Overview

overview

10

Static

static

3

Portmaster...up.exe

windows11-21h2-x64

10

$APPDATA/P...e.dsdl

windows11-21h2-x64

3

$APPDATA/P...4.mmdb

windows11-21h2-x64

3

$APPDATA/P...6.mmdb

windows11-21h2-x64

3

$APPDATA/P...ex.dsd

windows11-21h2-x64

3

$APPDATA/P...x.json

windows11-21h2-x64

3

$APPDATA/P...e.dsdl

windows11-21h2-x64

3

$APPDATA/P...l.yaml

windows11-21h2-x64

3

$APPDATA/P...s.yaml

windows11-21h2-x64

3

$APPDATA/P...s.yaml

windows11-21h2-x64

3

$APPDATA/P...t.dsdl

windows11-21h2-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...SC.dll

windows11-21h2-x64

3

$PLUGINSDI...nu.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...rd.bmp

windows11-21h2-x64

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

WebView2Loader.dll

windows11-21h2-x64

1

assets.zip

windows11-21h2-x64

1

img/spn-fe...ns.png

windows11-21h2-x64

img/spn-fe...cy.png

windows11-21h2-x64

img/spn-fe...pp.png

windows11-21h2-x64

img/spn-login.png

windows11-21h2-x64

img/windows.svg

windows11-21h2-x64

8

world-50m.json

windows11-21h2-x64

3

portmaster-core.dll

windows11-21h2-x64

1

portmaster-core.exe

windows11-21h2-x64

1

portmaster-kext.sys

windows11-21h2-x64

3

portmaster.exe

windows11-21h2-x64

6

portmaster.zip

windows11-21h2-x64

1

uninstall.exe.nsis

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Portmaster_2.2.1_x64-setup.exe
  • Size 96.8MB
  • Sample260724-b7kyqa1dkh
  • SHA256 721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywaretrojan

Malware Config

Targets

    • Target
      Portmaster_2.2.1_x64-setup.exe
    • Size 96.8MB
    • SHA256 721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionpersistencespywaretrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds Run key to start application

      persistence

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Drops file in System32 directory

