5221f2a8895a97ec935caf369ed6846a1e1f7c32a4204c81a8f21c711d79e9b4

Sharing

Copy URL Twitter E-mail

General

Target
Active_Partition_&_File_Recovery_Ultimate_26.0.3.rar
Size 38.8MB
Sample260730-cm9xsabm71
SHA256 5221f2a8895a97ec935caf369ed6846a1e1f7c32a4204c81a8f21c711d79e9b4
MD5 19cdd22f1061f08482689362786b5cce
SHA1 33faecc400239ad996b0b062b3633b8faa746b7a
SHA512 a616cc24f3e2a96e54dd945344cee05c31c6c29bb46a656709340b487a59b5715ad3651a984bac13da520e99fabb26e26441e2dc1dd344867e30b9fbb80533d0
SSDEEP 786432:MHae34WbngMg51UWwYWFQzIlO9zn+SDeCSwygTyJ3m2hfs3C:MHnVbgMg51UWw+SgzbhM35Fs3C
TLSH
T1119733B019EEB5ACA154EF718333F71C4119F444E5BF682B5821EC66FEE2650122E6BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/DiskEditor.exe
- Size 13.5MB
- SHA256 1f330bdb5d0a511483c2c14c5db62e1c372c6315b1b78248da60dc2414e7d6b7
- MD5 8d00ba68b533610e0fd11ad25fcaec90
- SHA1 ddc31e4f55ad398206dbdb6e2fdd5d98be74e35e
- SHA512 f3a05fc34bfcc331dea4b56be17b5d33cc6d7764414a8183010c496b398125c54ad4dd55f04084d238dd688c245b8b02c992c969ca3b09a4557f714aa656f4bb
- SSDEEP 393216:WpS0th5xMAXGnXnMToMcbGNFHCVH6IyEfnXmdNB:C+QCM2nW9
- TLSH
  T111E6AE97F1414690D826C97DCD23DA62D2323C25FF2656DB3048BF2A2F372D25E39686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-core-rtlsupport-l1-1-0.dll
- Size 11KB
- SHA256 91508ab353b90b30ff2551020e9755d7ab0e860308f16c2f6417dfb2e9a75014
- MD5 9fa3fc24186d912b0694a572847d6d74
- SHA1 93184e00cbddacab7f2ad78447d0eac1b764114d
- SHA512 95ad31c9082f57ea57f5b4c605331fcad62735a1862afb01ef8a67fea4e450154c1ae0c411cf3ac5b9cd35741f8100409cc1910f69c1b2d807d252389812f594
- SSDEEP 192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
- TLSH
  T1B8422CD69BB85003F6933E7042A5EE937D3D67C72494816605A9F6AC1CD33C4EB10A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-core-string-l1-1-0.dll
- Size 11KB
- SHA256 f3a7a9c98ebe915b1b57c16e27fffd4ddf31a82f0f21c06fe292878e48f5883e
- MD5 c9cbad5632d4d42a1bc25ccfa8833601
- SHA1 09f37353a89f1bfe49f7508559da2922b8efeb05
- SHA512 2412e0affdc6db069de7bd9666b7baa1cd76aa8d976c9649a4c2f1ffce27f8269c9b02da5fd486ec86b54231b1a5ebf6a1c72790815b7c253fee1f211086892f
- SSDEEP 192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
- TLSH
  T1C1323C925AB89007FAE75DB05399E9977E3CA7C72920C1A90554F59C2CD33C1EF00B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-core-synch-l1-1-0.dll
- Size 13KB
- SHA256 d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045
- MD5 4ccde2d1681217e282996e27f3d9ed2e
- SHA1 8eda134b0294ed35e4bbac4911da620301a3f34d
- SHA512 93fe6ae9a947ac88cc5ed78996e555700340e110d12b2651f11956db7cee66322c269717d31fccb31744f4c572a455b156b368f08b70eda9effec6de01dbab23
- SSDEEP 384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
- TLSH
  T127522A52E2E4F547F99BED7042DAC553AD3857C70920C0661695E6AD3CE33C0EB1462E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-core-synch-l1-2-0.dll
- Size 11KB
- SHA256 72c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a
