e62a07a05095af134d0a3c73e98aab6ed6e7111abc4c3d31a8883c0aa88aedd7

Sharing

Copy URL Twitter E-mail

General

Target
ASIO4ALL_2_21.exe
Size 386KB
Sample260707-apf2daet4y
SHA256 e62a07a05095af134d0a3c73e98aab6ed6e7111abc4c3d31a8883c0aa88aedd7
MD5 945b4d99519dc217e9cddee945dfe612
SHA1 60af34e138d64292a38dea39bdead91d00a0af5c
SHA512 ba50ca7be51bc7bfcd33e62001883927ebda8f3c996e11f28cfea67389452bd489a47c941a1bab224bc2dcdd2df788c195b8ab5036c92d421ffbee2d4a6b7571
SSDEEP 6144:pT4Dt36QmUeDP8afzNnmS1LpxMFWWMvfdFY6JzEiceFQWNZb5g3Th+U6ldH4:pTmz7cP8afBmY9i2XgeFQWPWB6XY
TLSH
T1A58401CE2760C406D9520B3064A6DDBBFEB4BEC575C02A43B78C3E2B69E5AD1CD091E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ASIO4ALL_2_21.exe
- Size 386KB
- SHA256 e62a07a05095af134d0a3c73e98aab6ed6e7111abc4c3d31a8883c0aa88aedd7
- MD5 945b4d99519dc217e9cddee945dfe612
- SHA1 60af34e138d64292a38dea39bdead91d00a0af5c
- SHA512 ba50ca7be51bc7bfcd33e62001883927ebda8f3c996e11f28cfea67389452bd489a47c941a1bab224bc2dcdd2df788c195b8ab5036c92d421ffbee2d4a6b7571
- SSDEEP 6144:pT4Dt36QmUeDP8afzNnmS1LpxMFWWMvfdFY6JzEiceFQWNZb5g3Th+U6ldH4:pTmz7cP8afBmY9i2XgeFQWPWB6XY
- TLSH
  T1A58401CE2760C406D9520B3064A6DDBBFEB4BEC575C02A43B78C3E2B69E5AD1CD091E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7
- MD5 0a9fb96a7579b685ec36b17fc354e6a3
- SHA1 355754104dd47d5fcf8918dee0dc2e2ee53390a6
- SHA512 67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b
- SSDEEP 384:EFC43tPegZ3eBaRwCPOYY7nNYXCg/Yosa:EMTgZ3eBTCmrnNAo
- TLSH
  T183624D1137C558B3E2D62A797EE2B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  A4ARegFix.exe
- Size 90KB
- SHA256 c3bbbc8c4b502f910c3613b614e159ffe407f343abb2e208f4bb7bd6c7b4ca0f
- MD5 a48bbddcb6771a48a6f71258ec6d2371
- SHA1 e0ce96abb0eb771058ef1e6e4c8babb0539d61b9
- SHA512 374fe784b3f6e663a40f300bcc4611485ec10ed38b276b0c99a432d1cfcba77b1686b8b445bc7647447a697278f2d452bd3ac30caf9a612c5fed3f71a4c61e14
- SSDEEP 1536:CTsd3/DWhVwct7bTv3WJmqPsi6Z5FuSo07kC1m8CWssW4deGnD+eaDSioQ+fp:CT03/DW7wG/v3WJqi6xLCWjVnD+e8SZp
- TLSH
  T138935A8773A034F9E4638A78DCE24961E772F97606718F4E46A4025A4F632D19E38F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ASIO4ALL Web Site.url
- Size 95B
- SHA256 007df5b56ad9ffb83061019e3fbf9f7a8af84a4ea8c65c38b0f02ab27c4e2546
- MD5 15a5d95ed493bf090f5a9633943b775a
- SHA1 8d22eb5bd1b1f1baa7b4d7ed8d95d1d44e2bfa76
- SHA512 11a8539467e5e060828790916ee9901abd57082ea0946c670647a3ca85e2ab186b6a148b98e483232ac1f905702d45dd409bb3809bff6a3a0fddf8618556ca30
- TLSH
  T1E8B0028C9509C259C442DF8E70F6C9B5DD1671F4C0E7C5D4DB40CEF41855443799C355
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  a4apanel.exe
- Size 39KB
- SHA256 d60145898b3cb575c23b205a483b5b5d271ab0c6c912899f8feed4b90b309bda
- MD5 0846352e576dfc9a7e71f0552e486afd
- SHA1 0bcc61730bddf3bc58ea0f7b512fec8dc0452b41
- SHA512 bafeac37eb1a191f2f6f3a0afdc61406e716ae74e55cd75c4fcf92dafc001c1168eec2d51aebd30310c12c9da92b8f325bcf6bd8e43d2171938c8323b2e27896
- SSDEEP 384:exQNtXlI9ZaRo+uqTNNqINzufPARpwKANynsdNHmL4/y8R1U1Fi6Vc:eis9ZaRo+uqTNNqINifPAwdNGLk5gvY
- TLSH
  T187032CDE2A20D805DA425730A486CDE7F562BDC9F5C42082F0ADBF3B5AD86D5ED081F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  asio4all.dll
- Size 361KB
- SHA256 041b22af3eaf95554484a22a7944bd2d63905e4f10329b7976ca560e5330bf2c
- MD5 8cbf750faf785dfcbdb63323961ad6ef
- SHA1 800c807b368f52d37eddfcf62c2846f51a11b723
- SHA512 f99b48ff4cc00c95d70517aa73e96359a04bcad0be907f3b36e7ad336b9a1e817871e57bb8f0f7f05f88fb3bb38ddfc5c1b78aec8b5cea83130fba862d6cfa90
- SSDEEP 3072:y5w8k6xH7g1tdUNBB6SQa3Xy4s+lRELtdLy:8dG0BVRE5dLy
- TLSH
  T1E074A50CDA82F46CE0550EF88452F7BA72946E9B9963741B92DC3D0777BF7C29470A82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  asio4all64.dll
- Size 396KB
- SHA256 4ae415252479e63fc4c02b9c9a67a05aef857d5fd1a069ea923109513b6bb95f
- MD5 e87125096b9c9582bafafe7b52d563c2
- SHA1 c0903be432a72c8a3d8fe45c6667e50bd48da5ec
- SHA512 f401261e92f05692678ed8318bb1327dd5a4d917368042791a660cd27f333c59feb7a1d731aef0320fd34402dce3d16c08c2964c1a90fcfee6eb07bafd70a3cd
- SSDEEP 3072:KCtiBKjJM/fXjFqVO1itdUNBB6SQa3Xy4s+l6d2P:JsXfqO1G0BV6d2P
- TLSH
  T11F84940EE982F45CD0594EF88581F3B6B2A47E8B59233527869C7D0777BFBC1A470A42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence privilege_escalation adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16