e54763231fe140e0ff1fb72f3071481a20fd6138e54cdbdb8145a89484db287e

Sharing

Copy URL Twitter E-mail

General

Target
reboot.zip
Size 50.0MB
Sample260819-22a5faysey
SHA256 e54763231fe140e0ff1fb72f3071481a20fd6138e54cdbdb8145a89484db287e
MD5 12ab8b6d78c9a1d1d4c36f3635b1dcb4
SHA1 929a6b6e443be07f02396d9362603b327dca8275
SHA512 02fcbc46124b1a2e9cd62f7a4291be1037f6a612843b2b4e2f5c5ca1a899cf92389e43e33dbc65e8586b078f7e59e4632b21b602929a45dbf3a3e86878873893
SSDEEP 1572864:U7vxA3sPxr5KXQPR4DDoUtBwM85EuS5yHWQEot:YfPxFohDxr+57bHWbC
TLSH
T157B7339FD58E450DECF2EBFBA63810D3C646AF5688D78633912D669B008FACB6740174
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Reboot Launcher/app_links_plugin.dll
- Size 131KB
- SHA256 037b4f9c0e3935ab155dfcbeb24395f3211d4ec9ed9901bb9598cd41fa98a9b0
- MD5 140e765c83466e6a6ff328ecae5dd91d
- SHA1 81fc321fa562623bf09c6fc0604cf04ca47656bb
- SHA512 2fc1c14e4383200cb2bed004e915dbc951a9d306cabb9f4683bdceb1b3c5a1947d2d9adc5d3932f87e0fc288919b9f6be195d7cb305ed163821359c6fdf123ba
- SSDEEP 3072:S6SK3J8bbTh6kVPO6QK5utzH1fy7qaUZdhCZC74N:SEJCbTQkV2KCzVy7qaUZdhCZC7o
- TLSH
  T108D35A6B736801EAD227D27CCA575E46D372B4560B618BCF27A4436E1F13BE81C7E620
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  Reboot Launcher/data/app.so
- Size 7.5MB
- SHA256 a3a87347b95d3558ea941e067bb499c816dbe2f46fb2eb5b19a406f97e9503a3
- MD5 06cac4f8facf69e01f936f56c583e3b3
- SHA1 3b3a9cd12094ba2c778de248cf79fe2eb47bea10
- SHA512 e79c79ea961dc4a36d3a8dd0cc3d3d3697b87a926c244caf9e40b30dbe716bd8c1a864d22974a152c804412b2e1ca8d15e60ab1ed5bcdd1ee456734ea115f846
- SSDEEP 98304:xTjnnYFX/+PNXyhzhxUUfl9E6LJLNZsKJ6R8dRodwlJbbfXp:VjnQFOUfl9E6LJBZv6R8dRoalJbbf5
- TLSH
  T17A862B4FD0E06250D122F2B5F78EB7BAB61C78984E74A28A16D84B772DD7D604BCD231
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Reboot Launcher/data/flutter_assets/assets/backend/lawinserver.exe
- Size 82.4MB
- SHA256 5d23c13ef5bbfff82c6d104c78fc105a92c986fc869bfc5f5a737988dd8d17bc
- MD5 cccc60b237bb039249160ad89d577386
- SHA1 5c4b6cc01917bdf5aae50a3d7b6edb2fcaa72db7
- SHA512 ac0174262e249dfbc0f906a0315040f50f5ebcc03600a3470ca5e65990fa3512b866b2033b9b828fc6953bf280e59affa99719f91ed71805c3ceb26427b681cb
- SSDEEP 393216:3n/Z4Y7Mw02NYkd85l+sx/kAr0gZqyBd+ykiAqHQu58EASEhoIaE2lShYqyRvLsV:3Br+IkQJh8VCBY5SEzBxOWbQ
- TLSH
  T171187C13D2F60CA6E9FBA63499F95213E132BA0B2B3085DB36BC171D1F336905572B16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4 behavioral5
- Target
  Reboot Launcher/data/flutter_assets/assets/build/7zip.exe
- Size 1.2MB
- SHA256 356bea8b6e9eb84dfa0dd8674e7c03428c641a47789df605c5bea0730de4aed2
- MD5 1a7eaa1dab7867e15d7800ae0b5af5e3
- SHA1 9e6d344bd8724aa1862f4254d8c42b7cc929a797
- SHA512 a12373ec7ec4bac3421363f70cc593f4334b4bb5a5c917e050a45090220fab002c36ba8b03be81159fd70955b4680146c9469e44ddf75a901465d6b1231ee6cd
- SSDEEP 12288:GJwq/ZGV1wl40xgxBcOocKjdpmPK+Jhd45q+WYWFuzZj9IbcaoFyQraz74JGMWvK:Q2y5uwhDm45qn47IbMFyxz0JD8UvQY
- TLSH
  T167551966F6748275D0B3C0BAC5D29B9AEE723085173086C71289D76D3F17BE6863A331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  Reboot Launcher/data/flutter_assets/assets/build/aria2c.exe
- Size 5.4MB
- SHA256 be2099c214f63a3cb4954b09a0becd6e2e34660b886d4c898d260febfe9d70c2
- MD5 8c71b86bf407c05baf11e8d296b9c8b8
- SHA1 6624ab8ca883c48f02c58250d4eee9e90098f4e4
- SHA512 bb3fee727e40f8213f0a7d9808048e341295a684ecba6f4df52f1b07b528d7206ca41926b2433f4b63451565ad2854570fee976bc7051b629acd24fca6d0f507
