ce59dc8f871c1bb76f58da243bffff5bd46993dee2b017c974315b94fcf7bc7b

Sharing

Copy URL Twitter E-mail

General

Target
EportClientSetup_V1.6.57.exe
Size 33.4MB
Sample260710-pelansbs9k
SHA256 ce59dc8f871c1bb76f58da243bffff5bd46993dee2b017c974315b94fcf7bc7b
MD5 0e768f12e32dc59393a59082364d213e
SHA1 8941aa82e3e7e84a9e453db569fbd00ba37c3a88
SHA512 fb948ab432a07151bca0df7954d5275d6e6a1746995d5625ca449a8f373a51be8335338c0c713911d8372a8e74e87afbeff479c2a100d3d7c7f92c44e8de26fd
SSDEEP 786432:WdS9FW1pGseoh3w+FbOguhJ6liOT727pqt4DReAyvFSKZVF:oSz+xeA3PFigu76hq7pjDRfyvkMVF
TLSH
T15A7733C00487E851C358AF75AA98C779AF51CC5D1A091B3EA1D62FB97F28227CB73247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  EportClientSetup_V1.6.57.exe
- Size 33.4MB
- SHA256 ce59dc8f871c1bb76f58da243bffff5bd46993dee2b017c974315b94fcf7bc7b
- MD5 0e768f12e32dc59393a59082364d213e
- SHA1 8941aa82e3e7e84a9e453db569fbd00ba37c3a88
- SHA512 fb948ab432a07151bca0df7954d5275d6e6a1746995d5625ca449a8f373a51be8335338c0c713911d8372a8e74e87afbeff479c2a100d3d7c7f92c44e8de26fd
- SSDEEP 786432:WdS9FW1pGseoh3w+FbOguhJ6liOT727pqt4DReAyvFSKZVF:oSz+xeA3PFigu76hq7pjDRfyvkMVF
- TLSH
  T15A7733C00487E851C358AF75AA98C779AF51CC5D1A091B3EA1D62FB97F28227CB73247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution installer persistence spyware trojan
- Drops file in Drivers directory
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- MD5 d753362649aecd60ff434adf171a4e7f
- SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
- TLSH
  T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- TLSH
  T10881C5436B102FBBC0880630358E7D1E64FA49A8536E00BFD786A98E3DD62D4F170367
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 fd26ef21d72797fedecd3d15f2001cea793383aceb3cee19a5ae2a3d30e197b6
- MD5 e447e49175c0db1f27888aede301084f
- SHA1 f5946c743265cd8e81f3e7b6376dada57f99877f
- SHA512 e6543bf81bedce94a58f48cd6f9daaec891775e01ff76b771c22d459a778490f9bba0bebbf111b1ca3091b3ca69bca806a9b5e68ce12df03abbaa6ce5c4b7cec
- SSDEEP 48:iV6qAvq8WeMPUptuM4Z+0x/ImnycNSCwVYOY4vnpXTHhHX/JvR0Jaof5d2:2ZplJ5ZbnycNSCwVYTwFB3ZR0td2
- TLSH
  T181C18577B3C249F9D6854633161373C3A7139E30735A800F9B6712AE1924CABAD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/MessageBox.dll
- Size 6KB
- SHA256 42430e825f649f669d99775e95343e0f3a39c6517b9e300c28f2e4add9d67693
- MD5 b1a548fcf6c6fc8857f21b336261fe30
- SHA1 093cbcf35cc31b3a6373ef3c801647e552c73dde
- SHA512 0b45d4c97104190aa850674fea0ab7b5d4cf00040c64b399178dffe1f9d7b9db25f87d2e81d38399796f2661ade3ecfc1deabca2ec07db5a8be1746297285918
- SSDEEP 96:7H4EngqCn0E+deRMa3DQUhXLkYNqbo4decXRvvap7vB:pngZo2MaTJVkYNqboB61i1v
- TLSH
  T18BC1096F377157FAC26A3A3F00953F6F02A7C12084E2640E155F19D6385263ABA74FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 49KB
