cdff2b9dc5b36aa77b0b77ed45db712a7b78a3d0f3a216a3611c313fdce0dc13

Sharing

Copy URL Twitter E-mail

General

Target
AdwareProPlusInstaller.exe
Size 36.7MB
Sample260712-28ndcabx8x
SHA256 cdff2b9dc5b36aa77b0b77ed45db712a7b78a3d0f3a216a3611c313fdce0dc13
MD5 28f3a2cddb8bf09f6e961cdc8f56666f
SHA1 1d667d2d116bc5edce69f44751c430f8f7afa1dc
SHA512 b6243ac176edfaabfda0db1d034201df6b5656abcdf7e39815f5e49666dda78725095cf53d25b19e2932f6187e3156322c3e4a7e4358bfb6cb34d2f5f8bfeda3
SSDEEP 786432:u9sUEhqAh84Qe5HETdHffybiozv/069TV5LmPO21TzfnilDDht/Z:u9VrAhX5kpHffwiq9p56PO2BOJthZ
TLSH
T1248733E990E2F98ADCF6B1B0547450DA4DF9F01122D33A397819C39229BB642F51D2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  AdwareProPlusInstaller.exe
- Size 36.7MB
- SHA256 cdff2b9dc5b36aa77b0b77ed45db712a7b78a3d0f3a216a3611c313fdce0dc13
- MD5 28f3a2cddb8bf09f6e961cdc8f56666f
- SHA1 1d667d2d116bc5edce69f44751c430f8f7afa1dc
- SHA512 b6243ac176edfaabfda0db1d034201df6b5656abcdf7e39815f5e49666dda78725095cf53d25b19e2932f6187e3156322c3e4a7e4358bfb6cb34d2f5f8bfeda3
- SSDEEP 786432:u9sUEhqAh84Qe5HETdHffybiozv/069TV5LmPO21TzfnilDDht/Z:u9VrAhX5kpHffwiq9p56PO2BOJthZ
- TLSH
  T1248733E990E2F98ADCF6B1B0547450DA4DF9F01122D33A397819C39229BB642F51D2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery persistence spyware upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  $PLUGINSDIR/SelfDel.dll
- Size 5KB
- SHA256 d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
- MD5 e5786e8703d651bc8bd4bfecf46d3844
- SHA1 fee5aa4b325deecbf69ccb6eadd89bd5ae59723f
- SHA512 d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3
- SSDEEP 96:NdekHUj5z13cPopei+Ml9PNDFbS7xg+TScrQ5:NdeuU9xcPopr+M9FbSS+TSE
- TLSH
  T1D6B1D785B7DC0A7AE0F747351EB18A26202BFC504EB8D3AD4994214BAC76294C67A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  AdwareProPlusV4.exe
- Size 45KB
- SHA256 49db0d9728dbb76e5e89232c6215e0f978b45e54911b930d79b2b5b90a334a65
- MD5 63cbc43c51b702604c3b934799e1f8bf
- SHA1 dc326e63910a0289d6400cd8638f6d6a02ab6233
- SHA512 6865b4eeb4898f9705c31ebd7095dd1d8828c58a0338be61dedd987bbb6570b5872214698d0c8415325fbcca66fb8b75c11b1794b71c2485386abd79984e2460
- SSDEEP 768:V+lbYZBIpu3Y6gP7YIM0Dso0rW44evDkvk9rNqab8XPRk7evk9rNqab8XPRk7l:Al8OP7YIM0DnFeLk2kabfa2kabfh
- TLSH
  T1A223AE06BBBC8A13D69E2F7C5432261A0BF09717A612DFE91EDC608D6F6338119117DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  LibVLCSharp.WinForms.dll
- Size 8KB
- SHA256 4013ca26934860211c0783a46fee225125572a4f6e92f6207479325be1d1a719
- MD5 1bbcf84cb9a8d2bf645a31e9b2e9818c
- SHA1 c1b1c1b247da11c195bfa1c8e00bd813422ba94f
