ce7f2dfa2ed42b0013c9342d52b5b870fab1a2ecda4d114c12074887806de60e

Sharing

Copy URL Twitter E-mail

General

Target
AirDroid 3.8.0.4 [pesktop.com].exe
Size 48.4MB
Sample260705-nbspxab14t
SHA256 ce7f2dfa2ed42b0013c9342d52b5b870fab1a2ecda4d114c12074887806de60e
MD5 ace80cf10e8f34ac5f0c9d37b41c33cc
SHA1 ad94b9e92fd031e481beecee3610799b7afc2388
SHA512 5cb68613d5d9da91366d4345763ddb131c9f133e64a4466fc3f9e3775f1015ad9a3af48b4a8b102f758a4d4c0e0c9ea1b3522c21737b275eb4fb982ed9fbd035
SSDEEP 1572864:3VVeZwvppSWZ7zEM95rPnjd8uJlTe5WVxnl:3DeZQSaJ9Fvjd9lTrh
TLSH
T13FB733B0DE0ABDE6EDB10F79C0325E354D26CD574550888AA41A3C366EF3982B7187BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AirDroid 3.8.0.4 [pesktop.com].exe
- Size 48.4MB
- SHA256 ce7f2dfa2ed42b0013c9342d52b5b870fab1a2ecda4d114c12074887806de60e
- MD5 ace80cf10e8f34ac5f0c9d37b41c33cc
- SHA1 ad94b9e92fd031e481beecee3610799b7afc2388
- SHA512 5cb68613d5d9da91366d4345763ddb131c9f133e64a4466fc3f9e3775f1015ad9a3af48b4a8b102f758a4d4c0e0c9ea1b3522c21737b275eb4fb982ed9fbd035
- SSDEEP 1572864:3VVeZwvppSWZ7zEM95rPnjd8uJlTe5WVxnl:3DeZQSaJ9Fvjd9lTrh
- TLSH
  T13FB733B0DE0ABDE6EDB10F79C0325E354D26CD574550888AA41A3C366EF3982B7187BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InetBgDL.dll
- Size 4KB
- SHA256 de9e643db43acb47978214bbf2c269e7e39a13fedb453da8084a2abe79eb4b07
- MD5 be9d896415dd3b3425ee7b292d2a5a04
- SHA1 e51f89eb7aa193e4ab58e884f3e6298b043e09df
- SHA512 1913ae81a643e6b259fbffa82c4dd1d9ef1ff5561653e984fac3696ea75c15f01668316495e24cac4ef175d04f7a91f8dbd837c1eed8bdea67c9976b7783ef4b
- SSDEEP 48:iL//qWagmBTGJSIWaMJcvGOo8FB74Jx5xSSzP8eaiMmKzESFDlW9Dy3:OBaTGJSemcT74BwSBafmi/FDYc3
- TLSH
  T10891C6777387CFFDE24A16B415CAF80B1460A1081574869F6BB3495A37B61ACE47D313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
- MD5 67d8f4d5acdb722e9cb7a99570b3ded1
- SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
- SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
- SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
- TLSH
  T15862192077C650B3EF6226722AFF77179BA5B11414D29C0B4E732D472D39641EF392A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 b15b1fc88d1b56088b2d3738d76772a91fa186a316a3e0a154358820d0fb9005
- MD5 410a586735f45164c86bda363ad8446f
- SHA1 a68d18a8c72ffaa8f8d9ed9f76ea9b0ed397821b
- SHA512 d12083f67df132b2be57c202601a0cf82dba4c234910e780d2723aac14ae68407b824405b04737b55104bc97750550a3271a944d647661b067ce134075e6cc2a
- SSDEEP 48:aYZT4WeApYxYlxamAWHN+EuWkGWBBWAGr9SdLB8m+ofYZVSA:JCWGSxamjHNDuWRWBBWvmuV
- TLSH
  T187B18630F7C088F6C691453B249336C7AA52B9143708445FCB6B219A2615EEBEF3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- TLSH
  T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  AirCmd.exe
- Size 412KB
