a0cfe83a4013b569724a560a4a7a845d5b1ab785d5bffdd2ffc753cfd5788dbb

Sharing

Copy URL Twitter E-mail

General

Target
TeraBox_sl_b_1.46.0.172.exe
Size 157.9MB
Sample260719-e9hsxsew6y
SHA256 a0cfe83a4013b569724a560a4a7a845d5b1ab785d5bffdd2ffc753cfd5788dbb
MD5 7310ebfc2e099d2d73e1c5e4f22ccdc3
SHA1 7cc9167af4021c48b522297991bbe0503c6d2d60
SHA512 8e362a9550acf8fa7ff8c16dcdb8a80a905dbea8612b852dcebe49c3782c92367e23e6caf6d5a9bdde13da0106b5006c45b831212eb3bddd733af9a018ab723f
SSDEEP 3145728:ljs3RRToTrfQ+mN8uwNeZGSUj4uF8cPYkdq/EK1A7qA3wK2ceQKWFrZG/MbsB:lAhRIrBeZGl3gGq/E5gK/trZ2MbW
TLSH
T18688330F2F24F9F4FB40A739F054D4AE94BA4010B1E56ADA29980CEA607D63815DFD9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  TeraBox_sl_b_1.46.0.172.exe
- Size 157.9MB
- SHA256 a0cfe83a4013b569724a560a4a7a845d5b1ab785d5bffdd2ffc753cfd5788dbb
- MD5 7310ebfc2e099d2d73e1c5e4f22ccdc3
- SHA1 7cc9167af4021c48b522297991bbe0503c6d2d60
- SHA512 8e362a9550acf8fa7ff8c16dcdb8a80a905dbea8612b852dcebe49c3782c92367e23e6caf6d5a9bdde13da0106b5006c45b831212eb3bddd733af9a018ab723f
- SSDEEP 3145728:ljs3RRToTrfQ+mN8uwNeZGSUj4uF8cPYkdq/EK1A7qA3wK2ceQKWFrZG/MbsB:lAhRIrBeZGl3gGq/E5gK/trZ2MbW
- TLSH
  T18688330F2F24F9F4FB40A739F054D4AE94BA4010B1E56ADA29980CEA607D63815DFD9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsProcessW.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/kernel.dll
- Size 36.4MB
- SHA256 131b8523473bf856a9a49143b81d273b1af7a764fbfb4c42cdfb0f4a1a8fb804
- MD5 8adaed66bf08ff424586d0f50e57f718
- SHA1 915f38dd02667a008f7d304025f4d002e682acd2
- SHA512 76bd045fc46cfb3ebe9234361a016166cc237219da7382932bdfcb31802dc83017378f44ea08e8a5377afe879cf1a06fcb30aa79731b2e9db917d4c7de723b49
- SSDEEP 786432:QuRMpfEGtNnYF1AwWrreqpC590U3pqtbFfBGXDNcN:AfEKn8hWfeqpCIU5qtpfeNcN
- TLSH
  T13887BF03B653E0FAC94B41B0751EA73EA4359A305B204DD7D3C0AEB96DB15D12E36B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  AppUtil.dll
- Size 1.6MB
- SHA256 41211ab51b62764bb9f75428f95eacf42047301121cb35ee907b380de1644505
- MD5 4dc3757f4a8e549f00a86c3bd608a152
- SHA1 f8865ef655554b462918507f63f0d2c2374b8496
- SHA512 603baf3c296dd99cfa42fabeb49c9218920a07365f83567e2282f38b5daf374cdeeea2082303160d21690d6a2cf95db73c89b32d6d4cbee145d6f5ccc48ac516
- SSDEEP 24576:1fnynASRylrd1y3N8aGtUtvSN+UR6TSHGPP80//JX9IRwIV1:13S664R6TKGPP8m/JX9IRwC
- TLSH
  T1D475C002FF8A8671E9CE037995BA9B3F5A37A7104334C5D39B902DA68C712D2263F745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  AutoUpdate/AutoUpdateUtil.dll
- Size 199KB
- SHA256 c9793d5f108b17978ffb2c36a695173ad2fbc1f9a3d2c7b2dcb1222e078e6d20
- MD5 46e9f86eb74be792637f28ad37b67c19
- SHA1 80056929df98abbc046daabff5e769161c160665
- SHA512 deabe7e133cf24c9c415bdcf0f83d76fd2235f70f3cac27c92ccaed91eb84088fa9c9547eb6a320d5ccc12148b11805c51b3611fa97fc1b6ffc3a684437b21b8
- SSDEEP 3072:QOq3B8kyfQQC2mC2gbvCsGowP96rH0Vu3b1vJ4gMdM5Vj+gwfnv58LvRVT:/q3BJ4vCCa9Vgx/+Tvv58LvRVT
- TLSH
  T144149C027E81C033C67F1A3404AAC6611A7C79701FB59A8F67988E7D9F742C17B29A77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  AutoUpdate/Autoupdate.exe
- Size 2.8MB