- SHA512 85f57f7cd5691743c79a13bc59ae2ffb51f44d0153ca9aabf0e23a40cd28459ba23a22f16bda0098da3a7f2dc17aaab3bf5fdaf2168b8246d7d31425cf5dca74
- SSDEEP 192:11JAK4E5w1WMCe1iGInwALFL/aSvHSJc5SeSCSgSCfSDSWSQ/S3SCI:11v4IOWMCe1u5R0c1y
- TLSH
  T11AF17326A3B852ABEDF70F7179B712422778BA21BE77DF5C084140094C257049632B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  LibVLCSharp.dll
- Size 224KB
- SHA256 4ab569e3e458e04881c108f96bb35bfaada573d4149df1da78587b10f1da93eb
- MD5 34c58b206baaa16d040880e059fd0fb4
- SHA1 04d90c5247200167bf59970f94e8c6f62a7866f8
- SHA512 3d1eaaeaeb953edabd2dfcf824fccf964c8eb9b2e77021d8bf1b5021acc0a7a6524718b3093b83b1b8e2bc2e1c8a77d90379d4aac8c8fc40b46f253a09b271c2
- SSDEEP 6144:YKHmkNbfy6l7dWsEMqgVmvWKsqE5BZSB1KweD:Y+fD6bx1K
- TLSH
  T13D247D235BA8B557C2DF967AF47346080370EA11E502EF4C6FDEEC6C264E7909634A83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Microsoft.Bcl.AsyncInterfaces.dll
- Size 25KB
- SHA256 881d98c0d56edcba53c18eb5df0a334333cb647f47ba42049784258778f34596
- MD5 92137f9236555b4719d53437aa609061
- SHA1 c7b925c258c91504179f68635594bf2ced31c9ce
- SHA512 abdf8188bf09374fd94781a6914f455b9bfd368cc37a34951671dfd0e22827eda39a79634ecda08b1a828b8f72fad7669df6afa8883c14af6d27cb401e29c647
- SSDEEP 384:a9OJWqnwKBbNAG0VES2j0cX6dAl+NWlVzrdcgYaWeR/WcPfLXmztvGHRN7ZR9zqz:kulwKBh0Vv2wK57dcgYSpjQtaT9zHiz
- TLSH
  T10FC27D1AE31C5317CFAA1EF5E5B4C5462E36D78A2812EB3F1188F6E81D97345A730638
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  System.Buffers.dll
- Size 23KB
- SHA256 3af1e07305bed0abe0cf32d9854e0a7f5f470216adee1b87d02350be09d31b35
- MD5 b20c1ed526c9fd90569a340914864d32
- SHA1 8c23283128d23f6cbc208e3a485a1cf1a9c0cb50
- SHA512 c7de839aa129b73094678efea3da88073c3521c99e3533a0858ec8e0804db2004c4e84af12ecf4358ce134b12c66040fd04add9ab96c78414a247a7cbd0d75d5
- SSDEEP 384:HRJyzxhqFAB5n55560IxEFuAUTcxR+sDWY82W6fX6HRN7gCJDtdQ5R9z1QUMtr:xJyYkx60IxeuSM2Wrds9z8
- TLSH
  T110B27E21C7DC421BCE7F5D7056B9DA862D3A43D5A503E62F108CE9081DE3789DB32AAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  System.IO.Pipelines.dll
- Size 82KB
- SHA256 eea5dee4914b04801e1541f2ad5a14b4317a30d07760e55d5d37aec03097c47e
- MD5 ef13ce84688eba846ab9ae666b82fc10
- SHA1 e186068eb116f8ef0f5915d252a801d41e0f0473
- SHA512 57fb589c4eed98aef39a8bc28bc2871c66240c0df291f8e01d0cc4b2ec09c662a4381cf0ea54ffbbcb1ce4bbc970742ce89811be7c89b20e4650ce2cb2ddaa5e
- SSDEEP 1536:5OBEtNwWq02pH6ZafBzoGrriJNNjrgFXjfYbsAzYo4bgN0xeR5evOjvjfT44oRL0:IBSNTAl6ZcBzoGQ8XSRYo4bgN0xeR5ec
- TLSH
  T11C835A6853BC472BEFDE1ABDA170A5020FB7D7126913F74AAC4CF99D188738046252B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  System.Memory.dll
- Size 141KB
