28ba264d32542f8c1e8004e11d6d6a88c6b2e315bd540b3b51629420afe612a0

Sharing

Copy URL Twitter E-mail

General

Target
pct_free_installer_20260807.17861318137820b9952.exe
Size 1.5MB
Sample260808-advemawarf
SHA256 28ba264d32542f8c1e8004e11d6d6a88c6b2e315bd540b3b51629420afe612a0
MD5 6adcc74d9e698fe05f938c3c64d1541c
SHA1 0cd47b01fbef090a01de4936ad9c8b6c0d73fe31
SHA512 39e945f2d7812480feccd6f8d34eb0b91497240e75a56d2d7ca8a2f4665a4fa96bb70cedca51ea77f2fd67d22b1a245d68df1cf1b3784732723de286f289a8d3
SSDEEP 24576:ktVrIDug5LlH/4ezzuzNlhAMgCbgVJ8EUXtvqYgRDknf02MXDS0caU9M2xqabDhQ:GuHdVvsNDVdEkCr9kKXDIa6DxqafIQfe
TLSH
T15075332326994146D9E20E348C99D2704B749DCA45DE9F83C396FE1C782C3D3F61F6A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  pct_free_installer_20260807.17861318137820b9952.exe
- Size 1.5MB
- SHA256 28ba264d32542f8c1e8004e11d6d6a88c6b2e315bd540b3b51629420afe612a0
- MD5 6adcc74d9e698fe05f938c3c64d1541c
- SHA1 0cd47b01fbef090a01de4936ad9c8b6c0d73fe31
- SHA512 39e945f2d7812480feccd6f8d34eb0b91497240e75a56d2d7ca8a2f4665a4fa96bb70cedca51ea77f2fd67d22b1a245d68df1cf1b3784732723de286f289a8d3
- SSDEEP 24576:ktVrIDug5LlH/4ezzuzNlhAMgCbgVJ8EUXtvqYgRDknf02MXDS0caU9M2xqabDhQ:GuHdVvsNDVdEkCr9kKXDIa6DxqafIQfe
- TLSH
  T15075332326994146D9E20E348C99D2704B749DCA45DE9F83C396FE1C782C3D3F61F6A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware bootkit collection discovery execution installer persistence privilege_escalation spyware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Accesses Microsoft Outlook profiles
  collection
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $TEMP/downloader_easeus/13.0/4free/Arabic.ini
- Size 3KB
- SHA256 704f79769d8a16c2f5ed50e134ae9142d827bcddd2fb36d048c6fd10390e2983
- MD5 f466622b175ca02db482aaf148ae620d
- SHA1 5a6ad4b8c46c0ba2792bebd433c826a5b1bdb7f4
- SHA512 976860e9570306bd0e9a6d26be09ed5301936a9140331215135797b42c069f9e18de10794715517f396bf6c9a4812da67c890028f8af01dc50dd1b030e122646
- TLSH
  T1BD71D1D11A398475335ECE2AC2933988ED757D67D3CAFC25A4D7442042C7A5AF61E331
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $TEMP/downloader_easeus/13.0/4free/Chinese.ini
- Size 2KB
- SHA256 b60d6e006a1155ff12ba24b3b7674611facc55ee22214cbf1b2bdfb0cc51ed3c
- MD5 c6532af02fc2cf1c30341a85f2e6d2ba
- SHA1 602732310d6344b085839587d22fcfda9d6abd2e
- SHA512 90d51af04816eb15937af224e9306c6a59098a7bbe8488866523ac002296de49912286b97f4b03d56aebffc5bb2bb83e02a89abada69b915f94d5e692225c137
- TLSH
  T11051B5E92A2184BC3A870F3813AF4C6DBDB5489613E4C3A5CDA98CD411CDEED176512F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $TEMP/downloader_easeus/13.0/4free/ChineseTrad.ini
- Size 2KB
- SHA256 c90d529cb98219a8e3e04d01e547afdc64254bfa1e85b2408d9f02c062f76dea
- MD5 4b82798797a04df04e4855a283431ebc
- SHA1 4b7b78a90318c5b4e99f206ccafe69f15f8789b1
- SHA512 25465d7d001f5d0f36460f5c4e4f38c1f94a3342a6bfacbf47d7e586fa88246b2b4c34cc342c025d3127f02197aeeef66047462a7e44128ff4f832d0efdc271c
- TLSH
  T1DF51946E782645F879622F79066F1D957EAC059801E47230ECED9987018EBFC2F6212F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $TEMP/downloader_easeus/13.0/4free/Dutch.ini