- SHA256 df9d63dc911251f61aa3e7788d8a7a8ab4711d4cfa12fd486ece127c781d04b5
- MD5 e2091ba4ae3e3a891cebf411b22e4fa1
- SHA1 8870b566507a2d372a79fd9df17443b7e8ca6372
- SHA512 01a6f32bb3a2b4eb93862f20916b67b210ef158b2cd7f0626e83bdd4c00e32269cc69c1340ec05b866cdb08139d6284c820445f4dedfe6b61e80fe265445e006
- SSDEEP 49152:d/Oxu2LONc9DXFYn6EXTlrmPHSJAFdkpt4ldTk8:dGKNcHYnlpISJBw
- TLSH
  T15AD5AE11B785C172E5A201F199686BFE8439BE211B3591C3B3FC7A5E0F305D2DE3A626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  BugReport.exe
- Size 1.4MB
- SHA256 41a9733e87f5ab466fe926fe51fb321fe0b0ae8a3897e5171ae7722cfdc7d1be
- MD5 4485865044b7ff2f82aace5240e7f0fd
- SHA1 521c275966a74275043328f415dcd178b3a87406
- SHA512 f7f2b50420760298ac28922de4549e45f0faafb9773a92c1bac2e36ae548d19d7edcd406dbf870a1fe9d411c8d7af0b18549326fdea380737f8bf97355e3a2fe
- SSDEEP 24576:+//l5sGcaqTOIjrArfwSljXUHa2w9VmjumhBtyZPhqPsfClT8kHFn7SCiqyHSVl:+//l+fWwSljXU6GyZpqPsfClT1l7SCik
- TLSH
  T13865CF42FB8285B2E5D2427851A69B3F4E366E249335C9C38BE13E668C316D2173F3D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  Bull140U.dll
- Size 3.2MB
- SHA256 fac65d7b4d7862ddee8273e07fc4eb31acd6339c6e1eca017cd985c611a85d25
- MD5 b9d36b6c9de7a54e2e474374bd980cc6
- SHA1 9962f26feff153609c4728a622b3f51f831db1c9
- SHA512 2cc9777645a67ee5a8eea278ad634bcae06b8568ebf771d5cd9cfb149494f1ac0cc335603a5867ecffb8057b48a2445a05fd94882eb624abecfa2e2f84dd2151
- SSDEEP 49152:sucCrMBcHiNTP0aVY+cTiPA+uo8TW4txOPD7LViYZ4XZwnlmdW:TdCtVYfbno5Via
- TLSH
  T105F5BE12BB41C162E6DE00F9553A6FFF587A9F204324D4E396F1B9A95C301D1EE3A34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  ChromeNativeMessagingHost.exe
- Size 127KB
- SHA256 6be882bb70abc8bb82c9fc6670d4ff4ff8dc64ac38b8ad04ef5468a41bfe4eda
- MD5 276e3e1e4c6d384be9b14d9d60f96e3c
- SHA1 d028db6e78cd98bfb3b632e5bb058708c23b7ace
- SHA512 6d653566875e15e08a2feebdd8d848aea7d4c16850f39148b3ec71fc34f2d9d010c5801a65e4a97a7723d0dfff9ff1508d87f87776939143e4eda733a9535935
- SSDEEP 1536:bc4mzVpxZe1xQ1DB4lFJGG3kO0Rklkh6oCB3m8CijRJF4wL7nnBxWnB4/V/:bc4mzV/B44hh6owmGRJywfnnHWnO/V/
- TLSH
  T1B7D35C53BB4B4032DA53027254BA9B6A44BAEF705FA209C3E39C361D1E747D11F3296B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  HelpUtility.exe
- Size 149KB
- SHA256 5397f4e199e02189ae66a654671c5b244fdfac836b9448ec105dc94b2a39329a
- MD5 a92806fc3ec7e2fa5c3580e1463e9339
- SHA1 bba6bfc024cf8a25a3a1ffc738aa5ebbbcac9ecb
- SHA512 897bd406ac2b9ac9eb40154709070852d618cf369d547162ea3cf4298537aedb803c36047d81230ef08cf0434ba250211768e9c32d9ed0a0d4137d47aa117438
- SSDEEP 3072:sSiN9E5eKz4AMEuE8pm9DW7aWo1WoFuVjy6B0jFuFwfnvACv7Vb:sSiWzc5U1k0jA+vvACv7Vb
- TLSH
  T132E37D507ADB8572E693053289A8EB2A80B5FF31AB9258D7F358365E0D743C11F71E0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  LICENSES.chromium.html
- Size 6.5MB
- SHA256 9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
- MD5 796505037e030807d9ddd01c93eb353b
- SHA1 79a1eac3b505e6d94a6206d4a5198d3cc11ab038
- SHA512 9435273a4541a579a427a295be47af8b81133896f50c97bab1d8ab391089f90186a7fd057b53e8b74829e4747e98428d8b4d242eb6854b1304a94a2891c2fd11
