abb2a7402906b0baec2f58438c8154a2085316f72cdbbe20fb5ac107834b3585

General

Target
ashampoo_winoptimizer_29.0.2.zip
Size 24.3MB
Sample260815-ttf2qazcrb
SHA256 abb2a7402906b0baec2f58438c8154a2085316f72cdbbe20fb5ac107834b3585
MD5 24ff8ce0642505568b926245254dc5cb
SHA1 f032fe06cba9e13e9402e03436e9cc43f72a2e10
SHA512 a20c58c93cd0d28887e83d6772929e6d3b03ad4729296d2fc2329d636f90ae943c006f497189fa0e0e189448a29ef7e4af45c281b63410c78c9336ed94269aea
SSDEEP 393216:Nql6Jw0r1Uax9kPdUgowP96L9SI61dCsM712edeibXsjdgK6HTSbMEZI:GL0JUckPOt5LRSgsM712e0yK6zSgEy
TLSH
T139473384C13F1FA5EE1237D5FFE43E0E42D61924090D6E273E99F281BB412EAD760966
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Ashampoo WinOptimizer 29.0.2.exe
- Size 24.4MB
- SHA256 07a31e73fc46dd81cabb1d9ef0111d66abe3b32c09353c27d18d0860431e3361
- MD5 06a1538d99c5ff8dea2ecd8ca92223d2
- SHA1 ca419558dc0dde89fb41a173f4d838b5d7359d8f
- SHA512 2a28c31dd299a21b682a2a17d43e61a19d68f30d8a0e2d87a6074c8a1535518e183b7248c2725d058682c7428619b5633ad57b502a7dc2715d2e14acc72951f8
- SSDEEP 786432:exmtcgOZEzzpF6UioFTYSZoPKg5bBa+hNUMqt:aDgO2/pRi29ZoyglBrNUMqt
- TLSH
  T1B5473344C53A0E74FD063BB1FFE43D0E46E69DB0061AAE133ADEF585AB522B4A710593
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware spyware stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1
- Target
  _Silent Install.cmd
- Size 1KB
- SHA256 b2c1f80632e5e957ea8044e0638e7ea374956702d8f23ac535cde15fe49e356b
- MD5 6c9445e44084ba135f64d30cd62d3c8e
- SHA1 7bfab567b88089da891dd13f40fc620197ed8397
- SHA512 7bb13f84e751f99932c39ad8cd9958e0c4d59808dd80d58e42056b139f85afc1bcfd6ee90160ed72185516686a8659f696a0f7eb789c99ccb72c7de4233fb58e
- TLSH
  T1921125273670E54C93B00F842D748526742522EB2DB20D60B47F813B83A06C838ACF6B
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery execution installer
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral2
- Target
  _Unpack Portable.cmd
- Size 1KB
- SHA256 4d80e779605761ffecfdd2ee69bb0c5f86a36c288d8bea51db32998f299193e1
- MD5 4d498017fe3dc89da79986a34a84cb87
- SHA1 415cb95e913bf626d26a093c3c501109bd62c460
- SHA512 51bad607de4e424cc43a3f6e34a5bffec472e5f1f1ce8eb83b65a789bf230d345dbb9b2333e6891be72615ed98b782639999d88b0fd7dab66de877d818dc105e
- TLSH
  T1C2115A2B3670E54C93B00F842C748526B47122DB2CB20D10B07F813B83A16C9386CF5F
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution installer
- Executes dropped EXE
- Loads dropped DLL
behavioral3