7c7da30a7d33d945d4f7f0c2e2f67f9db4a0c783e8cb31e4d6ab52bee6ba9c33

Sharing

Copy URL Twitter E-mail

General

Target
AugustusCrack.zip
Size 79.2MB
Sample260724-1ekjxsteld
SHA256 7c7da30a7d33d945d4f7f0c2e2f67f9db4a0c783e8cb31e4d6ab52bee6ba9c33
MD5 b34e3ac22fef2783d08a1fa446f910c5
SHA1 637c59f4619a7a5a80d36b7a44991756dbbdc356
SHA512 e90b7bc9cd2e7c13ea50849bf66e3c701cf6567501b0def7c9e4be1f49b6a9989087bd4e4c516549424da1091a827884269186006df1b7a495a49c6e3ee03d73
SSDEEP 1572864:pcWLkEtIEnQ9XWjS35DBn4jKfcX93SOLeaVgesWAsllT49ET:CUAcQ9XQ+ZBANqfeUcdwE
TLSH
T1B80833FC9B01C2F0F634A1762F9522348D74B3E1A76929D86E365FD1AD80A740926FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  AugustusCrack.zip
- Size 79.2MB
- SHA256 7c7da30a7d33d945d4f7f0c2e2f67f9db4a0c783e8cb31e4d6ab52bee6ba9c33
- MD5 b34e3ac22fef2783d08a1fa446f910c5
- SHA1 637c59f4619a7a5a80d36b7a44991756dbbdc356
- SHA512 e90b7bc9cd2e7c13ea50849bf66e3c701cf6567501b0def7c9e4be1f49b6a9989087bd4e4c516549424da1091a827884269186006df1b7a495a49c6e3ee03d73
- SSDEEP 1572864:pcWLkEtIEnQ9XWjS35DBn4jKfcX93SOLeaVgesWAsllT49ET:CUAcQ9XQ+ZBANqfeUcdwE
- TLSH
  T1B80833FC9B01C2F0F634A1762F9522348D74B3E1A76929D86E365FD1AD80A740926FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  AugustusCrack/AugLaunch.exe
- Size 27.2MB
- SHA256 83bbd1f9c757e416a977fdf5f0a84bd0f7373b511c4bb0f615de8d5b23f1e813
- MD5 9427886d7f621b727648ee2df337e469
- SHA1 e07b1b50b575f410a7db423c4e3a41b03a9d64be
- SHA512 48e16cd46821ea26e82f080163df8e85001015dec9867a0ca0fca57792f4e5da83aad2971a76e0dcd131f7e2b812cb08bfe1326db49b6ab8fa1d174e9108582c
- SSDEEP 393216:BsyRCGjmikobNnbw4kuPUKX/iwGyISX+GgfXS2nXTlTBiDofLbBIBfEwOPoy8d45:BrJSMR0Ozv1HIi8xnX5T0EdoftMu6HDD
- TLSH
  T19A57335FF7C411E5DAD65170CC43C84ACAB278871BA4D6C387B8ADA52F7B061DD2A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence pyinstaller trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
behavioral3 behavioral4
- Target
  AugustusCrack/LK_lib.dll
- Size 2.0MB
- SHA256 f6a2972a0ae597d7383274508d4ae9c56037956100a48bde903c852f7fea5dd0
- MD5 ae22861c11c61b2ccaec93c1fab16171
- SHA1 becaa212ea22d91e2b02bd62c76c12453fa4e330
- SHA512 7bdd219007980f9cfb615f49ae652efcc0dccba5ee6e52191c7843d053042979f875321866ab417c7a6cb2cb7335c46cbd92cafbc45ebbafe40d81e8d1c6c851
- SSDEEP 24576:XX+Te08Vufu96mydDhM0H0ZG0Wv4Y0mSX9a/C7yoKVaWEYd+pZ:e8Vu2961DhMg0ZG064YUwCu9cWEY0Z
- TLSH
  T1E6A56B43E2D900D8D01AD179878BA623EAB2BC454B3436EF1650B6562F77FE05B7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  AugustusCrack/auglib.dll
- Size 5.7MB
- SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
- MD5 817520432a42efa345b2d97f5c24510e
- SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
- SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
- SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
- TLSH
  T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  AugustusCrack/d3dcompiler_47.dll
- Size 4.5MB
- SHA256 fe86899dadd7cf158ce8dd1105c4d2d5c8adf5eac18928ba4e847da7596a1400
- MD5 ec36d8978bd65b8395fcd466af62523d
- SHA1 268f3f71da909f3a5336dadd8a971f857ae94c7f
- SHA512 9b7cc7669ad27d0a3cd796c403b0b46ada08a34f10abc5dbf23f44864d1ce2e30113a7f486fc9e7c0abfa62a2387c636c391113dbd49ce4367afa060341988b1
- SSDEEP 49152:d6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLv7mbpJ3M/J:dUdeqt737jFmFwB
- TLSH
  T1A0268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  AugustusCrack/db/Borland
- Size 1KB
- SHA256 0ec52d9088983aa88fade85c56561972615975d7d7c79837faed40d8b9dc575a
- MD5 5bf5b1dde59a19de904029fd74e37484
- SHA1 43026f73858698039dd422fb064bde601c2347ae
- SHA512 800b4e1f4fac508fcd5b3798f5d68612dc72dee524dde97a943e69889b3094e0aa521cc26ff658c33268b846790a4a705450073a969417147232a9f3d12ff2a1
- TLSH
  T18E31AF5EB5882753FC332B366B593405D6A5703780C04A443A3FB28A3F7939140E6F46
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  AugustusCrack/dxcompiler.dll
- Size 25.2MB
- SHA256 2dd8bd7d9f3d73b60527bd0db22e3477da8d9f0cd6d4145549e6a629866851d3
- MD5 81112daf755099e6e8bd130a8c85e6b7
- SHA1 f4e5edeb7edd5250a28b43116f6a95191c838f10
- SHA512 4d15169e0b775f577d7ecdb83a53ea9b4e8eb821f700fb43e2fe09b2cf9f6c1197a7b550f0c16dd23ebfd52463e658779ffba51fa3d31dd3a1ffe7a730e7fee1
- SSDEEP 196608:ZsOarC8tib/+rO8Ro445HWDr7oJ0N6hLI1z+CBXp1Zwlv:ZsPrrO0N6I9vZwJ
- TLSH
  T151476C127685589AF049D47047878AA3DE3538CB1F3A7DEB40D495252FBBEB41F3E228
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  AugustusCrack/dxil.dll
- Size 1.4MB
- SHA256 f5035bbe5af2fb6333622d3fd003440bb7bf82d97a2bf22acda6c246a3914765
- MD5 0e6cb4fe47aab638cf0118cbaa0cc31b
- SHA1 985123f26132a21587c38526359db16dd0e7d025
- SHA512 2e8598ecbb3784c95e01a77e95cbe4cfc698d38fdec0d866850ec407801070ebb0b36f2bb0bfce813fb0e3b2796c33551fed59e471d5a968faba0be8fc756e95
- SSDEEP 24576:RCfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkru:RCfhbh3v3mtEAQrW41obCraeRhy9ou6g
- TLSH
  T110658D1B629801B5D4BBD178DE578E07E6B2B41503B09BCF12F006A62F2BBF54A7E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  AugustusCrack/eventlog_provider.dll
- Size 6KB
- SHA256 500fbcedf992d12fd056f2087c70049c5a06d7ca147d91c0bab8e5dd5aee9d04
- MD5 f2f1d7ad3f0e2f90ba01544bf623cf70
- SHA1 753d4ea60a37bccd8d94415947abbae39c1fc95c
- SHA512 d1f729fcdb2dc4994fc12ac73e5f7174aebca7a122edeb1cf70f444979f332982802d096b9f2ad0871a2bbb406eb0bc42616485302a50f9209b4f566e2cc8b54
