84e7c2d32cbb0b1546c14fe3f7fbceb36ca143dbae8f19fb03f91f7a4a42d8ba

Sharing

Copy URL Twitter E-mail

General

Target
VpnInstaller.exe
Size 7.4MB
Sample260708-ph9sfafw2w
SHA256 84e7c2d32cbb0b1546c14fe3f7fbceb36ca143dbae8f19fb03f91f7a4a42d8ba
MD5 d9918b5ed9fb58631f174e56e07a079c
SHA1 e3b177da01ef18d658c03f426702f2d369728d19
SHA512 edf1cb7a3bcef229db7e65821f76a8d70df5e2252fd675e53641d76c247fe5de96b67c799f9f2813cfdced8f832267b16bdee231ace833bfc864909fd6e7d7e7
SSDEEP 98304:40Z7v4NSszc2mO23g+KaKkqZ3KEmE9ZYsCFk1WVbS/D3K6Yb6vEHvmPcF3kZe3qN:z7vOlI2r+pgKU9CiWpS7GeMPdt8ea9z
TLSH
T18A7633CF02D05D5BC66B0A73121B0165ECE31F454B3794CE8BADF4EF2A633512699A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VpnInstaller.exe
- Size 7.4MB
- SHA256 84e7c2d32cbb0b1546c14fe3f7fbceb36ca143dbae8f19fb03f91f7a4a42d8ba
- MD5 d9918b5ed9fb58631f174e56e07a079c
- SHA1 e3b177da01ef18d658c03f426702f2d369728d19
- SHA512 edf1cb7a3bcef229db7e65821f76a8d70df5e2252fd675e53641d76c247fe5de96b67c799f9f2813cfdced8f832267b16bdee231ace833bfc864909fd6e7d7e7
- SSDEEP 98304:40Z7v4NSszc2mO23g+KaKkqZ3KEmE9ZYsCFk1WVbS/D3K6Yb6vEHvmPcF3kZe3qN:z7vOlI2r+pgKU9CiWpS7GeMPdt8ea9z
- TLSH
  T18A7633CF02D05D5BC66B0A73121B0165ECE31F454B3794CE8BADF4EF2A633512699A8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence adware ransomware spyware stealer
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 7ffc549e7f679a08c77fa230654b77cdffb3444296bb7c6b8b5769db374b61ee
- MD5 75e7351a0f836b8659e6f315683c29f7
- SHA1 66b733d1c978d68cadc245e7efbfcae32807429d
- SHA512 f03400798b07ccca5e12fa119a586ee9444deb0d2419aced24d93fd84a4702d66864a71b40a11b04b1dbe56e36481cd6a644aec0347bc82bc7375b27bc403fe4
- TLSH
  T17C71C56663A09FFED1A41330309E38176DDA703123BB66DACE3B761ABBE0081C835711
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/INetC.dll
- Size 21KB
- SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
- MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
- SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
- SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
- SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
- TLSH
  T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
- MD5 81e268e27dbbcadbf116b5a9402195ab
- SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
- SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
- TLSH
  T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/base64.dll
- Size 40KB
- SHA256 7e10ef2723a50b7346449f8bb39efab8a99e2815d33d311ecb8112734f91519d
- MD5 ac6fb776262b63562c00374392fe1c55
- SHA1 045dcad3edcd1c6865f5dea95ace35f4d9964b78
- SHA512 2c511c5f2bb265fd247e43c47046a3cddad2b72a0fd3b35fcb70ab53d7fbc070d36eadd93c279680306d30d6ef5730fcbfed01195a85761ae571e2d324416ed5
- SSDEEP 768:h0lTvjkgjp5vVBFTKnebbo1QiB9PfdkMClc8o4CJh1o:evAgbJTKnMo/dXY3ohp
- TLSH
