dbfc3f08f66af2442edff55216021fb31ea9f888188bdd5dd51d63516b720609

Sharing

Copy URL Twitter E-mail

General

Target
AlecaFrame - Installer.exe
Size 2.6MB
Sample260704-s6rtbadt3p
SHA256 dbfc3f08f66af2442edff55216021fb31ea9f888188bdd5dd51d63516b720609
MD5 463e9f6d2af47f1f3d218ce2bac1ec56
SHA1 bb357e7f38f99450dca4c3bc0561face9d0b51cb
SHA512 01d080bd93817f5361ad63991ba8ab5ed9c95e4a343253860ab009d9549865ec993bd301d819106b5df8d56144d06ab00f32dc6fa0e5ce89dbbdf799715b9e67
SSDEEP 49152:OJErxE87vxpsrFpIvQ5hczGe0kkkDs4pYaIw3UhsooAFhR8MSdc:OKFPN+TIvUh0uY6arkhsbc8MSd
TLSH
T108D53331C6A9526DF623C8743AF5C39FC621EB0121754B9AE784EC503825ED3638CA7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AlecaFrame - Installer.exe
- Size 2.6MB
- SHA256 dbfc3f08f66af2442edff55216021fb31ea9f888188bdd5dd51d63516b720609
- MD5 463e9f6d2af47f1f3d218ce2bac1ec56
- SHA1 bb357e7f38f99450dca4c3bc0561face9d0b51cb
- SHA512 01d080bd93817f5361ad63991ba8ab5ed9c95e4a343253860ab009d9549865ec993bd301d819106b5df8d56144d06ab00f32dc6fa0e5ce89dbbdf799715b9e67
- SSDEEP 49152:OJErxE87vxpsrFpIvQ5hczGe0kkkDs4pYaIw3UhsooAFhR8MSdc:OKFPN+TIvUh0uY6arkhsbc8MSd
- TLSH
  T108D53331C6A9526DF623C8743AF5C39FC621EB0121754B9AE784EC503825ED3638CA7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan adware
- Adds Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/app/js/utils/cookies.js
- Size 1KB
- SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
- MD5 6c60e675f8c8c68c0174b644d3a63a2a
- SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
- SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
- TLSH
  T17721E0087580D81EC5725739AE286778FD30992611C6D54DB88CA4F02F30C169DBE9FF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  $PLUGINSDIR/app/js/utils/modal-events-delegate.js
- Size 1KB
- SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
- MD5 117e4fdbdb0ecf211c8bd909efd337d1
- SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
- SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
- TLSH
  T13C31D54D36FD173AE5B7172B5B2F5F8CAB72120B09054A26B2E69A804F354241196CFF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app/js/utils/strings-loader.js
- Size 5KB
- SHA256 96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf
- MD5 9c94eb933d8a43dd3825e67a7e30c980
- SHA1 7ec7b16af6f399219209ba5967d377040486a11b
- SHA512 a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5
- SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6WfwkUlx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6Wme0muXDK0W
- TLSH
  T163B1FD58289314118C32B764CD935264ED6A4917023996F3FDEEC2686FB149E82F8FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app/js/utils/utils.js
- Size 118B
- SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
- MD5 a0952ebeab701c05c75710c33d725e7e
- SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
- SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
- TLSH