- Size 2KB
- SHA256 43f9fe04a109de8ad0f5b35e4a195dd7fac8ff4ab181a97074452ba89de3369d
- MD5 c880bebd5b10f99d3baaab4d2ec4479a
- SHA1 0fb6c18558c016cb7eeac41c18176240f4677143
- SHA512 9b324aac30a1bf30bad6f5a738667d38faa062efb3919360cacbb3bd19871e20127f504469f2f533bfe36142a3c38d27ecfee60da6bbf5f647a7a8877267a7f4
- TLSH
  T18551968F9624837D35C29B3DC70B6F862F37609D82D59124ACEFC456128BA9C32E615F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $TEMP/downloader_easeus/13.0/4free/EDownloader.exe
- Size 1.2MB
- SHA256 b247262a2863e72b85773998a0087ff4e057dcbef8c39ecc5de891d0592534cb
- MD5 0fb5bca699e8c9dc1e4fdc2feb29c2bd
- SHA1 21f970d5343db12d2253e787a357047f5871fc0f
- SHA512 3c2f30480fd0652cfca2adc183fb66d68f9d6b596baaf2559cc95439302db7b5cf104f35d9a10307c2824300f570a087bcbbfeac657d0602f8f5fc02e575e228
- SSDEEP 24576:LIHpr4Q+0X+oZPvTWifDZiKg/VXbbyEiSikGhiaUrAoxkAWufmRdB:L0U4uohabbGhYA6hJSdB
- TLSH
  T14C459E11FBD781B2D54395B42C7BA33E5D36B698032589CBE3A02D194A223D1AE3D35F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $TEMP/downloader_easeus/13.0/4free/French.ini
- Size 3KB
- SHA256 89c8ec5711b3aa939f2df8639ea805c14d7998926d099e839a535aa786e753b9
- MD5 18cd19ff7e812acbfb0b58a5392bb70b
- SHA1 540e4e8b45fc8cc81064a2adb4cf70dcd1e35912
- SHA512 6d0b3d3828a4602d97ec76993ceaf9b8f9f1d6c1d2a45dd6680290ceda032368fa801512c7e92879bcdde4b6dffef7ecc2d947bb0172c9b3df87a46075f2ba81
- TLSH
  T1B551A7CE6A38837C39C6133E97676E517D2A5688219982288CDB444241879EC62BB1DB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  $TEMP/downloader_easeus/13.0/4free/German.ini
- Size 3KB
- SHA256 a5e41cbf7c5194c7acf33cc8734ea04f71849e17bcbf80aead5f90ebb08fcd02
- MD5 dd7b05222499895a237b65c361ce65e7
- SHA1 21f2bffe82339381bbfa0034c869791272c9e71a
- SHA512 4bdd63dabaec4800c8ae0f6c7d14d427e3deb614b7306ed380e0b8c00b6d7d6f89cd4ebfa99a0e382dfcf9681cac7f9ebc076ebace32930d11c7f161c2302995
- TLSH
  T10851949B997B527D37875B36830B1E427F32858A4299A228C8EFC043034B6DC436A577
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  $TEMP/downloader_easeus/13.0/4free/InitConfigure.ini
- Size 3KB
- SHA256 c70893994b68127e7213e37a81f81f37c3b6efd4ffe75c6dc84c9326531acd0e
- MD5 70171fe7fe218d663ad300b644223b9d
- SHA1 4c1360ec499763e9d07e900d9eedb0464603e218
- SHA512 473fea98b22927d6b9811b0a797030fb6e956b4b7ce8426410a63faad8d63cbc02a9673381e4a17b75c1cfebf4fae0a054351bd46f30421b8d8813d1f4a4ca18
- TLSH
  T1465187CED920930A7DC402B633CA6E447DF645E70690C658F2FD180BA785A551BDF21B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  $TEMP/downloader_easeus/13.0/4free/Italian.ini
- Size 2KB
- SHA256 707602bdd148853e33adb91a04eea32664f4cf37c2114461b49c1b40143744e5
- MD5 a806902172f6dfc84377dce9fe66e95c
- SHA1 86c6bbe759a977096bb23b89fbc75f66479b07aa
- SHA512 bca05b379d53332f0231cf1215a9bdd98048718d238a7926f4dc530162ca64633cb5bee015470de290332a4a5bb34821ca629ba9495b71b11326f8ceef8ac9d3
- TLSH
  T16F51966B76A4403D7287036D87573C84BE2E5CC9B5A511148CDB0486438FEE833BA26B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  $TEMP/downloader_easeus/13.0/4free/Japanese.ini
