bec15ba4a959682e3b7197d1aef9598559d001853ebc7c734099621675ce46f92d05fb8fac262e94736879da9e5ac2abff182abc454
- SSDEEP 1536:8Z5BlvF2CBbgU1xHBu260A7e8PxFUszhz:8ZnxF2CBbx1xHBu2603sxCmh
- TLSH
  T161836D6B936918A9DD59C9B8C6B9961BEFF070031B7182DF02E4C5851F637D29F2C328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  driver/tdi/windows10/i386/wvpack.sys
- Size 74KB
- SHA256 cd4b2f1450d750e31293440a2b6da30ad2202479587ffa01df13a7681192356e
- MD5 e68c32fc41bfa9e38fd72cf8ca433c2f
- SHA1 194da4adfd6721c4a7caafb5a193bb32e48001aa
- SHA512 d36dca71bca10f1b35011cf85bacd8707005c67744306abca48d0b3d3d3d5539f6c64ef29ec89cef9a5ed30c1417a60eb4191bc0bf56f85baa03796150906d06
- SSDEEP 1536:M1tbOTCyQEdSl1R4crFdXpECR7uQ3VU1UFRTWA7soPx/skUhzB:M1t2QEA1OcZUCR7TVUOFIox/NUh
- TLSH
  T1C1736DD3E6400C73D6D64AB0B2E8E3276B79DF060A9050F78B25C9C095717D1EAA936F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  driver/tdi/windows7/amd64/wvpack.sys
- Size 85KB
- SHA256 c21ba9518e5e4ed1045354ae4dae9d485a134b40f54b1662af2a6f2bfd07cb3a
- MD5 22bd68726ec87be63869b0d041916d57
- SHA1 5720433092b99f21006e3dc12c84ca05b5897bb8
- SHA512 f105bfbf1892a95fd308ba02aa656d8c7151d0fc793e0e2527e97d39fc5f363c837fd08813371c1393a153956172d553678042bfd13a67032cbd399fd4ad585b
- SSDEEP 768:mpLWkhlJL9JnxxWfjmydo+BEx1sf3rpY3kEnZNMjGPIB9hDIX/qgYvkO10k79CJO:TZ5BlvF2CBbgU1xHyu26RA7APxqslhz
- TLSH
  T18E836C6B936914A9DD59C9B8C6B9961BEFF070432B7182CF02E4C5851F637D29F2C328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  driver/tdi/windows7/i386/wvpack.sys
- Size 74KB
- SHA256 75c950906b1d13587461f04938b3381b1e90d4859696cf4ef55499fc6b641769
- MD5 99d739a2a75bf2871d7e593178cedd3e
- SHA1 e5b9bcf1acc69be7ad763111576460b26c7d74bf
- SHA512 033f790c5909859b2aa4fda0b4cac3fe7d908a09f8ae88b90a4ba58e6fe102183e7740344f4a065603e0f7bf55fb17e2bfb22da6067a80ae4a1ccebe8fcdfc97
- SSDEEP 1536:MytbOTCyQEdSl1R4crFdXpECR7uQ35U1UFRTHA7yPxCsahz:Myt2QEA1OcZUCR7T5UOF11xCLh
- TLSH
  T1E0737DD3E6400C63D6C64AB1B5ECE3276B79DF020A9050F78B25C9C095717D1EAA93AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  driver/wfp/windows10/amd64/wvpack.sys
- Size 100KB
- SHA256 c85553c0b7db2f975e03e0a0a6a2570c86d7f48bbbed376c7edc5360adaafeb7
- MD5 825436a04c40f7e0b2c97e5f738da64a
- SHA1 17649181819f38dcefe1dbce53958598666d8c65
- SHA512 0d7357a31985f183b0ee0abbf5f2fe7950236ef19ec52a56ac9368e8192f64723482d2de98531371be471b537bb2f840508c7bdb2205e10a67019034ee395b34
- SSDEEP 1536:sg6VIer15WqL+WNvh6Y2Ns1aLv2LpTEi1aIIiikZxEA74oPxSVTsZhzy:sDKS55L+WNp6yajszZqV4x0shm
- TLSH