  T1ADB01274B7AC73A2D315377AACBF6C1DF0375C368414B099B19034E19572D04519DCD4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app/js/windows/cri/cri-controller.js
- Size 5KB
- SHA256 051f1d8fd41a0e7a6727c628885be179fe3e390c5b431b18a03911fcc710c601
- MD5 222a3efccc749b1442f012aa64757753
- SHA1 f0f13e5e3e3bda57f0662032c700a6bcd4aee807
- SHA512 292e0413dc9f821b934ebeaa988a6b9cac8cf94053af27e7a01cc47f9e99104b2f5a7ce250098426a9400f3cc188efa3f3c1c79340e959114454f5da472b14b3
- SSDEEP 96:u6CeVFfOhETv5T6ToY/aqBb2WCtvKqKLANwGy0keErsvwn:u6jVtOyl2EY/aESWCqANu0krsvwn
- TLSH
  T158B1CE5C3CF9866158B7277ACF261518E73742172241AA2A7AFE47804FF5F00461AFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $PLUGINSDIR/app/js/windows/cri/template.js
- Size 1KB
- SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
- MD5 2f82acef2d339db31fab5c73edf8af19
- SHA1 d9138de6fe1320cd232fd6e1971fbbfdb9225bd6
- SHA512 90311035970edf2c1d0175c9b718c731fad4f58ad5a0b43a2588e2e6132cc09deff1d49328174408c51fe3082d62612f7a2a6c25179ac474101468ab68c2abcd
- TLSH
  T188212E24441C90331B7B979BDA13276CE9519301D80B7D3871AE43A82BF3B828E62359
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $PLUGINSDIR/app/js/windows/cris/cris-controller.js
- Size 9KB
- SHA256 8c1fb6f5bd30ce21ae2f3f23c815b094d3351673513b0f6190919c1e776ae0de
- MD5 d62bcf3408f8a28371fbc6bd976ec371
- SHA1 49d7ef51d862f8a3539dfddda92f1969a757fd0e
- SHA512 d2516f128d48dfa0bd25ff687cdda15293908f5bb1146211af2182fc16c1aaa2de3ae16bd26e20e78177c6866492bd5d30f6673b17a00a1d70a5523bb543ff48
- SSDEEP 192:cRdar5Yvyl2AxrZn2Cb4vd/Hc7z3e5ankGMelZCcgqR6U:kamyl2eV2CI/Hcn9MeliqP
- TLSH
  T1CD2232459CAE26299AB7B275CF6A0505FB3043176984EA2E78FCD3840FB510181B7FED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  $PLUGINSDIR/app/js/windows/cris/template.js
- Size 395B
- SHA256 b990022c56a909a0e0979346e8ece1ef6adcfcab54ddd7ee11cca0f857a30f6a
- MD5 fe0f4c4c71096d1badb922430336cf8c
- SHA1 deb92b6fb4d8d605024267eb3e5c00cf32d33447
- SHA512 d6d65a50508c473564d5fbd3363972c8cc42c6af4d8523c8b22876f9ed4d32e4cb5ef7edddc43aa2fdd210221d4a169534291b9a9b44c3fa5bd65ab18b12e85e
- TLSH
  T195E09B1541359A30373F526F93671B28B622D1124F42593845D75350327F4978E4979B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  $PLUGINSDIR/app/js/windows/finish-with-recommended-app/finish-with-recommended-app-controller.js
- Size 6KB
- SHA256 0e677188974e100509526b147492af99c82fbfe6d0cfb88444cad6598f4300f8
- MD5 2f346559cddb2d3b37dc32b3d39ab816
- SHA1 560f89254912a5d03843ece74cf5f46af9f5c377
- SHA512 d22682aa46c2d901f7b41a65c7e13039d75db5264aaf6d9250bbe9b059b76454ed3c3b37d6cbf66ad6159a43bbcd12de4ad9d65f1f91fce24655cc8768cbf98d
- SSDEEP 192:otBaiFc1rnGDtjcnvpu7t7jt/Pv0+bnZ7uc:otBaiLZ6+tHt/5nZ7t
- TLSH
  T150D1004CAE9E5568E53BB33ACE9B4188F73502271540AA17BCDD97946FF0305026AFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $PLUGINSDIR/app/js/windows/finish-with-recommended-app/template.js
- Size 1KB
- SHA256 f2f955faf5dc90e9ad50815566aa42a693128f97f07d02c5c3a1dbac27f570c4
