417f5b1165bbbc6b13b897402c66686bdb363ad0ba469214e669114724a42eee

Sharing

Copy URL Twitter E-mail

General

Target
btweb_installer.exe
Size 20.7MB
Sample260805-h1za4afe82
SHA256 417f5b1165bbbc6b13b897402c66686bdb363ad0ba469214e669114724a42eee
MD5 3bc613bf0c7b72311ed2d9a1662460fa
SHA1 64386393034c4634222bb6b0c23efe148ba1abad
SHA512 09769e3b7fca30f31c8499e7b9f258a49e984c687317c86ee2b1ad912bdb9ad3911cca4790896cd3ec6f152781b49baa46d05cf40e248791d9d51427a9e78e5d
SSDEEP 393216:1GK65jo8j14/Nu8qq2m3BSfWExFwI0hGQeBa+FcazaN5KA4nICZ8aTJqG8p5Z:1GV5jo8Ruu+SfWUsc/7WNvK8KoG8Z
TLSH
T19927339F3AB64AD8F0B9A1F6C405F5163CE0B3EB26B64C43D390B45D4FAD492257920B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  btweb_installer.exe
- Size 20.7MB
- SHA256 417f5b1165bbbc6b13b897402c66686bdb363ad0ba469214e669114724a42eee
- MD5 3bc613bf0c7b72311ed2d9a1662460fa
- SHA1 64386393034c4634222bb6b0c23efe148ba1abad
- SHA512 09769e3b7fca30f31c8499e7b9f258a49e984c687317c86ee2b1ad912bdb9ad3911cca4790896cd3ec6f152781b49baa46d05cf40e248791d9d51427a9e78e5d
- SSDEEP 393216:1GK65jo8j14/Nu8qq2m3BSfWExFwI0hGQeBa+FcazaN5KA4nICZ8aTJqG8p5Z:1GV5jo8Ruu+SfWUsc/7WNvK8KoG8Z
- TLSH
  T19927339F3AB64AD8F0B9A1F6C405F5163CE0B3EB26B64C43D390B45D4FAD492257920B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence trojan spyware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
- MD5 b4faf654de4284a89eaf7d073e4e1e63
- SHA1 8efcfd1ca648e942cbffd27af429784b7fcf514b
- SHA512 eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
- TLSH
  T1E07186BA56E54FFDD1541A3030CE7003EBDE75B416AB625AC93B261A7BD0191D83CA22
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsisFirewall.dll
- Size 8KB
- SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
- MD5 f5bf81a102de52a4add21b8a367e54e0
- SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
- SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
- SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
- TLSH
  T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $TEMP/ut_web_redist/vcredist_x86.exe
- Size 13.1MB
- SHA256 b7ae307237f869e09f7413691a2cd1944357b5cee28049c0a0d3430b47bb3edc
- MD5 d3b594464f2312cde31af3f2aa516f9e
- SHA1 15fe8e70c3c5582b70df173cd9b580331677735a
- SHA512 ccb19250b90eb629c35a897aba6d0ab16402305d9ec16b97b902fc810cde5d215cf8149a273cc8f8cae5a4b0665b116c085fe3b01a3ab3860c44f20ca95d6e83
- SSDEEP 393216:7/H+lptVYmfr7yBG/4tWp4uXK63Ntq+qS:7/upttD7yBG/cy4Aq+qS
- TLSH
  T164D63333B498843AD7F30533E964FA246E3DA128130089BBE6DCEC5E5B7415227FB656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  Uninstall.exe
- Size 282KB
- SHA256 9718419747a362b4cb3bf7056256f8b1d1ddbaabfcfdd73961ba94517cc35c6c
- MD5 6f52b0f7a73d2975a9cb18cd1cc7e653
- SHA1 a68e25b564acb7823699b2896ecd9208ee974593
- SHA512 be72455c9b9324e8ce545b65e3b7b476827c0a350147b94fec331a7f1092b6ead5c7f870e1350afd079811612c237b33700318cc92c327fa29c885f1dcf4cb3f
- SSDEEP 6144:bNeZNt4RuDHhZiuKLZjC70I/3SLHqLwZA:bN2LgSDPSLKIA
- TLSH
  T1735428017BF88656F5F36B30ADBA96964A7ABC912E35D24F2311BA9D0C71B00DD24733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  avcodec-58.dll
- Size 1.4MB
- SHA256 8b527770e0580ee328f8c91aae05016b174d15e13f28befff5a6b6a6f4837084
- MD5 9d7585d920144436fd23b5397ad20abf
- SHA1 396b69f02b672b2df8b630e0690c440f17e7cd8e
- SHA512 c6fce0b220e319c8c91739159e9870302240e734b15c1721bb1357b6e62772b743d62f0a8b280aa285d8adde10e1fe24056ccfd1b05b9bf220e7f4f9434dd356
- SSDEEP 24576:cE8XclfxoSJogsbNfrVuuwM8Jjbx4bRu:cE8X9gsbNfKBbxwRu
- TLSH
  T14D65AD12BA608552F9C20236E2FEAE377D3C4B38139981D7A2C474FDA9B05D2757274B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  avfilter-7.dll
