04c2f0cdc0dd90aec5e0abf092da045c0f30bbf14de1659f4fb63a9ed4e03b89

Sharing

Copy URL Twitter E-mail

General

Target
RuLauncher.Updater.exe
Size 18.2MB
Sample260702-shf2xady4r
SHA256 04c2f0cdc0dd90aec5e0abf092da045c0f30bbf14de1659f4fb63a9ed4e03b89
MD5 5354ff34e1ea50a7ad81a698a09bdf14
SHA1 902f1516a3f615f1daa1c68d1c58e09cf5cb7732
SHA512 40e865040f36093945535ce8966f69e18638581d1eb446bc1bfee3cf4f6e9cc1fd89bec9a40dc9c262e295dac8cd60da261af1c4c11651f114084b15a8b7e11c
SSDEEP 393216:/VKMfhLu0sh2rGkJ3p+rVjJWXNplH1+v2ytRo9p+PokSllMq0+v2yt9C:VacJ3pyV8p1EtT4p7l3t6
TLSH
T11B17127A09640F08D97635FF467598AEEAAC1E2410034FD651B2384EEB76243DF6B2CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RuLauncher.Updater.exe
- Size 18.2MB
- SHA256 04c2f0cdc0dd90aec5e0abf092da045c0f30bbf14de1659f4fb63a9ed4e03b89
- MD5 5354ff34e1ea50a7ad81a698a09bdf14
- SHA1 902f1516a3f615f1daa1c68d1c58e09cf5cb7732
- SHA512 40e865040f36093945535ce8966f69e18638581d1eb446bc1bfee3cf4f6e9cc1fd89bec9a40dc9c262e295dac8cd60da261af1c4c11651f114084b15a8b7e11c
- SSDEEP 393216:/VKMfhLu0sh2rGkJ3p+rVjJWXNplH1+v2ytRo9p+PokSllMq0+v2yt9C:VacJ3pyV8p1EtT4p7l3t6
- TLSH
  T11B17127A09640F08D97635FF467598AEEAAC1E2410034FD651B2384EEB76243DF6B2CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2
- Target
  commandline.dll
- Size 212KB
- SHA256 26af31165dbf6af3864609df7834a06404e6cfbd8905ba202e0a0bb921326d57
- MD5 d788b7dedb2e07ab596569360fcd3154
- SHA1 3fee00542701ea636c8a4db60e96856cfe4deb39
- SHA512 1e83c8e64a63046d1c0a620c088ccba5e7205539b249dc814b59a0360bd06dadd66d6d1e4b0b494c574d311fca1103011691453d910cf32b6092dd8f492dc8d2
- SSDEEP 3072:Lo5LAk8+YfkQRqP9RhBh1uirTB+3Lr/guqCwtipIllWf1/IFacB:Lo5Mk8XfkQRqP9RhduirT+OXllCwk
- TLSH
  T1A8244E44639D0327D6FF2B76A470219F87F4ED62B891EBDE6589B8F30DD23829840359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  controlzex.dll
- Size 230KB
- SHA256 eaff0a2cb796e6dc877505941bbcc0489e0e8488cc1a0dbd6c004f9232367410
- MD5 211964418487200c2859a69d3ff0aa9e
- SHA1 46284c40bc74a5d9f80ce97d643744620482d336
- SHA512 8f9025d4f205f85126ec9a364eb4babcd2fc1aeafc34fbbe5b4bfc00e545ce20a3f27e7f3f2a04c28547c7ad8f64d9ee7dc410b03d6deec3d73188643381800b
- SSDEEP 6144:S4JV2IoPEzhywGgN7mjckGJpY88CRB57gP2rxp+7vVNviPF11WnSs:S4JgISEzhti
- TLSH
  T175347E3463A88F1AC6BF4E38E0B00621C672F652E763CB5D59C461BA0897791EE517F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  controlzex.pdb
- Size 749KB
- SHA256 4126e5b06f00e108870e38418fa49034bead6251aa1d1f3186bdaf0b310e2563
- MD5 ca1b00fb24402ad4fecf909ba9dedd63
- SHA1 dd4fa978b95e0bb8b022d5fc0fc56bf8e24a42bf
- SHA512 cb98836702a4e9164430d34ae01d266ede6a3a72ee07645e2b024a18a7580246aa8c731baea19b9a6112d34235d443f28580f7542c86bbf4a531d49b7b87f31d
- SSDEEP 12288:eHavZy/OTFgjZxEvUAJOKFvZy/OTFguVO:bvZcOTFgjgvUAnvZcOTFg