- MD5 e3f895c48a2c99c3e8656c9093075286
- SHA1 4d1c13a0f03ba903787b23f5f27563966cc08a31
- SHA512 7c71787b7bc49e77923e178fbc38e2fe7e45283f257766020a21e25535ff095b7896406e612e254c46fef5af4a0fd2a4a9f5ecb0b33fab91261f01a3bad9a54a
- TLSH
  T1D1315859425F9A73173A468E9B670EAD3960DF02C8B00F11B5DF4784E3735888EA7318
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $PLUGINSDIR/app/js/windows/finish/finish-controller.js
- Size 1KB
- SHA256 36887d1e8506f68b64329d514e9eaf53e1ef12017a161ca258b4dce67930eea0
- MD5 61001b717d72bbde5c8e9be46eb63e68
- SHA1 ea904057f373c0ef4c2c5f4f3998108923582223
- SHA512 a2934c0c9a691f84b806bdf104e19b12ddad65dd32cf0b857534ba9736728d766491389696aecea6611394b1f64c4ab97d961b06d4b0d38484cb2bf715380d9f
- TLSH
  T175416B487EBA43B567757F3EDE250655F732426B0A4A4A6A3DDC53C08FB1014029DFE4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  $PLUGINSDIR/app/js/windows/finish/template.js
- Size 1KB
- SHA256 cedc900131ac48e92bd931926946dc342a99de1b16757969b7416f8ba037fad7
- MD5 6410e00eec2197f48a0d2ff66d0c07d2
- SHA1 480c640d3849cc90fc881306322ea96e31c1207b
- SHA512 302f2fa32afdc0d2e8729a91ce20d16427f2a6d56f97a84aa1785c3babaaeb080ff8d1ba400a0d1c3917646b1597e1800a36622f3ebdcf14979da6e3a76879f4
- TLSH
  T13221289D426B5B37073A469C52675E6D3C60DE00C9710E29B4D74780E37789D8EA630D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $PLUGINSDIR/app/js/windows/main/main-controller.js
- Size 13KB
- SHA256 06f9408a9ac6d1adc1bf00c35031a24fe53cd579d29e31aab3f47a421afd93a9
- MD5 9d79b949c35645b033792e79a47071c2
- SHA1 94828d1c7844fe4b481a475be15c184e2389b051
- SHA512 1c12d713c7ae4c78649a7f27b0d16b59b86f09581f466c7aa8681bb9f8908289827bbea70ef9b5f5d970f6d049cb43d1d26c1c51651bdf63094369e6a4df2d84
- SSDEEP 192:28RUCEI9NxThFzkzLZ1ksEIA6li5djpAAgvUqFHVgMKV59GsZ2d5GwOVTfkqdfj2:2tChTTzkzLZhJi0y3Z8QwVaf6
- TLSH
  T1F852DD0879B916A4E5B7333EDF2B4614FB71442B45068B1A39ED82C04FB6810426BFFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $PLUGINSDIR/app/js/windows/main/template.js
- Size 3KB
- SHA256 d827fab7a8ec31dd68bcd7e6725c01b7d72d1224fc0c1a136dac513cc7884d0d
- MD5 694ea1756f2dace45053080494afbb70
- SHA1 f503248779de58075f5a3ea9ba97a4838b95d1a7
- SHA512 aae8397bbea463cbcff7a26efbc8be6e9697a65073fb566fbe0d32a68dd4e656f9ca70268a1faacd2b137cd7fdeee1a380f4b4126cb1ee2a6d2bcf07bf076029
- TLSH
  T1956131221065157267BA42DA56266E7AFE61E303C58B9F25B6EE13C007F3C42CDB760B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  $PLUGINSDIR/app/js/windows/modal/modal-controller.js
- Size 2KB
- SHA256 4565ee81ffe222b31982088b1c18850076e3acf59198ebce08118e12cbd87ea1
- MD5 b04bdfd1c7d09bdbdb94a2455fdd677b
- SHA1 f000ba4866ff16d75bfd6cf446763498e19b12b1
- SHA512 3cb6ef0a16309046e7f407e7321eb12212b0eec09ec1a04b1d813f6c7a04546714865c3b398a93985041f598156ed905ebd23a64260801281b29ada9bc19ec5c
- TLSH
  T17351228E281B218195B7777F8F8740A9FF77446B0602475A3FCE87610FB0410929FEA8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32