- SHA256 8b1c6a8a12477605aac63d405e52d1faef4b0118b1980c188d138239c8bab8da
- MD5 f179fb72ba0e30a064d45d587ac141ca
- SHA1 ff2da4672529e66a42ba1bd95a75474ff97d3711
- SHA512 002c68e3dac346f6ae979518824a7ba95d48bc0318dfa3eed0eac6e48088be185da41c27c23bcf206fb1979d2a0a45eb520f7eb87755900f48e50928f1a0fd42
- SSDEEP 3072:TOO9cvjmGPsS6QGjm4wL9fC7Zd/tvGf6wiRP8SZQDYm4wL9fC7Zd/tvGIVWJ:T79cLmOsSMjR0HiR8SMYR0m
- TLSH
  T1F294B6B2CE05034BF8193FBD943D5FE1E07B6F91DEA06A155A1B79A616B33D301B180A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  AirDroid.exe
- Size 13.3MB
- SHA256 5f6339c876bde9c4d32f821b2914f0891d38e815b282bb093e0b494f5713e4f1
- MD5 94e04661e4b88f94d5573694163b6202
- SHA1 3af6585015c3c0b7931847e4e81a6501a5cb7155
- SHA512 57c8294e222dfd32b5410bc7f0a3fb1cc00479f1f9174e5b82fe688c3629917f0207c2c74c91f7db2893cbfa539ec47ef33955b88f33d9ac1d26154adf5a08ce
- SSDEEP 196608:28EOkp2ruV5KvusCwIdoQJM6jiHaPc/ZjX+/6Y8bVg3B0/GrA5cfs7:28vw2GKGoW1LGamXw6Y8S0/Iq04
- TLSH
  T19EE601D3F7034C0EE259477240B94A406736DE812B629B5F666AB13C3E7336B4FE1296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  Android.dll
- Size 7.6MB
- SHA256 c16f6f097ba25ecd0540c860e7494565229b8bcf3f6b9d882d82aaa8515b68eb
- MD5 bf35a7b7f90f250cc6c39513fac7f4c0
- SHA1 367cf91fe2ec37cb1e1d3dd6f1b542063a247921
- SHA512 fceaa372b3f6345e63a7b1a1deecd6b6695f98974785ab1947f2e8eaa2586d311a5e116975494c461cdb51098b67709a21bec2081a7841cd873ea2c34df3c2d0
- SSDEEP 98304:4C7a1CCLbq2b8z8rxTJ+wN/dkN/pGBrq06xHSBAvl77wgI34ihQT:44GdKfzqEwN/dkNuxMqC7spIN
- TLSH
  T1CD86AE06F746CE1ECB962A7764639A301331C757A702BB9B176C62386DC23B44E4A3DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  CoreWebView2.dll
- Size 177KB
- SHA256 036c54caf60e1add87a034c0fd082781d6de08038c7e87d7863d26e46371f303
- MD5 a8447d032312c19641caf4436d4f7904
- SHA1 e4ab37fb8e41b6c4b586c84c9b7cfbe34b1df240
- SHA512 1290fdf14b13dfce5db4b018ec975baf9ef32a77b68ed2ace9cddbe5d0c19d4791c0bd96cec6dade0fe33c41c7c7338994a89f8b2403f17a816e9c0fdab0cfe6
- SSDEEP 3072:CVh7QlRqaI2R89zD2d1bQLmgyTsIveoJp2sHgDQ1wNe8MiI4xLH33nek7K25uYed:CTIIZzyd5QqII2oJp2sHgDQ1wc8Mi1xK
- TLSH
  T18C044B5023E84515F2EF4BB4E47055A28B73F906793ADB8E5C4C60AD1FA3F80A9127B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Helper.exe
- Size 842KB
- SHA256 f05375d22a61b01dda5ad730972d571b6ebf54461464719ba8be74575eb1ef67
- MD5 675b7b08e5f9126bb3c674fc3b9c7175
- SHA1 8d065d702bb9d296363945e9be1c90fd94cd4681
- SHA512 a4ad5a2e517c4877a02850ee6088532a60dd211c66b0d623d7e2bf88fcf71ddb321feb80b94ba1adaf1faef1d0713de25e5cf703b30f113de8f575784caea826
- SSDEEP 12288:24ur48+BKwOO0hCs7jR0FLJS3js7jR0CTFJ+76:BurJQpO/t90lJSC90CTFJ+76
- TLSH
  T18605A1B2DE01134BF40D3FBD907D4FE1A27B6F92DEB0AA151A1B756616B36D300B190A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  IKVM.OpenJDK.Charsets.dll