  T130036D22349181F3E1AB82761595CB1F9F7EEB1403D218C38FF4694A6F256E1A53F24B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
- MD5 13bd8e89dc79004d85ab02626e08c3c5
- SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
- SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
- SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
- TLSH
  T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 70KB
- SHA256 8f80ef429ce7c8a1ac7958ab36ec177f732dc924d14b21230da045e5ed1b255a
- MD5 9c452d3cb1f2b06c16467849755cd724
- SHA1 35f2e9754e9dc226baa8b0cbf21db2b523248a73
- SHA512 438e406a18db363008776172e20f6422db71c5b1eaeb63f0a8100f05c5365f52ee177851c7710985b529e1b5fb2be2ac8142cc6e0ca08628054b6eabe063fea2
- SSDEEP 1536:8Z6GdfXw+kpgUfswHfQeMVYOsW+ocd3q8DsRUClo:8ZgGURzMVY73q8DUi
- TLSH
  T1EF635C10B2D0C8B1E1BE1E391434D6616A7E3D214FE48DAB3B99012E5F741D2AB36E67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsisXML.dll
- Size 12KB
- SHA256 77aa1a74a556f00f16baf9b94637fa997bd4085695ba81bf496223644e43e815
- MD5 9f3d5344e7ede1f41f99d8fc37fd01ad
- SHA1 d0322ce3ba30a924daa1c9e322846a3d8ccda878
- SHA512 2849b261b77fa2abf0d0efc7604ccce7f502d20a556eea9877cfe1cbc6d515d8fe41986943081629243b81987cddd54613ee01fc7859ae16eab57f6ca2cd4bfc
- SSDEEP 192:EWauH4FuPphUmX1VGsGN2kmQNJnm1ilWnE:EWasoMphljGs4NJoil2
- TLSH
  T1D242C8033EEAD8B7C94A0278AF977389D6B4630524810D06A3564F0B6F3199EFD7D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/registry.dll
- Size 24KB
- SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
- MD5 2b7007ed0262ca02ef69d8990815cbeb
- SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
- SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
- SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
- TLSH
  T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  App/fonts/ionicons.svg
- Size 328KB
- SHA256 dd1d74abcb411c1c0d334e3dbd47820e990f99e8b10f239b93eb73d721084078
- MD5 c037dbbc0e6790f30e824a50010df5fb
- SHA1 a6f29d7d411b77aebfb32edf4f22d6fb227f399b
- SHA512 8e3b71ec98f421296d4e53c5ea7f89d96db46dcd02bc0a77ceb03b2ceec9106a4aacd0bf40c039f7ed4bd7e5f151f7b031dcb069a58bbd4394c062c4b554f575
- SSDEEP 3072:2CuKJjnjoIeQamnBFPaUn+GkSmr9O0kbddOupXBIZPGQlhYBixU9/+9Xjb6Pksnv:2CuKJj/3er9DkeupWZemPVjb6Rn5H5TH
- TLSH
  T18164E428D8A65478CBEA03C18A791ED4873DD29F192D3C75696CA2B00E0FF7D569FB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  App/index.html
- Size 5KB
- SHA256 954e696f9ef29f1756d187852965d8736460887481aed0cd7134d997d1e32c85
- MD5 0ad729fcb114555b3a93951040ac03f9
- SHA1 baea1f70f9730ff0be86953dadd1bc53bec3164b
- SHA512 a6fd6675797f084312593c823a409efd244933aa5dc154f6ba82bb5c7435b27b469ab9efec60a54dbc99f3ac9f8288510ebf1fd05cfd15a8628e0528765da0ac
- SSDEEP 96:ZtUZXjcMVMa0B9s4BH3JfJYqJql6bCcd5IP2k2ylDHe:3U1jcn15JDl6Le
- TLSH
  T170C1AE509580212492B792B14D609B5EFFB3930782DA9221F7FC12DB1FF785AEC07AE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  App/js/vpn-1.0.0.js
