b5245c2695426270309e6b086b8aa5616b20554a3e203305083113319d47c901

General

Target
b5245c2695426270309e6b086b8aa5616b20554a3e203305083113319d47c901
Size 9.6MB
Sample260817-kxpzcsgn2x
SHA256 b5245c2695426270309e6b086b8aa5616b20554a3e203305083113319d47c901
MD5 e4f1dc2d2d303eb6a5e1ae1bbea19681
SHA1 632cfc4716db4e29eb992f572bc6086c8c1b3346
SHA512 18f9e405cf70bda95c87ac800dda404c847cc052a56cc7551483d3c8a18680a3061a2fffe8e85a879b0d640e005ae165cc33c00d2085b70493387016500585ac
SSDEEP 196608:Q15OIwuYYVf4H5nOyYUKCzp91sB90ifN8XMYntCFKm4BEVukTAuBshNVvEfMj2pB:awvYVf9DJCd9U9jfN8XtGKm4eVTAushi
TLSH
T1D9A6333BEAFD875C948B014E39862ED243542CFC91DFA9394C6842B4D5CEDAD86CF168
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  图文安装上手教程.url
- Size 170B
- SHA256 f9bf405756d78fd3421e7c54a9d99ca90cb8ceae1a1a382dc043d82bf50b9c04
- MD5 836d60517aa941928c5edd47940ab17e
- SHA1 d81cf741281e198fcec4771794db6dce8b8891cc
- SHA512 b849e85bdfaf43a5e581b820b06b360ac3446f9e7d93cde0bc918942356c0ebf2162fb7a297103deb61491b093be791e4cca3d874d8c7df157d24da8ffde7c34
- TLSH
  T14CC08CA90201C0C6E700800A2070F90E9D0FB6E00ED2C6FD2ACADF9D7C9D0D2E848675
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  官方版/SilentSetup.cmd
- Size 471B
- SHA256 2a2792641895124acafc8e70c231e99eca007b928156101fb4429c2eae9bb2f0
- MD5 ea063c4d49425fe8177a7ee31894f97b
- SHA1 62d7318d0161e2a005c6633097e3ad222b8d4505
- SHA512 a894abffa3f89997654c48bf16ee08d5bd78eb75be76f1108ac2cf73d1615c5678f908328b177235da899bd48ad13328b37ebe0b81eca03b96ac30ae87cab4e2
- TLSH
  T14AF0274069AA376432928A0EA76DCB9DD96504ED98EE08B435D520C4313A29685ADCBD
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery execution installer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3 behavioral4
- Target
  官方版/WinaeroTweaker-1.65.0.0-setup.exe
- Size 5.8MB
- SHA256 4af7d37322fb7167c26043bae23d34877733e4bd478a863b92d317e840f87377
- MD5 9b82dfbe5299124b7160f64c873b2276
- SHA1 10efd67ddb8bd7251b5d2de98e9f49856ae869b3
- SHA512 f951fe4f84dedc3bed2f599b958c4d54593769cc0f23c65f4ad32ed0e583a81856575b5ebe9084cd07cb5d537769d55257ecc1c837dc568b6b3cd8de5bb68e0a
- SSDEEP 98304:nkLsgf1khtw6FtQYtkRUYZ9yDQEfe4VkfFgNcR3+PX6gvDCBnQX5FHin1KToof:cdf1k7w6FtQxqUyDQ1Ukfmc1+PXnDyna
- TLSH
  T12156123FB2A8663EC4AF0B35457397609A7B7A61B81A8C1E47F4090CCF664701E3F665
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution installer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral5 behavioral6