- Size 3KB
- SHA256 1104a2e473cd3f9b4783ac88c48845d2995db630a4d5d5dcaba744a04cd19ea1
- MD5 b58eecf922e31eeff10954237b00d8a5
- SHA1 ed5e8d2c8f1585da151b33acb26ab7c007759b68
- SHA512 e3cc95d1fed07b009952992cbaabd0b9ce147489e864485e44dceb742a66d993152120dfba8c0987b59ed10e4663dc3d695098b9e7782ba26708868bd736f0d7
- TLSH
  T1D1610F2DD751103ABEC14336155F7AD12E134CCADEFA2231489EC86172668DEE23AA76
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  $TEMP/downloader_easeus/13.0/4free/Korean.ini
- Size 3KB
- SHA256 321b072147b07ff12919a94afed5d4bbccb61dd6d41b0ed26ef81d55c8e82cce
- MD5 45f12844bb642cf7df5ccf61f66e1ef9
- SHA1 458ecf34008f03167d36cded4d991bee3a909f20
- SHA512 66bf27699b7f42b6fc77e9507f75d438331cbe475399d0ca4beb68db3411af816e9f4fb61979b33d34eee941b43753e0db7e750181753c95ef06cd2c258eeb00
- TLSH
  T16E5184573EF745FC30860E165FEBBD225E50C4DBA3A65124AC8B8CDA5AC90CC422AC77
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  $TEMP/downloader_easeus/13.0/4free/LanguageTransfor.ini
- Size 287B
- SHA256 ea177f6163205189df8409f21b934d46241f444993eb46c2dadd1e85b4bd142c
- MD5 6470c77fbd30ca7245a77617f5575760
- SHA1 5772f6c8ec51663a19420fc2c04009777511d4de
- SHA512 6ffe419f191f7e88038624b0a53d5fe21d078e758059c769b7ed26e260862d815f246f8e2e3f4e2879bd3a654dbbde8ea6c5bedebf813015f66fe30cd85d4222
- TLSH
  T193D02B24F6327CA11D2C99CA341F8980E9C57CFE2A5686E341B06AD82A139D62E70471
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  $TEMP/downloader_easeus/13.0/4free/Polish.ini
- Size 2KB
- SHA256 8e65535a137fddd2ecbb1980cf22180a68478cd01eba767e4614184677cd7e35
- MD5 412828cff52b2a7233c0a47f3c20e43a
- SHA1 b073b9c877393a0d362d5ada353b59b08c98460d
- SHA512 7dbe37abea663fcd384d3175ddb94dd536fc421f809807df03a18dd140cd5c3f8715cf1854c0467dfbfb4b8f9c89977708b90fcf01bc40fc8fd9b2e335127011
- TLSH
  T19E51838B4578856C7EA80F3E9BD32FC82D6C8989D15911168CCF488AD14FA8D233369B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  $TEMP/downloader_easeus/13.0/4free/Portuguese.ini
- Size 2KB
- SHA256 413302fd23ad809b2563f969bb5fdbc9306ec60d6b9d951da94f9eab870de4c8
- MD5 5b08865b1292abcc30c206db2877675b
- SHA1 b35debb1f447f00bddabb58b8ca2a3b835841e06
- SHA512 a1e0b9f1bed90879f578f6ee358c86ece2f16efa300e0a4aba2714f9ac5b69c2f4c64dfa6feeb75ae5cf852c8fcbe4a7a98b5cee7382b0f98ede89062d81164b
- TLSH
  T1635186896A04613E33870B6993575E82AD510C841569C209DDFF0DC763DBACCA277D17
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  $TEMP/downloader_easeus/13.0/4free/Russian.ini
- Size 4KB
- SHA256 ed7f485743855d32e66b1bcacda5739125e6391ba60e620ec9885f388688d159
- MD5 6d2d1a37eb55d623974f1280e560e0ed
- SHA1 ee9a1deb443e348d0021ebd1ef53528e3906d335
- SHA512 af56b622f7d258c33772b821848bf68e8dad12325efc20801786d1d77fc97d3c70248dbd55efd9a0bb269ffb22552b60b9d31d2f41f831b27ef54952720d8a3b
- SSDEEP 48:AqPDQRPe2QlXVdc9GNu6AVrfQ4uKTvPupLzLHZg5vRd9SyeNqK7MBH8SPC:OPAlXDAVrvPupXLHm5JHE7q8uC
- TLSH
  T14981F056265830EE2641A22BEE466D097DEA04FD2F7EA3220CF53C7E71F5558416E10A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32