- Size 2.1MB
- SHA256 2f01e4d8580b24cee07a0603daa6fc12a8a7a23f0db4dc992e894c5b31ca772b
- MD5 c6f85be0186d83ce7a24b0d33322c2b3
- SHA1 fc001845dc842d6cfb049087de150705e638d171
- SHA512 aacdae21d72423c52cc8455252c802fcd8cc67575429e417104e8828145face4918845105b96ee17bebcaf4678826b637a9ef8b127e0f9b079468014c5737423
- SSDEEP 24576:y0YS0LQCnCbRTGA773Ah+598UdaeRbHo0LLecZiZAjuOJj1:y0YS0Ll0V7aURE0LLec0ZHOJ1
- TLSH
  T19AA58D1BF2107227F127D93082736F32A99BDA366A6D05DEAC4152C2CF962D07EC45E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  IKVM.OpenJDK.Core.dll
- Size 4.1MB
- SHA256 542f1121f3c961aa804240229b075462bbe1348a01ffdf1047a4c05b6ed508f2
- MD5 2491c356e88e453d32b72db7fbde736e
- SHA1 a97c959bbecccb56dd9d35e6b77b5b3002bfe4f7
- SHA512 d530daf03e41a9c8c611559250c1af44dd371c02ac3122d8564ec8513844e6158e4bc35cb5a5beefd960f8f15712cd6183a4ffd48bbaa3e4038dc087fb732a2a
- SSDEEP 98304:inO3Qcxf53riGzK5SIVTM4cWXt4V8e274:OWxfz8r4
- TLSH
  T1A8167C8AF2B40F62F1BADAB6A474501153F6EC7087E2A70A014565787F53BE18E41FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  IKVM.OpenJDK.Text.dll
- Size 819KB
- SHA256 a26f8f8f2617eafcc58771f50a980cec722099de400e2e997d999b3b7c2f3bad
- MD5 f8939872bbaffbdb727a56b7112319e5
- SHA1 83078398361b274625dd56f061cb827fb21e9000
- SHA512 6c102bd79f30d38abf639a7046378df02b28586e170d2ca7e3dd25bf2f80d3ba797c7108e0801784e0a3f6f269c2a82c54fb2b18186be3e8ba782ad354764925
- SSDEEP 24576:Y/OPD9z1/2LriD3PxNLBmeaCT4TE/goHA5u2R0i5:YLL+DPLYC6voHA5u2R0i5
- TLSH
  T10805BFE393646A32EF769A74B4757101D233E83AD06ED38C4945B0B1AFA1BB1E801777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  IKVM.OpenJDK.Util.dll
- Size 1.9MB
- SHA256 b07899e1218512dcc58de1cb3961c505869a5bab420215757db972601e756018
- MD5 138f4ce2cd384736ab710ef3f2e878bc
- SHA1 c38510fbfcf099ccf9ad8ce51637fdc77982c468
- SHA512 729755a34b24453c569a2784e2a2e4710008061e70f71d06e2634400abc6d8d61c93a86752f908eec344f6bc5391e78e8d953805a4cbf02c608b8237f384e4d4
- SSDEEP 24576:nNn8+aeov3lTCa4o2A/eZTR7aXkrCu4MwW2OGkxUkbafxXEriKY4QU0ZimdxEP1q:NkDNimdx+1q
- TLSH
  T147954EF557A5363BE6BEDA30D4B5F101CA71F9A69429910C391CB4C9FBE0701B8A072B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  IKVM.Runtime.dll
- Size 976KB
- SHA256 b54568dcff7b53b812d344f0d3118447a7be951b09b6d18be64e1705cacb6fdb
- MD5 dcb37c3cd331c81ad2c3bf07d47aca4f
- SHA1 5b42a37b3d8f844cb7616a37d4975b518771c169
- SHA512 b31196e69e00303e8ff00c9e34451ca08da20c8f7a7b0d01385dc0ffdec6cdc90e57c0761e6cdfaa6453a675818c284505d86a3845425b8a05f3d5344ecaf7d9
- SSDEEP 24576:vD9s3GNOWcNmuodCEx3VaLnrArZtE7TyJ85h:hOvN6pBUiSTyJ85h
- TLSH
  T140259D027BEC4547F5EFA778E0AA5A04C2F5F4439696EB8F5C8022781C92790DF60B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32