8688aae5eb0d65b5f0d261c647b21bfac98d3e8e7a120dbfed7f91955b891756

Sharing

Copy URL Twitter E-mail

General

Target
Paragon Tweaking Utility-4.1.8-amd64-installer.exe
Size 32.1MB
Sample260724-ferysagl3v
SHA256 8688aae5eb0d65b5f0d261c647b21bfac98d3e8e7a120dbfed7f91955b891756
MD5 3bd14a38f263f8f47d0fffae76104d9a
SHA1 ed12a46625c9f614e4894678bdb71416522794e9
SHA512 59ae46e73ae223a6044d797f0d4282b42aa1b4457bb52af62546250cabe75db71d44369c7a0b056068b9e0bb76c2cb924909df384207d3032df5d5e6a102b03c
SSDEEP 786432:9PinM47SoeF16XWFo3sDZSedzRYRv5uAAvcTzBNHB69Cza3:9Qmowur0Zr62A6cnH3za3
TLSH
T1A677334C93B18F58E28C1F715C92298E79B13594A564BF2D9C10353A27CBBA0FBB354E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Paragon Tweaking Utility-4.1.8-amd64-installer.exe
- Size 32.1MB
- SHA256 8688aae5eb0d65b5f0d261c647b21bfac98d3e8e7a120dbfed7f91955b891756
- MD5 3bd14a38f263f8f47d0fffae76104d9a
- SHA1 ed12a46625c9f614e4894678bdb71416522794e9
- SHA512 59ae46e73ae223a6044d797f0d4282b42aa1b4457bb52af62546250cabe75db71d44369c7a0b056068b9e0bb76c2cb924909df384207d3032df5d5e6a102b03c
- SSDEEP 786432:9PinM47SoeF16XWFo3sDZSedzRYRv5uAAvcTzBNHB69Cza3:9Qmowur0Zr62A6cnH3za3
- TLSH
  T1A677334C93B18F58E28C1F715C92298E79B13594A564BF2D9C10353A27CBBA0FBB354E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- TLSH
  T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral4
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  $PLUGINSDIR/pawnio/PawnIO_setup.exe
- Size 3.1MB
- SHA256 a3a46226c5e2824f4cdd42be0eecbabfc672c86f7889710f5ab1e6ad385b47a0
- MD5 9e1a77fd232800d2e5479cd04708fda1
- SHA1 3720a97ad396dd340381be51b4b276749c0f4551
- SHA512 21ac94df4e384cb5f15ec14fbe54d4c359d380d87ef63d566db8b118dffef0f92c31c652fbb6efdc7262989ca8fbbad5fef1ffbbe0e397eb25a015262d16f11d
- SSDEEP 49152:9oTI40WXBdJe9damQqtNgbxHed/GpuH9vd4PmdNV5QDM6K2ZM4YN:WcAMd7QmNUHepGw9vdKml5AM6K23YN
- TLSH
  T177E5113295F07088EC96CBF1D1492DA36DED7C498BE17DEBD793A72829636D09630306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7
- Target
  Paragon Tweaking Utility.exe
- Size 47.9MB
- SHA256 35a06290f29e6ae04d62031c9c984c8587c08ea0db26bc5ed222f364a58a30a7
- MD5 57e5fc36e9dafe95511953df51a81566
- SHA1 1a7eb1a7fbca3ecb139431252c598a4877c060f2
- SHA512 5ce90caa4ad36d04564a13c7a658da4189afcb6dd619d30970877dcbfc8121136bab2a39dd9fcb26586a98e3c544d88b2722bfcaec6c2fbaaec5b3667adb3b32
- SSDEEP 393216:wLqNUUZIJNiBmEp6hMU94fdWykz146Mb5vrfwR4NaaW2qx/W:wLqFBmEp6hbsdWyOkmRea5e
- TLSH
  T1C7B7BE17F6A920E9C1AEC130C8775512FB71BC49172063DB6A68EA683F73BD05E7A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
behavioral8
- Target
  appicon.ico
- Size 93KB
- SHA256 db1468e9a2c0b58f6e523fa764b6b0fc650a23c883c36c6ef89f781aab94097c
- MD5 692a486cf8332d31659ca732ef08ed26
- SHA1 e632eac8cc70f9957e7824a2dc2568b9d9318169
- SHA512 c4f7c0e4a54b79bbea0d0505083d53c10a5eedcdd0ad7b7b98d9b0d683781e4d2d5835c7ffd64f98e8e2f07c466285d813fd471c4235ad4e745cf55c1afeafc5
- SSDEEP 1536:H3czb516eJgdYUGijZI1WFkZi8+HaTt9RtlzjG+jlOQETcH7GIN7QMBQojk5inRM:SydYajXeN6+tdlYXY6IN7QWnRbGYRyS+
- TLSH
  T1819312DBF3B24140B6198D81C1E310D06FB036D7F59C9A99C32A27BBFD79A73A095248
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  ptu_core.dll
- Size 421KB
- SHA256 5899f37aab97c060c539b5198999134c890563bed4aebba3b9b888ccafc741f8
- MD5 efd8923c935534e86e3a2b25b0d293c2
- SHA1 131697bd1be850d0ad4bab6f588b038aa952d03c
- SHA512 a571bf25dfdf7643af36496815e9516d925d32ecd6c8455d4b85a706dd12773184bba31721b1a2ff850ad2327da82d383b82bb6b102f38ef6d6af3aafeceea69
- SSDEEP 6144:sIUMuEjTscExkW+r7ipxa9ydYsrKK8jGBM3Fas3IOQfKNIVI:H1Qc9upsMxKMMVasYsIVI
- TLSH
  T158946D17FA9164B8E56BC07887178122FA7674854B21EEFF47A482313E62FE06B7C705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  updater/updater.exe
- Size 6.0MB
- SHA256 71c959123c9693a15bd04a9c5f86b389a547cfb8e57322ff45b5d7d8dfc688cb
- MD5 83b64d2a24be01848c12da1d07ecee77
- SHA1 41d61831d38f81e439de21252ae8ed58695e186e
- SHA512 74280ed97ec1a61c1325e6fbee72cc64bae5d26b00900c9df969a4f20b6b228a8167d0fe307705f7e0402ddcf730ac0fde5662bbd7bcba2e9ea705e832df1527
- SSDEEP 49152:w8iY+06EERtPzOGrey2ryJ+njAogUgrEKk+7AXJrd1e5+tFcTtxwCjKbK1K6SC4r:w8WLFu+k5rGuFOjqE0cA
- TLSH
  T11A564907FC9914E9C1AE913189729253BF717C885B2123D76BA0F6382F76BD0ADB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral11