661decf1d0f09fd15e531d1d4c4612ad701af7a736ffe7d427b6c1e3f01958a7

Sharing

Copy URL Twitter E-mail

General

Target
jv16 PowerTools 6.0.0.1099.rar
Size 17.1MB
Sample260812-qqcy4sda28
SHA256 661decf1d0f09fd15e531d1d4c4612ad701af7a736ffe7d427b6c1e3f01958a7
MD5 d23d8c227860c5d39801dc0cb2b07e6c
SHA1 cf58b812927c3a4bef8905efb3edab910e5241d0
SHA512 44e9f7f3382af398c14aca848742a06cce4679694058cfb535678a4c1d3b009d6a7481973b3e5a3c17a56b07580d11fe79ac63a4b17c1554b0c37d672f019e22
SSDEEP 393216:5SMBVXxPlZw8Ec2Kt82Vb0RfQHLLLFSM61cqhhCa:82dZlKK70RfQHLLLx6u+4a
TLSH
T14A07331378368B4B25F6C3D0B6AF7B1097C69A25E18B037EC2D184928336CF1B79D656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  jv16 PowerTools 6.0.0.1099/all/Ionic.Zip.dll
- Size 480KB
- SHA256 17bb0c9be45289a2be56a5f5a68ec9891d7792b886e0054bc86d57fe84d01c89
- MD5 f6933bf7cee0fd6c80cdf207ff15a523
- SHA1 039eeb1169e1defe387c7d4ca4021bce9d11786d
- SHA512 88675512daa41e17ce4daf6ca764ccb17cd9633a7c2b7545875089cae60f6918909a947f3b1692d16ec5fa209e18e84bc0ff3594f72c3e677a6cca9f3a70b8d6
- SSDEEP 6144:OhagC/Mq25o9sXGtSV41OJDsTDDVUMle6ZjxLV/kHu4Bht79I9:iagxWS4msNUCe65fkHdBf9
- TLSH
  T183A4AD0427E90A55F4BE5BBAC0B69260C3B1B4166D6FD70F4EE020EE2D37790D9147AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  jv16 PowerTools 6.0.0.1099/all/Launcher.exe
- Size 53KB
- SHA256 0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32
- MD5 c6d4c881112022eb30725978ecd7c6ec
- SHA1 ba4f96dc374195d873b3eebdb28b633d9a1c5bf5
- SHA512 3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981
- SSDEEP 768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5
- TLSH
  T11B332A489A4C9773C9ED46BE98E366904375C02B6B47E70FBC8982345E133EA194279F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral2
- Target
  jv16 PowerTools 6.0.0.1099/all/designmode.exe
- Size 16.4MB
- SHA256 47b4965d787ad7a7e0e0b7a59f72bfa835d0743f032aa4c79737ab0efb6cd4e2
- MD5 64475b184a36cf63690617df70671689
- SHA1 72530cb1eedbd8fc075bd3e881cc933060be826b
- SHA512 89f8c1ffd876d195f34717ac77f0d9a03d2bf533c222d5216e207707e4c5a597f5f061ff79469fc04ba874d491d39ce71b60d0f438617af8f8dceac801b2aa54
- SSDEEP 196608:0MYo/CnOzy6ks5bDDUUFDtACqQaxT75nzx/NaDXAJC5LDzxT3XnmpGdRPg+ak/ri:0MensPHDUexxah59VCQuV3i8RY+V13lW
- TLSH
  T1F00733D53382C400E789CF7965E4EECB05646C0680632D8337A8F65E5A749EB3F856BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution ransomware spyware stealer upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
- MD5 48f3e7860e1de2b4e63ec744a5e9582a
- SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
- SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
- SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
- TLSH
  T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  AutoUpdater.exe
- Size 2.4MB
- SHA256 4a5ed01ce55e1672c320b3cf504d78ef1739323c5e878afa2dc42caf49169a97
- MD5 5568d8ce5945c53ccd4d00cdb38422fe
- SHA1 ac0346d52bc93e938d948e083378c8dd576725d2
- SHA512 1f58dde879da6b78d7516d87663cd9a570c5d4fa62062bfae29ca45d50178b647ec42d1172db19233bf455986ab4cab24fcbf6a9eebf95ce9bfc8754f3f74a7f
- SSDEEP 49152:bF+9GHdTaIGkbr5pvmMbyZCaQvY9IgBPZKPnqFMfs8n73GS:EAdT5G8r5pv/bGUY9IgBPZKPq0n7l
- TLSH
  T10DC522C5730350E1E655FABDB267282B4111BD36C4CF0A9037AFB64B72BA0CE3465A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7
- Target
  cURL/curl.exe
- Size 3.6MB
- SHA256 4fae7a2c81d933a9955f276ab680ab75ffbdb15cd62abc43af161bcce4c29847
- MD5 2b5f330320dea666e02e28b97b751af9
- SHA1 4038562d0a950229b6d68fb62384ae59eef07ffd
- SHA512 3506dbc851c34ec63203fe578a449fd607b8374998a97ae384c05f6c0fd6d4bb6cb12c6c185f06e629bf49c572d5a0cb5e97df54a28eb9470ad74c0d10bdf952
- SSDEEP 98304:LQId9Ob3f50XXoN7SeHqZS4BcWtNJ2zH8Rbxc1ewUdCO46MtWjwDHT+K2FcnDJpO:LQ+k50XXoN7SeHqZS4ltNJ2zH8Rbxc1i
- TLSH
  T14C065984EAC750F2FE575CB0A09BF7BF4B349A01C420CEE6DA44D941F933A526609B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  cURL/libcurl.dll
- Size 1.1MB
- SHA256 6e158f098213773ee2ab91c1f02ab39fbe2896947c9dfcf762aee10662a8bcd8
- MD5 5e4d6ce410e2c156c293162cef078fca
- SHA1 19e8f2046683a71cdaf907120ce4c95f5339faf3
- SHA512 076824cc390a7ede124f6acbbf407ed7caed0cf15e5b827f0b622fc93b851eaaa3f8a1d6f2f701ccb2078b7b8a28d2383de7b71de6f560b628049394dfc29ea9
- SSDEEP 24576:tTZKRJUbe2HjVjy9ZYSpFRrhifOgCtH30nPpbFTBT44A900TE:tKUbibtYTmE
- TLSH
  T1B9359F05FAC341B2E5430070E06E6B7FAE3D9216E506CAC7FB94DD58D853662A70E3AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  jv16pt.exe
- Size 11.9MB
- SHA256 3512b716468751e93f96e07f203dae85a4e637ae80bee8dff1340bc2f2d8541a
- MD5 39b298ab2ba279fa3e8cf8159de355ed
- SHA1 83e5c6a16ca947dbc2b59f90bac3fd74440a6863
- SHA512 c2c6c8375091f613a882eab377dc24d753a7d6c4bcbba3d9b343ab4169e4e5e67deb3899b1dea7c9cd6a3fb4ee69a3b0ed64af1bde120a37fe2bda8d897f9c51
- SSDEEP 196608:bCCjaTbomSYH4marXP9M+JzGw4KG0/gbSNO4slUOpLlPSNPZhoESbt3V46:bCCC8u4HXlM+jNG0/gbmOVegEuV3
- TLSH
  T14EC623F1770320F5E14FA87DB3746A5A1485FC3386DA0CD06BAEF8AF563ACC22159646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution ransomware spyware stealer upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10
- Target
  sqlite3.dll
- Size 889KB
- SHA256 c18ee6a56320e6f35d1552fbc4ddfeff188aab9af167c106a59f96bccfac5571
- MD5 bf4a43692d59c5fad41b8c57d322af53
- SHA1 0749e07fe3a07a68a98eafafa73d6f9b3d8bc3fb
- SHA512 3937b9101ad81a412f81ca19332f6264cb48ced00019c899765eb1d8c362e4261cb993b52a06f38bf8d019065d834ce6610df36dd0de116722d1a204071f090a
- SSDEEP 24576:xShcsA7a815cjO1gf1Yf11VPx6RUbjA8/mU:xGoka1gfafVPx6Rwt
- TLSH
  T11E157D46EA17A87BDC5701754607E39B0575DA30A833CB8BEBC91D68DEB3ED2160A343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  jv16 PowerTools 6.0.0.1099/all/mfc100cht.dll
- Size 36KB
- SHA256 928f0528706576c2f7211e98462e87e03bfc14eb7a84ca3531f45ce1d9f080a3
