fb29551b76712d708b7ce4dd3c9e7d7aa0e4ea4673d621c0d42f13c29b576f39

Sharing

Copy URL Twitter E-mail

General

Target
WorldInstaller.zip
Size 111.1MB
Sample260724-dbzhcafm5x
SHA256 fb29551b76712d708b7ce4dd3c9e7d7aa0e4ea4673d621c0d42f13c29b576f39
MD5 52b5988a518cf40d0c77e112a96f3022
SHA1 ec5099571f92346a723f405376d34d607b779d1a
SHA512 00961795f64056b482ca7cba1632c51a69b9fdc22994fefe9e51507eef0f2390e553b5a544bebe9b5affaab7181a51506702eafd2e9d4549a013e8520d20fb15
SSDEEP 3145728:gvBLFa7Js6A+7Gl4oywN5kbrm0l1euQeUdK3a:gvBqe6A+U4o3N5ke0l1TUV
TLSH
T1B1483323F41CDF6CD4A520A083B6FC1D8369B87BD29525B3E98DAF5E13A754320B4DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WorldInstaller/Microsoft.Win32.dll
- Size 152KB
- SHA256 a97583c283e2cc54a036f6b3d5d41e3df5f5ea9d7a2a37b5e1b069acddeca38a
- MD5 088c1909f0c079edbeed22c6bf034248
- SHA1 c8e3d678b5f293ad431c4adb3b577290fc453ac7
- SHA512 0e6e9f4fc9799d181e946586a0ec1641443fa31ca716a1c4afaa3b5761955c3a84e0d84dac40f66ef125abec174e79c56c3d6c91b75e25cd84d968858bc5a39e
- SSDEEP 3072:/9TECWUUw1kLMoRQoaisl4mtKfQ8zP6a8U1Gp4q7EmhwB:WCWUUwgMmxai5y8zx8oG4GEm
- TLSH
  T188E32B15FA371FFBC60C993A3073050B90A8660DE23E763FB19D99452DE5EC21E989E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  WorldInstaller/Newtonsoft.Json.dll
- Size 704KB
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH
  T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  WorldInstaller/Prerequisites/NDP481-Web.exe
- Size 1.4MB
- SHA256 05e9ada305fd0013a6844e7657f06ed330887093e3df59c11cb528b86efa3fbf
- MD5 39304ce18d93eeeb6efa488387adaed8
- SHA1 22c974f3865cce3f0ec385dd9c0b291ca045bc2c
- SHA512 4cf7f831fc1316dd36ed562a9bd1fda8cca223d64d662f3da0ade5fddc04be48c2d40333ba3320ee2d6c900e54c4f7e4f503897793e86666eac7e242d8194f5b
- SSDEEP 24576:MGHL3siy9eKfSmtLvUDSRbm4Jah1rVxBtcSEe8g00XAIZiS8Klpxt/PueauCCk:RL3s7RqeTUDBzrVx4WqipxlPuHujk
- TLSH
  T1E265232236B1C073D4B316309AF5E7F1AE3AF62A13748547BF84672D1F22790657A709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3
- Target
  WorldInstaller/Prerequisites/VC_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH
  T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral4
- Target
  WorldInstaller/Prerequisites/python-3.13.7-amd64.exe
- Size 27.5MB
- SHA256 b12e2e82461ac8e51fc43289050bc8eb937a32d84ce4d242e2c88258c37cf2bb
- MD5 1da92e43c79f3d1539dd23a3c14bf3f0
- SHA1 8c5720c32f92b5b626b4467dba22da523a30ace6
- SHA512 36db028e9f3d6805a57e89320283c07bd5eb0bb15c6edcd2ae4a7e46b06bfe6c96ed0793e8936cbb09b4f6b680a3f06dace2220a1e7d8b74ab6047698871db9e
- SSDEEP 393216:I9lBSnGxdzPm+MZp4WkuaXZZRkMTp8obmpluY5gvWdN8qV5j9fh2s0dUAyj3MoGe:I9SMgp6TeUpUvTged+qV5Zfhm+pj3TdX
- TLSH
  T1D85733337464807BE2F015B17634E571BA6CEF296740D86AF3D8FC5A3AB904267B3186
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  WorldInstaller/Prerequisites/windowsdesktop-runtime-9.0.11-win-x64.exe
- Size 58.1MB
- SHA256 dda4def927873f64ee72daad84f37e1dc021e7f329c955e4d6deb39be981c990
- MD5 00e00fb5c2082a6547392c71a41839f6
- SHA1 2a39e354c7c3453a037febdd85993866460804d5
- SHA512 5c6dd5616f8365cc618087916bf9e0470f5fe61242010df040ce7a688acc0598797bce0a62d3915d8951dc70f89deb1e30223c1dc0918f05af92c88658f4b3ec
- SSDEEP 1572864:dIFm8U/hGsKPCHa+ZiHfBDCg6pqXGD0xEmBNQ1:cUJxKP6hiHlCg2M3+
- TLSH
  T13CD73336E520DA38F5F002B38B76E9385A357579439418B6DAC4BC1C2B72DC332F6A65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral6
- Target
  WorldInstaller/WorldInstaller.exe
- Size 210KB
- SHA256 01a5ccaaa68b2282d16d32a229084944d11f1282a70eee15d43c24bc7aa34b79
- MD5 376efa51682725e49e8c841238f7780c
- SHA1 fe9ad573457a17e40f97e4cebc46d714fce1d05e
- SHA512 e68da169d4515ee42271b93c686c241b444f99f202adbbf972c2f422918054aea810da8718d830cee5bd58ab1228c8d7d8e9169325743532b8dafcbba649f88c
- SSDEEP 6144:odH0JyaKwc54m7ioWQz0IIJ9StEKn0Y7thDiRLiRlHbyQ:yU9Kn4m7mQz0IIJ9StEKn0Y7thDiRLij
- TLSH
  T1EF24519D722072DFC857D476DEA82C68FA5074BB831F4203A42715EDAA4D89BDF140F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral7