e836236dd22dab3535e3b5981b187f88fef7be4f50aa6b1a3ce42a9c02166d12

General

Target
SPGMISFToolkitSetup64.zip
Size 7.5MB
Sample260802-wtyb4sdh52
SHA256 e836236dd22dab3535e3b5981b187f88fef7be4f50aa6b1a3ce42a9c02166d12
MD5 a073e72c71f88d6d12a2567a033f5c9b
SHA1 2db6447c68c8f39779412a21a773528896105b69
SHA512 17fd7004979257dce77d72f1a9b3ae417d87895e01d0e88eaeda6e8c5d8af7a116bcfa228cca8355d676c557b624cda38868eb650e8bfdd3198f436729ae026f
SSDEEP 196608:w16F5+1MZrCqdTQ8wz8LjC+Olhw8Qdq2qO:U1MZeQG4ZO3+q2qO
TLSH
T1B0863390CDFF94BBCDE3E831997663A5C9DA1123495118309D526BFF2B8CD28863D232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SPGlobalRtdServerSetup64.msi
- Size 8.5MB
- SHA256 6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d
- MD5 f29dd4529a6c590414c7817a286e64c4
- SHA1 2e9aea157e96b29718667ccb149071cc247fc65f
- SHA512 f8b1b1570fa1f54e2c56cca56e1ebcac967c481463e9b97cd5489301fe2b44314781bb19e781d2c1869073af51b3ad38ddfc92ab53fbe47611756dd4558bbfe4
- SSDEEP 196608:46txSbUXvyX2u0VAlT0MOBQphlYmCegIuxhj6WbTfV6I:4rbUXPCTxFhlLCQu7ZLV6I
- TLSH
  T17E962300B565CE2FC693A234A9FDE77089192D023565431C7AF43D973BB0B90F6A6E39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  setup.exe
- Size 421KB
- SHA256 5720d23a5b11b93fc43be8041e3c51fd5255bdcebf9839a87275c7c032d1e69c
- MD5 1e596d5b073234478d79746d0e8cb00c
- SHA1 b265d3e383217eb2505e7dbabe283a7aeada3a85
- SHA512 d0c222cc87f71e3a5487d93740f900b56727bebbc1a409ec01513937c2784e8776e576f3d264fe09dd8653afd7d334bae768c35d36e98a1b73691aabae381e28
- SSDEEP 6144:YDYWR5J+Wnp8JZt1u3s+++yPmhbyonmqZ2TLdwMpvXVQF4WaobRu:YDtPJKQ7v5yamCmwj1R
- TLSH
  T161942812A7E89035F1B34770AB7693A04BBEBC715D36CA1F63C4490E59B5982FD20B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4