877cdff9283c64034b372fc26e6235743981abb3c43164669703d509228ff0c3

Sharing

Copy URL Twitter E-mail

General

Target
Acesso Remoto SMP.exe.gzip.txt
Size 2.4MB
Sample260730-pnmj4axeqe
SHA256 877cdff9283c64034b372fc26e6235743981abb3c43164669703d509228ff0c3
MD5 8ee8c85e66dd3e63bbf0229731a0ca40
SHA1 758c3f9ddc52886256d3a10c031d9c1356441436
SHA512 147229d6a4dc1fc173a3354cae89e5f77961d5c17d41b592be17d43c6559887dccab6a8927a274c1982c54e85b731de44fed1cf40b91a48af0ab50de2c4b296e
SSDEEP 49152:vxNooyoLUoJqyL9gtXB2x157HnwdgrpWGRKtm71Rk89ejds:vryogoJq5B2r5UgrpWGItmRrH
TLSH
T114B53392D23DC83795162C2ADD74CA0D9F7CB8323C8E1AE49653B7BEBBB718A5501443
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Acesso Remoto SMP.exe.gzip.txt
- Size 2.5MB
- SHA256 ccb816456245296c904461f052e78ade8cba9c8a2472c0eff9f693a22d35087d
- MD5 883b4e5618c0de0576596be3bf1c037a
- SHA1 d612c0d801b9c2ad95cef2aeff2dbc1072b74dd5
- SHA512 da77ccb050bae169153de541b483e71e1428e0eaa966597da4ce5aaab9787c749e96dd7d91435d2d09c60bb65b852c72178c99380bc86f773b656862c91e91d8
- SSDEEP 49152:Baeo90OseLOsJgGt9wjX7GldNxbzWvKzVWmR6BK7ZHg8zUbQ:BaeMseysJgV7GTNUKzVWm8BKFfH
- TLSH
  T1F0C53342B554DE73E4230E3288B9C73ADF78BD722DC84B85AB827BBF7BB21415519112
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery installer persistence privilege_escalation spyware trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH
  T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/md5dll.dll
- Size 6KB
- SHA256 32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
- MD5 7059f133ea2316b9e7e39094a52a8c34
- SHA1 ee9f1487c8152d8c42fecf2efb8ed1db68395802
- SHA512 9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
- SSDEEP 96:5mArJv6F3TqDmgK4ghEin1US36eHQZDUDgGogZcko5Nt4AMP:5XJ63LhR6inZ6dsgZkKQT
- TLSH
  T1FDD10A66F7DC1B6BF1730B722BF903214936B9B19BB7D76D16901159AC612208C31F2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  SMPCSetup.exe
- Size 926KB
- SHA256 6549e8adbb4665fac84b4ef77b2f2e4b5120db2ddb2d26d8f9c0168bf7408ef6
- MD5 575ba324a96ab2b2bc8e85ecbceeab91
- SHA1 db6ca9dd9fc8a97fe48bc65ac687ef20a6c3181c
- SHA512 f8806edecf6afc57169f50394bd46baece81207f91dd4d09ef27fc2f2a3acd836292590fac58fd5ac8e6248a8b3ca27af4b1902591f8ce27bde89b82b90f3d97
- SSDEEP 24576:Anzd4MQuwcJwcBwcBwcWwcRwcrXBIDHp8T78Z:o1Qu5J5B5B5W5R5jGDJ8f6
- TLSH
  T148156CC277E8754AE1FF4FB4147301000DF5BF336AA1DBCD9992649D45B6680CA2BBA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation spyware trojan
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  loading.html
- Size 44B
- SHA256 3388da97dd4d38401c6eb562311ba0fbf9dd22ca6ea7d0cb177962b209bb392e
- MD5 b450032bc545154438743daecef0908e
- SHA1 78f63f5ee1e88db77fc2150534fce8f1f957e8b7
- SHA512 0e33aa9918cc8a777e6681c6520567aa74540e8cb5e933f7df88b79026078e69a159f4d174a0a2f2da52c8d5f44825b38578ff8329ac2dbf2888ae8ef6318ddf
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  sas.dll
