996178d9f1b8c367a4e8c757215c312d91acf9f17b555061f99d9b01c98493f0

Sharing

Copy URL Twitter E-mail

General

Target
tenorshare-itunes-data-recovery-trial.exe
Size 22.9MB
Sample260805-ttmt9s1cpf
SHA256 996178d9f1b8c367a4e8c757215c312d91acf9f17b555061f99d9b01c98493f0
MD5 abf7f7b5c51167b1e75a5583a13e1ab0
SHA1 f602ac466a64e55e3b0e98c3b46dc77017dd6bb5
SHA512 8cd82a5dc780d4028eb64e62d9f03e32c3d8e09169eb66bdf7b2ebaf541ad08a27e6e23f3216150ce88480011b334191889e4f8b2157d40f6547445aaaabe35a
SSDEEP 393216:+nEBtAlZdySy7MXbGmF+xdPRyiS+djBR78jZSwHRBHmxqThlHbvrYNR6PB5yiuxj:+Omc3tRyENXw1jGEbrYv67UorO
TLSH
T14037338BA84CC9C6D1B6C7FF0967D23847B2BF857A136A054AF4BD6BF9716032C18644
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  tenorshare-itunes-data-recovery-trial.exe
- Size 22.9MB
- SHA256 996178d9f1b8c367a4e8c757215c312d91acf9f17b555061f99d9b01c98493f0
- MD5 abf7f7b5c51167b1e75a5583a13e1ab0
- SHA1 f602ac466a64e55e3b0e98c3b46dc77017dd6bb5
- SHA512 8cd82a5dc780d4028eb64e62d9f03e32c3d8e09169eb66bdf7b2ebaf541ad08a27e6e23f3216150ce88480011b334191889e4f8b2157d40f6547445aaaabe35a
- SSDEEP 393216:+nEBtAlZdySy7MXbGmF+xdPRyiS+djBR78jZSwHRBHmxqThlHbvrYNR6PB5yiuxj:+Omc3tRyENXw1jGEbrYv67UorO
- TLSH
  T14037338BA84CC9C6D1B6C7FF0967D23847B2BF857A136A054AF4BD6BF9716032C18644
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
- MD5 3e277798b9d8f48806fbb5ebfd4990db
- SHA1 d1ab343c5792bc99599ec7acba506e8ba7e05969
- SHA512 84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92
- SSDEEP 192:d4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjsK72dwF7dBOne:Wn3T5KdHCMRD/R1cOnrjs+BO
- TLSH
  T188622B55738488F3DBD2003E785237079B995565B4929ED2CA275FC6683B08D7EB2303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
- MD5 b26b412d9f1050ad53f663c972fdcd9f
- SHA1 7bc4ed444f3f8fd14c2c36784d828175bace8c17
- SHA512 ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
- SSDEEP 48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
- TLSH
  T164C17537B3C246F9D6858133151373C3A6139A306365C00F9B6712AE2521CB79D7EB93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/SoftwareLog.dll
- Size 543KB
- SHA256 4cbc6824b3cd0357459267a0ae4ec683038a4eeaba28f3870f775c7d65445417
- MD5 830dd8c3ba815ab1d62b232ff61666c5
- SHA1 92db7bdaecfece5a881f4542a2e33a9365bee786
- SHA512 b164c9c01394c4edc910975ef8753b75669bb032e61f71d5777346aadb986403849b9722f1f9a6f8e68d98351350e9dbea8008ce0e474e35abc387bc8dbb8e18
- SSDEEP 6144:kLqEl9qaFQ5uo3tYNRqq9QGyM80FklDGlvEqExZyag7GmYyqjnHFbEz:kWE6w8uo3KN8dGyNlDGlvERMaGQREz
- TLSH
  T170C46B10BB54C428F5FA00F556BEA22DA91C79F087E894CBB1C473EE96356E0AD33257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
- MD5 b5a1f9dc73e2944a388a61411bdd8c70
- SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
- SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
- SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
- TLSH
  T16BD1097675E22EB3C50ACA313C127A2B57F8C8111B9401549B938BD238C5EB3EA28282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  7z/7z.dll
- Size 709KB
