5b380810bb12d8a2fc45cbff4f8d95b11d597ac2d38a152a5522e4828d22e5bf

Sharing

Copy URL Twitter E-mail

General

Target
AppControlSetup.exe
Size 20.3MB
Sample260818-avncmsbq8v
SHA256 5b380810bb12d8a2fc45cbff4f8d95b11d597ac2d38a152a5522e4828d22e5bf
MD5 ebb01673075639773c157f6380582f58
SHA1 5d70fa703967946cd4c5e41e77807729d0b95389
SHA512 d0291693837787bce26e10e1ecfd66c95f7e4bee80cc04b13747eb6b9e78aa94abbcf5a76063f95cf1f9e0c319891c18916cb72b8af905e1d1bd5f2a0c57f28e
SSDEEP 393216:Bw7XuQoRdWJZg7uD3LKS0Iqc10iWUEyMRnqnbe9ANr0UVcDRhfc:BweR0eiDLR0IH13WUER8/d5cVS
TLSH
T17B2733257D1DCE2FC2EAD0725858BB2960731DEF4E4272CDA3D5FCA96D36247A023285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AppControlSetup.exe
- Size 20.3MB
- SHA256 5b380810bb12d8a2fc45cbff4f8d95b11d597ac2d38a152a5522e4828d22e5bf
- MD5 ebb01673075639773c157f6380582f58
- SHA1 5d70fa703967946cd4c5e41e77807729d0b95389
- SHA512 d0291693837787bce26e10e1ecfd66c95f7e4bee80cc04b13747eb6b9e78aa94abbcf5a76063f95cf1f9e0c319891c18916cb72b8af905e1d1bd5f2a0c57f28e
- SSDEEP 393216:Bw7XuQoRdWJZg7uD3LKS0Iqc10iWUEyMRnqnbe9ANr0UVcDRhfc:BweR0eiDLR0IH13WUER8/d5cVS
- TLSH
  T17B2733257D1DCE2FC2EAD0725858BB2960731DEF4E4272CDA3D5FCA96D36247A023285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  ui/data/flutter_assets/assets/images/main/wrench.svg
- Size 3KB
- SHA256 2673f99faae3347904023ca6aed957e974f588821bfa5469cfafa69ece54c090
- MD5 d25fe91a5b18e025259b38d7901c160a
- SHA1 f02f9a3cd73ba0026af8cb75338c031eaf5d3a30
- SHA512 40c4dd49fa27f974f66fdd10461a1a00f6d08f30266274af3f640274765ebadf257aeaeee4b498d79970091bc549d498e7bab8e33f80f7884e6b20a41b052f00
- TLSH
  T1696171F1F2E4E2C0560BDB71ED33A9A1AC0E2CBE7FC69A9A4165CCF41051198C65CC54
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  ui/data/flutter_assets/assets/images/main/zap.svg
- Size 919B
- SHA256 ad45bba1a369c47153333539c0c957d3c5f3be4466e354ae9a1174f235d9f9f0
- MD5 989020992c760e4e87b8105723809b68
- SHA1 db1c7d0930ccdb82017e51357a795ee7ef4090d1
- SHA512 7164f5abae8dc1bbac20b436f113b6d8fd8a8d85314b1ee4b10babd5230e1dbaf7b1a943415a17d301ebb41294a2817d3c67928682640918aa3b1db6d800ca14
- TLSH
  T12F111CFA564472C4A802C3F2891D2479227F383FBF4882880EA6AD42F7012BC584CC89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ui/data/flutter_assets/assets/images/main/zoom-out.svg
- Size 1KB
- SHA256 79f4c1353e8720d4da65b17316eefa129b542feda05a39a95a2e6f97864cf288
- MD5 75532dd5e9424f7107eacd8d56565634
- SHA1 9248e07c464eb1e6f735f14441a169803e4db93b
- SHA512 d35933f5c68b8a1e92b869765d4c81c4eadd7266803e2731b963e8b403f4d4a24000e644f489d9f4eb8c09a46ce3ee6048f73a1373ad8e1cd3912a516a0e705a
- TLSH
  T1F7216BE841D9A3C06646EF7C8A18B67D122235BF7FC1C64B81946941E14543E9C8E94F
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ui/data/flutter_assets/assets/images/views/events_page/launch.svg
- Size 596B
- SHA256 40cd73aa829d060f0953a9d54ae044a30bdc8d12be240b25f3b20907225eb51b
- MD5 bb306fe54705cb748dfcf825516bff25
- SHA1 c1d3348f6758664bc2d7109258b414c17299c144
- SHA512 453823d8b503c6393cc80734ffefdbdcc04303d99dc960d2b531234ba8240af6a2ef4f95180b63f45e1ab123068a6a700dfa14ade4081d2f413d1e1b9119fc84
- TLSH
  T177F0ACFD91554EF0FE45C926ED3628F3648770B67D8801ADC45936F3A4455F4BC20E24
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  ui/data/flutter_assets/assets/images/views/events_page/single_event_bg.svg
- Size 297B
- SHA256 4b60b152ab09e40a6c123db9fc5b961c1491a2baa131609a7191282a8f902da0
- MD5 dced2978dac4391d98cfdbb95b63c79b
- SHA1 784bf84423f3fb28b13ca403d4b045b58e579806
- SHA512 37cae7f517d7198d54c4e4c63f46b1dddccfb84fc4bed1a2243f59bfbd280ae5be30564474d409e349bfab96ad988ec74e9ecd2d2fa70983a0e0554e0092cac3
- TLSH
  T131E0C2D9179C7840EED3CB60AA1CB526AB16209225A80ACBD100BAD1D946C8F2C59D6C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  ui/data/flutter_assets/assets/images/views/events_page/terminate.svg
- Size 883B
- SHA256 726a68720a32af0c34333995770a1793ce3be6c6f3c3fb7862461bbcc4275f8f
- MD5 adb058b111e991e963cc6f78e254a1e8
- SHA1 7f09ad096d4655f2a032ae5d171c4e6f2287f127
- SHA512 15b294e3571b88c6ef7e2a20a3ddcd5919f8e006d0c99023c692829e9be5361f2738c82a1c7de85b9d8585c3aa11f3b040fb541f1a06d79e2ace9d533dd1aab0
- TLSH
  T151112FF420A0E8D9A5CAC954FC37308A281B14FBAD4241EAC0A9F8E664012F39D30DA8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  ui/data/flutter_assets/assets/images/views/events_page/wrench.svg
- Size 3KB
- SHA256 158e04494d998ea6bcfd08107253c7c52f15b515ecb7b54a63ceed4d2ef66a48
- MD5 a0e873d1dca2ed3f989a2f8392700fe9
- SHA1 e7c436e7098fc75d4aa24386785d8ad65498c6dc
- SHA512 5801e48c9ec394204c707696fa3f604a9619e735628f023d994e61910931a67df0baa220bc44d782a56d9b259be566d37bc63405c1082d464d6bb89ecd2a8a90
- TLSH
  T14561A9F4A298E2C0710EEB70DD31B8E6EC0F6CBA7FC957968141DAB491551A1C6CDC40
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  ui/data/flutter_assets/packages/components/assets/images/app_settings.svg
- Size 5KB
- SHA256 7d8a2011bdbbfb8159fd590a7fa72c786b330e48fd828228cd8008b82617a1c9
- MD5 47a45c25fa34696d01a50fdd95473971
- SHA1 801cf8ac59da4c6d91f80ec3cc7ec66cfd984b43
- SHA512 47075227f80759d8f75d8a33d1c45b21468322977765ce9addc9c65fa4829d54e8a8e3ded9ba0d9456e44e1d8721345437c4346be8b2df35c62521caebe71dd2
- SSDEEP 96:PRRnLJkSe2xv463v+nh+uh5LT5OVHrieh19KzaEiZKD:PbLJkl2xgC+h+uHTAVHmAriF
- TLSH
  T161B180F7A3A8B2E09907CFB4E82756B2BD5F28BF2FC9568940D4C8D5F56128485CDC80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  ui/data/flutter_assets/packages/components/assets/images/check.svg
- Size 526B
- SHA256 a70f17c5095b6057eba051735273cef65bdfbc882bb2e7f554cd348a9dcd75d5
- MD5 917e46ddc12031cd04f1cb43ac4e0b81
- SHA1 66462a4fc6ada5dff7bac5e903c43b29a3a99cda
- SHA512 bb23daecba010a4e8896548d4675a5853e620be791e258391964d238fc47ebced050002c317858f2bd3ba544fd252742b5838bf175c66fec62ad399d978d2491
- TLSH
  T1B7F050997814DDB6C902E374B51E09EA5831F7AD3F4520D960C87D97F2005AB9D41D50
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  ui/data/flutter_assets/packages/components/assets/images/checked_icon.svg
- Size 521B