- Size 476KB
- SHA256 0ae5fb7fff1414f81a9429940c8ff2f89e138825119ebb7fb75c423ec048fa2a
- MD5 1cfe5e2496149fce27b0284a9d03cd22
- SHA1 e3a7d57cb6bd1e27f0e4192cd51199ab716cc5f9
- SHA512 9e1de7f09340d49885ad2d095435f32cd9346d57730a3dffad50953fcbf308a36740c10f68e19b3af4de600565dcfaa7ab30607323edb15f76cd302567122b33
- SSDEEP 6144:j3IDnadi8oJU5x5YeXpKEUCX8Acl+lgFBgG1JT33Hwsmspn6xtra:TIDnadZbi3Amo4
- TLSH
  T148A4C81DA5D328660593716ABA0F7105723154172A0DF918BF6C83DC2FAC46E83FABED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  App/js/vpn-1.0.0.min.js
- Size 317KB
- SHA256 ccfd8f13339211df2a8e428877f8bb202697f9e4b86d6770bc62a08dd9964148
- MD5 5b31c591b0a5d4d2fae5865702fd8809
- SHA1 5f65d9ad21f8d9b7f5303064b1741635af83ab24
- SHA512 5fa10beb24beb2c596e10a9573678f3ceecdf2fde9bcffb1a7526bee558ce3856e59d3df5aff26473379df1fdfd58f74579dcd1c79c5dd93285a2aebc6a86992
- SSDEEP 6144:Dp8UnCM2Hx/GIWuKBCUHdQICUs2aE5M50ByQ0w59J3NDe0Yk7DkjDPK:Dp8UnClXWuK6Rq3QuSe
- TLSH
  T1E3645D4DB28034760BE311A5781F621EB37714AC36498079A97DC0A93BF898DD277BED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  App/js/vpn-vendor-1.0.0.js
- Size 1.8MB
- SHA256 db846df7ef7ad8e884cb9a211e32cf5386069de8cf880d9740000730fb930bd6
- MD5 8712284650adae265a3cbfa562843f02
- SHA1 6bc5239cade661fc1c80e8ec76f2bf8a5cd88572
- SHA512 6faadae01e80697e4b026c4b7c9c95d5326f78d7e25b5e480d0e88cd8526b6f73c9e22c2d7a1a493a4c0a5b893a890b60725ea94738f701260fc98534f6b44eb
- SSDEEP 12288:XezuqiarNrwn8WU9j/1wnz3QFct9e5VadGz2lSFKgL/Zljl69HRMdpevbsfZs0ez:XliOneZ/8e5yMFVxljl69HadpevbsfuB
- TLSH
  T1CE95E89A7AC6222645737339DB7F5188F739C13B11154194B8AC92A82F70D2483BBFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  App/js/vpn-vendor-1.0.0.min.js
- Size 317KB
- SHA256 696393aa261c0980dac558ce58fc30e9806d8b64f65c28c572b282ebf2a04f56
- MD5 fd6679775b921878549ef80e6d9d59d3
- SHA1 fb89bc2eb33f47cc56b00630ea79818d61fd678d
- SHA512 66976a9b0002f1d32b6c7618a7a7c6ccbbc373ffc565415448428eb75fb60251b3b1934571b6bc725ec5ce456f5adaddfc994595cc3b1d87ef02ba3478ed7e34
- SSDEEP 3072:VGMY+N4J9ipUoGj4d2A/bFnQlnFjs/qDFY6appyX7onLjSfNWvQPQo2HxyF+xDc:VC+N42HGcdLJLc7oLO0j7Ru
- TLSH
  T1B76429CD72C2B02243A730B580AF540BF23A5999780D4854F278E8E67C79A5D927BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  App/views/directives/collect_diagnostic_data.html
- Size 3KB
- SHA256 dd7dd366358552282ec473d282cbacbaf8b3ebeb865ac41da299a57c4631fd7f
- MD5 6ab18a37740080eb70fa17735b0bf7ed
- SHA1 16b23da444369f3dd64769dff7df840241add67f
- SHA512 834e5ea84be0ff177d8ef784ccdd86164d2f9d66c5faa4361971ce99e4cf9abe00628d554ae735333d1935f93157778740e1274aaff1c48ee9af8bbdd60b0a6d
- TLSH
  T14C719E21D1C4181C9173B090AA515FDBFEB5434F438B9A64B6AC07A7AFFBC85DA1394C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32