- MD5 e86cfc5e1147c25972a5eefed7be989f
- SHA1 0075091c0b1f2809393c5b8b5921586bdd389b29
- SHA512 ea58a8d5aa587b7f5bde74b4d394921902412617100ed161a7e0bef6b3c91c5dae657065ea7805a152dd76992997017e070f5415ef120812b0d61a401aa8c110
- SSDEEP 192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
- TLSH
  T1BB424BD3DBA89143F597EDB042D5E5937D3D57C62A20805515AAF16D2CE33C2E700E2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-core-sysinfo-l1-1-0.dll
- Size 12KB
- SHA256 76d8e4ed946deefeefa0d0012c276f0b61f3d1c84af00533f4931546cbb2f99e
- MD5 206adcb409a1c9a026f7afdfc2933202
- SHA1 bb67e1232a536a4d1ae63370bd1a9b5431335e77
- SHA512 727aa0c4cd1a0b7e2affdced5da3a0e898e9bae3c731ff804406ad13864cee2b27e5baac653bab9a0d2d961489915d4fcad18557d4383ecb0a066902276955a7
- SSDEEP 192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
- TLSH
  T14D420793DAB8A103F55B6E7052D9E6833D3897C66425C01D069AF3AD6CA33C9D710A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-core-timezone-l1-1-0.dll
- Size 11KB
- SHA256 b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34
- MD5 91a2ae3c4eb79cf748e15a58108409ad
- SHA1 d402b9df99723ea26a141bfc640d78eaf0b0111b
- SHA512 8527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed
- SSDEEP 192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
- TLSH
  T13342F7D2CBA89403FDDB6F7007E9E5937D3C67DB1820816A15DAE1A92CD7385DB00A2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-core-util-l1-1-0.dll
- Size 11KB
- SHA256 f28a8fe2cd7e8e00b6d2ec273c16db6e6eea9b6b16f7f69887154b6228af981e
- MD5 1e4c4c8e643de249401e954488744997
- SHA1 db1c4c0fc907100f204b21474e8cd2db0135bc61
- SHA512 ef8411fd321c0e363c2e5742312cc566e616d4b0a65eff4fb6f1b22fdbea3410e1d75b99e889939ff70ad4629c84cedc88f6794896428c5f0355143443fdc3a3
- SSDEEP 192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
- TLSH
  T18F3219D3DBB8D443F9976E704294DA937C3DA7C62950919915A9F2A82CD33C1EB00F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-conio-l1-1-0.dll
- Size 12KB
- SHA256 e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf
- MD5 fa770bcd70208a479bde8086d02c22da
- SHA1 28ee5f3ce3732a55ca60aee781212f117c6f3b26
- SHA512 f8d81e350cebdba5afb579a072bad7986691e9f3d4c9febca8756b807301782ee6eb5ba16b045cfa29b6e4f4696e0554c718d36d4e64431f46d1e4b1f42dc2b8
- SSDEEP 192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
- TLSH
  T176421783AAFC9943E5435B70A2F5DBD3BE3927C225506069455AF1683CC33D6BB01A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-convert-l1-1-0.dll
- Size 15KB
- SHA256 5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639
- MD5 4ec4790281017e616af632da1dc624e1
- SHA1 342b15c5d3e34ab4ac0b9904b95d0d5b074447b7
- SHA512 80c4e20d37eff29c7577b2d0ed67539a9c2c228edb48ab05d72648a6ed38f5ff537715c130342beb0e3ef16eb11179b9b484303354a026bda3a86d5414d24e69
- SSDEEP 192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
- TLSH
  T1F562C64366E43E26EA9F177221FE97E36A391786155143B4C207D19C38837C2BE97C1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-environment-l1-1-0.dll
