1c6abf57b91409becdd64cf7e95b60659b379ca943aaffa81830b9336ce4373f

Sharing

Copy URL Twitter E-mail

General

Target
BubbleUPnPServer-installer-user.exe
Size 2.1MB
Sample260724-g1symstdlh
SHA256 1c6abf57b91409becdd64cf7e95b60659b379ca943aaffa81830b9336ce4373f
MD5 5a782e8bc273ab1935d0f557b08ddb9d
SHA1 69f5715a285039a052878a92dd228a3ae60aabf7
SHA512 52852c4cb533902262747f9f59a148ae172a21297fd11cf40a2f92ba4948f3774e2913b9de199c36956b53eaac3af01ebfb151e67a83ce288c339c7bc5ae2d8e
SSDEEP 49152:wwhogrxKrdT/Dt4WEpox/E2HHEMEkOg+LOQVX4GG:nhog9KNt4NoJp9bF3YXA
TLSH
T160A533B2B2E10B7AC3DECE7D4941D26A8D94199C400513070BAE7CB75DBEB4BB88D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  BubbleUPnPServer-installer-user.exe
- Size 2.1MB
- SHA256 1c6abf57b91409becdd64cf7e95b60659b379ca943aaffa81830b9336ce4373f
- MD5 5a782e8bc273ab1935d0f557b08ddb9d
- SHA1 69f5715a285039a052878a92dd228a3ae60aabf7
- SHA512 52852c4cb533902262747f9f59a148ae172a21297fd11cf40a2f92ba4948f3774e2913b9de199c36956b53eaac3af01ebfb151e67a83ce288c339c7bc5ae2d8e
- SSDEEP 49152:wwhogrxKrdT/Dt4WEpox/E2HHEMEkOg+LOQVX4GG:nhog9KNt4NoJp9bF3YXA
- TLSH
  T160A533B2B2E10B7AC3DECE7D4941D26A8D94199C400513070BAE7CB75DBEB4BB88D758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- MD5 d753362649aecd60ff434adf171a4e7f
- SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
- TLSH
  T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- TLSH
  T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
- MD5 428c3a07fba184367a5085e46e4a790b
- SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
- SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
- SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
- TLSH
  T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsisunz.dll
- Size 40KB
- SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
- MD5 5f13dbc378792f23e598079fc1e4422b
- SHA1 5813c05802f15930aa860b8363af2b58426c8adf
- SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
- SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
- TLSH
  T188038EA392C146FBC5F8843931DA6E1D6A9EFC301BC16103CB2DBDA52D153967A642CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $TEMP/wget.exe
- Size 4.2MB
- SHA256 1908c52cc8b3f573c719451874b0cce62c89d965d733f403fc0e8f67480434fd
- MD5 f8247397ae65792524d949c825969391
- SHA1 18a870960334be784abd9e3aab9329040b49fbea
- SHA512 8b15bf18410afd05fb96f5b3bdb5ec8cc9852cced051e39568d5ed268ff65766bfb8ce01dc03a1bf0027a9b0c104dfd3c259a9e51f82c8667b9dea828aa936a0
- SSDEEP 98304:DcKXMEGWw52DblQteLTTzQs6MGsdgOYrqX4SP+J4jTnSPCPv1EDaZgHlHuj2Dtg6:gmMEGWw52D+teLTTzQs6MGsdgOYrqX4p
- TLSH
  T1F3264884EACB80F6EE1B08B19487F37F0B316E12D870CDA7EA847909F973A51951935D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 70KB
- SHA256 30e633d2913d4f3a8f3afb0beddb38cc9d7aaea02b9d91d72f9cd9e28ffb9505
- MD5 13bd84999d2f967a6638e6ba800467ad
- SHA1 e86d2db9edce31162b377244065963d4606fe5e3
- SHA512 9af94e07a646aece244af0fb6e359b9d7e392258aa03e2cd4800c6da01dc7e616d1baa48c15774e2fe8491ce22c3fc3f5cb2432f4f0e5a8b64289c3124ad3a01
- SSDEEP 1536:MKJAES3bS2L6KbuVfmMk0DCwcjgdLeAyNLcHRIB6c8CkC5w8TKw76:vJ2S2L6KbqDCwcjceAZio2kCfWu6
- TLSH
  T19C63CF0777C188F7D5E646B00EBBABBAFB77D50042119B438B945F7F292024B9E19253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery installer persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral13 behavioral14
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- MD5 d753362649aecd60ff434adf171a4e7f
- SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
- TLSH
  T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- TLSH
  T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18