64b939a761af7e8796ccee76a30ff62eebfc105007daf5dd95fb50a82ad60c99

Sharing

Copy URL Twitter E-mail

General

Target
Unconfirmed 72288.crdownload
Size 63.4MB
Sample260806-we22raxblg
SHA256 64b939a761af7e8796ccee76a30ff62eebfc105007daf5dd95fb50a82ad60c99
MD5 f4d24211adc70615ee654cca9befb394
SHA1 835634cf635adb8befdd6e2ae1c4ba48b1efd4f6
SHA512 a95a2bd4443a2ea685dc5f822563555661fa85b4d50b2a3d2ec72cfaab7694c15ec8b8e3e8485dd5559296effb21428956ef834c0fe6fabe44cadc437bae62c2
SSDEEP 1572864:Jl5+FUhS0lu1L2nj5dRuecKw4bwvmkE/2oky1fOo6mg:JHlh3rnj5dRbTGmbdLfs
TLSH
T1C1E7336C0C617CA43BC875EF0117AF5D2CCFF096CE66C64D1A2AAC2F671069781BD866
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Unconfirmed 72288.crdownload
- Size 63.4MB
- SHA256 64b939a761af7e8796ccee76a30ff62eebfc105007daf5dd95fb50a82ad60c99
- MD5 f4d24211adc70615ee654cca9befb394
- SHA1 835634cf635adb8befdd6e2ae1c4ba48b1efd4f6
- SHA512 a95a2bd4443a2ea685dc5f822563555661fa85b4d50b2a3d2ec72cfaab7694c15ec8b8e3e8485dd5559296effb21428956ef834c0fe6fabe44cadc437bae62c2
- SSDEEP 1572864:Jl5+FUhS0lu1L2nj5dRuecKw4bwvmkE/2oky1fOo6mg:JHlh3rnj5dRbTGmbdLfs
- TLSH
  T1C1E7336C0C617CA43BC875EF0117AF5D2CCFF096CE66C64D1A2AAC2F671069781BD866
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery installer persistence privilege_escalation spyware trojan
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1
- Target
  Sugar Bytes - Effectrix 2 @DrumkitLeaks/Effectrix2.dmg
- Size 43.0MB
- SHA256 7ae31ba3cd53f06ed3681f0de2a446c3233bbbd227c7906e107b9cde4d2f1978
- MD5 16aba542ee78df33ef76dbac6eafa4c4
- SHA1 a5e8e21a992faca24c32a4aaa868955bb2a61475
- SHA512 2c5e99bc51e07a83a3c524bb16d71ac0241bcede77b623bb26dbe96052d645d1c80947548241d23e0c036f3bbdd39060e48a56b1114147d182f36ea11d64490a
- SSDEEP 786432:VEslZ6OmNQUtwE3fw2jTBax14bcJHZ1Ko1KvzRpanpHWlt+KKnpSQ1Gj444Ri5N2:+slNJvEPnjTBax14YHZYo1KvzDanp2Hx
- TLSH
  T1A3A73378A4954188FF1E9C72E16066206F30BDCB6F276417FE1492D33429BF74AA3789
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  Effectrix2/Install Effectrix2.pkg
- Size 42.3MB
- SHA256 ed84d133566c7c0eed010aad2a64b0e0f490582711d0b009a70335d4086cc7a1
- MD5 89ca1f92b5e7df7fb7795d1348da8673
- SHA1 8751950a13e146b3c942b91a95d57e7a567d41a2
- SHA512 fb29173d293603c0f42865a6f824111998ef3222bad292ead06c2550cacb0b2b79c72d3f0db9947bc16c194658420e98c6b6dffd080478ad054d791ce23495c8
- SSDEEP 786432:rEslZ6OmNQUtwE3fw2jTBax14bcJHZ1Ko1KozRpanpHWlt+KKnpSQ1Gj4Wr4Ri5B:IslNJvEPnjTBax14YHZYo1KozDanp2Hn
- TLSH
  T151A7333854994198FB2BDCB2F52026146724BD847F2BA497FE1C95A3382DFB70B63358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Effectrix2/Uninstall.app/Contents/MacOS/Uninstall
- Size 178KB
- SHA256 4d5685923418e575867d958e5022633d6624f7a5f2a649ebfd44f654d5eb30cd
- MD5 e1715631964b7d3e5ab3d671322f874e
- SHA1 d785628225049fd683536707a836ec5b7bbb9aa9
- SHA512 1a3cf9acd08fd362edfd1e96585f92e47c12e8ee6ae0132db25b0c28611bfd9c5c40f0eed11590f6d0dda218e1190e5080700b5d4952a1ff6e04d6a502273f49
- SSDEEP 1536:DEf/WS0eTVkgIihDasKpveJehUvnn26/GqthnlWgIRSXzD4g1K:DEf/F0eTVAipFAueavHaRSXHl
- TLSH
  T122042C83BF240427CEEA137D8B5FC7C95A27F39E8FD1821B1894A1811EC27B5075BA56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Sugar Bytes - Effectrix 2 @DrumkitLeaks/Effectrix2.exe
- Size 20.6MB
- SHA256 170c62f2832a0b546600295d0bedb73daf9f12756eeb65153cb517675e3d5d09
- MD5 93ba035d60da4e4406e6c7b9901007ce
- SHA1 bc5fe480066288e6105bf4d489b3353d740e9ae9
- SHA512 a9860bb81533db913ace5c6029f4e1f53440865990b2382a6609d102429f3a65c033802c243d20427989a035f30690587f509e67cd01d5386ef3c9b2478ef8e8
- SSDEEP 393216:ink/ymKCI5KSLuL4xY2tRkMLcnDMFMydHKOyrCJ/6AaH0Dg0hVYNSGmoqhVjVPS7:ByRCI5KSLzY2a+MydqOnJyrUsm1HTjVQ
- TLSH
  T11827332BB188B53ED09D27764573A15064FFA2ADF51B7E0736E8C88CCF661C01E35A62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
behavioral5
- Target
  Sugar Bytes - Effectrix 2 @DrumkitLeaks/R2R/SugarBytes_KeyGen.exe
- Size 378KB
- SHA256 04bf3276585b73b94b0f764e45aa3535ccf40ea6f99243d6d556510cf6bd65e6
- MD5 331d5a78119abbdd928d69a4243df137
- SHA1 ace54e458e4214163cf019ab333255e14a5b5f91
- SHA512 1b2cdbe791bd22fb4dd218e8cdf47136b2c7b8ed17360d1fa927243645ab1266f3f506cb97ff46085b8846c974a4cd122a2086264e4705dcbc8af8bb2e3d3ac9
- SSDEEP 6144:XYa6K2nA8P9tlASRzKW3PYwDaC+jpnKrGshAr7itUMjE6Wj5LPgRTJGF0weyiZD:XYkc9t2Sll/YwOC+ln/r7/M652PD
- TLSH
  T15A840241FEA584A3DC77073494BBCA2536BB3E269AA5164F33D4BB2C7473352840B742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral6
- Target
  $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $TEMP/R2RSBKG3.dll
- Size 1KB
- SHA256 83a2ae8d4af1ada808231b3e17ffbba11ec8be43b605dd5e43e86717dd295987
- MD5 37b534cd67212ca27bc547527fe90bb7
- SHA1 ffa6c1b7cebbd94969dce744e7aab63af2f8d8c7
- SHA512 5f498334e210e5bddf47a1ae173893ae8855d2910254caae10166c10413fa9266a93251e968b2afcac44d0ea962dbaceabd606acd782ced36f716117c67af2e1
- TLSH
  T1AF31814FB29EA873E81E033947D3D45D73B72711479793022449062D688256D6865F85
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral8
- Target
  $TEMP/keygen.exe
- Size 285KB
- SHA256 dcd48beb438386f01125f8c8eb7aeb869177fb6babbf46e0f6ead99e4a9eda67
- MD5 c85b91d03f6f1e1ef4be06dde4b85e67
- SHA1 1a59d130c80ab37f877fe815f1b6bd27c9ff6c81
- SHA512 9bc88e478f7905c481f44eb6846c809fb1f5b0f904f1163d0aaa861fe1d4719b175290f69354d1379cdf19b90276782bd3a33ab0ea67e11784ebdffdad077e21
- SSDEEP 6144:pcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOrEEW8y:pc/kEPDonR6Y436vRS98y
- TLSH
  T18154BF02B3E384B2ED5922BD055E5F1E663562140B36D9F7D3A82E8EDC213D09E3735A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  SugarBytes_KeyGen.exe
- Size 378KB
- SHA256 04bf3276585b73b94b0f764e45aa3535ccf40ea6f99243d6d556510cf6bd65e6
- MD5 331d5a78119abbdd928d69a4243df137
- SHA1 ace54e458e4214163cf019ab333255e14a5b5f91
- SHA512 1b2cdbe791bd22fb4dd218e8cdf47136b2c7b8ed17360d1fa927243645ab1266f3f506cb97ff46085b8846c974a4cd122a2086264e4705dcbc8af8bb2e3d3ac9
- SSDEEP 6144:XYa6K2nA8P9tlASRzKW3PYwDaC+jpnKrGshAr7itUMjE6Wj5LPgRTJGF0weyiZD:XYkc9t2Sll/YwOC+ln/r7/M652PD
- TLSH
  T15A840241FEA584A3DC77073494BBCA2536BB3E269AA5164F33D4BB2C7473352840B742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral10
- Target
  $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  $TEMP/R2RSBKG3.dll
- Size 1KB
- SHA256 83a2ae8d4af1ada808231b3e17ffbba11ec8be43b605dd5e43e86717dd295987
- MD5 37b534cd67212ca27bc547527fe90bb7
- SHA1 ffa6c1b7cebbd94969dce744e7aab63af2f8d8c7
- SHA512 5f498334e210e5bddf47a1ae173893ae8855d2910254caae10166c10413fa9266a93251e968b2afcac44d0ea962dbaceabd606acd782ced36f716117c67af2e1
- TLSH
  T1AF31814FB29EA873E81E033947D3D45D73B72711479793022449062D688256D6865F85
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral12
- Target
  $TEMP/keygen.exe
- Size 285KB
- SHA256 dcd48beb438386f01125f8c8eb7aeb869177fb6babbf46e0f6ead99e4a9eda67
- MD5 c85b91d03f6f1e1ef4be06dde4b85e67
- SHA1 1a59d130c80ab37f877fe815f1b6bd27c9ff6c81
- SHA512 9bc88e478f7905c481f44eb6846c809fb1f5b0f904f1163d0aaa861fe1d4719b175290f69354d1379cdf19b90276782bd3a33ab0ea67e11784ebdffdad077e21
- SSDEEP 6144:pcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOrEEW8y:pc/kEPDonR6Y436vRS98y
- TLSH
  T18154BF02B3E384B2ED5922BD055E5F1E663562140B36D9F7D3A82E8EDC213D09E3735A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13