47e8e65ff8613bab1b42d5ae4a1525c24d102108e33710b31e367d58ab6468e7

General

Target
Ant_Download_Manager_Pro_2.17.3.95883_(x64)_Multilingual_Downloadly.ir.rar
Size 62.6MB
Sample260711-mremjsgt2l
SHA256 47e8e65ff8613bab1b42d5ae4a1525c24d102108e33710b31e367d58ab6468e7
MD5 051908dd0810dfa9ee8a778d7fb8f5b7
SHA1 7ff82840de0f41b2c969f0f9a9e18948e1e49e7d
SHA512 ebef12e857c45fcbd3cb4332dac049c6d98d4d1e1b092fdffe4b3e41cc0914774d361fa931fc2f522a84b62c27aa3af919889b6acfc5b01eeed0c1e4ac0d5abe
SSDEEP 1572864:DT83tV8w9H9P0JZdVLc6UbBWmaZFT3rKV0RxG+iqoP:DTMUwz0JZrLJmGT3rKCxGsoP
TLSH
T1B6E733892DA3397DC141AA76112BBFFC512BA586B3D58C30748F5B140FE251EB60FB98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Ant_Download_Manager_Pro_2.17.3.95883_(x64)_Multilingual_Downloadly.ir.rar
- Size 62.6MB
- SHA256 47e8e65ff8613bab1b42d5ae4a1525c24d102108e33710b31e367d58ab6468e7
- MD5 051908dd0810dfa9ee8a778d7fb8f5b7
- SHA1 7ff82840de0f41b2c969f0f9a9e18948e1e49e7d
- SHA512 ebef12e857c45fcbd3cb4332dac049c6d98d4d1e1b092fdffe4b3e41cc0914774d361fa931fc2f522a84b62c27aa3af919889b6acfc5b01eeed0c1e4ac0d5abe
- SSDEEP 1572864:DT83tV8w9H9P0JZdVLc6UbBWmaZFT3rKV0RxG+iqoP:DTMUwz0JZrLJmGT3rKCxGsoP
- TLSH
  T1B6E733892DA3397DC141AA76112BBFFC512BA586B3D58C30748F5B140FE251EB60FB98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery installer persistence privilege_escalation spyware
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Ant Download Manager Pro 2.17.3.95883 (x64) Multilingual/AntDM-x64.2.17.3-setup_Downloadly.ir.exe
- Size 60.0MB
- SHA256 e22516eead6e509a6764099e2ae4df814d54df4d29a652a2bd1b70ee9092f85e
- MD5 2cdd8baa69b4d5ab2b7033c787d4ee88
- SHA1 4c871cfb29e15d8bc80118d516088aa9e1f9208b
- SHA512 59970db14028c43457e169f04d9eb7304a5baec939835e77ae5e6f608866526530d0bd07a027670a6ad48e145a2ed4840375c2b42bacfd88dd5ffc05a869fa2f
- SSDEEP 1572864:J0mTCPT3UiNJVDC4zk5YFkHwJ5qmlBf8BxSuje/ZS:u4CginyHHwJtB27i/ZS
- TLSH
  T16FD73313A78B693BF03D99382473C37295B72D66E293482597F8985CCE1B1C16D2E24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery installer persistence privilege_escalation spyware
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral2
- Target
  Ant Download Manager Pro 2.17.3.95883 (x64) Multilingual/Crack/PYG64.dll
- Size 1.3MB
- SHA256 609861dd865b8de6d8fb5ad19540387335fe894637d24c38d296a6884a1235e8
- MD5 b128fced63a4c0adcc3cbea10043465f
- SHA1 07ddeba9d6836f70dc3d632d08867b515dec7b81
- SHA512 4b39f479c89f560691bc29ef0f1bfc85d9bff3011ff65e8e1b6dde6f5d740fad4e83df697a8c851cd6c24c61fddc694f524687d0e297ad9d1c5ba54f9b2cf7e8
- SSDEEP 24576:pdsTjpIsqRRROoaLut7GnAW9UeP3W7Hp3TJgHemDA6UhrGfifSB93G4xKNg:KOLhaSu/e7Hp392nE/4SSB93GJg
- TLSH
  T1085522BA40326C72E2159AFEC553E0966932E916EFADC0DF03C91A39F6037D15DB1DA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  Ant Download Manager Pro 2.17.3.95883 (x64) Multilingual/Crack/Readme.txt
- Size 75B
- SHA256 7d539591dc19ccbd582ea82850c2600aa56b52221f5e3a6ab6d79c7665f9e3ee
- MD5 46f1f8fd9812f7d9579fc711542944bd
- SHA1 74fc55b52f2ec410b0d897152171afb17dba4f5a
- SHA512 254c3690dea07a0d85b69c96d0c8c10e7572d4dd8dd8badbf2b6a376ebc69dcc1daebf79c6894d690835d502152ec16c013a304602e9b90f358063858e82b1cf
- TLSH
  T121A022CE0022C2B00A2A0B28E30808003028FB08C08F0A0200CC0008F00030C02C300B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral4
- Target
  Ant Download Manager Pro 2.17.3.95883 (x64) Multilingual/Crack/winmm.dll
- Size 74KB
- SHA256 4b26672824ad0bf7ef1f1e24d289cbc659c69802550b72e17cdf546aa9cd604e
- MD5 7f98a54a93e9978012868a35c40dc208
- SHA1 f81f723e28e15830e66d6c915e626548b389d163
- SHA512 acb849ea9b65dc27ca9365fac44b2ad35d2d8bc2dd37c8580d36c1e362b8aaa3df8490291828f416bc023adcc644585b5ebfad0777fe2a865d575203bda115fe
- SSDEEP 1536:Bsn9BhF0A5e76qpKZFy6k1I8AQAdQ8L3AqFQLGyxi/p5KW5EVbdVbM/TX:BsnbhFg47y6k1rAQ04yy43KW5EDo
- TLSH
  T1E5736B99225020FED4429274D8A74B07E672B406237927CF1734AF168F5B3D1B52FFA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5