- SHA256 b8fe216aff0f6d162f8eefe7be1712162b7d8199e20ce2e70ffac36c7ce20a4c
- MD5 35e6237ff5533342516bf01a46e4b7cd
- SHA1 f8a118f07eea37ce732b487ab730646dedc46235
- SHA512 dce731c61aea73d16813b0932d47ac94926d84d9077115ef147971b1e1c76a88e333ccd0f88b34fca9e2533f54c140947316fd63415199fe5f20a45cd0aef033
- SSDEEP 3072:wPgSRYPuMbrhcabqwwwUtiPmu3XxNtvckP:2uPaaWwww7OuR4k
- TLSH
  T1F3E35CBC67C6DD12CB5F4C70A028621A5A31C63FAE42F7E215C9F4F436A27A935193D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  System.Numerics.Vectors.dll
- Size 107KB
- SHA256 22c84be385fe8ba6d0e0138952748f28d781fce36078b5a7aed91a6104bcd99b
- MD5 7ab5dbdd2ace2a313392cff4f372e4b9
- SHA1 8890ad1911448490526d2a45ac8cc518b6e886a2
- SHA512 5bce867274f23694402e9f9f73f8c3ebf5d77114836f56d3cbf5cbdeef164a299091e1cd69fd7635e6b7bbacc7376193eb8daff32d5aeed0df72835a00baa4e2
- SSDEEP 1536:cuIaashZlF/cLecJE3+DWG/E2NstmOz+aAKWGd7isnzP:czaashZzWeca3+DWG/E2it5GK7dnL
- TLSH
  T119B3EFE22F6C655AC7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  System.Runtime.CompilerServices.Unsafe.dll
- Size 18KB
- SHA256 2d6f419d641682d8efc4a40e850d2e85de519d6823b93daf2aeee63206d4e32d
- MD5 aa7a54f5a3ba48e60d51e6eeb378404d
- SHA1 e5d644311a6087c6a500f0e79bae4af305430b3d
- SHA512 b033330695b4edc1bef5d36d98e1a68f5862469598cd6a71cafb8f72732d29403d4e8b9e4df3809c2f49dcd59d5ca751ada97ea9b7e268298effd6e19eb52399
- SSDEEP 384:hkGbUzdrbbxHKWgr2WXTX6HRN7K3/7R9zXL/Lq:WGAdlQTWoF9z7zq
- TLSH
  T1B7826D20C7D44543FE673B3055ACE583BE38E7D51806A3763585E97A2C963C8AF3562C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  System.Text.Encodings.Web.dll
- Size 77KB
- SHA256 e779d7127d1f270edaf85d9d5516bd51b1d71618c4df5a23c65befcaffcd44a1
- MD5 f4fa310aebf0e911efa8acb6c4fd0cbe
- SHA1 7e2f18af287e5f1f30ba4608843b9cdc13ebadf2
- SHA512 08dbe44624de814f51bb58700faeff521280e4ee4888b75bd2028e729f6f8cef991c8c77d55683bad292be8a3fc5aab9f2e2abcd6b19b3ce2c6c305d162e0498
- SSDEEP 1536:YOOUnOOOc++v9mBkdQ3IWIxLBHFkzoA4VnrpwrG7ojGjO7h2QcmzOK7K:G+FmCQ3IOG7oSj62Qn6uK
- TLSH
  T165735C26A7898B2EC73E16305561857097F0BF5F2362F3825854B40F1B777CAA21D2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  System.Text.Json.dll
- Size 709KB
- SHA256 53463df8e4d8f3d7b20d58d6ec75e2591df64b9c4bcf0f85c07403154f6d32c3
- MD5 f4a33b207e855bbb677061e7e665dc58
- SHA1 64d5f626ed142f73f0becefc859d1fb23770b3d7
- SHA512 ad015fa93f18c852fc89f8773cadf2686582262ded420bd0e96c374915ef662d58ece783959d9bc406b75c112959cecb62d6b43976cad1ed5644aa421290e53b
- SSDEEP 6144:ZBKdLt5cj2/gSYvY6M7XyTSAMREMJ03Yt7HO+xMSXCIVAL0jO0ypCfDhGI8UgE9Z:mt5cvSYLM2jMl7eI3gKeLwOZmGZRiKk
- TLSH