- SHA256 6c80e3f49fcf561e6a0b52f9b4c81d1d07b22085f7864ee4cfd30dd10f6b3b12
- MD5 ca41d56630191e61565a343c59695ca1
- SHA1 774584ff54b38da5d3b3ee02e30908dacab175c5
- SHA512 7f2eb8f773951c5b682b208807235bf4d7d937ece3d9d5c30d17abeb8f74e0be016140e74c64f9d38440269784308ed53c9c76dce6850afa1c7f9cb701229fe1
- SSDEEP 12288:ICR0sfbz8QwSOh+PBFayDTAZju0sBdZ7ATm8zI:I9GX8JSOM5FayDTAZa0GdZ7G9E
- TLSH
  T1F4F46D15F7B5C4B4E2CE44318619ABF550F4FB4ACA2168D377C0EE2E1F36899C12AE49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  7z/7z.exe
- Size 944KB
- SHA256 ba4de34220c959baa0b9fdcd46fbddb501b18da5032ab3dc6e9d8af2a0391251
- MD5 f4f67a08ca7e31807bfcf505b3762966
- SHA1 1814f492c7a2477a65653fe4c2955cb756d37058
- SHA512 27387c08d2bd5a2e4edc662d035d0f8caa59a60756b5467f7808b11d0cbb1e4e0727042ddd32efd68d5ca28a30dbd5ae6e82453eff037a89e8c566e2164c09cb
- SSDEEP 12288:08ar2RIEnTNZfZ9IT5ouKVJLdgs5tFYUPhQoTZGFJLjkTzng:9a6TjfoZK7LbvFGo8B
- TLSH
  T18B252B10E741C029F9E301B34AFC96AD9558B8718FD810C772C94BFE66BA7E11E32697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  CalcHashAB.dll
- Size 1.2MB
- SHA256 b9fef900e0fa62dae963a54e3a88ecc848d803cb185b5b089147e12062f2c95f
- MD5 ee1ba5004d9a635d4c4c615b1741c20e
- SHA1 a8bc79da3bd0b946624e0b0281cdeda41666a84b
- SHA512 9b468b6b038b2e8baa34e00688dc8ba3f20bcabb6699c09a9a287466c85a3d24738a6969b9c82b0dd72f9d8015e3ecfeea5d4d47776fb9d154a0a4ef01cd0210
- SSDEEP 24576:qRo7AfCUuKsOMmSxpeH6FzhjnQf9XPCRy:TAaULKxoH6FzhjnQ4Ry
- TLSH
  T12445CF00FFA1D012FEEB9AF043AAD07DD82A74605725A4CBA7851BCC56247E4AD7325F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Extxml2.dll
- Size 969KB
- SHA256 dab79f703ca734859dcea8cb19458be24745de0e3fc2c64bb5f38ac0d40961cb
- MD5 e209066457010481e857cdc65d87e049
- SHA1 b2994275cc866ad792dd9c16a531903a315b671f
- SHA512 7c21750e2799834aab24779db907d021dd1bb8009532827626ff0ddb992ada143b304c66eef5d988c2875c2566826d34da2f6dddf3b878808d3e3de07e6a32ad
- SSDEEP 24576:kLcKcC0rO2s6c0k0/BMeJywAqiyOJUMEA:MMncDZQizSA
- TLSH
  T149258EA9B650C0BAD65985B523FBD7BB5D3B83225335F9C3CAA02C409D212E1673E34D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  FatOperate.dll
- Size 129KB
- SHA256 052dec1372b3b4af15df13aac4b572c7b6d754c51f22b2afe64cf82b0225ed07
- MD5 f4029c3adedd09435e75925039582a21
- SHA1 cf425da01260edf2eff640c4bdc3b537501f5424
- SHA512 8ac70c702e10f49d8854c57245a9b1a963af1e4bad30407a1f421725d590ac7173cbf264a396c1d1198e65bd4c79761ef8abc7cf809cebcc812730d14699e140
- SSDEEP 1536:ETg8mPw8d4SLbmRPt4Ntxn4tBTjzHS9rck5QyuIoaGsS5yBd:EU82gkbjLprzuIoaGsSoBd
- TLSH
  T122D3BF5135A1807BF18E40789156BF36EF7AB1A08EF15DC38B78E7549E71B41CA3720A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  FileHash.dll
- Size 534KB
- SHA256 5c61bb2dd816a42ab07ddb21e7ef101a3db8ee91982007fb78833b5b40bd5aef
- MD5 cff01ce5095796289d400dee57f4c0a5
- SHA1 1d9c8ddc743748c728aeb25efc2c6d14b40eba4e
- SHA512 da6ec0bcb56c06ce082c5a0c8f433c2575643f9a49c066079d81930d8b1114214e0281d537df6554b96dae28cccf338447881f4f66841c96df369ac7cd1d1cbb