- Size 11KB
- SHA256 b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607
- MD5 7a859e91fdcf78a584ac93aa85371bc9
- SHA1 1fa9d9cad7cc26808e697373c1f5f32aaf59d6b7
- SHA512 a368f21eca765afca86e03d59cf953500770f4a5bff8b86b2ac53f1b5174c627e061ce9a1f781dc56506774e0d0b09725e9698d4dc2d3a59e93da7ef3d900887
- SSDEEP 192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
- TLSH
  T1EA421B828FB89443FA976E7082B4EA937D3967D639108139066AF15C2CD33C1FB11A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-filesystem-l1-1-0.dll
- Size 13KB
- SHA256 7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86
- MD5 972544ade7e32bfdeb28b39bc734cdee
- SHA1 87816f4afabbdec0ec2cfeb417748398505c5aa9
- SHA512 5e1131b405e0c7a255b1c51073aff99e2d5c0d28fd3e55cabc04d463758a575a954008ea1ba5b4e2b345b49af448b93ad21dfc4a01573b3cb6e7256d9ecceef1
- SSDEEP 192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
- TLSH
  T1C352F78387E8AD13EAA71F7112FDD7D73F3D5A8614538262800AE16839D33C07F16999
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-heap-l1-1-0.dll
- Size 12KB
- SHA256 f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f
- MD5 8906279245f7385b189a6b0b67df2d7c
- SHA1 fcf03d9043a2daafe8e28dee0b130513677227e4
- SHA512 67cac89ae58cc715976107f3bdf279b1e78945afd07e6f657e076d78e92ee1a98e3e7b8feae295af5ce35e00c804f3f53a890895badb1eed32377d85c21672b9
- SSDEEP 192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
- TLSH
  T1BA421A939ABC5943F9937FB061E4E7C77D3A67C27950816A4157F1A82C833C0BB11A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-locale-l1-1-0.dll
- Size 11KB
- SHA256 2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e
- MD5 dd8176e132eedea3322443046ac35ca2
- SHA1 d13587c7cc52b2c6fbcaa548c8ed2c771a260769
- SHA512 77cb8c44c8cc8dd29997fba4424407579ac91176482db3cf7bc37e1f9f6aa4c4f5ba14862d2f3a9c05d1fdd7ca5a043b5f566bd0e9a9e1ed837da9c11803b253
- SSDEEP 192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
- TLSH
  T1C0422B838AFC5443F5D36EB056B8EB8B7E3D67C3291581590156F5A82C833CCAF41A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-math-l1-1-0.dll
- Size 20KB
- SHA256 a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0
- MD5 a6a3d6d11d623e16866f38185853facd
- SHA1 fbeadd1e9016908ecce5753de1d435d6fcf3d0b5
- SHA512 abbf32ceb35e5ec6c1562f9f3b2652b96b7dbd97bfc08d918f987c0ec0503e8390dd697476b2a2389f0172cd8cf16029fd2ec5f32a9ba3688bf2ebeefb081b2c
- SSDEEP 384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
- TLSH
  T17E92C5474ADCFF67D18F17B701F08BCE6A381AA664D6B1B5C81B91C834A27C07E83959
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-multibyte-l1-1-0.dll
- Size 19KB
- SHA256 7101b3dff525ea47b7a40dd96544c944ae400447df7a6acd07363b6d7968b889
- MD5 b5c8af5badcdefd8812af4f63364fe2b
- SHA1 750678935010a83e2d83769445f0d249e4568a8d
- SHA512 a2a8d08d658f5ed368f9fb556bfb13b897f31e9540bfdfff6567826614d6c5f0d64bd08fec66c63e74d852ab6b083294e187507e83f2bc284dfb7ca5c86ae047