  T1B7F44A117FDC5B2BDAEF6378B07451148BB5EA12A3AED70F264485E93C42790AD803B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  System.Threading.Tasks.Extensions.dll
- Size 25KB
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
- MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
- SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
- SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
- SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
- TLSH
  T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  System.ValueTuple.dll
- Size 24KB
- SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
- MD5 23ee4302e85013a1eb4324c414d561d5
- SHA1 d1664731719e85aad7a2273685d77feb0204ec98
- SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
- SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
- TLSH
  T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libvlc/win-x64/libvlc.dll
- Size 186KB
- SHA256 a9340c99206f3388153d85df4ca94d33b28c60879406cc10ff1fd10eae16523f
- MD5 4b262612db64f26ea1168ca569811110
- SHA1 8e59964d1302a3109513cd4fd22c1f313e79654c
- SHA512 9902e64eb1e5ed4c67f4b7e523b41bde4535148c6be20db5f386a1da74533ca575383f1b3154f5985e379df9e1e164b6bda25a66504edcfaa57d40b04fc658c7
- SSDEEP 3072:f3jr3xal+e5Wz5+xCwcNohCMYMUyNUjqsbJLyLM5xjxN:f3jFe5WYYwRj4yNMqSLyLS
- TLSH
  T1AF143A57A28664EDC5ABC235D3D6AB33B531B4201730BE6E1B28C7341F91D507F2AE68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libvlc/win-x64/libvlccore.dll
- Size 2.7MB
- SHA256 1fed66191a0cda73b37ba2bc58f6ebad3ee1ec4f8193608f3ac1d8ad2b97640d
- MD5 01f6f807faf190a38bded7bb1c105c18
- SHA1 22c9fbe9a92be74fe857aaea020025a78c52365f
- SHA512 e35201ce08d51cf3c7580ec390e4eee228dbe17b51ee0885f748a65f36f2bb6a1c4deee10ce9be92d6b6d58db8a59b8d1f93dc8108e9ae7ef0f059c62d2faee9
- SSDEEP 49152:DA9qEelmNGJRcsADizpXtBOy+BAUZLY6sEZGaXBuQQ9eyr:+q8fW+BAUZL3e
- TLSH
  T1FCD59D17E2D214EDD16BC13087666B33B931FC6406313EBF29A0F6352E31EA06B5DA59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libvlc/win-x64/plugins/access/libaccess_srt_plugin.dll
- Size 3.5MB
- SHA256 d032c07dc6cdd73d8b9ca722836a4ba75809c2c808004f663c7a187c9116928a
- MD5 ef8754762924e185bc64a23a8e8f5a8f
- SHA1 731c4df43dba07c89e9b70063b0dec355beb3393
- SHA512 69810d21054e10ebf3398149105a4ee9d0414936a0bb8a5c55bdff5c19ed1e99ead00c28250bef1b2dd44a0269ca6e7816f8bf2f0d3a95df405b4756e6508587
- SSDEEP 49152:3jB8X8qBIqRmsYqSEibpu92wqnVoc3CNJGtlqRO9ExEXA7FsQgXo0u1FyRNzNoxz:391h4mg49vHCNVYEx1mN5nifIW9b
- TLSH
  T115064B03E2A255ECC57BC1308753A332BA71BC255530BE7B5A94FB712F31EA05B6AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  libvlc/win-x64/plugins/access/libdcp_plugin.dll
