16532bc640315f87bd66e04f78b137e1ec90db2d0b7357bfcc47af8873e0076e

Sharing

Copy URL Twitter E-mail

General

Target
BleachBit-6.0.2-setup.exe
Size 16.7MB
Sample260804-ps7e3a1bjb
SHA256 16532bc640315f87bd66e04f78b137e1ec90db2d0b7357bfcc47af8873e0076e
MD5 ec0ea65eab140933c486bd578c2856a2
SHA1 aedd01a36c1b2e6256779d810925816e67d76535
SHA512 a188066754ee67242d809bcb66fe5d75e86b02e6690f923362d9ece8d9eaa5d0468e2295e608697418327cfbb9fdcd2314993fdefc980ccd7146d2cd09b3c3c0
SSDEEP 393216:d5SvW4877own+hco0aQpBda6Ttidl8ylo1P1ZtV:d5SuT7oj6TaIA8ylQ1ZD
TLSH
T1CC07336951D7DC0AF930EBB42F93AD4B38BDAA53364307131705E9265982FA53EDCB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BleachBit-6.0.2-setup.exe
- Size 16.7MB
- SHA256 16532bc640315f87bd66e04f78b137e1ec90db2d0b7357bfcc47af8873e0076e
- MD5 ec0ea65eab140933c486bd578c2856a2
- SHA1 aedd01a36c1b2e6256779d810925816e67d76535
- SHA512 a188066754ee67242d809bcb66fe5d75e86b02e6690f923362d9ece8d9eaa5d0468e2295e608697418327cfbb9fdcd2314993fdefc980ccd7146d2cd09b3c3c0
- SSDEEP 393216:d5SvW4877own+hco0aQpBda6Ttidl8ylo1P1ZtV:d5SuT7oj6TaIA8ylQ1ZD
- TLSH
  T1CC07336951D7DC0AF930EBB42F93AD4B38BDAA53364307131705E9265982FA53EDCB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery spyware stealer upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/modern-header.bmp
- Size 25KB
- SHA256 e44bfda2eb8eef9c72cb7fef16ce2f5c101f65ffe6e78ba2b8d9de8180dbb7fc
- MD5 f8d708785ed8811670399e2c003cb28b
- SHA1 972578017e49a6d5f70e8aacf82b3698981da0d2
- SHA512 a31afe31c0c17e13262389ef91f9aa93b55932a1f87e26a2b97d8837a24f0e9a486156b6dc25afd5252944aad3858e6d9f05892392aa108edc7a924dfc8c76e2
- SSDEEP 96:9KxmKN3J4z9b0iaeYj/LOggkKjCWvGzldO6a0Dr7+d:9K8k4x3vYj/LOg7TlzlYJ07+
- TLSH
  T10BC284F4E47A85DFE651A1BEED666404BDDA40E249882A4CF0079B70394B275217F88E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 947580be382ddf446f9548ea7e2e9402e32aae2ff65af4699e9a9dc55855491f
- MD5 013d31e76b08b61f2ca73e9b7ff32170
- SHA1 b36ca27e188e93b006d9fb5905e9b39365a52a68
- SHA512 6355ca62a03e86152ea5f461aaf23bf79d3b376c13ab5fd3f33beb0e9c7545d98bc3dbb01134b0665589dd984be81d71564fe1e3ab1d3aaa492559c8aa66d19b
- SSDEEP 768:5bGLTaEFntGN++/CQwJrt9kIWtuHLeoCxxe:eFn7Qw5otM
- TLSH
  T1D5E30BF490B884CFF6F726793D027160B8D754E623889689B083AED03D67365389DE5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  COPYING
- Size 34KB
- SHA256 e79e9c8a0c85d735ff98185918ec94ed7d175efc377012787aebcf3b80f0d90b
- MD5 c678957b0c8e964aa6c70fd77641a71e
- SHA1 0dd432edfab90223f22e49c02e2124f87d6f0a56
- SHA512 54d2af2e51b3a0e263e9fbab956d02ccb533ab3a155e526fe90385ae6ab954976ee92cd8b55f3da187f1ba88eea15c6b91af76cf1eb817ab93b3c4b1919191c0
- SSDEEP 768:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A72:FhcycsrfrnouF
- TLSH
  T19CF2735FB74413B2018206A26A9F68DEE319D03A73664095785DC15C27B3E3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  cacert.pem
- Size 228KB
- SHA256 bbc7e9c01d7551bb8a159b5dedd989b8ee3ce105aff522b68eb1b01bf854cab0
- MD5 53724ebe755e8c9505a580b59a6fa5d1
- SHA1 d277cde9a92feb6689b565025f5610576a67540b