- SSDEEP 384:8A/kPLPmIHJI6/CpG3t2G3t4odXLRWthW/N5GlGswz3:3/kjPmIHJI6manp3
- TLSH
  T11592106B8EA82E11D18FD7F3B5F6C7C62A354F8104C07375E26B95483846EE9BD42E14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-private-l1-1-0.dll
- Size 62KB
- SHA256 785c49fd9f99c6eb636d78887aa186233e9304921dd835dee8f72e2609ff65c4
- MD5 d76e7aaecb3d1ca9948c31bdae52eb9d
- SHA1 142a2bb0084faa2a25d0028846921545f09d9ae9
- SHA512 52da403286659cf201c72fa0ab3c506ade86c7e2fef679f35876a5cec4aee97afbc5bb13a259c51efb8706f6ae7f5a6a3800176b89f424b6a4e9f3d5b8289620
- SSDEEP 1536:2PMeDe5c4bFe2JyhcvxXWpD7d3334BkZn+Ppzh:2DDe5c4bFe2JyhcvxXWpD7d3334BkZnU
- TLSH
  T1C15307DB49E63F21E18FF3B76BFB13C90B253A4418806274EAC7556B34853A9BC53A41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-process-l1-1-0.dll
- Size 12KB
- SHA256 3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65
- MD5 074b81a625fb68159431bb556d28fab5
- SHA1 20f8ead66d548cfa861bc366bb1250ced165be24
- SHA512 36388c3effa0d94cf626decaa1da427801cc5607a2106abdadf92252c6f6fd2ce5bf0802f5d0a4245a1ffdb4481464c99d60510cf95e83ebaf17bd3d6acbc3dc
- SSDEEP 192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
- TLSH
  T14342F987CBF81557E6A31F3041F9DB83BF3B97D75810916A8866F09D3883391AB2192D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-runtime-l1-1-0.dll
- Size 15KB
- SHA256 d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198
- MD5 f1a23c251fcbb7041496352ec9bcffbe
- SHA1 be4a00642ec82465bc7b3d0cc07d4e8df72094e8
- SHA512 31f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9
- SSDEEP 192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
- TLSH
  T14072E6438AF87F17E6872B3316F9DBC75E36638626108179C867F09838C3781BD5661A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-stdio-l1-1-0.dll
- Size 17KB
- SHA256 f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb
- MD5 55b2eb7f17f82b2096e94bca9d2db901
- SHA1 44d85f1b1134ee7a609165e9c142188c0f0b17e0
- SHA512 0cf0770f5965a83f546253decfa967d8f85c340b5f6ea220d3caa14245f3cdb37c53bf8d3da6c35297b22a3fa88e7621202634f6b3649d7d9c166a221d3456a5
- SSDEEP 192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
- TLSH
  T14B82B48395EC7F02E28787732AFAFBDB5B35578228047178C503E99839C63997E0355A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-string-l1-1-0.dll
- Size 17KB
- SHA256 1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6
- MD5 9b79965f06fd756a5efde11e8d373108
- SHA1 3b9de8bf6b912f19f7742ad34a875cbe2b5ffa50
- SHA512 7d4155c00d65c3554e90575178a80d20dc7c80d543c4b5c4c3f508f0811482515638fe513e291b82f958b4d7a63c9876be4e368557b07ff062961197ed4286fb
- SSDEEP 384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
- TLSH
  T1E782A44346F83F02DACF57B359FACBC31A384F8621415275C467A59C38827A6BE6B90D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-time-l1-1-0.dll
- Size 13KB
- SHA256 b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0
- MD5 1d48a3189a55b632798f0e859628b0fb
- SHA1 61569a8e4f37adc353986d83efc90dc043cdc673