  T1D6A36A6B23F414D9EAA7E5B4C6A5DA07EBB1B0423BA153CF07A184801F633D16F39395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  driver/wfp/windows10/i386/wvpack.sys
- Size 88KB
- SHA256 6e421c21ba0538b8366ea1c06feb63cec5f203fea101827b9c78aa22454784bc
- MD5 39747bcde257a2388ceea8ab793efb4b
- SHA1 c3e1581b27cc2a1628a64a269d10a917efff735d
- SHA512 03ccc7da105a2761602a67a5e0300b53cbd757c9e2778e5ab38125c1b5a17e033a52e859130c92eb328acd1f7d1a04b8e815cc8b223e96834787de0986764641
- SSDEEP 1536:4oyacY7LBT8t8BZpWFfNuxQO+Q5tlnakthrlmXF54qE6lqa378A70PxjslhzQ:WlEBTGwZpWuF53akthsU6qawvxjYhk
- TLSH
  T13493AEB3FA0490A3FA965A30F29CEB736D3D63122A568CE39398C54654317C1D5363EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  driver/wfp/windows7/amd64/wvpack.sys
- Size 99KB
- SHA256 bfb207e31c1f29a0730d5d1a85d0e7f6d19cd2034e0101b31c3aba6b4f27b0d4
- MD5 ce64a66a8f9d8f221424872fd735989a
- SHA1 70f3f3eb1434c6baa0acff56fa9a3c8bfd02f54a
- SHA512 d181be06186b27923b8c4324be09421258d9cc69c7852d912982f91b5757d044784b855c027a8935d776ebf55cd653e45372a027160ddd078e8412449105aedd
- SSDEEP 1536:lvAPe1lXssUNtrOuCDven0syd91EiIEI3NhxeA7RePxosyhz:ljasUNtrRCXd90NhI7xoHh
- TLSH
  T1A3A37B6B23E414D9EAABE5B4C2A9DA17EFB1B4423BA153CF0761C4501F633D16F38285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  driver/wfp/windows7/i386/wvpack.sys
- Size 87KB
- SHA256 b0831e1baa2738e9fdb649c9e5563118d39d3548b6fe3843aacdcbed031d0213
- MD5 2405b07af9ad529c79a1f9f21ec619f0
- SHA1 9f51ec99b94d5f9a629289704feb52de8e08e18b
- SHA512 940f16a9602247f38c3ce1899d8ad795941866c19ea0c21ccc5c5b4fb336f929e8adcc59b8c7f7cf2389bc0a6a3e0c2ae796661f9e901593f969ea343816e98e
- SSDEEP 1536:4zSKHsizINbr2VwwzJBKj0k2mhudCRgWkE6/1qUhQTD3A7PhPx3syhz5:zWsizIcBbkbhQs0qUU0x37hd
- TLSH
  T1F0939EB3F7044073EA92ADB092BCDB232F7E9E516A9545E35354C607A4787C1DA3432E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  driver/tdi/windows10/amd64/wvpack.sys
- Size 85KB
- SHA256 0049a6710d955d023f0f4df17595372068248bc0075a91ccc2bf02eac5bad3c8
- MD5 f5ef422804d6de2fb51dceeb325d0c53
- SHA1 05c19f77186e8bc11f4311ce6b9cdc662b2235b0
- SHA512 0524b2fb44d2e595b2dc0bec15ba4a959682e3b7197d1aef9598559d001853ebc7c734099621675ce46f92d05fb8fac262e94736879da9e5ac2abff182abc454
- SSDEEP 1536:8Z5BlvF2CBbgU1xHBu260A7e8PxFUszhz:8ZnxF2CBbx1xHBu2603sxCmh
- TLSH
  T161836D6B936918A9DD59C9B8C6B9961BEFF070031B7182DF02E4C5851F637D29F2C328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  driver/tdi/windows10/i386/wvpack.sys
- Size 74KB
- SHA256 cd4b2f1450d750e31293440a2b6da30ad2202479587ffa01df13a7681192356e
