932b6a66119af2315a390089ce45d086ed8a71e7e79da22ae129a8d4226fd00d

Sharing

Copy URL Twitter E-mail

General

Target
932b6a66119af2315a390089ce45d086ed8a71e7e79da22ae129a8d4226fd00d
Size 6.2MB
Sample260709-mdf88agv9l
SHA256 932b6a66119af2315a390089ce45d086ed8a71e7e79da22ae129a8d4226fd00d
MD5 c0efdfd0265ac4733b0f8b60299b71c3
SHA1 9fe77092fe3cc252a67ed1e3955325ae33f4b610
SHA512 5678a348bd369a16a59b60c6ec990f2eaf52f2bc78a90de63ad64f16a73fcd0b584b5054c863b8dfdbad33f08cacea6d580d9fc3b5e2649b431f0dfbaeeeeaee
SSDEEP 196608:4lq0b9+Ef8FS9VXhioV3gsfJG5CikhX4+4O:4l3blfkKXxtikhI+4O
TLSH
T158663346FA18A6E2DA626B317D9DC6B91311AD451731D78FBC70733AB333FC25A26600
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  932b6a66119af2315a390089ce45d086ed8a71e7e79da22ae129a8d4226fd00d
- Size 6.2MB
- SHA256 932b6a66119af2315a390089ce45d086ed8a71e7e79da22ae129a8d4226fd00d
- MD5 c0efdfd0265ac4733b0f8b60299b71c3
- SHA1 9fe77092fe3cc252a67ed1e3955325ae33f4b610
- SHA512 5678a348bd369a16a59b60c6ec990f2eaf52f2bc78a90de63ad64f16a73fcd0b584b5054c863b8dfdbad33f08cacea6d580d9fc3b5e2649b431f0dfbaeeeeaee
- SSDEEP 196608:4lq0b9+Ef8FS9VXhioV3gsfJG5CikhX4+4O:4l3blfkKXxtikhI+4O
- TLSH
  T158663346FA18A6E2DA626B317D9DC6B91311AD451731D78FBC70733AB333FC25A26600
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 24KB
- SHA256 89ae5e9ed94c71972ddb25aeb508ee6fb8c7a39e39e775182bcdba02762e6dce
- MD5 03cc5115234c4868cc8e2116ed949ca1
- SHA1 9cb86d1d2c41da77fd486a128ac43afcd6b8c129
- SHA512 57b1a63316192bd76f65168f07d1797f4d04b98b4a99d0e543ebee3ab4b65b8562ac3f83100c25a207c385956025c10c298ff68a17770bbf0e8b82c7b89d0c58
- SSDEEP 384:udGZ2ESnTqkddTm43saIvybNyb8E9VF6IYiTPxIZHMMZknCC:uMANdTHpIvy3EpYiTPxIKMC
- TLSH
  T145B22C624FB80BFEF9B21A303AF8547747B6B50125A0C18F5316C95A6D217876EB8337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 292KB
- SHA256 acabf187f608858363ce88fcf64e78c09738860ce4a84952c114cf53fa81ade5
- MD5 5a177de1f2e0a85e3fe15e9821747a79
- SHA1 e339619f777fc21ecb731559799b7189c2a324c1
- SHA512 0e8456b5b480c18300515af33a1ca665c20da4c07fa66baa7ccde9dc83dfc9fdde7e4d0ea05a3fd030e67dc96e0619c236410ed59985de9bc95654eac2b36103
- SSDEEP 6144:A+WFR2dU22mRXAtS40ZxdjYHXQohL7cRJ5:Av2dmmRXAIDzxzotQRJ5
- TLSH
  T107548D117DC18432C2BB38346678E2B64DBCA8311D749A8F539C0A795F74582FB36A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/JxNsis.dll
- Size 2.6MB
- SHA256 5163c903fca3c005f740edb9b512a42288522c368a241d4dd9511715abc5c18f
- MD5 a97329864cca00ec55e65846932b17fd
- SHA1 b3082c38daa3ed30252ae042745ab8ce72b240db
- SHA512 5409a54064d52d26de02eccc381ead35e9bb913d6bcc62aa084bea078093ed2b47b13805b775dc7068d3cf600b0bbd06c7cd4c543ad8898fcf4019c8a1afed30
- SSDEEP 49152:fat9QdYYMl6vOgbFih7lz+Ab/M38rzm+vaTA+dPYXcWHEHm8/F4mdS:fW9QdYT0vOSFGlz+Ab/M3yy+QOXcE
- TLSH
  T1F4C5BF02FF8280B2E5AF013491BA577F4D3EAA244738C9D397E119B99D301D1663E79E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 21KB
- SHA256 d4c3a23eff386c311129d582650abce1ca1e15adcef9482a303306fd3a958058
- MD5 5b11192faeb214d966ae26b4bd47cc9d
- SHA1 be5ef8b780d51b85aaac5932f1587e74ca05c705
- SHA512 714eb5c2352637bd218b889c3ed2c564227568e9c01f0046fd096b500923f5d805e372a2a7633d5662e584b5860aad3b546fddb967fb77057d3539b6d80d1d8a