- SHA512 47f329102b703bfbb1ebaeb5203d1c8404a0c912019193c93d150a95bb0c5ba8dc101ac56d3283285f9f91239fc64a66a5357afe428a919b0be7194bada1f64f
- SSDEEP 192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
- TLSH
  T16A52F98386E4AA0BFAC71B7112FDD7D77B3953C2298061768117D4A83A83384FE5396D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/api-ms-win-crt-utility-l1-1-0.dll
- Size 11KB
- SHA256 dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1
- MD5 dbc27d384679916ba76316fb5e972ea6
- SHA1 fb9f021f2220c852f6ff4ea94e8577368f0616a4
- SHA512 cc0d8c56749ccb9d007b6d3f5c4a8f1d4e368bb81446ebcd7cc7b40399bbd56d0acaba588ca172ecb7472a8cbddbd4c366ffa38094a832f6d7e343b813ba565e
- SSDEEP 192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
- TLSH
  T1914209978AA85943F6972F7052E4EBC3BD3D6BC2292182664156F19C3C837C1FF11A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/audio/qtaudio_windows.dll
- Size 62KB
- SHA256 25eae92da745d2998b3132aa4f4ab80233750e90a66cd9e35cda333c9e16f069
- MD5 4d0bcf2355c5e2b1bbf1ae370bfba37a
- SHA1 d54551633301c2815d5a679322f972fe4fcfebbc
- SHA512 e1f436959dc5b994f4573fc1e236c9fae7088d412baad91b95033d1e1838113127e9c649a7ee5e379a3389ab92ac67382766e3e92752aefa28423f107ab81df9
- SSDEEP 768:R74+PT+sBOim9X8lPk37U5Sif7YF+NCNbZIf6XLeHkyeq8rz6e5kOSJUyqxJCxSN:R8IT+f8ls37UhUOKeggqxUIr3b1
- TLSH
  T185536B9773664099E0A6C678D8974E4AE2B2F4E01752C7DF1376C7AE0F13BC066B8705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/bearer/qgenericbearer.dll
- Size 52KB
- SHA256 63846e9f27f4d24c34fe965dfc28d295df44f03651e918f8e59dd24b5ec271d2
- MD5 d518b296ca4828f85dda4730c00199e6
- SHA1 d8a9c90c27e82d6d4405761b8864d63ed2b5ccc1
- SHA512 f9249f62f94d45b54e83a8de2b5cf7d851705629274e0ef364b582b807d68f5302319519973354bec3373467f7ec98a1b8cae99ac70e19d020d1e3a3bd642331
- SSDEEP 768:qolXYbaMunyZQOpBxnMUgqHtVTJk9Au8bHmzK:xRXkQO6UgqNHcAu8bGG
- TLSH
  T13E33299A33179092D067C379C4A74E0AD2B6F2518B13DBDF5279836E2FA37D1297E204
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/bearer/qnativewifibearer.dll
- Size 50KB
- SHA256 83ba4a666a11caf9cf098cbb807cc2413c6de385d217928dfa5ed19e7baf16f1
- MD5 1383fa1a726e46a08765b7e17c614579
- SHA1 6032e8afe8ca2bd281d40f1e9ff186f085c717cf
- SHA512 b01b79ccc4c529cea7f57012ad7ad755a8b81c9270b1465e1544b802eab595be79a1d66291d6667daece39c33ba3b87f583ea59c14c26bcf212f1a1e93ed6912
- SSDEEP 768:Vwrd5XCSifH97j7SVoeExN6qqjjFgqJqYeuZjh/sS:VEjXO/973soqqqtgqJqYeuZjh/sS
- TLSH
  T1F133F89A73654192D03AC379C8A70B49E2B2F0128B63A7CF5339932E1F737D2697D245
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/imageformats/qjpeg.dll
- Size 397KB
- SHA256 65deb15ae574a0528db3545571d9030535125c0846d8e875b1b1ee61d3cd0cbb
- MD5 fe5a2c5cf35758d772a3a44f062e11a6
- SHA1 59a6678b67a27175f9a27ae06df6bc96afd86e8f
- SHA512 8a7f36e01e3dcbbcf0e5caf84acfc30570989473d43ff3fcc9de3e9017b0e6e5cde966800ec5288c078b520204159356645f08bba4d793e6aa93353f5f6db2c8
- SSDEEP 6144:0n//hKUG0LzVw9RWRYTy/eVvK7fFmCVtT5dYDO:0n470fGRyCvK79WO