- Size 150KB
- SHA256 aa89af1bc9ddd990c0f51313f69864fa55e68c455b5027e7d88cf754cdc9f4aa
- MD5 6cb3a6fe8d27893061dbe9711c6a857d
- SHA1 caf804fc72ffa69d768ca34078e64126e77a8bae
- SHA512 9cb72ebb97f485254e3df2ad9769fa87a81a2efc5ff285cbb508c613b0fbd6b2382b9744e9e787f11699100285911f4de48fcc90dadc7df8199b55bcd950cd17
- SSDEEP 1536:O/piv02NctxTH0EnB5ElAq7lcTVY0xktVuuAqaK8uId5FAs9eCscjyxCDwEXCnZb:O/p5lVnkAstVuuDIkYY
- TLSH
  T160E38D56BD808032F9E3107FF2FD2F778E2C522A072955D39B8899BD46A44D3B63A705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  avformat-58.dll
- Size 927KB
- SHA256 4e8d418e6b1345c05e08a4b88e78a84a97c9a8179ca851bd87c93836c2409f31
- MD5 c123211331c1f98b8a679ecbd5048997
- SHA1 4b6807dcbbb0160b191cba08413c79ce557921ed
- SHA512 4232c5f759109cb71a5c5833cb3de2b641c71504f62132cced98f56f792c11d9d5a84ac96c91c8dec6b4d19021b9ba555976779957faa3a6c6438f0abc51a6e8
- SSDEEP 24576:70gpCJDvl1ceBW6MAgi5t5UW6HyZyJJV9999usE:7La1BDfmNHyZvV
- TLSH
  T1D2158D62FE518411FDD100B6A3FE4FA29E7D5338172890D7AB8464F49A344E3B63672B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  avutil-56.dll
- Size 620KB
- SHA256 47a1c21d501b81a93088ae081da08e74d098ac82e0dbae7a909f39af5bd24815
- MD5 e0cdb9bbfa7a22ef965d55161945176e
- SHA1 1d0929e86b838f02025552cd4e0f6eb91f769d75
- SHA512 813c9b18aa7e8d8794010cc40eda839db324079a87a784b9ab8a98c3f318e9c12d2d86eaa8bd4ec1e4ec6175a9e12efce243c0d0daa193b802ed0cc4739173f5
- SSDEEP 12288:Dt3KFuWVbRZ6Mv4Sf1tCoReru8EuJlFTCttioB:Dt3KUWVbuMASfexA
- TLSH
  T1D4D49E11BA80A25AF5E1017AE3FE7BB32A386334136525E35C942CD99DB00E37977763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  btweb.exe
- Size 9.1MB
- SHA256 9bb31a5915ec31e9b40a0ed06a30ce58c6bae839a9f526eff29f50096cee8200
- MD5 d9e181378787a6ca37e2356c86cef226
- SHA1 234919a850abbc7a231ac738d6878c7a6f7c1a54
- SHA512 2b2268f5c0d7af528dd6a693dc6c978dbb70f0355eb715ce34869272d3983d5f165551740c84b73ced0330b07830529e2cf897884bfb437d3dad15454fec8ab2
- SSDEEP 196608:NfW/i1/tS5u1wFHmWh6cf34OU1VfAlAD08OFA79a:QUU5u1GHID08uA79a
- TLSH
  T1C3A67D223AD58229F5E202F2A57C6F7E8439BD394F2542DB93941A1D59306E32B31F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware trojan
- Downloads MZ/PE file
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral27 behavioral28
- Target
  crashpad_handler.exe
- Size 874KB
- SHA256 6a51c9205babdcbc8962985a6c44db1494a891957567e18780f5c0a9bed478fc
- MD5 34ef4c06ef503c4c1e95fbbdda912d7a
- SHA1 3ada2fba1fc85e855161a931135166d4c5920fb6
- SHA512 ed9b8063b9f5c5e528c0ceb040b11fd0a18c44a7150bfa4a2fa9ff3a5f5afbf64f135b8d13e52393bb6a1d4d291e51fd4d9ef6a5da2ad5550c5c3012f6092c8d
- SSDEEP 24576:Ncvi/5iYg9XGitueKsFRTL5MuKWvUdOZDa2oG74:Nxn6LKsFRTL5MuKWvUdOZa2
- TLSH
  T178156C307A19D136EB9201F2D9B96FAA817CA41A0B7315C7A1CC172D56B86D33F33A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  libcrypto-1_1.dll
- Size 2.4MB
- SHA256 b8453da0de5aefb1b775486cec41011c4877ebd1ffa8089d89bce2ee8e3d5eb5
- MD5 cc316f02b1166ba92e53788ab269a639
- SHA1 f1ffc069ffd1abacd9b3378a2c40599b8a3d0f85
- SHA512 0a86400a472c4ae91a051dde9b260b630f81028aef144f6b6c37754801049958cef3545f903427b0ad1af8c380c8267d95dfd8144601c7c6fedc239ad4a397db
- SSDEEP 49152:TpZMOyiFMqZL1ktvLF819w8SP1CPwDv3uFfJghigAW5y:TpZMKlkFF819w8E1CPwDv3uFfJg
- TLSH
  T13CC5AF03FB961591E9CF463D12EA573F4E3A5A18C328DAD38E612891DCB16D0773E398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Network Share Discovery

Deletes itself

Executes dropped EXE

Loads dropped DLL

Downloads MZ/PE file

Checks whether UAC is enabled

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32