- Size 2.4MB
- SHA256 70dbda1fe19c58f57d75b4f9f0ceb2960272bfd4578973f233434734f43db5c7
- MD5 7b6ff607323c5959e3bbacf44a020a63
- SHA1 c1dcd68691f16abf1ac5505d216e8f45234b195b
- SHA512 2048000757f07e065fe671253e83ec72f03d46eff6c6670bcf5f61e9663062ff17d85e6f2d1d66ca649568235e3db088972b74629ab941b4816a162cb4273721
- SSDEEP 49152:znmfoIXzigQBVxffk5tFzF/cZe+wQ0+2g0+5ILRqv850:/0wwmQcC0
- TLSH
  T19EC54C0BE6A350FCC16FC03483969772A630B46951347A7F2A94D7322FA1F50DB6E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  libvlc/win-x64/plugins/access/libfilesystem_plugin.dll
- Size 69KB
- SHA256 1074ed0713b19008c9d6cf9baa85215aa8f5f5de1a3986b757f67d2ec891ad7a
- MD5 d72adf488c072b89c8effa5feee6075d
- SHA1 93be557e9bd3c759e987dda92b1d1282b3fb574b
- SHA512 61ac0e7fd236b3a26ea8b84808b66ebe8a960cd9fb3c9c2314f793f742aae2f41c32087f7b0ea835d8144fc14bece7d9b8ba3df05f3d92c832cd150fdb3eb11b
- SSDEEP 768:/5trTmhRgIwlwxNCX2Kk/ehlB+4G7Q2eaEqbWzY1hae+Pfqy0YDGREJPx9NyDGR9:hZm3wlcIH9E7QBpxzsh4qy0YPxPqPxVE
- TLSH
  T1E1634D1BF3922CE8C56BC57461EA9B32BF71B9111560AB7B43B4C2711F40B413FAD668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  libvlc/win-x64/plugins/access/libftp_plugin.dll
- Size 124KB
- SHA256 755969ab9109c8b9adb2ea47f6737520754cbbbc6fe3a320df73df48be7d1109
- MD5 066a14f063e391192213355a17b8c112
- SHA1 80d87b150f9ad09433f65232c9a20f4fed5c5136
- SHA512 0cbe79339a04f240ad07f8b75c31c381f22c221cc0b8ce976f9e4b7f73b9b9114c8ff2375830639ae56e160c770d5512dafb34891b1803b1401c32d42b640902
- SSDEEP 3072:3U0JWnZalfNNtyjnDALuxUn+gwEwqDx3ixE:3z2alfNujDyuqn+gwjqJ
- TLSH
  T178C34A57F19A68E8C5AAC17457D76333F630B8914930AFBF47A4D6322E40E90BF5C268
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  libvlc/win-x64/plugins/access/libhttp_plugin.dll
- Size 74KB
- SHA256 239b6fc3e680ff798c6a46683330960f5f98617e676e3c35e09e3e57054979e7
- MD5 22a6364dd6ce3d43851557eb4bc5fca1
- SHA1 5d39e630186545ea2ab84b4ac961b765c538fb5a
- SHA512 dba9e9d160f938b3e7d0e49ef6568205bfa780d675dcd25105b82974242d1bba9c3e7e218c8f216fb32d791648a7ef2f8e16477805555d2895da58471fbb2157
- SSDEEP 768:CoPHyw02chsi41zLuGbh2Ii/SeJY287h9P8HvV2Z4x5LKdSstPsc0scFiaDGREJT:2Tyi66sNVL7hSPAiasc0scFiCPxvPPx/
- TLSH
  T1A6735B5BF39228ECC96BC53162E99733EB71B91155609BFF07A4C2301F80A817F6D668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  libvlc/win-x64/plugins/access/libhttps_plugin.dll
- Size 151KB
- SHA256 908baa924b9ac929eabe5d07f3c05dac72e654314eddd7d9ff1ffc52e8476f8d
- MD5 64c037b9c364da561f88a1782acb8888
- SHA1 efcaedb1a060f94e091624750f47bae7c39d23ca
- SHA512 0622cc3322ac68a05b638f16bb09e34064668f773d14601e9484833dc177d2e4e346dd1ca3e198bf34a20f8f620b7aa32b744aec539456ffc82a28470e247dca