- SSDEEP 24576:8Pjy5WjWSpgDrAV8gmfwN6i6w6C6g6T+gH3BMbp0W:oJDN
- TLSH
  T19866942F7B48037306C602A2AB8BA5CBF21B903F3B565654345CD1681F6BE2543FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  TeraBox.exe
- Size 1.4MB
- SHA256 757d732d3a378a01ccc3587a8db0e5bca56c93bb5f0ac2ba2035be3ba6eca6b9
- MD5 dbfc944d2a2e9e37b97e065b96c02ff1
- SHA1 f390aa4820a306c9645a0f489ec357a0b065e82f
- SHA512 1e8f9b964e0c8627030a414d0d08c1150bb7518f41bcf1838caaf95a2981649d28331b7df54d2d383c9441747b8169930475d5e850b726f421786b7c100b8307
- SSDEEP 24576:l2XkO6r3cDeGhkEneocg4l56Y4pPiwcV9aDbQaTcoQJR7H:SkSejEneocg4l5CUIbZTcDJRD
- TLSH
  T1CF659E3138818025EED320B146ECF939106EBD740F7745CB95CA37E99A76AD32B32A57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion discovery spyware trojan
behavioral23 behavioral24
- Target
  TeraBoxHost.exe
- Size 3.6MB
- SHA256 482289a680155a822005fd6e84794601e431cb9ff9e75a38ed1f235f64775966
- MD5 ed0d8bf9b79c59be7476189bc91f96b0
- SHA1 7dd6ef2162d35e5cc6ee0e0f6fbc872d4bf3ef27
- SHA512 dfb1898a23afe0e9ca56fd02ef354e327bc1228fc6880826a39b47c613a25a7c26c21e626136fbec149fdc15e488ae13d7c931e62ec0abc7655ec5944075c0a2
- SSDEEP 49152:9sFJXTvb3UWeNBVtnwKmd9jmv6qgxpOHWMGSG61UwQxkuf2T5H5Ta6xXWkXjEB5h:mTHrABVtwZjmv6qgxpOHWLyLW5h
- TLSH
  T11E06082076E98739FAF306B45979AA7A063DBD258F21C6CF4244351E0D34BD25A31B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  TeraBoxUnite.exe
- Size 130.2MB
- SHA256 5e015a87b508aed6c257d47d3c0824009d3730dfc598204e27ea34619f63b9b9
- MD5 ec3cd98e54bf91e3a75b05bac1c8a328
- SHA1 54951e60717185f13d0acc1b20a7ef2e06b95699
- SHA512 2e0a8f4a69090d9c1d8e01a2234409bae0134c4b2ede52a303be1fd9cd6f3cd2f56e2f782dc116fdce800df62e8d3043b4c50eae9bd810021ba7f14d9dfd6d9b
- SSDEEP 1572864:jcbpqKkZruFcijLKkgSTXLlvFyQRBlkZ/ugaz23xlh2CmI7KRvg56itpw54mqzJb:N+/e/ug3A9I7KRv4XNi/SAAMx5k
- TLSH
  T1B2588D01B49260B9DC4731B2346EB73D5924464787394EDBAA8C7CC47FBD2D12ABE34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral27 behavioral28
- Target
  TeraBoxWebService.exe
- Size 767KB
- SHA256 c0a0ac8ef8f8c8103fdde451c5809268f843a0c72ef3eeac771209fc3ab8ceec
- MD5 f669727e89c73c16fd72ee27c5eab4cd
- SHA1 a269062484408ceec4207999342a48ed91e849a8
- SHA512 57f268df37a2ec6063cfd76afe153e0a4504a6f91b35c364d74e56d6acfa4da626ce8508115195434aa7bd8b8d12468e38034acdc17f56416220fad9774a506c
- SSDEEP 12288:EaG7G2JfzvodoW/0WSwgK+huGGWsjxyMUxr3t2bxNNaxTmZGVY:0Gmf8dx0WyuGGljFY3ixNkQGVY
- TLSH
  T1D2F44B12E74F94B2EB9701B583EA5BFF4D265E3703154CD385843A6C4930EE23A7AA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  YunOfficeAddin.dll
- Size 399KB
- SHA256 fa8bcaea8a09ecee95b2110321614a249de4dfbd2fd56f8c8e15d64e4f96600d
- MD5 fb0b6b7d510885212f743f0cb948d82a
- SHA1 e8a538dbd2ddd191ff672880ecb90ae0c10594f2
- SHA512 3a92bec46459170ee6daae14c6ea8e5fd0417378a0a5bccacbf325709977b95e38e6397d8d9d93134e61f98fb52eded384775c6a00894c96177b2ffa7e694789
- SSDEEP 12288:jbkyT07b6G/Q0Tz9smQecxT8ixymivI9wVF:9ATf9smQfxT8ixym3OVF
- TLSH
  T186947C10B685C532E99E0131EA7CCB6A147DBB611BB294C7B7CC566A8F70AC21B31F17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32