- Size 14KB
- SHA256 c2904b2822b3c1b003a72f84d42ffbfdefd253f322c99b77cf8a950f37c716e6
- MD5 60c3820c4f56c77e3e8bece9d7a51842
- SHA1 b1bda7390cc5515718a23fb95dab44e7436cf24c
- SHA512 474ddfbd8524163396a9335b25acb577cd12e87e9bdfa5ed7f4aa54a7d1cea17d94d001772cb76376b4f921b96bf3341011e94ade97aca76be942363ed92a6da
- SSDEEP 192:mGq/KLYix0kmAEE8O5cTbOVT66o+5W/9wWMQQKPnEtTIXXYxjaIhjTG9x6Im:NTYiWXAjHGOVZP5W/9wWlLz4Z/j+6d
- TLSH
  T116623A86762C816AE8AF2E71616CF6B22D3CF3910BA1825F1467E1D82C763D15F3056D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  screenhooks.dll
- Size 67KB
- SHA256 c92512c7d0319fff8d773558e5a2ac77ebbd74452f03482ab3b68b782ad161ce
- MD5 362ba3b724eb94eef488f6865d1b54e6
- SHA1 17650a06446b06c20b3da6d056e214378dfb8f78
- SHA512 62b5bb21a5ddde14263b681ad94e623e3955dc4dfde87d384b81e6944067207647520a4d5893678cb792bcbeb4d2cd73003ad6bfdba4a3f88272c326c43f8d03
- SSDEEP 768:neZqWeHKKFCdvT2aXstUF478LoTciwPPYd22f39fiBiY10sZU+owORpNFw/NfLs:e4EyChXXFO8LrCrNfyXZU+ARp3wp4
- TLSH
  T194638D117A12C0B3C45E96305466D7619E7EBB002FE281C77F6A0BBE6F203D2673934A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  smpcinstaller.exe
- Size 325KB
- SHA256 505426b744252dcab87fa2e901936b9f4b21ac008d5389311e25f423471834a2
- MD5 b69864515ef9dbff074f3e4939efc5ea
- SHA1 8a9de7addb188bd659eaa5c2890d0cc4c0e45037
- SHA512 451af3fecea49d7b5a2cf8b8a2788359a7b58e22017316e3ac223200921574e773efef621a7e07e467ebab42cea52e186a8514dd3ad6cdd8ed994a3da1dee9e1
- SSDEEP 6144:LhR45gnwDWBhOenylyz0PezTyIGp+I2UMnj+:1N1senyKuUTBY2nny
- TLSH
  T10264D0527880EEF5EA234B3145BEE337E3B1BEA197D083473BC03B6F2AB25415569245
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 d0949b4c0640ee6a80db5a7f6d93fc631ed194de197d79bf080ec1752c6f1166
- MD5 c051c86f6fa84ac87efb0cf3961950a1
- SHA1 f18f4bb803099b80a3a013ecb03fea11cff0ac01
- SHA512 6e9de5d07aaed2ac297faa5049d567884d817ed94dece055d96913ac8e497ade6f0ff5c28bae7cc7d3ac41f8795efb9939e6d12061a3c446d5d2a3e2287d49d2
- TLSH
  T1E48151BB62A40CF3C0941BBB42D71CA71776DD702792412E98474E9A34C4A6FED6E705
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  uninstall.exe
- Size 244KB
- SHA256 19afbf4bfdb95ccb5c171b8f6a79e53836a3c0bcaee5ded47434bd87aa9dd4f4
- MD5 ebb0c0e9e303c225254abf0d49d12c2f
- SHA1 8a620e1cca1f52b89c86b20af55a12e87779298e
- SHA512 0921e8bbbc48bbd61ae8b8f7bf281a0ee11f8c89d545fb14043bee4bc36ba278872a41e4355ac2d3271aea840dda36d5bd3e914654e8c207abfd141b81af362a
- SSDEEP 3072:QNzPHk9MpcDkxj+woL8owqyRVwzBwKOAgWf/Mpr8WAZiPJST0xKj0j1:QhRh5gnwDWBhOen6YWMiPOkfj1
- TLSH
  T1A534BE527840EAE5E5238F3105AED337E762BFA196C0834B3BC13BAF3AB2151556E215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery installer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 61KB
- SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
- MD5 d63975ce28f801f236c4aca5af726961
- SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
- SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
- SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
- TLSH
  T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 d0949b4c0640ee6a80db5a7f6d93fc631ed194de197d79bf080ec1752c6f1166
- MD5 c051c86f6fa84ac87efb0cf3961950a1
- SHA1 f18f4bb803099b80a3a013ecb03fea11cff0ac01
- SHA512 6e9de5d07aaed2ac297faa5049d567884d817ed94dece055d96913ac8e497ade6f0ff5c28bae7cc7d3ac41f8795efb9939e6d12061a3c446d5d2a3e2287d49d2
- TLSH
  T1E48151BB62A40CF3C0941BBB42D71CA71776DD702792412E98474E9A34C4A6FED6E705
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9
- MD5 b38561661a7164e3bbb04edc3718fe89
- SHA1 f13c873c8db121ba21244b1e9a457204360d543f
- SHA512 fedcaac20722de3519382011ccf22314af3edcd11b69f814db14710966853b69b9b5fc98383edcdb64d050ff825264eaba27b1c5adfe61d1fc9d77f13a052ced
- SSDEEP 96:f7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNPS3e:zXhHR0aTQN4gRHdMqJVgNPR
- TLSH
  T11ED1F97675E22EB3C54ECE353C527A2B57F8C8111B9401549B978BD23CC5EB3EA39282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  smpcvc.exe
- Size 41KB
- SHA256 07afdc7bf69ed49391b52e15ac08fcae5744af1d19207251d4c8e14d7b4ab5cf
- MD5 0ceb92bc938674df03d1ad51f8ece6e1
- SHA1 c1bcab9e735299283c491c003c23e0b0362b4d47
- SHA512 1aad14344dd8f718dfb71414f4c8bc1a677055025a0b7abfabf4b8a8d202017e2ac0786162aa1dc7efaacb10242df2eccdeed301f32ad7f0f5abfee4f6c6bd70
- SSDEEP 384:Ut6kTbTThSz4L2mlVCyPASnTqbcFB2yji+MhsMhvxQZWoRrrYJLrDy6DU:sLThpLmy4SnTswB2BBKMbQwo0LHDU
- TLSH
  T156136D57BA504277D0458B7050FBCB26AF7B66A60AE240D78B20D5D83DB23E07D3678B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  smpcview.exe
- Size 188KB
- SHA256 4221571d8da8d217a1bb0754e5fdb3bab1ea49820da4811b7ca93a8a7d80b00d
- MD5 eefa3b39cf14a5677b350c04ea2c2956
- SHA1 168e4cc0d580bf77ddcd49fc9c8b635e3665a6c8
- SHA512 a5225fdd906ba2a324e56753ad19621d2286f2244e33c1d2f562e27d52b4b9400cc9e1474c1c08d6392ba2b8a2003920a6b10f8372b75196e98bf305847fc0e0
- SSDEEP 3072:X4L5q8BHLqrS3/TCSm26a2Aypb/pUW/MFn5Ug0ZQPwK+/g0ZQPwK+JQQwqTTfj9s:X4L5q8BHLqrS3/TCSm26a2h/MFn542PH
- TLSH
  T17F148E0A73AC0953F5DF0FF610BA12488775F953A596E78D9CC518EE0AA27D04923B8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

defense_evasion spyware trojan
behavioral29 behavioral30
- Target
  smvnview.exe
- Size 1.1MB
- SHA256 f80d00560741bc8e1b01efeff689a4f777378ff5a20c9e56c32cbc8cf53a262e
- MD5 84fe4d39e839a9e23cdafa0a8f7c02bf
- SHA1 d716de7bd0f112f75afc978307490a228b31af08
- SHA512 eb960cdd6f6fd8c7fb8926281f4dddce4074e8726c3f7735e9618f1356a200c23d5237995a492e43aefb6267a4fa7c77aa7b297af68025962e074deff4b7e173
- SSDEEP 12288:pjOfymTo6jlNjSa7uKJKAdwPooMhFc41UYNTrPQSMx1dluTfdMjx:JmTo6Jdwm7c41UgT0luzd+
- TLSH
  T1543538107A8082EDF5A32231E9EDD6791129BD6B1B2849CBD3C43E2F69F02C15E357D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32