- SSDEEP 3072:JSaQgM+V/1nu/e3kot03f8NkowrSrvSS+H5nJDdSPx4sx+:YZti/1u/eUn3f8pySbSB5nJDow
- TLSH
  T159E35C67E29254FDC66BC13496EA9732F831B8210730AEBE4774D6312E41F507B9E728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  libvlc/win-x64/plugins/access/libimem_plugin.dll
- Size 40KB
- SHA256 7266e96ba730878aa4c12f86528811ecbfaab99e7e32aeb2a1886a80ec04843b
- MD5 50af31d831c0ed08a15667ad81d81438
- SHA1 d97a6377e3601a33700bb5cb41d5a04298f941d1
- SHA512 5e2022831f50bc5917f340600be3030e8f24b3a7a0949ff34e38e77b6ee098650de6aaa195272b37216c13b50e3e4acb4ba408e43ee73ebadaec436e4f05f243
- SSDEEP 384:830IxSlEHfllOH1RFvh1FJ33deWKSBwDwvDGjoe02Nyb8E9VFDPxfv2zvDGjoe00:xiSlqqn15IWTwqDGREJPxnEDGREJPxV8
- TLSH
  T1B7135C5BD7106CD6CA5BC97171E98A32AA71B6422AB0C2FB4328C1705FD17817BFD1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  libvlc/win-x64/plugins/access/libnfs_plugin.dll
- Size 285KB
- SHA256 66a90f84e4718dd77ddd8f587dda500f15f5fcf7d6845c573d16d8c9a22b0fa7
- MD5 5a52733ec86b80039ebf115a30d8b370
- SHA1 e29191c3f0b5a29f85152e6ab3d0515b31f200f8
- SHA512 0e2325ce133b1ad67e7ac89cd648fcd18b3b5debdbd77ab3fedf62ae191b97d769800de71f5b38a678ade8846696126e75c26db00da7cf12a03b6b0065ad51c3
- SSDEEP 3072:5OVL5rbgQw+ETcCGetV/3F5xHQRnGb4jOjHJJGSCg/AKCb9vzVIcCawxhxtK:UL5r/QICz/3F5xw64jOjzCGvi9vzYacK
- TLSH
  T1F3541926D29625BCCB6F92308256D3327971F464D721BD7F04A5CA382D18C617BBFE28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  libvlc/win-x64/plugins/access/libsftp_plugin.dll
- Size 865KB
- SHA256 5809f8e9632fbb34c237858510ae17e76d6458345e6d1d562aea17e19a6902d2
- MD5 0057349f26eee3b3dd2683ef7fd6264f
- SHA1 5c0aab836a8c19a022abae30fa20f57c5f71aa54
- SHA512 bc36af83d8b45c0ed2f994064dcaeea4f28e7c61ffec8ae9e7de950630b187926cf4ea951f1336818943dffb68fcfc5613d6a696f04eb84777a83a051d6f3c0b
- SSDEEP 12288:27FLfCTfZSF1pikpKwEicslSa0GFgI20EfbJmANBYn0JhHiZ8+:GNCLI1pik8DicslFgTVfbNB+cZCz
- TLSH
  T195156C17E6A220FCC56BC17087A7A733B571F85512B07EBF16A4D7302E22E506B1E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  libvlc/win-x64/plugins/access/libtcp_plugin.dll
- Size 40KB
- SHA256 39ae5338db96a014347dd3a92e56bbec8c8c65bd21a822d087b844641793f400
- MD5 055f36c8d796e522bd6e2889127a9957
- SHA1 5c6b79c99a2aad4cd81cbf07ac67f00790d8d04c
- SHA512 83625bf98ee774e233567a7f4fdee02b27f369b2a058032a6c8ae4b83cb35e8b37614f92812c1986c608b1f11965cf4303e5adc47325695f70f10c1a08fc1b69
- SSDEEP 384:O+rYY0gH/HzF6ugGe/51WD7wF32gumSBwDxvDGjoe02Nyb8E9VFDPx9PX/1NvDGB:xYz8HNkOObu3wZDGREJPx9nfDGREJPxQ
- TLSH