- SSDEEP 384:I8PJlt70esj0Mt9vn6ay6mNyb8E9VF6IYiTPxIZHiW39bU:I+qesjRL6HEpYiTPxIL39bU
- TLSH
  T119A29E6386604CF2F9524D3430D4AA36AF79B6851FE081D3A39BC1416F943C77BF92A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsFolderIcon.dll
- Size 127KB
- SHA256 8adb71b8f8dd87adeb44c873b2e75a61d4deab1637f10ae33d48454bcc641786
- MD5 2f06a36c102fb5165a9260651f827d3f
- SHA1 88c696026eff26bab7b89a34331b35e0269590b8
- SHA512 62d23bb45825737f5e48e203606913f492dd16efcc66cd442a5b126b254ce0283edbef3915636a99b1fff6551656bb96c8984ba029be0ca4a09b3e1856d84888
- SSDEEP 1536:KHjCVzTw4NQZmTynGpQmpdqfPwlUZr+HXanAOyE4gRwG9WVmg7TPxID1:qjCrNQZZCQmpY+3E14gSG8VmgfxS1
- TLSH
  T1FDD38C1132A0C071E09A5A395979D7729B7E74719AB488CB7BB8037E8FB03D09F7435A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/setupdll.dll
- Size 2.3MB
- SHA256 e30f2d1583462e6556fcb71112adc533f7c004262e2cecf48a6921625a6f4c10
- MD5 7e469cadf8f403fd07c0a29ec0b2a2da
- SHA1 f95ae76a7fb8cc55540be7193e5bca2f9b17ae49
- SHA512 d7ff11594a633171afe44758abe2dae229a8d88f72b1a086f28c3deb3871acf9c49bad44147ed923af00dc74c6a2595e47d1ed48bda0597666649d54201c4b6e
- SSDEEP 49152:AiY1Wf/vu0J9E7od0yMHacx967Tgp9XJ23:w1au0J9UOMPx7C
- TLSH
  T113B5BF1275E2C035C27E03305D18B28B56BEBEB409B4D76BBBAC151CAF74C819A577A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/uires/rtf/agreement.rtf
- Size 121KB
- SHA256 626f792d24fd410e31c9bb711e6ca948a2a9ca3520596745558b3440fd0a5ca4
- MD5 1e9de140c4c22f7cc3325132200cb552
- SHA1 d2c6c5db50a88a9caef6cce3657287c8dcf038a1
- SHA512 af3b957a4d79aaaa66c89347aaacfe437b5608d48a69e21c4a23125f59acea49a8db85ff837bbb97f30d91b2c0bbff1202d483e749f9b968ca95fc536ba53992
- SSDEEP 384:1NX8ncNWw1/StiVP2zY/FdvL4+GM50iCLH9jQHGK+sOC3xudrLUe01vf0fHTUsup:16cNWKZ5+g+M32+R
- TLSH
  T1E1C33503683F9B5D0E465A2E9B748D8A7969D502D5BA3009AF6E42EF9C1CE3CC1733D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/uires/rtf/agreement360.rtf
- Size 133KB
- SHA256 7ba6af163449a0a60e6f08bffdd1c551f7fb43e386847e44f18647b670623f2b
- MD5 4d959bad19f8fd797a10eb7e9a817c7e
- SHA1 e5e8facc48bec182a0e2514e457bc5d85ab31295
- SHA512 f764451edf36ebf95f060f9e9f30053608cb2914c5c2abebbb86062280ce5a5c4b0ff96ec1e2c2367b7d452ff6ca59c4e73c36d36129a3f17adf3e0a6ae96901
- SSDEEP 384:HwO8ncNW11/QUH7/BwqVP2zYfX8m2A3kJmZu8ZelWYSCFqlOuQ/Rjb1SWejlLdJ/:HacNWKV/0pN/aPUB
- TLSH
  T14DD32603683FDB5D0F465A2A9B748D8A7969D502D5BA3048AF6E42EF9C1CE2CC1733D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/uires/rtf/agreementchina.rtf
- Size 121KB
- SHA256 626f792d24fd410e31c9bb711e6ca948a2a9ca3520596745558b3440fd0a5ca4
- MD5 1e9de140c4c22f7cc3325132200cb552
- SHA1 d2c6c5db50a88a9caef6cce3657287c8dcf038a1
- SHA512 af3b957a4d79aaaa66c89347aaacfe437b5608d48a69e21c4a23125f59acea49a8db85ff837bbb97f30d91b2c0bbff1202d483e749f9b968ca95fc536ba53992
- SSDEEP 384:1NX8ncNWw1/StiVP2zY/FdvL4+GM50iCLH9jQHGK+sOC3xudrLUe01vf0fHTUsup:16cNWKZ5+g+M32+R
- TLSH
  T1E1C33503683F9B5D0E465A2E9B748D8A7969D502D5BA3009AF6E42EF9C1CE3CC1733D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  $PLUGINSDIR/uires/rtf/agreementlx.rtf
- Size 120KB
- SHA256 da0262fce5049c89b1246d5767e96060344067a1d0f1a503083323cc5e353d01
- MD5 65594a5ba0af7724af7725ae2bde08fa