- SHA256 c28048423dfd6e33e6471883755fda7ebd51d7c1579ebf790f4ac6979d0648fb
- MD5 fdb4944cdf3809d90dc696cc7572c300
- SHA1 7d01e4d82835d3f333c4670ec09aa0177ebf6fb5
- SHA512 b024a81dcf5adfc32317b2be50452d220f8cb2caebce7829b68a863dad3ddeacc4f77f0515ee35d7623eafb04cd37aa35cf5f0c0e3f2deaba29889138d9579bc
- TLSH
  T1F9F00EFA288E3E061601C331F03D36D3B97700F81EE14221B1C27D57F8202B12A8C9D1
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  ui/data/flutter_assets/packages/components/assets/images/chevron-down-small.svg
- Size 533B
- SHA256 5a428ee8e9cc14faf0c1d52c7e153306784c3165cdf4b95c2f6842a9229198c0
- MD5 aa6bb2708779e5d2354637e305ca3455
- SHA1 cc7eab7df3dca7261d33eaef9c76ec6244224ccb
- SHA512 a418ccef79c401c89b63c7636fd90d57db91287feada31d712cd23a739195612312aead330c84ffc7c86d13f4d84737b6feea5538039c2c4ae7de304bf826669
- TLSH
  T1B8F02BF8E89A4CD3CD22D835D224309094A260E9DF44CFDCB1A1943BAC13D830C88DF8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  ui/data/flutter_assets/packages/components/assets/images/chevron-down.svg
- Size 539B
- SHA256 e3fe711e9a46c25f5df361c2383be2c669268e27b13405c3bc588a989d85f77a
- MD5 6c1a9599462f6a068369d302e918317b
- SHA1 d4ca55b747c95fb9d26b27e7613e8d8a3506ede6
- SHA512 5e5e3098713ac65f3bf4535844d78ed10983c37cd7618c9ce4f649d8b872b81689688fcde12d7eea256856fffcc6ced41f966a89f0ef520ed01fae6d7a45bd4b
- TLSH
  T148F095D5B070EC45856EC3F2D9372DE2645711F4DC4B0250148DF527F119BF31C15558
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  ui/data/flutter_assets/packages/components/assets/images/chevron-right.svg
- Size 540B
- SHA256 bf46b3d06823019d42f4fde343f980bd658240b31c41686d87065a9968070b5b
- MD5 221215e9d212c931bc4dc7eda3821cf6
- SHA1 a36b7cae1cc51c1ac9c28e1f86b049df2ab4c3d8
- SHA512 fc3afec8065c8e0595b9c23a880930250133b3613503a8d79fafc806c4355f81ae12166a3a113a4fd6f92f3741fae498d21dcb295bd7122f2106ea36b2078b2d
- TLSH
  T17DF024EAB055F9A8C24E83F2D9267BE2344B24E4C84A8111699DBD46E00C7B54858608
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  ui/data/flutter_assets/packages/components/assets/images/chevron_left_24x24.svg
- Size 488B
- SHA256 44ea34edaed03f7c081cd6343f06d00020f4b58387d1d37f6872f719b3d529ce
- MD5 068290744d00e41fc9dd114c471cd5d5
- SHA1 f199ed591570eeb9135ba76aeca747def7e0901b
- SHA512 d0866a0bb6750d81463838d4a966f5db576d1011b005fe93c52f75f55471170e9ec9b5172b33f2d27e82599280e530bd8784972c17bd0f801a5f17d8fb63ca06
- TLSH
  T16EF0E2EF84520DD1FC0ACBF4C52C5663EC130DEF7789445C8651AA22F31127A4C4EC95
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  ui/data/flutter_assets/packages/components/assets/images/close.svg
- Size 734B
- SHA256 1419074ea278cd580aae71f3d268ca2c0aa8fbdeba314a2f494e22705eddbf04
- MD5 8a79bd6345d0516dbe5655ca704e41b4
- SHA1 edf17f8d20cf3e6897d87aa8128eebbe87e0e70d
- SHA512 906fd92b82a01af443b23fb7c6f17527a1036041f4015a7031d866333ef6f71d4802061b7355866a6bcd4e303798b554577f32f0da72da4b838d6978dfdd4455
- TLSH
  T10B0170E7B155EA5DF44BCBF8965758E130412869CC0BC06632CFA821E564B930C1D314
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32