  T1D5035C5BD7506C95C96BC97170F98A32BA70B6422EB1C2EB4329C2601FD17817BFD26C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  libvlc/win-x64/plugins/access/libudp_plugin.dll
- Size 41KB
- SHA256 49eb26b38ddcd1b45f277b02c242694449f086748cbf235c0109e94c0193e724
- MD5 1ea7dcc1e74e94988802b04db8f6db3f
- SHA1 87a84e45a27ec571651dbb6b5c743cd239fe891f
- SHA512 2dedd069cbf9dcc4d545ecdb66febc9ee2ddc7268605b5c78508a8208c7e5bd804b85bd1e2c86d1adb2f037c11197efd296899b94030fd9eb01ff47a170a8c36
- SSDEEP 768:XWkGJbUb6zUwLMpzDGREJPxzvDGREJPxEy:ZuowQppPxzNPxB
- TLSH
  T173135C6BD6806CDAC96BC47170F98A32BAB176426A60C6FB4328C1701FD17817BFC56C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  libvlc/win-x64/plugins/audio_filter/libaudio_format_plugin.dll
- Size 64KB
- SHA256 ccdec3bad40714eb1f5a27946f6c9ad6002524f9e15f0c39733322598fc8d08b
- MD5 59ac7d0e19c964bfd59b2e3ea7c99427
- SHA1 3c3354dd5da810a899b65bf7005a52adb62a4d2c
- SHA512 4772f8b8f72bb787275d1a17c0f12294158f789a26b484e82e2c76e61c95d93251c8b30d5f9b5678acf95b41b48bf9d42566679f0190c8c2cdd0cb1448bf0b0c
- SSDEEP 768:6eI/oM7Qc8yKY7I1tW6vv8GodwpJm9kfiyCHQw4DGREJPxJtcDGREJPxk:g/oM3OFv0kg9/yCww4PxJtEPxk
- TLSH
  T171537D8BA6D06CD9D91B853471FDAE37B331F5190AE046F75268C5340F93A422E9F2A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  libvlc/win-x64/plugins/audio_filter/libaudiobargraph_a_plugin.dll
- Size 69KB
- SHA256 85e903cec2ab823cb02ae5b638edb7cf6c33cd08547584aca59b037a3ac4540b
- MD5 727a777b66778499db3617784a31971d
- SHA1 0e560387dc3a8664a3b0035ed2edb0c24ac0692e
- SHA512 d5baac59566deb5613c719cf8d7ed81761f3b919a321362231f82b4f75b9a1089874ca70892f7e81fbb01102c252eac049c3ac40c0f6f8ab6c8d8a244671fd28
- SSDEEP 768:PG3qG5EHVx2cv/9GQvygw7o9CyduWjkdK4sDGREJPx92DGREJPxe:u6GcVJ99w7oHuW/40PxAPxe
- TLSH
  T189635C6AF2915CE8CA6BC87031F59F32FB72BA1119659B7B0324C2300F41F516FAD668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  libvlc/win-x64/plugins/audio_filter/libchorus_flanger_plugin.dll
- Size 49KB
- SHA256 98fa99f9bedb44f104da2752581042d41b8c1d541115a316d19e358eeebdd50e
- MD5 3076d5a58364ab61c4fbadd59320282a
- SHA1 986fbd4bc6725650511dd9cd635935ab1bac4e1c
- SHA512 b8122915cae3a79e87ec1f7c27403154c8fe33190d1a230681100b776f9a5a2914df93f6d6d80b205d327192ef1b8064f8d6bfe8f43ef377a3a403e0faa124bc
- SSDEEP 768:sPHK4p1AZw1TfbOQzMpCdqLWBYabGowDGREJPxwdVDGREJPxv:uHHKw1PxzMAqLaR9APxwdjPxv
- TLSH
  T19A336C9ED3512CD5C95BC97071F8AA33FA30BA521AA186FB4369C2700F807813BFD569
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Deletes itself

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

UPX packed file

ACProtect 1.3x - 1.4x DLL software

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32