- SHA512 cd7cecdfd755693b99b7eaac14418fc639f7cb32bb0e9414e6eaa57c4992e2874ac39e40335a1049bcd7bb0d61b8ebffe9d5395aeecbc163359887582ae4b5a1
- SSDEEP 6144:0plSRrqADwYCuCRT/QRSRqNb7c4u59hrB:0LSRrHnRWav309n
- TLSH
  T1AC347C954F2A9C092C9FF1C1CA9B1357DD3E027A99FEF0F1290A2408D24622A57FDD9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  etc/fonts/conf.d/10-hinting-slight.conf
- Size 620B
- SHA256 d138eca2bac3f78d45ff7cfb649ad792caa4a6e61f73cea7cf0ea54b091f1ef4
- MD5 5da52d777c5af2cb4b7445b81ead6c3d
- SHA1 eaa33b6e3caab59de4d1658dddcc1d49acdd8149
- SHA512 d49ff3355bf0c0fa9c1c23ee0326d82fbd6c2d320d9439f841a21f5e0cef346f87fff4b6b489f3722ce9c8eaa54b384e060ee76f9ba2be7d6736bef34a79d9f3
- TLSH
  T109F002036268086310900E3ABF6A647D6F3193FA2287B114B0DCE5440797598012FB81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  etc/fonts/conf.d/10-scale-bitmap-fonts.conf
- Size 2KB
- SHA256 df8e99abb6f82384c61978906a45a95794940545da95790d87f01d9391e0894b
- MD5 8588f87eaf68a1eb73920066f6817b48
- SHA1 d662489d576538a2fa80387f0992c2c47159659a
- SHA512 d419ef273977ca59742a03207e3b0f1cc4e342753025860246b9c2dfcd1c1ea4f42faa84e7aba539a548a6c5a7dd9d61a89be11ec9316470156ea7ccc0cd6ef7
- TLSH
  T174417C37E0EDBD56A5804D52BF39368AEE91C3BA0159B025F4CC06041F9E3C35763E96
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  etc/fonts/conf.d/10-sub-pixel-none.conf
- Size 647B
- SHA256 0f00b5cf0ce07062ec65b9b340aa888f6c5fbc215aafebd26781be2d5a13ff6a
- MD5 3b917873967397433a44ddff38568ce8
- SHA1 9a8f7683c1097b70cad6c92208e8d662e48377c1
- SHA512 a4b27dd1b809f686819679ce6fcee662e59d005c5c72a00802a7aba366cfb740a77e04df7f2832de04efc24a4b0294a3099c63c8457bfe4ec11ca419baee5fd8
- TLSH
  T1D3F02D2756A82C2300980E32BF79746E6F3157BE6286A020B08C618C13EB59D031FB82
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  etc/fonts/conf.d/10-yes-antialias.conf
- Size 258B
- SHA256 e6d82a642d1b37f7d24dc37f938b999f00ff7aa4303b2602d04164d53f221005
- MD5 908d9e324c24bf809448ca7041db580b
- SHA1 d0b8a9221bbf15a96b4ec974a38dcb82249cb2ef
- SHA512 f13d491cf884e354e1f00fc231a3ed61883f3f121c8f3ed9cc2f58f6cdc7ca8847fa4a2571a0303f4ba7243d3a8031f2a3daff00b51f0009158cf872f776b42e
- TLSH
  T175D02B13C9EC6E2280C24E577F35305C0E21C7E128477010D8C4656402C91CA0167742
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  etc/fonts/conf.d/11-lcdfilter-default.conf
- Size 695B
- SHA256 76aec9d8dac48faabe1bbde9e887cfb09fa45f30be5f8826e945a394a0097e48
- MD5 4dd5ffa8e7c3448e76fe1bbe2f3df871
- SHA1 82d6f28b0b2457e5ff02476aaa5bff2789ee052f
- SHA512 351e2f0a3c274971f464453ac6dc0c691feeac633cdd56d40980a7b997f35a1cd03fb139b1cecd63dece278136ab6c25c62fb60472cdd988de9abf9db409ae01
- TLSH
  T1EA019E5391ADD8B310540A22FF66613EAF20AFFE7247701470CCEA483787595861B785
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  etc/fonts/conf.d/20-unhint-small-vera.conf
- Size 1KB
- SHA256 278732c68c16177f2aa3c7e4ea318b9f720aee13a433c32eb15ba626806c609d
- MD5 535df1a3aed553ced27e176639e4b541
- SHA1 955a354712d2b13466a95016fa6df29351747902