    behavioral1
    • Target
      $APPDATA/Portmaster/intel/base.dsdl
    • Size 14.7MB
    • SHA256 6c770483743f20c49ec7c57bdaae78b0cc30c9496c8a10a4f8675c5baeaa4498
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral2
    • Target
      $APPDATA/Portmaster/intel/geoipv4.mmdb
    • Size 52.0MB
    • SHA256 7696735fbe3e21e5fc3e955099e4131f1d8a47d08019e48db4e04c46ac71c9b8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral3
    • Target
      $APPDATA/Portmaster/intel/geoipv6.mmdb
    • Size 51.2MB
    • SHA256 12eec14f13545e5cc3a4217f7d1cba026ebe76aaffb43d9a95dd8916dc54fe3c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral4
    • Target
      $APPDATA/Portmaster/intel/index.dsd
    • Size 4KB
    • SHA256 026325cc7af459251fb08dce0a6166aeece4c9b5a4b7d26e15f4f7d94e0e6e0e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5
    • Target
      $APPDATA/Portmaster/intel/index.json
    • Size 2KB
    • SHA256 4d9e21ccd810b34903f86ae1f3daf07619c34f5665fea46be17ad3e077979499
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral6
    • Target
      $APPDATA/Portmaster/intel/intermediate.dsdl
    • Size 17.2MB
    • SHA256 8be0df9689d4f1ee809fc633179485d5673e1126fe1fb9e0bfe296f2fb9f672c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral7
    • Target
      $APPDATA/Portmaster/intel/main-intel.yaml
    • Size 14KB
    • SHA256 c73be8f0600af4500f5d3e6f8e354f5d96dba2ce37d59aa976306a8ea9e5bc6d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral8
    • Target
      $APPDATA/Portmaster/intel/news.yaml
    • Size 972B
    • SHA256 fa64e8d0f2adc61093df516d4be68ad536c4de29fd9f7c2473311dbdaaa1f9c6
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral9
    • Target
      $APPDATA/Portmaster/intel/notifications.yaml
    • Size 6KB
    • SHA256 8168f64860717712a9d0a00da876e84f03c34834b3a8e0e1dfa783a9c29f7235
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10
    • Target
      $APPDATA/Portmaster/intel/urgent.dsdl
    • Size 2.7MB
    • SHA256 10d70c5ae83c6554a169f97380314ae0bc5c1bd51110a4cefa5ccd548a714c4b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral11
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 15KB
    • SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral12
    • Target
      $PLUGINSDIR/SimpleSC.dll
    • Size 1.1MB
    • SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13
    • Target
      $PLUGINSDIR/StartMenu.dll
    • Size 7KB
    • SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral14
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15
    • Target
      $PLUGINSDIR/modern-wizard.bmp
    • Size 25KB
    • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17
    • Target
      $PLUGINSDIR/nsis_tauri_utils.dll
    • Size 30KB
    • SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral18
    • Target
      WebView2Loader.dll
    • Size 162KB
    • SHA256 609c974a8cdd6a76a745b3d81b62f321d79f2dc8f4929e1eea8469d9d78baf79
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      assets.zip
    • Size 2.5MB
    • SHA256 fb61a09b7223ad9dfcfafab71a25afca42fb5bb36250e5518effc7bc1fd31550
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      img/spn-feature-carousel/bye-bye-vpns.png
    • Size 100KB
    • SHA256 11604c93165f547789f6dd6aaf815023ab249361e68a53e446e712f0e8e5980e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21
    • Target
      img/spn-feature-carousel/easily-control-your-privacy.png
    • Size 71KB
    • SHA256 28095d0e123e757ba6c2503635e395554945e6eada1becb0a384ea45a4ed6339
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22
    • Target
      img/spn-feature-carousel/multiple-identities-for-each-app.png
    • Size 48KB
    • SHA256 594ad2f73e31d5414b1f4d258cf09b22f588e7128fcd192187ea5ead6886e901
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23
    • Target
      img/spn-login.png
    • Size 86KB
    • SHA256 3e586f429944f075e7281c2e3a1ea5e07432c415e7edabf5c86c9547e6f781ac
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      img/windows.svg
    • Size 235B
    • SHA256 d0a0b38f557df25a3eb7f78b44957f7950c5840a12ee923d7dcd1f6bcd36e723
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    adwarediscoverypersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral25
    • Target
      world-50m.json
    • Size 525KB
    • SHA256 c8598aca2a616f5fcdda15a95c5ee2d7c2be4ecc30edf67943c79e5ae97ee6e5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral26
    • Target
      portmaster-core.dll
    • Size 23KB
    • SHA256 a0f7d615bdd58230e20fe66df6804fffc20a38bdae8b540780236f6b15dac580
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27
    • Target
      portmaster-core.exe
    • Size 41.7MB
    • SHA256 0b5aa3d7a4ab8b03126a3dc8346c39872164782d8b067f804a142290e3e6237c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28
    • Target
      portmaster-kext.sys
    • Size 283KB
    • SHA256 e07d172667bddc606c6a76079ed3e79281fa23ebbe68a9740ee71ea681b55d4d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral29
    • Target
      portmaster.exe
    • Size 32.9MB
    • SHA256 e27cddea106b682dea030fc07211c1fcdb68b38a97510efd109b89d585463dae
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverytrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral30
    • Target
      portmaster.zip
    • Size 1.9MB
    • SHA256 563a732e411f9e22b60fa8142fdc1657414bfef1838923051d3f7b2250643cd8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31
    • Target
      uninstall.exe.nsis
    • Size 321KB
    • SHA256 da7400594053c4d662ff4871f8afe8b368be4af62fd1a66902416cce90a1cb15
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryexecutionpersistencespywaretrojan
Score
10/10

behavioral2

execution
Score
3/10

behavioral3

execution
Score
3/10

behavioral4

execution
Score
3/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

Score
1/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral26

execution
Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

execution
Score
3/10

behavioral30

defense_evasiondiscoverytrojan
Score
6/10

behavioral31

Score
1/10

behavioral32

execution
Score
3/10