3a456fa71ed8e098c07ac97027ad3334ed4aaa9db8fd28febebab71884c5de14

General

Target
7xing_1.45.0.exe
Size 38.6MB
Sample260731-nnzzrasvav
SHA256 3a456fa71ed8e098c07ac97027ad3334ed4aaa9db8fd28febebab71884c5de14
MD5 d1111de2c1f1651546b4bd418a0bb3f4
SHA1 41fa6a8af40796bdd3f7de664449f733e7dc6539
SHA512 5440a3633ad0c60df1a026a54db8a84c071bdec1001fc7f077e4f3e1e342966d84b6c8e62dfd5ee3513218c39104e2be7d4d8806d1e67d0296a355ccc97261f5
SSDEEP 786432:1n9GRFDyyCVBJeteLO7IrL2cJUuBfbbV0SPltYpzc1aHSdpTKNZg:1n9GPy/VBIIK7Irq2UuBfnV0SrYpypmk
TLSH
T11997333469B1BAFBFDB34A7C3B1533BE8EB2A2B28382961B453084C5A775714D074D46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  7xing_1.45.0.exe
- Size 38.6MB
- SHA256 3a456fa71ed8e098c07ac97027ad3334ed4aaa9db8fd28febebab71884c5de14
- MD5 d1111de2c1f1651546b4bd418a0bb3f4
- SHA1 41fa6a8af40796bdd3f7de664449f733e7dc6539
- SHA512 5440a3633ad0c60df1a026a54db8a84c071bdec1001fc7f077e4f3e1e342966d84b6c8e62dfd5ee3513218c39104e2be7d4d8806d1e67d0296a355ccc97261f5
- SSDEEP 786432:1n9GRFDyyCVBJeteLO7IrL2cJUuBfbbV0SPltYpzc1aHSdpTKNZg:1n9GPy/VBIIK7Irq2UuBfnV0SrYpypmk
- TLSH
  T11997333469B1BAFBFDB34A7C3B1533BE8EB2A2B28382961B453084C5A775714D074D46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH
  T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  mini_installer.exe
- Size 37.8MB
- SHA256 e28d210e377037bb8aeff9a6198147a4a883aed112da2724dddbf566ed0fae43
- MD5 83f2fd62f0d09ec6e2c3019aab38b640
- SHA1 c3efee39d0e3266d3f04fc285702615ebfcac1e8
- SHA512 ae7f979a2f077835d04a2b374325003bee7f4120c9019a841bd3189548498c6c0462390ed7bc945e91c913618502fe74b5d2d30f0b034bebcaee28aec83b9bed
- SSDEEP 786432:veSFJUDnRm44Gjwh0iac67ML9LFuJ/7FTlOxjEw9XTmWXyYyb:vzJqnRbP0h0iRam9LFA/7F8xj7PC
- TLSH
  T18097333858B1BFF7FDB69A3D370532FECEB462A3C3869657853184C59678624E03484A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3
- Target
  update_installer.exe
- Size 761KB
- SHA256 6e2b0ab5cc318544995a7b2f212a7bdf9c344a9db75f8b759694ed5478135567
- MD5 8162944db32021380d020d610364d842
- SHA1 99fd24ed1700739356b20ac8872f5bb3d07e8f6a
- SHA512 9f620e40a931d7410b02f282c014cee94178ac60158ce4cb62be8e74706ede8da2313193fe154b8ce95b86df518c70d12e5244f8a839b00b96088c3ccad390be
- SSDEEP 12288:flT1K+njZWFp4BQSO/bae43yPjT1G/drnLR64MDqlZNkDCIv3e2+OI+NTeb2GRjc:/ZW/4aSMbaeUEjk/ls+p4D3P+SVDs7mL
- TLSH
  T1B8F4020167E69038F5F709798DFAC8664A7ABC215B2484DF23C89A4C5A315F2FB34367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4