- SHA512 ca312f20fc6a2c23e1520c98aab57f62c8b35cf1dbd56703c1fde6744b5ad88bdcf8a068c671f7264439c9aebb61ceec3b506ed1b1ec2090322771b23697d162
- TLSH
  T1D321C03BE18C6F6E1CCC0926BE6D23CC7AA787781125A294D0DF3458121B44626327B3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  etc/fonts/conf.d/30-metric-aliases.conf
- Size 13KB
- SHA256 3baf25c82e1a14c606d45c212296852be06ae9795d60e84aab573226151450a2
- MD5 1eefbc368808e53dc9ab1b73aa300d99
- SHA1 553bde3c041c15b775c17e1db74a2f6f702f9f2d
- SHA512 9d5c25aba9a7edb189cb0b1fcf26725eeb7d1eaebca871117f1cdc1640edd803358f6d7f8cda0d11b1c12345df1c9a79dfccf515d37fcd31fe084e5b8041a4ad
- SSDEEP 192:nL8NRlcxW9CHMMKbEbwXkcmsROmAUpEFHb:LQlcxGMtcmsROmAfF7
- TLSH
  T11752B33C3DE0441132A2229B71217D8759A54C3BDAE77123F09DBE11AB683C27DABAD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  etc/fonts/conf.d/40-nonlatin.conf
- Size 7KB
- SHA256 5c3f7d62a44258d5d9e81a93b1685bee5ab78acb8688b25a43c4c1e749312a84
- MD5 a5b99766dd902496b2b708dd0a5d047a
- SHA1 f206d6f64f1c72bcccc1d6438439de33e73688da
- SHA512 88146901c41c194d449e69550af3d3bb6d8b2d691a5e23fcab39cbc362aeb3f90c029dc41b66dde35cfb6b2ba10feb524ea7358f70fb5de3a551c1490a27ca9b
- SSDEEP 192:9o9GhyPHlYE+2dXiVEIVix3seb8iWLd3t70P:Om+
- TLSH
  T107F1FA4E3AA08B903229234B320479D755EBED6CC6EE784774C4BD819C8A6C371D9FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  etc/fonts/conf.d/45-generic.conf
- Size 3KB
- SHA256 24de9f68189d544bb4cc084d9bd8f3a59d8b988a9dc44b11e9877d5add5fc948
- MD5 6eb7544e52701729de1bc87c7e03b155
- SHA1 295754dd99d277d8b61c07828e1e28284789f982
- SHA512 fab9eb85c2462345cd43fa65b35ef5bf4ff8421226f82b5d530e38168585ffb31c319881367363a1d9fab2f7e42b32000a05c9ff51cdd7ce567b24ef4cb629de
- TLSH
  T1E9715B2D3DDA5E5230C823BB7D547C976827CE3A5ADE70C3B1C91D0128560C23DA9ED6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  etc/fonts/conf.d/45-latin.conf
- Size 6KB
- SHA256 807638284032d8d8f6ed8b014a0edae79a4d4f3c4e70317fdb0bfa8edd66779e
- MD5 d065b45633b306b895b0d582b8898eda
- SHA1 b518703c5ecafdfee5165f2ca3ff5a44c86c0bf9
- SHA512 774c216b91b672913da3fce113faa598b7e6a1d906f23e25063ec78c928db6efb37fda983bdc3998400ec0b8489bef5d444eaf6692e94a33a07a82ec12034521
- SSDEEP 96:foR79mW9mz9mj79mK9ms9mZ9mR79ms79mY79mO9m89mJ9mA9mu9mO9mf9mZQOKO/:foPH6yl/6cZB9zm9PPYsfRM6if18r
- TLSH
  T112E1B60D39A09B943128634B31057AE759E7ED6CD6EF790374C4AD819C8A2C771CAFCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  etc/fonts/conf.d/48-spacing.conf
- Size 441B
- SHA256 99d839cd8aa28854e8f54f26e7200b6e57951f39f56791a0ed473662488bcef6
- MD5 9ef1b86cdc752b8765d2d1531e799cc1
- SHA1 aceb6139032c431a8ff176c9fb823d10b6f0c5f0
- SHA512 f4180859b4782c3ac1f23bd8de9555452ed5d431d5371bb99fa57a4e8d49962c0705d9a08b1a56e4a5a5064600e89f8aa70f96aea431c5dd75a55a4abcb19e95
- TLSH
  T1D1F0E5234BCCEE2BA0D90A32BF3920AE5D27ABDE65C6A058E4C6AE4525DD191053A153
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Unsecured Credentials: Credentials In Files

Checks computer location settings

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32