- MD5 e68c32fc41bfa9e38fd72cf8ca433c2f
- SHA1 194da4adfd6721c4a7caafb5a193bb32e48001aa
- SHA512 d36dca71bca10f1b35011cf85bacd8707005c67744306abca48d0b3d3d3d5539f6c64ef29ec89cef9a5ed30c1417a60eb4191bc0bf56f85baa03796150906d06
- SSDEEP 1536:M1tbOTCyQEdSl1R4crFdXpECR7uQ3VU1UFRTWA7soPx/skUhzB:M1t2QEA1OcZUCR7TVUOFIox/NUh
- TLSH
  T1C1736DD3E6400C73D6D64AB0B2E8E3276B79DF060A9050F78B25C9C095717D1EAA936F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  driver/tdi/windows7/amd64/wvpack.sys
- Size 85KB
- SHA256 c21ba9518e5e4ed1045354ae4dae9d485a134b40f54b1662af2a6f2bfd07cb3a
- MD5 22bd68726ec87be63869b0d041916d57
- SHA1 5720433092b99f21006e3dc12c84ca05b5897bb8
- SHA512 f105bfbf1892a95fd308ba02aa656d8c7151d0fc793e0e2527e97d39fc5f363c837fd08813371c1393a153956172d553678042bfd13a67032cbd399fd4ad585b
- SSDEEP 768:mpLWkhlJL9JnxxWfjmydo+BEx1sf3rpY3kEnZNMjGPIB9hDIX/qgYvkO10k79CJO:TZ5BlvF2CBbgU1xHyu26RA7APxqslhz
- TLSH
  T18E836C6B936914A9DD59C9B8C6B9961BEFF070432B7182CF02E4C5851F637D29F2C328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  driver/tdi/windows7/i386/wvpack.sys
- Size 74KB
- SHA256 75c950906b1d13587461f04938b3381b1e90d4859696cf4ef55499fc6b641769
- MD5 99d739a2a75bf2871d7e593178cedd3e
- SHA1 e5b9bcf1acc69be7ad763111576460b26c7d74bf
- SHA512 033f790c5909859b2aa4fda0b4cac3fe7d908a09f8ae88b90a4ba58e6fe102183e7740344f4a065603e0f7bf55fb17e2bfb22da6067a80ae4a1ccebe8fcdfc97
- SSDEEP 1536:MytbOTCyQEdSl1R4crFdXpECR7uQ35U1UFRTHA7yPxCsahz:Myt2QEA1OcZUCR7T5UOF11xCLh
- TLSH
  T1E0737DD3E6400C63D6C64AB1B5ECE3276B79DF020A9050F78B25C9C095717D1EAA93AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  driver/wfp/windows10/amd64/wvpack.sys
- Size 100KB
- SHA256 c85553c0b7db2f975e03e0a0a6a2570c86d7f48bbbed376c7edc5360adaafeb7
- MD5 825436a04c40f7e0b2c97e5f738da64a
- SHA1 17649181819f38dcefe1dbce53958598666d8c65
- SHA512 0d7357a31985f183b0ee0abbf5f2fe7950236ef19ec52a56ac9368e8192f64723482d2de98531371be471b537bb2f840508c7bdb2205e10a67019034ee395b34
- SSDEEP 1536:sg6VIer15WqL+WNvh6Y2Ns1aLv2LpTEi1aIIiikZxEA74oPxSVTsZhzy:sDKS55L+WNp6yajszZqV4x0shm
- TLSH
  T1D6A36A6B23F414D9EAA7E5B4C6A5DA07EBB1B0423BA153CF07A184801F633D16F39395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  driver/wfp/windows10/i386/wvpack.sys
- Size 88KB
- SHA256 6e421c21ba0538b8366ea1c06feb63cec5f203fea101827b9c78aa22454784bc
- MD5 39747bcde257a2388ceea8ab793efb4b
- SHA1 c3e1581b27cc2a1628a64a269d10a917efff735d
- SHA512 03ccc7da105a2761602a67a5e0300b53cbd757c9e2778e5ab38125c1b5a17e033a52e859130c92eb328acd1f7d1a04b8e815cc8b223e96834787de0986764641