- SSDEEP 48:vpg9JQJJ4Apiqq1o9LtiGKWsjIFO2DqIaU:BnUqq2hn1sjRiqI
- TLSH
  T16CC1FD229BF8052AF0BA177467B70A167634F8A15B25DADF0AE1120D1CA1BC5ED30B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  AugustusCrack/libEGL.dll
- Size 487KB
- SHA256 752f87950f8e2b65634b943f6907c23c9e4e5b46130316190ff3577dddce1e51
- MD5 b601876ff30755b81b26e45034a48e4e
- SHA1 ad5bbcfff3e44aa5bfc7449b965a52329edcd065
- SHA512 1b47bbc84fa82984b72afd1c9d7b4f99736cb2b5db36111778bdf8533a9cf69cd67608b800fd28762fd87b184ddeae8fbf3784cb1806ae0e0483f6f386fdc7fa
- SSDEEP 6144:bb5y/16pQ5l9ZyJG14/oNqTZ5KpjacsMjb4FgkZpYhXPIxxWstB:hy96pO/H4/o+5KpjacsMjb4OkAhQxo
- TLSH
  T1F2B49D11B3D449A5E02FD074CA538643EAB278460B65B6EF02D0A2792F7BBE45F3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  AugustusCrack/libGLESv2.dll
- Size 8.1MB
- SHA256 06d3c33590c0a01a15d0b7ee1df9684c1d036cb1fa448ec8601767c8f5951bb5
- MD5 328b5b70e9b2160292305e1cc378759e
- SHA1 74e207ff20ce96e8dacf509a6f5afde6344f08bd
- SHA512 e2d15aba6dd87ecf1182b191f70fefb7a68001e98e739efa74ddf41cd184cdf4bbdef373f8866bb0a3c4d80254cdf313b947dd975bcf6132f72cd5982eb4cbd5
- SSDEEP 98304:PGRHPhz5bIly5bfTaQrVj2zt8navzf+XqE/sJ:0XDfWOzzs
- TLSH
  T10D866B03F69640D9C00DD2B8875B9523F575B88A0B2472EF36549B222FB7BD06BBE714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  AugustusCrack/msvcp140.dll
- Size 554KB
- SHA256 e0a22a594e148fa55ceef3e49969bfa77011a801267a0bd7805b681b593c9d0b
- MD5 0d89995cc45c7eb40e5a7e287506c1e9
- SHA1 096c27b06ee7fff2bcd290af0264cdafd04cded9
- SHA512 3497c2957d10fcddeec8f312fb15c53f82d770dcc3e771a94daf4f4435c3ddf323ecd33310baaf1ad56673bac7c6268a9ef921d5f32cf7e4a7c9dcb0d8aafa63
- SSDEEP 12288:Q7dqZ1EqSGQEwkcz6sm7UtgZ/29z7mnuMG7NaekWdgJMKZ+h7rUh0wvaQEKZm+jl:QZNg+h7r6iQEKZm+jWodEERAW
- TLSH
  T197C40923B74D05A0E195A3B8A1C38315D7F17C8A4312A3C792FB96AD2F573D5AB3B190
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  AugustusCrack/msvcp140_1.dll
- Size 24KB
- SHA256 768e0829decea713afb35a7de07e276f051581c8ff2c17e1bae9b07dd1445dd0
- MD5 c060bb176a671f068362db2673a08c5e
- SHA1 1d6b4ae5e778f1daf3573d4817777a51c35cbac4
- SHA512 78a6c8f76d3ebd8db9c784d7775ec44647c4776fcb11d0b32ae2b3a6f2837c0b3be12f053ef6a25811a68da17d0eea83077521f496e238757f5539b445a58a7d
- SSDEEP 384:yXt9apR9PFQN2eWc75gWPCRtHRN7U+Hj+R9z/r:yXK79PFQEkkRt7Hji9zz
- TLSH
  T1E8B23AD6FB288847F9664430C1B6CE16BD39B3D59B21A29F53A1E74C0DA33C1A93472D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  AugustusCrack/vcruntime140.dll
- Size 96KB
- SHA256 c179d8914ba8e57b2f8f4d6c101c2c550c7c6712a7f0f9920a97db340f9d9574
- MD5 a4cf5c1f71c540c69371c861abe57726
- SHA1 f272b34182db8a78ffc71755b46a57a253fcd384
- SHA512 f2b53f28a6369f76b22e99fddfb86730f3d33e87c68dae7aa3d05808223693bb86ade263cccb99d5462cf98eeeaa6a6f1cfe5ea3aa1739f8ad6eb624caff1045
- SSDEEP 1536:y/XLjIqMoYdgwdpollAvhkCrlgnpdD+9H9YOecbKVCt/mz4:y/7mylIhkoQpdK9H9YOecbKV6mc
- TLSH
  T1CBA36A4A766442BBD06BD278C1E34A5AF771B840873093CF03B6866A5F63BE05E3D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  AugustusCrack/vcruntime140_1.dll
- Size 37KB
- SHA256 7cf38d20d00b6640d510eab70171e1c6f8fa2e42040832e17c7433ab61d94a8e
- MD5 9f4eac207cb58e8d110477e7fd19d565
- SHA1 687051b863f7a7178cabf9c06ab3b534b1e23dd3
- SHA512 9c5c4499adfc7b61751510f52a1288ff386dd1c1aaf8e8a9660990194813394329f8123f38e026ea10c6e30b4a5506625b9060329d524db68e48f36ab2691a05
- SSDEEP 384:5LnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfpYuncS74GlWrhKWXvsHRp:uCm5yhUcwrHY/ntTxT6ovF7IbwEll9z2
- TLSH
  T15403498463788086E06F85B4C4E36F27FE39F9615750968F0BA4865D2F637D0E63D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  AugustusCrack/vk_swiftshader.dll
- Size 7.8MB
- SHA256 7c69a635e448c52dc025252c912ad46ee237932fc88adb4c653f3a12a4ced6a7
- MD5 1d52735d8ba9280008a23277f51cb105
- SHA1 db11c55ba0f9351d55bf978c6a97f39f9177fda2
- SHA512 d4efaaec4db7323b3f6fe7c16269a13ee9f9fe0359da5c3c19a2e83a7ce61a7521b7ce99331bcd00e8b375db3c4f655450dec416800f01bbdf456d35ca537de7
- SSDEEP 49152:fh2Ye+Df8PH7Egi9Fs1Qfy/oVxMK4527fcwwgfGkDgOQvl4n7/VmtSq9jXgmPesf:Z2YeEMg7fg3tSqVPGvq6EnMZ0BVZw
- TLSH
  T18C860A03E2AA90DEF005DA34971FE123E175B88D663836B75B6129113BF7B906B3B744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  AugustusCrack/vulkan-1.dll
- Size 913KB
- SHA256 1869dafabe98087cdaec379af3f76a19922b2c6f9352a560ec4e26bfd9aaba48
- MD5 5ded26e58d0efc5411a9a61aab94a002
- SHA1 d0e46c317ad131ecf018d86f9bd8a674eb448405
- SHA512 6cd92f77b2319de27abf643cec73068f84f8cc2083aafb974c21ce57b8288b121e61df3a891a6f790d39d046d11ac116fb1789ced833e083f290f9b6301b7342
- SSDEEP 24576:mu96VaqMvs2yJhEwFtVtg0A4im0zAf6k7g3E5RW62:V0usFJhE8Gb4im0zAf6k7g3E5RW62
- TLSH
  T1FB158C2396944559D979D034CCD28703EAB574862321B9CF02A827087FABFF43B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  AugustusCrack/widevinecdm.dll
- Size 18.3MB
- SHA256 eb98fa2cfe142976b33fc3e15cf38a391f079e01cf61a82577b15107a98dea02
- MD5 9d76604a452d6fdad3cdad64dbdd68a1
- SHA1 dc7e98ad3cf8d7be84f6b3074158b7196356675b
- SHA512 edd0c26c0b1323344eb89f315876e9deb460817fc7c52faedadad34732797dad0d73906f63f832e7c877a37db4b2907c071748edfad81ea4009685385e9e9137
- SSDEEP 393216:FPRzXYeXFyjsrZuvpYl5SJIhw7PJeP9TZHZMaMq0Vrq8P:DFyjs0pYl1hwDJeVT7erq8P
- TLSH
  T1D817E04AE26310A4E85EDCF4827AD972D0743C4E0376A7EF16D876356E727C06B29F09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27