- SHA256 b549e39133b32eb4e67e239128c2b55467f01b4601c8147a6c8459d883169fa4
- MD5 75c51b238cbfb450464a03d3e18f70ac
- SHA1 03add7f8bab64967213d207685874e9252f5bf1c
- SHA512 0dfec48eb891397a3ddfcf19ea585f971a01bf0932fe1d6c9e05cedef2c3ab92f6ccaa2e62be678eae648aaf2cb78212d0b8ba0e6ae5c319790eae9d49c2dd74
- SSDEEP 768:Mvedqf1szewuS27OSoiftfDoQqwOToK+CClzQ62ZoAMH4VtF/uz2OXCR:Mmdqf1sB27g+Dg1Cl86EvhC2OXCR
- TLSH
  T13D336D2BFAC08437E0708FFC5D35E314A66B7B303E65241A77E40E8E48796D5598DA8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- TLSH
  T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
- MD5 428c3a07fba184367a5085e46e4a790b
- SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
- SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
- SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
- TLSH
  T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  C:/ProgramData/SW-client/win10or11.html
- Size 5KB
- SHA256 0e04ddcaedba0648ce856eb0b5c31ad11874abc4b51e5e3fa3857049518eedb6
- MD5 459d64bbe256aaf5e92ac0c16646d4e4
- SHA1 16b0bec9bd47f1cc5095d3135759eabbee584316
- SHA512 23bede5d51dfc2947fc865a06740d1b72ae0a6a5565372d8fc10e63cfa580ab9d5472dcce0c77406d6931a50d7298d3d303143db8d3bf7442531bb67aec6ed7f
- SSDEEP 48:tLorHjC3/pjGgvtiHV228WftPoOlgl2luv7Wvn4gCFZSnk:amPCEWJGMk7a4vSk
- TLSH
  T1A8C1BC2480E0045755B391946B61478AFE445283EB0786607BECABCBBFF7C65CD63A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  C:/ProgramData/SW-client/winserver.html
- Size 7KB
- SHA256 ee3b5953a6e5243d019b052a80183e23825392dfcbe2ce178e83a761441bb26b
- MD5 a6035692c7f3847bd7b93eee017799d6
- SHA1 d2b96be5af80488aea5c9a0c65c4e43da617cbfc
- SHA512 3d8faeb7777946d3be1f9a741d2dcf5d293625ffce40298cc9edb313d72ad046a9abb8c127d34d9734285ca66a1dcfeffe5dbfdf5efa80cf068c7bf717278f9e
- SSDEEP 96:jmPCiNWWAJsh3k70O3NPR6jeX2Sipftxcf5A:xoWWA6h3koEPR6eX2Sgftxcf5A
- TLSH
  T1C1E18A6480D4049701B360806A650B8AFE5452479B27D6507BEC6BCBBFF7CA5CE636CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  CPUCard_Client.dll
- Size 137KB
- SHA256 74764308bd43bfb9c7b2f061165e494def8d78d5cb7d0295d2c8ddf044aa2df6
- MD5 8ce33a2b93d326aeb47813a17e382cd5
- SHA1 bf5184dbec2f707b5846f3c813733c75c231f2df
- SHA512 89f9dfd7d0b4652a50a430ac61cb7439b98a8729049e8633221e1b5f37ecb836978f75bc1d2a8f71ac9901f5e440cf90aeece5e6ae33682c907394b1e37ccc7b
- SSDEEP 1536:AhDXI+cfqsE3Oz69gOGAR/UIn3TkN9YKbkisovx6jPFGjjn87j:6I9yZOOG0lzn6bkisoMjPF6n8n
- TLSH
  T102D37D917AD282F5D987893D00A76B3F6B3D17140B6A55D2E724DDA08C33342FE2B18B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  CertUpdateApi.dll
- Size 1.1MB
- SHA256 141d6de20f546eeac3aa5f5bdea2bd8d72fe9d37553455869931307511837e0c
- MD5 dac6185c477210a3bbaf1adc7ebccb86
- SHA1 cbd25eee9b65dd22916d79a81cd8874c5d1c848d