- SSDEEP 6144:P4R6UEBp1J2ha3tCvW/DCqkO7VBeDofjATQIzGISauEe+19yOmduJJK:P4RsBiadAkCqD7VBezdGISaRe+19yJdj
- TLSH
  T1E4C44B01EB90C425F4FA11F846BEA26DB82D79F057E894CB61D5A2ED9A346F06C33353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  FileReport.dll
- Size 89KB
- SHA256 e25c35019227ab4c5b4f85df53d87f39b26e721f38bff711ac922029269df4d4
- MD5 aed76e4270711984e290a075bf7efe19
- SHA1 19f6ab03c65caa8d8eee2eda8af2f3c666f4fd74
- SHA512 0782e82609ea9ed543f31e6c21bb6960c4c578210fbe2658f01b6aef1c6cd0f6835c7f7d4d10547106bb86139ec8d23b7d413e24a0c9fd838374dacf534b0d71
- SSDEEP 1536:83STKZg3a6MWGU4psXKbXYLuRkT2C5irAKGdUBp:83STKZgfMJkKba2C5irR2UBp
- TLSH
  T1AF938C217651C073C49B98394529D7B15B3E7532AFB8D9CBBB95077C9F203C0AB3A21A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  FirmwareExtract.dll
- Size 159KB
- SHA256 f07db7e883e0a2148b0c96a67f25065a237a8610b734e4d189cc0f1fff37c2d6
- MD5 4d57494454b65eee5f4d44e2b1c6e246
- SHA1 c31745d0fa1d4a6ee1317011b4e6572859276964
- SHA512 95c0b7b07a265aeb44fb5490ed3082db2eab5252eb513044bf7948cbf4da2793c34a1fb618c147e1695339c5021de524a3c63e6237ad69c3825357fff8800a03
- SSDEEP 3072:SgSklUPuQXcqtQomKGpBghqzrhk2CRB2DWleL4WTBf295+XB4o:XSvmQXcqtVmKIBJl7CRB6gG4WTBHao
- TLSH
  T1E0F37C00B692C03BC9D715BF84F2DA7A5B293352976088CF77881BE55B156D12E3A3CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  FreeImage.dll
- Size 5.4MB
- SHA256 10540a4021f6ecb5176543fd90d00e21cc39315c34def19846b15cbfc67ea768
- MD5 ed385128e93edd8ff0507e89b77bdcc9
- SHA1 616b8a5825af8f4161a6cbe18e312b4306a9d59b
- SHA512 a7ff20cc6d7b4b28a9d7d10a2dbb1ed0bd2966a67e7bbb7acf8408317a506ffe3896a12660402607e4d8b12f54c88dca8c5615cc0804fcd4b2f3c0cc0c20c4f9
- SSDEEP 49152:mhd0HhgBfznpmSWmQ0c28aE08eRbxocctahCEHqTTavB/cVrHM4GRlKsU8:mhdegB7nS0PXCIq6yslKM
- TLSH
  T179465B12FBA24DF2C89740B094BB6B27C97A9D740B2047E38B615A1EB8763C115777CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  InfoReport.dll
- Size 672KB
- SHA256 3a4397f99506a479b9e5febf317914d5cdbd5170edc2b5cb2e9ff11e0c907b79
- MD5 ea59a0440f6731bc526b8b3001a734e0
- SHA1 f434c2d2184f777142dd8ca1a60acda4a5b9abe1
- SHA512 f8dae23247c137eb6575ab70dd7db9d86eb0ed553b566c7999c31016ee98c83c10a431718c8adbfe40a678ef492ae1e350beeeecd15084d98ed4f908c5720a67
- SSDEEP 12288:aSIKJBPe8CTYQNRpomG8ZUfac1HdfBdohOxLlCQ2tlr3d+6S:aSDBPe8AxPpVG8W9f44xJ2z3dM
- TLSH
  T163E44C10BB50C02AFEFB11F54ABEA16C642E79F08B6850CB61C562EE46356F17D32397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Initialize.dll
- Size 146KB
- SHA256 a6bc976ebe20ebf346bf67863aa6e72c32ad8e17419a9b62d0f82a97c7361004
- MD5 b2dbdf8cddc62c601ba825b7c727a417
- SHA1 05e6f470e9ff112510825aa0abc734bf33a7ff5a
- SHA512 569a4f45cdba710537ad2b1a9fbaf6cf9ec822151202e4e7e929fbef080289fb62f09158a2267163e36e135d148765d3314b5aab853c96bba7de89555ae151ad
- SSDEEP 3072:r1pLEMzM8zaEa0ao5C2BSK/dzmZLPWVSIrIOl4kyoVe2uBpZqNBx:VBa10H5C2BS6daZqrIO3veNcZ
- TLSH
  T167E3AE0B3541C0B7E6C90839109ABF37ABBEF1218DB4A6835764CFE48D75292FD36246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral31 behavioral32