- SSDEEP 1536:4oyacY7LBT8t8BZpWFfNuxQO+Q5tlnakthrlmXF54qE6lqa378A70PxjslhzQ:WlEBTGwZpWuF53akthsU6qawvxjYhk
- TLSH
  T13493AEB3FA0490A3FA965A30F29CEB736D3D63122A568CE39398C54654317C1D5363EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  driver/wfp/windows7/amd64/wvpack.sys
- Size 99KB
- SHA256 bfb207e31c1f29a0730d5d1a85d0e7f6d19cd2034e0101b31c3aba6b4f27b0d4
- MD5 ce64a66a8f9d8f221424872fd735989a
- SHA1 70f3f3eb1434c6baa0acff56fa9a3c8bfd02f54a
- SHA512 d181be06186b27923b8c4324be09421258d9cc69c7852d912982f91b5757d044784b855c027a8935d776ebf55cd653e45372a027160ddd078e8412449105aedd
- SSDEEP 1536:lvAPe1lXssUNtrOuCDven0syd91EiIEI3NhxeA7RePxosyhz:ljasUNtrRCXd90NhI7xoHh
- TLSH
  T1A3A37B6B23E414D9EAABE5B4C2A9DA17EFB1B4423BA153CF0761C4501F633D16F38285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  driver/wfp/windows7/i386/wvpack.sys
- Size 87KB
- SHA256 b0831e1baa2738e9fdb649c9e5563118d39d3548b6fe3843aacdcbed031d0213
- MD5 2405b07af9ad529c79a1f9f21ec619f0
- SHA1 9f51ec99b94d5f9a629289704feb52de8e08e18b
- SHA512 940f16a9602247f38c3ce1899d8ad795941866c19ea0c21ccc5c5b4fb336f929e8adcc59b8c7f7cf2389bc0a6a3e0c2ae796661f9e901593f969ea343816e98e
- SSDEEP 1536:4zSKHsizINbr2VwwzJBKj0k2mhudCRgWkE6/1qUhQTD3A7PhPx3syhz5:zWsizIcBbkbhQs0qUU0x37hd
- TLSH
  T1F0939EB3F7044073EA92ADB092BCDB232F7E9E516A9545E35354C607A4787C1DA3432E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  proxyg.dll
- Size 2.6MB
- SHA256 b71fdb1e1cee470b75bd34006221bab84a00132e02b78a50ba66e089dea73488
- MD5 6f80e5ac45df495a43d0e6aae5978d27
- SHA1 209775ca1cd13381760ecf4123ed493f133249cf
- SHA512 ea50dbe6011d296a8d097d8d5c59091e3bac72d46d3280bd52bedf4469328ecab38a2fef39bf41b2b6e12bd78d71efd6a9614e1ecf85c8fc3b48adbdff7e4bda
- SSDEEP 49152:lw9/r5dgUGhKyaN4d295T61E5vZvpqmx1Fful5A9cc55GX:lQ/r5lLL4Qt9e
- TLSH
  T19DC54A52F99B50F2F60B15354467A2AF2330BA05D735CAC7DD00AE6AFCB36A21D37216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  upWire.exe
- Size 2.3MB
- SHA256 90b89a6dc4565c9817e7db8323702006860cb2b49f352863f2b18ba21c66b435
- MD5 8f6cec6f5436eb0fe79a1f26a1c663d4
- SHA1 4fb4b6ab3aa38fd54b8f52854e0d4b2a052a2805
- SHA512 a50b117bc3c041efc1783fd4df786d229b70ec686bd0e575238a5f92ddef333776eb55bfe7462e674430a8f79f7f9885e8e397136951354e9b79a75a07facd90
- SSDEEP 49152:DsQqp8Ay5PMpaOjPufBp3cyKB33Ma67NreT6scPEWcylvJbp:lquA8PQaOjPuZp3cyKB33Mx7NrpstQ
- TLSH
  T122B5AE12BA42C072E59202B462FA6B7FCC3A9934573585C397D01E7589312E37B3E79E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
behavioral31 behavioral32