- TLSH
  T112840843F621AC82D3D640BCCDA5D97693503C6D47F386FB3A94B2FA3D32AA07925244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/imageformats/qtiff.dll
- Size 370KB
- SHA256 fb03d5ed302d69a1e3479023299df17fbbaa4b077d9989a99781c9f18e928dc2
- MD5 41be91ad928b9ebc9ab1b58cba43a4b7
- SHA1 1043c2c3a785db372b1118e97f47bbab08747ab6
- SHA512 fff972ff4284751074ae3c5cf28d1e3b7d6fac848504f2a8b71885fc10fdd399b755499dee5e7cd90b65a805411be20fda0db027453eb842b0bfa6acfe87013e
- SSDEEP 6144:32lHqsWxUSANRcBttttttV1KNBYMLvcVWhL4lBzFMiCCLsNBFl:320sSUNFBYMLUVjz2v
- TLSH
  T1CB848205DED049ABD876813956E7C612F273B4893F02C78B9698B1353F427D025AB2FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/libwim-15.dll
- Size 472KB
- SHA256 6480b53d4ecd4423af9e100fe15e3d2c3d114eff33fba07977e46c1ab124342e
- MD5 9abce30396b5dfe99460283b727622d0
- SHA1 26fbca9b5e8454053407b6738d76575ab68ec286
- SHA512 5e06c346d5a8d78529065d7f7ef5a044ef467909452b644cef2600a57f57750957a2364eb413eef13a5a8cb78781e5e91f858e2ef9ab3c2b45e9c551085289b0
- SSDEEP 6144:bZ5UqTTYW7fZJdUm7HyGqBqEy2KZ77r3AbATggiqk6D:bZvLvdUm5pZpR
- TLSH
  T128A43B03E3F6116CF2B7D6305AB7567269337C655930EE6E1248C9792F33E508A28B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/msvcp140.dll
- Size 557KB
- SHA256 72fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e
- MD5 7db24201efea565d930b7ec3306f4308
- SHA1 880c8034b1655597d0eebe056719a6f79b60e03c
- SHA512 bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e
- SSDEEP 12288:Rsjw3shF+jss1I8CgEWTe5+YMCMGz2MMY5U489wiyaf+QEKZm+jWodEEVksLd:Rs/5U4RBaf+QEKZm+jWodEECsL
- TLSH
  T176C40927B74902A0E196A3B8A1C34306D7F17C4A8312A3C792FBD66D2F577D56B3B190
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/msvcp140_1.dll
- Size 24KB
- SHA256 7d52238ff5a7af6f4a5e229b1a7465a20fc17e2b401da5da9215a3073bf238c2
- MD5 9c1447bc98b6633b3e6964c5ba68483a
- SHA1 57743afcfd13ece2830b8f44af744bbd10de7263
- SHA512 a63fe4059ed519c3fd56ce012b08c8a7836a8563b738a19b2ea8a8fc7e48b4637a68d357cae754e0a3d4a3509968bcd67de69365925ec0f67209fe6e4e2555d6
- SSDEEP 384:Pu1vZLEtU/POoKFYdWcp5gWaSKLHRN71dEjR9z0gi:WpqtcPOj6XLA1dEF9z
- TLSH
  T11DB25B86FB188842EC6A4930C1ABDD06BD3DB7D19B2197CB1391EA1C0DA33C1E93572D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Active Partition & File Recovery Ultimate 26.0.3/App/Active Recovery/msvcp140_2.dll
- Size 182KB
- SHA256 ee22b3403268cbac3f280f1a49a7fa285c0d01da601f6914d6fe6aac43068efa
- MD5 27816fb67fb85a331aaac2929d7d9c53
- SHA1 8730fd669eeacad5325d3d4ba4e08e563fe7b504
- SHA512 e3d0c7b7c2c564df482034e075f967115ca87b7eb9675cc61d741d27f6058e42835041f058d7fbb18573ea21a1fb1ba6abf41de81194128157473c0dffd04b7e
- SSDEEP 3072:sYRRZqoOwZfxWsy0f8FM0YGal4cxFL24T7bMXm1cF9cr70z5ThmdrVZt:swfqoIuf8q0Y2QFLjbM2Tegdr
- TLSH
  T183044986B61D02BEC4A7B4788439311AF632381447B4C98F1BD34E3D4F1B7967EA3A65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Enumerates connected drives

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32