- SHA1 3ea8f30fc7a54b123d9a411869f43ca2773d3f9e
- SHA512 d5327148f35d7d8e79e8155c206496d0ed37e00ac571b73be2486611e65dfb21c4675757d7cf1af3297f867532d7b4a073b6a6aa5f945a034a5a3d7eec2a8ed0
- SSDEEP 384:HXB8ncNWC1/oTTVP2zYQ8PNfuKIi/SaCLr9jQHBKQuOOm73ftxg0B4orMfNkUyaZ:HucNWnl/UrQymNwB
- TLSH
  T15CC33703683F9B5D0F465A2E9B748D8A7969D502D5BA3009AF6E42EF9C1CE2CC1733D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  $PLUGINSDIR/uires/rtf/agreementoversea.rtf
- Size 56KB
- SHA256 89e8be123623ca0018f24382129a8dbdf51010cf1f7f3319d653d8883da32386
- MD5 bd6b1995430c025bb7c08f4720c56b02
- SHA1 ae7d142fd5a19f27addd1033d6a913b3db7f2675
- SHA512 4a34387d3de90269a8e910b545c4c544a12d04dfb1ea46ff0ab420523c4a53f602454447fb78a7f5208027579433ad2cd15fc57e11dbe1fd8901a225b86ae279
- SSDEEP 192:HMXi5nEO845cNW7NJDMn77HKj59z80c/JlSFz0Mv14k7LTW:H0i5EO8OcNWTY/JAz7v7LTW
- TLSH
  T14F438C56918B978C1B0792EDEB34D9893E2EE500F17574AC76DF82AD985DCACC0B3390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  uninstx.exe
- Size 3.2MB
- SHA256 b2183a8a7063a3551da1c4c2960a2c58d3b39a1f4a8b647ca105d6d6db82eaf4
- MD5 1ea580fdaf63ad12b610f9f5f6dd83c8
- SHA1 08c766c804e6f597655c1aeb08a671a82f4e2f30
- SHA512 e765baee4767407e8c67994b80548be19521728416e6ddb3c91996cf8aeb2ef0ca16b98da19d940df2e8ff5868a9c86535469e01f442d10cf53cc9d98b206ca7
- SSDEEP 98304:R4X4ryGi1zwlTCe7eb1ZQdO/fDPsamYtWdYRgug:R4Xei10lPIvQ+feYtW+RQ
- TLSH
  T1D2F523C7E208A6D1C45B177559D6C6770300AE682B72D79F39BC7339F233BC22A66621
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral25 behavioral26
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 24KB
- SHA256 89ae5e9ed94c71972ddb25aeb508ee6fb8c7a39e39e775182bcdba02762e6dce
- MD5 03cc5115234c4868cc8e2116ed949ca1
- SHA1 9cb86d1d2c41da77fd486a128ac43afcd6b8c129
- SHA512 57b1a63316192bd76f65168f07d1797f4d04b98b4a99d0e543ebee3ab4b65b8562ac3f83100c25a207c385956025c10c298ff68a17770bbf0e8b82c7b89d0c58
- SSDEEP 384:udGZ2ESnTqkddTm43saIvybNyb8E9VF6IYiTPxIZHMMZknCC:uMANdTHpIvy3EpYiTPxIKMC
- TLSH
  T145B22C624FB80BFEF9B21A303AF8547747B6B50125A0C18F5316C95A6D217876EB8337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 292KB
- SHA256 acabf187f608858363ce88fcf64e78c09738860ce4a84952c114cf53fa81ade5
- MD5 5a177de1f2e0a85e3fe15e9821747a79
- SHA1 e339619f777fc21ecb731559799b7189c2a324c1
- SHA512 0e8456b5b480c18300515af33a1ca665c20da4c07fa66baa7ccde9dc83dfc9fdde7e4d0ea05a3fd030e67dc96e0619c236410ed59985de9bc95654eac2b36103
- SSDEEP 6144:A+WFR2dU22mRXAtS40ZxdjYHXQohL7cRJ5:Av2dmmRXAIDzxzotQRJ5
- TLSH
  T107548D117DC18432C2BB38346678E2B64DBCA8311D749A8F539C0A795F74582FB36A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/JxNsis.dll
- Size 2.6MB
- SHA256 5163c903fca3c005f740edb9b512a42288522c368a241d4dd9511715abc5c18f
- MD5 a97329864cca00ec55e65846932b17fd
- SHA1 b3082c38daa3ed30252ae042745ab8ce72b240db
- SHA512 5409a54064d52d26de02eccc381ead35e9bb913d6bcc62aa084bea078093ed2b47b13805b775dc7068d3cf600b0bbd06c7cd4c543ad8898fcf4019c8a1afed30
- SSDEEP 49152:fat9QdYYMl6vOgbFih7lz+Ab/M38rzm+vaTA+dPYXcWHEHm8/F4mdS:fW9QdYT0vOSFGlz+Ab/M3yy+QOXcE
- TLSH
  T1F4C5BF02FF8280B2E5AF013491BA577F4D3EAA244738C9D397E119B99D301D1663E79E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32