- SHA512 4fa619c13e6e7062ec2c114805a7b2983a381e1b91dfd0431d7c38b51df96857508d4055d5b93b5d7234ddd14699900b9fec50d0ae4bfc6d10de84422e0203cd
- SSDEEP 24576:9hfjsnRG91I3oxBtXT2IZvZEjVBU/Pc/lIUpSTotTAzCBCA9ny:9hfiRq+4zvZw+GlIUpSTeTA+BCP
- TLSH
  T1C045AF12B740C173ED9E1278557AA7AF4937A621073986C397D43DDA9C302E2AB393C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Check903Reader.dll
- Size 235KB
- SHA256 7db70b2ad1df3ae5ab4fbe399d3c902836cec3abe402710f5fc2527a1ae94ce1
- MD5 86d4c640b79d0dbd9372c1738ad1f633
- SHA1 cbad31e22c527273c2edac5dbae9dae3b9701571
- SHA512 c8ba2114075583b3f6a4555d07917cb076981503945e7c2a57f9c70f7db383f75c26ba7df02b31a19e798b68b90bd6a7713c4079ffccfd5d4dde1bd6d31f7a95
- SSDEEP 3072:PQ+u3AdtkZj6cIKZQHc8PR8T1gSz+c5mY8BzQB7XYoYghtbi+IHcOnTdw47nH:PQ+8CtWj66GzK2qBLYoYghthIHNnTDH
- TLSH
  T1EF347CA13658C53BC6CF12748D7DCB6B046EA9614BA0C1C7BBDC9E7D1E252C1AA3134B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  CnEport.Pub.AutoUpdate.Updater.exe
- Size 518KB
- SHA256 6a296fc6e31beb5842b034b23c861ed76779962bf1ff1a98aa7a196fdbc88ae5
- MD5 dfee2b000ed9bcfae15305e21b9d44d0
- SHA1 0d01b19c718ac4dcd945686a8e76fa166bc23c4e
- SHA512 0e562649a398d8cb8a3a8298d09dd9ec70454a7d8fcae271991376462396564c5352b58e3cd321f7c2d35e1d6b0c499a013dac5571ae6d5048cca0f11cefa322
- SSDEEP 6144:zWhWjY5P0oeK9hM4L1fg+hWjY5P0oeK9hM4L1CVD:zUWAeEiIIMWoeEiICVD
- TLSH
  T156B47CD7A6569260CCAC983BD4CB81B90A1F5E36EB50827284E37F01FF30C9DA497B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral27 behavioral28
- Target
  CnEport.Pub.Config.dll
- Size 18KB
- SHA256 0e02f0e4d50e14603fb32b0c1044c47a543016d23054703e59615b41530f417b
- MD5 fcba9881b923c26267cb6327634daba0
- SHA1 ab1e7f3dcb25a6671facdb75f258bef2a60b58ae
- SHA512 bbd97491cd79674f5e6959e9e8fd4edd8256e9e1c6778216cd5813b7ede0e44c32484c52d816b180d0c11abdc1d2571eddbfa8948bedf3f1a3db8e766fee52cf
- SSDEEP 384:B/Qmn6YcN4WCaqIYiD6w6wiw4ldei2WSx7bLrn/:p6HXYi9iwRAmbLr/
- TLSH
  T1AE827C43BF219613DECB4E31B8C18B637D71B3824E61D6DBA84991149D173A12B613AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  CnEport.Pub.FullUpdate.exe
- Size 270KB
- SHA256 c80a636534d1476e10e09269c492b47790e59f54b43f1af9a83b4a3a922f3d5d
- MD5 f4c382ced7eae4c7d7c4a322f4ed891d
- SHA1 0d0ee8042bebbaa2b57355a9feeb61f21af01fe9
- SHA512 43947a17c03c1c8cec2d584e3f2ca7590dd575068346e45cf1c4a489a9a1d365730ae97fe327016781a01c3c870ebc370fedf5a3877cc0cad9f85570447bbf67
- SSDEEP 3072:TrRQPtVx6a/JHx17jB9mhLqjY5P09SeKQghMlCgn9nNqoLZeXg0ZVYcbTjNuEVMB:TrRQz+hWjY5P0oeK9hM4L15VMB
- TLSH
  T199447CD7A6569260CCAC983BD4CB81B9061F5E76EB60827284E37F01FF30C9DA487B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution installer persistence spyware trojan
- Drops file in Drivers directory
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral31 behavioral32