- TLSH
  T1A8F43A27BF54CA32C46A82782A9B8F1D0238F2C89B42D79F9386715C7DE37551E87394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  costura.pdb
- Size 2KB
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
- MD5 34b42a5776a3ad022b429124d55e576d
- SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
- SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
- TLSH
  T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  de.mahapps.metro.resources.dll
- Size 10KB
- SHA256 7f20905ac7a927b0405124273cd9f0d79a5b73ea413426929f8da34618152438
- MD5 cfbbf4daca25913c7a7f0cf3c1be5347
- SHA1 298e391afe13d0672c968af2fdabcf181c379d1f
- SHA512 e353c2d83e61f87d65dc4c81c4a11a53a22745b8bc41a48187be3a02358b6fdbc0a168fda556cfd4a36a19e06c99aa4d14ec5228566ffc884a899b0cd2d110d9
- SSDEEP 192:cGzDcHtDpvhpzcPWg3TUHfBo+6IhF0DY2ACkVtW/lRODhQkBp3ySNUt4LUuqsVZf:c3HtDpvhpz03TafBo+6IhF0DY2ACkVl5
- TLSH
  T12922C561ABE00768F2F70B796EF764AA1437FE024F29C2AF815091491D32754DEA1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  mahapps.metro.dll
- Size 3.4MB
- SHA256 4ec98cb9c86b38b721de7aa5e9f392407a6a57df950742bc089ee2f75c37177c
- MD5 a0f0e7cd27a953e7b7dda3ccaad8c5f4
- SHA1 c453eb867027bf1cb4a32fdc73a5f1b0f049d7d8
- SHA512 a3b082a24d575962d75b8e8dfc2f577f74d6121e03bf2f800370b7d86654ca90cea546de6e6e53c4a47a4117091ac328bc762fcc9cbe798603bd454a210314c9
- SSDEEP 24576:9rXx6dKYH5UHXfMvbj2vqhOR7qDL2P/1Y5e1bq7mTv+iruHt+f:iD2bM2bq7mTv+iruu
- TLSH
  T1FEF56424C319C437EFA35E751F5098E41D2028E98342FE1A2BFD2B3588C575E26BB967
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  mahapps.metro.pdb
- Size 1.8MB
- SHA256 23ad3d5e803328b51100fd520584aef40b98e0f248dda16c99bd4e66a7f11ba4
- MD5 17c2efb7c771c6b7871f1cc1ad0ac68e
- SHA1 f93123d3ba384324ddefe65f6e638c963ccd5ed5
- SHA512 a453916f75d445447fc6bb4cd6d93a7829a66609248c38c65d9e27150f978c114203d0a7e347bb58d8c69b0411e0833c68eac0eeef3cd5521c459a357b930cba
- SSDEEP 12288:vf2bNP3YDqAmFzQiIuTD5Wdu0uRuqs9xzhduTA9B:3MfVzCe5Wdu0XzTd
- TLSH
  T1B29594637B58CA31D86A95382ADB8B2D0338E1C85743A7DF63C6607CFED275A1D46384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  microsoft.win32.primitives.dll
- Size 22KB
- SHA256 e281d04d35118b7f3a2406014333e0581b74ea4b62f4f2388ad3ad8b32223c83
- MD5 9e12d3a3500f09d1ded5fe6830e4f8db
- SHA1 afa308c0166d8cbdd1d5e6fdaa8c9b87eb9184e7
- SHA512 459c90a4942b6014ec90a311c7ae45370e0d49ca4be3961570a2f50d340637ade1b6def90aa4722a91e3cedb0d14e5f8802c02745e72c5bcf705ac6499ae396e
- SSDEEP 384:ybha4YH9Whs3W2W/Z3WUQ7q0GftpBjcERHRN7DlJrv:ybwJ+EieEBHb
- TLSH
  T1E8A22A91C7BC4213ECE39E7062B4D9873C3CABD3AD2057290499F2D91C977D1DB24A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  microsoft.xaml.behaviors.dll
- Size 141KB
