721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6

Sharing

Copy URL Twitter E-mail

General

Target
Portmaster_2.2.1_x64-setup.exe
Size 96.8MB
Sample260808-tqthmszgmg
SHA256 721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6
MD5 e02558ef20c81a5458ab6a1aab4ade42
SHA1 9718d566336141ce99f1034451c9ea882bfaf258
SHA512 e838adf9a3509a88d0003336e1cf86ad8f0aa52880a52250fdb22f785c6c3c5a81c1572096d0d353458b032ea862ff8e7981c29c73c5b8dc83d2e1eebdcc4946
SSDEEP 1572864:7id1zV/kXljlvgA6D8thDxMWUxkhK2yHUs5M4XxDaGUcNhSS+ChPj7m40bODU:7cPCl2AY83DSRkwQMMKUfoSSZ5/mPF
TLSH
T1312833AA9898D745C764C1364C82D57E42ADFDA01BC3D81B39E37C07F63A10A8466DFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Portmaster_2.2.1_x64-setup.exe
- Size 96.8MB
- SHA256 721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6
- MD5 e02558ef20c81a5458ab6a1aab4ade42
- SHA1 9718d566336141ce99f1034451c9ea882bfaf258
- SHA512 e838adf9a3509a88d0003336e1cf86ad8f0aa52880a52250fdb22f785c6c3c5a81c1572096d0d353458b032ea862ff8e7981c29c73c5b8dc83d2e1eebdcc4946
- SSDEEP 1572864:7id1zV/kXljlvgA6D8thDxMWUxkhK2yHUs5M4XxDaGUcNhSS+ChPj7m40bODU:7cPCl2AY83DSRkwQMMKUfoSSZ5/mPF
- TLSH
  T1312833AA9898D745C764C1364C82D57E42ADFDA01BC3D81B39E37C07F63A10A8466DFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery defense_evasion execution persistence trojan
- Adds Run key to start application
  persistence
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $APPDATA/Portmaster/intel/base.dsdl
- Size 14.7MB
- SHA256 6c770483743f20c49ec7c57bdaae78b0cc30c9496c8a10a4f8675c5baeaa4498
- MD5 65d460591a2875752cee844c29c897fc
- SHA1 ce1bfe9dc428cc6300e0db4d79a441b33f8f9a27
- SHA512 4a3c19ee9c1b9b76651e25346da861e7ad384481647588a3ff3c91f704a582969277e86efe92c2ae5f0f08ff120e61a1f6dabfe6a8e3fab0a07ef8ee3d684b15
- SSDEEP 196608:7Z7aaVRpx8AS4wz23CLsBBbxvcJai95qfRWk+3/umMqaI0ju8YlvrrnExcgJnRXn:7ZGaV6cRhifqfokGMRu8YlXECgvXZN
- TLSH
  T1D0F633A313631A50684216BC3B7D37B3D82E86485FFA75D2884F4D26D68B08BD706FE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  $APPDATA/Portmaster/intel/geoipv4.mmdb
- Size 52.0MB
- SHA256 7696735fbe3e21e5fc3e955099e4131f1d8a47d08019e48db4e04c46ac71c9b8
- MD5 a2ce00d034aba5f0c192401526f78a9c
- SHA1 267d67e717e81f1ee34e14de588faaf0038d37cb
- SHA512 ebe972488a3b0bb3f1fc235337d2d8317b389adf5d5b3dc7f581a2a343c432e8fe540222047034b2860dd9a419745eaead4a1876ca07b0e88e7b1cc5c321dac7
- SSDEEP 786432:yraCBdDen7eauGIDzn9gu7yaeFEfCchPxziKXiD:yRBdDenSain9g9CCchXG
- TLSH
  T19DC7CFFDAAC7E9B7355B87C20CC2C1A08015884D1BEBF4B6B90774259C6E9503625FFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  $APPDATA/Portmaster/intel/geoipv6.mmdb
- Size 51.2MB
- SHA256 12eec14f13545e5cc3a4217f7d1cba026ebe76aaffb43d9a95dd8916dc54fe3c
- MD5 8cc2e765495efd94a16f2f4f1bc73337
- SHA1 92bb5af83634e26218ba874dbd591bdebcb04ee5
- SHA512 4d3e06e842445067af978f65a6fd02ae47c56a783dd114592915a52f48a4c8ad619ca84103a58ea100a5aeeb600c860d89356a5d853c98b028054ec7a785a335
- SSDEEP 786432:njY8a3Wgwc1RsP+jYRfcecvLCWJzaPUnRpwKFkC6:nEPrEfceLOR+Xt
- TLSH
  T126C7AF3637ECA930D50530DFA081EAB499F391E458F5B3B1345AE4856EAFF0B1712BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  $APPDATA/Portmaster/intel/index.dsd
- Size 4KB
- SHA256 026325cc7af459251fb08dce0a6166aeece4c9b5a4b7d26e15f4f7d94e0e6e0e
- MD5 b5faa7d7a5aeddbaa0745cd62b18a4b1
- SHA1 3d94a5f99e7fdd3e8159bc03e42567b06cc70d2f
- SHA512 0e01cac618d62440d8cd3236b94bc108984ae023a1e8fab5d8e99d19f38e6964b6eb3c359faca13d6d9defd59f4fd5e3c93f84914dc7b2d2c29b2a15d70a05a0
- SSDEEP 96:JAAlALAc6zrU0x42TFqXB8uFu9pDAIkCBjW8ts1qGkFXhi:HUIrpxFTFCTiDE1qGms
- TLSH
  T18B915D3CB1CCEA4BD27F6858E27EDF02975B3930FC55142741ED76929AE68129360C24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $APPDATA/Portmaster/intel/index.json
- Size 2KB
- SHA256 4d9e21ccd810b34903f86ae1f3daf07619c34f5665fea46be17ad3e077979499
- MD5 12d9b34bb53eb6b385cf8c9543496dcc
- SHA1 1ebea8c35987950db07bb245dc722739bee1a413
- SHA512 fba65ca23323742eb33a8d5da54974824adfa058ea3911bbb8ab6cf470970d43bcb2a6b86bc88aa4f29c0544778540308fee56fe37751554df2ad114c5f12cc0
- TLSH
  T17C51BC86C2756D6321CC33B185AD3095D62248DB6CEAAC09334D644C0FAD0BF2B3F28D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $APPDATA/Portmaster/intel/intermediate.dsdl
- Size 17.2MB
- SHA256 8be0df9689d4f1ee809fc633179485d5673e1126fe1fb9e0bfe296f2fb9f672c
- MD5 8c68219d0283fe3f340c21188063343c
- SHA1 c5101ab1f6ccc3d26d10e2352feddcbdbe4baa65
- SHA512 623bc95c5388b205b61ee014e97ec2b73d73c97179cf13932d93a49e249461253abaca2000fb94ce7e79668a5bbe5fb6772a85b18cbbadacb6087228e083079f
- SSDEEP 393216:IodqbI4Ey8LkbUqoOk1LJayaO1HGdsYIj3Z7Zxw:IsqbI4EpLkQFOvkMds5zO
- TLSH
  T1DC073313EE772602874299CF678C72D576394854E289355330DAF1ABBBB0F3E6890673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $APPDATA/Portmaster/intel/main-intel.yaml
- Size 14KB
- SHA256 c73be8f0600af4500f5d3e6f8e354f5d96dba2ce37d59aa976306a8ea9e5bc6d
- MD5 f6a3e1979bf4189a242208c20119c4fd
- SHA1 f15becdb33ae10c8898930eba7720e2e4bda5ac6
- SHA512 881ef1b5c23c2874592bd3c3e0c7ee3dd5cdaae8b9625c353ae3b7071ebafdbdb743bc93c49eeab3fa30ff4541248842004803fadf98be5175a7f4b8611a8d3c
- SSDEEP 192:HixmSUHIiRigYk4R9bG9/KmAcc83qSob4JE/RM5o9qLXVteDlP:+K31Yk4e9nUVJkJEZMK9j
- TLSH
  T139625456C72D1878F068D261E77BB6F1B32A8E039161141477AF93B91F4B34772E80CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $APPDATA/Portmaster/intel/news.yaml
- Size 972B
- SHA256 fa64e8d0f2adc61093df516d4be68ad536c4de29fd9f7c2473311dbdaaa1f9c6
- MD5 f88861e9dba633b7ed2b8db750e9b586
- SHA1 fd6355f3d0c0ae83713d42d4c6650fe7b276ffea
- SHA512 e5b671bfece741ed5baa57514c366d7a9623b1e914e8fd10af19fd0f7454959357a91b284fac4a91a581e6d9013bbb6854ad5eb1b05bc84b261f60d8cb456fc4
- TLSH
  T17211E1671A146B0E4A5557DEA2DF215DD305E6EEAAE0E0B878CF8101130E86454BE05D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $APPDATA/Portmaster/intel/notifications.yaml
- Size 6KB
- SHA256 8168f64860717712a9d0a00da876e84f03c34834b3a8e0e1dfa783a9c29f7235
- MD5 9f328dac539016f79a513f5b71517c29
- SHA1 b6b5d1a04eb8b6d0d88819e818d448b159a03381
- SHA512 0b3697a9b34ec142a9427e66c3f2e9f07aba92381c5bafc1111cc055f6e330f1a96ce08d13f4f9c5b8ca3dd3f3d7b1a37b9cb535ceec56e972a988d2f610b7d5
- SSDEEP 96:cUwvh6VR0ymBfRpXVNrnr/dqOZhXM4xKDqrFnn0ZEtn3FNT6RA+niFjRAEniFWct:cUI6H0ymbJrRqwrKDKAovK2vct
- TLSH
  T1C5D185D7B348A67ECD8A109BA4C251A18625F9EF937098BC70DD511C2F0B77081AFBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $APPDATA/Portmaster/intel/urgent.dsdl
- Size 2.7MB
- SHA256 10d70c5ae83c6554a169f97380314ae0bc5c1bd51110a4cefa5ccd548a714c4b
- MD5 451b0fd359fabb80ba3a2b0d483e755b
- SHA1 968b5159f2110ec885e3de8aa11467923d00750f
- SHA512 51b2c9deb7c61380b08d17d1307f902d64f078f98d563c7bb53f43032b26eff08ddad2e149978529f18d858bb8f1bbb0290a9943e38d61b56b90eae9db39d20a
- SSDEEP 49152:9OjRIwzVlQC4cBchk8IYfY42oBemlunvdbElgLUSJtQ+ilf61SsYUwveja9Nlh:oiklaGlYfzQz2lggL+ilESleja/
- TLSH
  T1D5D53310BC590240AF0233B18B835E769E3594B98FA0938A565FC9CDFED0CDB679B54B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
- MD5 ee68463fed225c5c98d800bdbd205598
- SHA1 306364af624de3028e2078c4d8c234fa497bd723
- SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
- SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
- TLSH
  T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 1.1MB
- SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
- MD5 7b89329c6d8693fb2f6a4330100490a0
- SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
- SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
- SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
- TLSH
  T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- MD5 d070f3275df715bf3708beff2c6c307d
- SHA1 93d3725801e07303e9727c4369e19fd139e69023
- SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
- TLSH
  T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32