5ae57cd7ca56ed8d2028d5468a40ad7b7e057e9668ef47c12afe87fff1e94e75

Sharing

Copy URL Twitter E-mail

General

Target
Fit.Launcher_4.2.0_x64-setup.exe
Size 13.0MB
Sample260801-rx4abaycke
SHA256 5ae57cd7ca56ed8d2028d5468a40ad7b7e057e9668ef47c12afe87fff1e94e75
MD5 d913567e7a0a01043800aeb31796bc78
SHA1 a8fe977c15c0bbcc35af5121b33c4cc99c3d0067
SHA512 0ebbe1d2c70d223b084dde008210a27335dd65d0e817a1764adfcb89165307a5155fddaedcee13883b4b33939a51565d96849bd7751cb254c809108e91f58d24
SSDEEP 393216:dxCpD6Gt31FNiAw18/8GbdOLhtHcPPIRfbNSe+S:d0D6Y3zrwy/lbd+hlyIRDZ+S
TLSH
T18DD63358CC31F097D7919FB1989380291791E6CA715EF368CBA6AF027FB3F93A016611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Fit.Launcher_4.2.0_x64-setup.exe
- Size 13.0MB
- SHA256 5ae57cd7ca56ed8d2028d5468a40ad7b7e057e9668ef47c12afe87fff1e94e75
- MD5 d913567e7a0a01043800aeb31796bc78
- SHA1 a8fe977c15c0bbcc35af5121b33c4cc99c3d0067
- SHA512 0ebbe1d2c70d223b084dde008210a27335dd65d0e817a1764adfcb89165307a5155fddaedcee13883b4b33939a51565d96849bd7751cb254c809108e91f58d24
- SSDEEP 393216:dxCpD6Gt31FNiAw18/8GbdOLhtHcPPIRfbNSe+S:d0D6Y3zrwy/lbd+hlyIRDZ+S
- TLSH
  T18DD63358CC31F097D7919FB1989380291791E6CA715EF368CBA6AF027FB3F93A016611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 32KB
- SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
- MD5 6ebdde247cad8468575f1f2a4d7ae2a2
- SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
- SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
- SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
- TLSH
  T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 02c97e5e32a97d896163ec68a3ea3ab0339e57f274348b8689399638b649b2b9
- MD5 7a859af9af33fdaf638eed723391b880
- SHA1 bfd5343fa72541de388b346c64b1b67237f906c4
- SHA512 8e92447f1189bc47fc4ef864d1f529fc1e286d2654bb7b4e4eda767832170c914fc1fa3d5516a1918de766d9657123f3b15c1d412b1a49815ad71e8626fdca8d
- SSDEEP 49152:AuiGh3coUtJs4nclJx9Zf123FjL3+QLlsiLR:Zi0KOcc19KFv+MqiLR
- TLSH
  T12F7512103AE44072F0B31A3159F49AB11E3ABD708FB56ADF13902A6E1E705D1D739B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral6
- Target
  Fit Launcher.exe
- Size 34.0MB
- SHA256 2e20d7f755b5022231b63b41f91ffe35dc56464ac0909e1b8854c8ba48864f3a
- MD5 231973e01f26744dc8cf47ce4e75f9b0
- SHA1 c32297904c1522c82bd0d268dff3ae93d7cea420
- SHA512 ea713528bf2fdeaa2270741a51e6d204b52805a2918cbd7ad13951fa536a8a5508405d8353175f440aaecb1c19eebc8c06bfe648bc8151ec3f8bce631427d91e
- SSDEEP 393216:CYVyEp5plxphNU+E2sJjj1Jy66Xd5WZ1CVHvNc0W:C9Ep5plDU+E2qjjV0S
- TLSH
  T16F7718117A6B98ADD09AC8B083464A735E2170DF0B36B9BF45C446393F6EBF45B39318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral7
- Target
  FitLauncherService.exe
- Size 988KB
- SHA256 71a67af537e81b8af77c1c579c1935c1b44f89ec3a835001843dad0cb6997383
- MD5 0057cc0428512fc59972a7956c0ae897
- SHA1 9f32b7eed627dfe18c7b59f6446af30d545a0c33
- SHA512 60e0808ae7d530f259f5c58d0ed2e0e3c3591371690813f819f04739cfb49609a76946146b1848a2416785bacfb56f3b64a5f07ba345ec7594b8bfc2658765bf
- SSDEEP 12288:wHLR5N8vq5ovyfIfchB9FWa/NPDVe9BsfyjZRKp907BA/3W0:TviFx/NPDVCBfjOp90tAPj
- TLSH
  T1BE256C15BB9A99BDC45AC470C30686736E71B4CB0B32BAFB44D465383E79AF02F39614
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  aria2c.exe
- Size 5.4MB
- SHA256 29f24859f3630b7e85855103dcb2d610e4e0517dac1f53da86e972394d6e4fe9
- MD5 0ae3711f5678e2ef6622904545e8e7ca
- SHA1 4afe51e7376922ca2bff28440adb07e526901ae6
- SHA512 45ac75c8de3ad56713bfa8f586ae16a3d47ce7b9b21a3d99f49d6c779eb59448eec52fdf8dc66089d25552675f70fb152b950ee6a7ea56bb016526342bc0c9e5
- SSDEEP 98304:GgRfP5jnFTyGZEWxSIBHVGT+t1ufqchZ:XRZDFTyGaHIJoWofqc
- TLSH
  T1B9463917E2A310ECC26BC170476BA273B932F81915307E7F79A8DB751F21E605A6DB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9