- SHA256 3e53d0be008d89b1841b563ad5db6d99f618dba5b4c2e02571764326d02841cd
- MD5 ea0feaf53c096c8abf03a314c2973ba6
- SHA1 34342e47cac0c5dd70f0096660bdfacff8921f93
- SHA512 6440c3afc07088347fb1616ba158c63b7fc5f1df0ca5183d9377f4e26f3077da143f269e8032cbe54dbe1f960315b6db775109ae8633e3ecb89cc7959fb5c687
- SSDEEP 3072:MAyazS96IT0OegAO56C9bOEW5m51dXcrz/so8E+5r9j8:FyhYIT0Oe5yV9bOz
- TLSH
  T10DE35BA593FC8A2EC7FF0675E1B451144630FB93B923DB4D5EC0A1AD099338266127BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  microsoft.xaml.behaviors.pdb
- Size 52KB
- SHA256 2376cca30ae1d9f9d36feaf48a041b017dbc1e7a56ac6b9aeed8af6d1cfd91a7
- MD5 2c36433a97b83ffe46e0b17246043ba3
- SHA1 0492c84c941120b0986163c95a3fdd835ac13436
- SHA512 0e5359bbd12e1a852b4b20ae651b80cc50fe9029bf0761fb518dca886d459090906b51a625ba7794e0dc90838b230ce130125dc143e6aaf30b6e34c69e1a0ac8
- SSDEEP 768:miqM3EZgM/mr09r4TKzkhd5WGnyfIXrBVP3bssnjpE9h4Muu9y5xdpsiGM1I0xgy:8MUrxk4wn7BVfq9Z4MFkPqa
- TLSH
  T16C331A129DC1831BC6A6543B41A35B246374C108A64A8F6BB3FCF3F5BDE27D40D6B259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  newtonsoft.json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  rulauncher.common.dll
- Size 21KB
- SHA256 799502cbf53db6691f3d589f1053e372b1da38e305755b98bd48e348aa866c81
- MD5 95ee7a81c1d4c63bd735f70e0c5c3034
- SHA1 6e952528ecdcbcc28acc74f8c6333be054d30677
- SHA512 fd8ec04b6daa64e98f2e0d7deddb3e44bb8e9423a07c6de9076e16c1518dafcc8cbb64ede52d305c5c30b8b2d52e6302e34f3b3f11b6087a9a12b78cff817e45
- SSDEEP 384:Lmhtd2PrSbAm3smRuQDO2VbB+ICC1GEEEAemOR8N3269SbX:wtArGAm8IRHvCC0Ese+9p9Q
- TLSH
  T1B2A21850937CC329D67E17B89869487003BBD3CA2907E9BE8B58F14D3D2B75D09C1AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  rulauncher.common.pdb
- Size 55KB
- SHA256 db00a161d352cb09d22c3ab12655a692bb03a91b1824b1012e0f5c301a125524
- MD5 fd3bc8a8866603a4a75d866899e3bdaf
- SHA1 aa1c8ce8c69a2bff4e81f701a5f84a7f4cd6a4d0
- SHA512 2d57479d2029fdefb538a87a7f248e5d8b13fa266da04e12854440716e3ab56861ee76a17933148e32519037530bdfe7590518d1b4397bc1af9576a5658facdd
- SSDEEP 768:Ipwt3/JD/khk4K+vHK3XSOOg17JBFOAvhLP7B7z:IbK3LP7Xhh
- TLSH
  T1EF436506FBC4CB35D4794B38118F872D0238FF95568697AB1B64B12C3DBA3691F472A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  system.appcontext.dll
- Size 19KB
- SHA256 ea3a3003e10f44280074810934261b61a209c1ec1e9029b932742c853bde743e
- MD5 b906366572177d428a8c3218b203b417
- SHA1 c9a0c7200ad55960a1e1824b04718cbf6ca84581
- SHA512 adb0d6f982e9f586d49eec0b8d775b98c87515e5c540968fd919864285ae6f970d00af7f8f5d0bdcce29b4c77f7fcf3247f461821781b020aa1413d2fa8b1282
- SSDEEP 384:99JjWvfWJSUA0GftpBjY+ILKHRN71UlBRAhHvH:9Dgiiem1qRAhvH
- TLSH
  T125923AD18FBC8143ED936D7062E8DA877D3CA7D35C20855A146AF6D82C833D5EB24A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32