c249e0af35b457a937f5f0a63f429c0237326dd9f6abda34fa5cd05798cc80f9

Sharing

Copy URL Twitter E-mail

General

Target
Froststrap-Setup.exe
Size 23.0MB
Sample260805-bgc57aswf1
SHA256 c249e0af35b457a937f5f0a63f429c0237326dd9f6abda34fa5cd05798cc80f9
MD5 f5a8cefa5783b08c6518a9206777376d
SHA1 cd726e502d2b93aa65b4fd728225aa626cca37e0
SHA512 3725d20149866c8a676590301f74e36b40c2390a9d6143cc10f860d134cd1e50abc266b5044ca7adb24cc19f402d637c9bca217c95213e5d23acf9b152d3fc2b
SSDEEP 393216:aRWaihijzckKBZFpVbtU46ECN9z3miS/N7NzeH7Gti5+gG6u4jRKkYTOgdfRM/f:Jhi/cFFpVKEgzWiS/Np6CtisHA0vJK
TLSH
T18237335EED2377BDDE265EF572AF6488A668ADB0C15F42CBCD0185AF0E90910DC21273
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Froststrap-Setup.exe
- Size 23.0MB
- SHA256 c249e0af35b457a937f5f0a63f429c0237326dd9f6abda34fa5cd05798cc80f9
- MD5 f5a8cefa5783b08c6518a9206777376d
- SHA1 cd726e502d2b93aa65b4fd728225aa626cca37e0
- SHA512 3725d20149866c8a676590301f74e36b40c2390a9d6143cc10f860d134cd1e50abc266b5044ca7adb24cc19f402d637c9bca217c95213e5d23acf9b152d3fc2b
- SSDEEP 393216:aRWaihijzckKBZFpVbtU46ECN9z3miS/N7NzeH7Gti5+gG6u4jRKkYTOgdfRM/f:Jhi/cFFpVKEgzWiS/Np6CtisHA0vJK
- TLSH
  T18237335EED2377BDDE265EF572AF6488A668ADB0C15F42CBCD0185AF0E90910DC21273
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation ransomware
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 29KB
- SHA256 a659985eb1c12d6eade4c2c9d4e48f5748c9f2afa942a8934034c2c622db050a
- MD5 5b0afb184846e9909fb478040da01557
- SHA1 08a8896ae10480988ae5af9b38f5283d278ce6f5
- SHA512 e12aad20aa652c8b31de57ca291b6bf51491b58a2d717b510cab1a421c16585e1d7e9f3a04059249ad615cb4df5ce0b3d17cd15d8c8ad37798c542c98df9ddcd
- SSDEEP 384:Ichls/EvE2XYBVtQQA+S4n+7g6ZxlU7RfYkvIZMIwwHnY9py2ediASIo:ImHckOVih+S/Fxq7v4HnYeoASIo
- TLSH
  T1E0D22929FF0BC8B2D1B655F049DFFB77482A790547225E6BEE168D08BC33A139A19107
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 044077656d92a24ca83e479a6c65143316e9a5d11e772ec54e9fc7d872a227d7
- MD5 acfde3d077386ed16db79956d9e29ffa
- SHA1 bd578f2315d397874d12f4542ff3cb6571a6f8f5
- SHA512 408d251ebfdc9c3cab9d0beb61506e45910f8fef7493548dd05f6df59c1604ec8ed604070e7e595a2f7034878e12242745c428d285a0cc80513c82df51a277a8
- SSDEEP 384:KqWL5JCYXh2OPxv9OIR6oYkvLlwgS+3X9jN:KqXG2cLR9v6gzNjN
- TLSH
  T13652C50DFB1B14FAC571D974958BFB3F8A9DA415C66B4E06EF160B0CBD922B1680E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Froststrap.exe
- Size 57.2MB
- SHA256 528fe2765393c47727023019bc606528c10bd90f1110fe7c441a56385b5f6798
- MD5 d18ea329319dea51d171de62b0047924
- SHA1 bf406782c2a6eed6f74447363f77e79989e3ddab
- SHA512 fb3278ed86b7d860074861bc385d3af3fa6eb1fdc4a706b37890ef26b6c5da4e6c24125aa91f839abe4713f7d4c02528c0fd0c3788fee11a23fd97e5b61adaeb
- SSDEEP 393216:HJssQJmXMsuJ8P2JzJRBltWYayYvVqiR1xSCl9Q1gWhZ2KCx+iJnsw5lQNCpvbvD:piR8MtdtWYajd9l9QHW+zwrQlliC8
- TLSH
  T1B1D7AE42B3E8CA69C07E8534967211165670BC5E5761EBCF368CB6BA2F737C00E76722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Loads dropped DLL
behavioral7 behavioral8