- MD5 61a56eb574daa6ceab692f98be3e5bb6
- SHA1 b52aa36e1a2594fe0ac97ee0b867df822d223b76
- SHA512 0b787be453e7d55b810e3075ab96e9f07a7f4a10d34c9082f17c26db0578a7199ddfccf1749c87c97541f9484908e59b1a237361b92123f98880dc5835173124
- SSDEEP 384:m1cPmgt96DteT9X2IEI41W4WA1G/7kn4TJgUqJgM3KbgkE3H+iihZ2+10vq0GftC:muufpTVI4P+7kn4TJVM3i/EhK2iex
- TLSH
  T173F2F67A07A4CB42D6518A3406D3CBA2BB31EB58AF008F57FF02F68D5919645FF19E24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  jv16 PowerTools 6.0.0.1099/all/redit.exe
- Size 181KB
- SHA256 49513524feeab386e8f77ce913edbd029be440fe788a2832ae0e1c5c2ea4ae0f
- MD5 e14a871a1d6d212ff97aa897f01ec55b
- SHA1 78be1527a7b8e11e4c1e4d447900b0b6910b58d3
- SHA512 bc077abd1275002abc394a517e9be436a999f5c229282cf43b1e1b9746bf5237341dac065b12be6e5a4efb5da6ca427b9d2da844f8aaabefa090c2f212c2419f
- SSDEEP 3072:kcUtSZLG0+bXjVyDlSGz5empnYi2dJLCGL0+hvgJV18Y6wXtBuFnWvd:3LLSXjVyEGVe8Yi2dJLhLZhvgJViRetj
- TLSH
  T1960402D043B7F16BCAE657FBB0B4660538496560EBD3847E7A32702C0FA8F4476642A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  jv16 PowerTools 6.0.0.1099/jv16pt_setup.exe
- Size 185KB
- SHA256 454a3e6701c8ec292a8bba5742ea2263060e74eb8238b9774d75fd922f9eb550
- MD5 40ae2d3f1ad1ea7acdbd09a28b46cdb7
- SHA1 c550144079afec5df52cfe0a90d45416c6b56186
- SHA512 1c6bf39145dbc99d8027b9bab5adc06ffa691635704ca73f4c35ba693105314f8b4cdc61424719189b6356d17b9e8e647f060bd2287f105232bb371746bb9f83
- SSDEEP 768:6ec4lj/+LePn4J96gmIX4ZFf+pvFOgFLeIHUXNI5382X82nVm0h+jPAYAv:y4lWePKw4XAFf+pvxpYGM2AIWs
- TLSH
  T19404F323ED12B798F5D40F7307DA86411A34AC13A8A6993FE538774E0B7628357ED329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral14
- Target
  jv16 PowerTools 6.0.0.1099/mfc100cht.dll
- Size 36KB
- SHA256 928f0528706576c2f7211e98462e87e03bfc14eb7a84ca3531f45ce1d9f080a3
- MD5 61a56eb574daa6ceab692f98be3e5bb6
- SHA1 b52aa36e1a2594fe0ac97ee0b867df822d223b76
- SHA512 0b787be453e7d55b810e3075ab96e9f07a7f4a10d34c9082f17c26db0578a7199ddfccf1749c87c97541f9484908e59b1a237361b92123f98880dc5835173124
- SSDEEP 384:m1cPmgt96DteT9X2IEI41W4WA1G/7kn4TJgUqJgM3KbgkE3H+iihZ2+10vq0GftC:muufpTVI4P+7kn4TJVM3i/EhK2iex
- TLSH
  T173F2F67A07A4CB42D6518A3406D3CBA2BB31EB58AF008F57FF02F68D5919645FF19E24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  jv16 PowerTools 6.0.0.1099/redit.exe
- Size 181KB
- SHA256 49513524feeab386e8f77ce913edbd029be440fe788a2832ae0e1c5c2ea4ae0f
- MD5 e14a871a1d6d212ff97aa897f01ec55b
- SHA1 78be1527a7b8e11e4c1e4d447900b0b6910b58d3
- SHA512 bc077abd1275002abc394a517e9be436a999f5c229282cf43b1e1b9746bf5237341dac065b12be6e5a4efb5da6ca427b9d2da844f8aaabefa090c2f212c2419f
- SSDEEP 3072:kcUtSZLG0+bXjVyDlSGz5empnYi2dJLCGL0+hvgJV18Y6wXtBuFnWvd:3LLSXjVyEGVe8Yi2dJLhLZhvgJViRetj
- TLSH
  T1960402D043B7F16BCAE657FBB0B4660538496560EBD3847E7A32702C0FA8F4476642A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16