- SSDEEP 98304:jgRfP5jnFTyGZEWxSIBHVGT+t1ufqchZ:kRZDFTyGaHIJoWofqc
- TLSH
  T1F0463917E2A310ECC26BC170476BA273B932F81915307E7F79A8DB751F21E605A6DB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8 behavioral9
- Target
  Reboot Launcher/data/flutter_assets/assets/build/winrar.exe
- Size 612KB
- SHA256 7a06b0227ad51454a72ea6e34347ecc8a61d4fb9c9fd15040a97f1ddebc4be81
- MD5 282f2abe0429b978c55f972171dfbc17
- SHA1 02f8c0841d3fb9a4d13c8d0b8266b23949c0b8f1
- SHA512 ecee57057f961b219093bf3f2d212bd911538b26cada1ce89b3882198f04d5d8b8dfb9067ab934902b432d2ff436e88b537075e7e2bb95d5956bb7f9bb23a9ca
- SSDEEP 12288:NpNEMz5MmkbJJ4kSFDgGiaO7Y2Ky6sTr8T90oDuXyIBgVB:9EMymkbJ2PoarBsTr8TaiIBgVB
- TLSH
  T12ED49D55A7E801F4E0B7E678C9A24517FBB7780627708B5F03A4865B1F237A09F39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral11
- Target
  Reboot Launcher/flutter_acrylic_plugin.dll
- Size 74KB
- SHA256 89b40469b227032cce7fc7afdb48846d5b1aca077dcbc4ed4ccf290320063c2d
- MD5 bc4e146c23c111af07c3cae3e736e654
- SHA1 6a673ee5f3720752a3219f8350e1ea3e4510f9b9
- SHA512 4ad94cfd784756864a774fe04ca3a78e678a9d11f4340466a3f2451a6aada88ff71350d176be76c28bafc2ba8d4d23705858a02f332f3083d3593e75f6124532
- SSDEEP 1536:9yTtxFT4VklYk7kFIxlDc58cqYmUeVSye7PlEC8wh+p:CtxFT23+kCu67Sye7PlEC8wh
- TLSH
  T1FC73392B77AC01EAE16AE17D89978A52D3B2B44507618BCF0BA0435F0F67BE41D3E611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  Reboot Launcher/flutter_windows.dll
- Size 17.9MB
- SHA256 78fa8913ccb75361b1976a62c1b6af6a066133450081a61e0d4d13028eb53bbb
- MD5 241cca9117e4403e4ab02d35097f8594
- SHA1 1bad86883d0934afd877801f7d42a5c245b3c72f
- SHA512 121eadd0eb40710f7a4bbbbe7c48967195cf4b9347082b0922c9553eefbe638f014322f9adbee5e063891384bcc12e12ee1fbe5cd1e9b422496ae2d12d719903
- SSDEEP 196608:Vn1mNgzaIdwuUjlICPi1frqT1bx8MYCp:V1mkO5jlIEUrMHhYC
- TLSH
  T14F177C03F69540E9C08DE2B89B5BA927F671BC490621B5DF278847163FA7BB01B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14 behavioral15
- Target
  Reboot Launcher/local_notifier_plugin.dll
- Size 158KB
- SHA256 4276a8b8aae1270490e484513373baff29bf857bde500f06faa0f9fd85a14a72
- MD5 c5abb971bbffbf42c301f84bd142bf21
- SHA1 3f84c9cf64fc30851a17e9f539a77777f5be38d7
- SHA512 0e3513bf885c296ab853d39ddc82078ca60712aec46f2c4e52ff9dea5b3f473932aa16cf4e9cad2483b5633b51a9127a4f95fcfec8c9290e20acd87c5cc13650
- SSDEEP 3072:vTd6mtwWYJITK+WjKy+XE+2ykW931lxcZB2VJtLySw3hFYN2nhNX6oIbxXb4+7lT:vZxGIm+eBkkWtJVJtLySw3hFYN2nhNX+
- TLSH
  T1C7F32827B36C01EAE1A7E278464B8A52E77374960B2187CF1750437E1F637E86E7A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  Reboot Launcher/reboot_launcher.exe
- Size 86KB
- SHA256 07a3f464e479003a9c598cb8a8feab17cc55298d74de34315ae78c31256fb9c7
- MD5 0a99c1fbc2e19352240c29620e90ce32
- SHA1 660838cdb049777eec8c9fb32ee74605fb75c3ca
- SHA512 b79200fe59fda6b04783dbf497c9cae62ef93ae288e013426c316dae645c76ae7a0632a901f469caa763abcc5b3082f52762e53d7dab00d9f9bd716f4e12d491
- SSDEEP 1536:Zf1w1URPkttf87x1k2zaspKmJ/G6huT06G69nlE14x8hoUE3xIN1dh4+Y0e2QpoR:115RMEnk2uWKmJ/G6hujG69mkN3xI7TJ
- TLSH
  T12083AE17B3A901E9E79A433C8A531E89D376BC491765D7CF07D0822B1F63AD0AD3B650
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  Reboot Launcher/screen_retriever_windows_plugin.dll
- Size 112KB
- SHA256 94c8bfbddfe1134c2f72e440de15a886c0adf6283bfbd140486cd8ecc72c9492
- MD5 f5a9626585d3d133440d2551e95b8dce
- SHA1 c992bffe1c9c75eed63c0b4af4e3dc803e22cb4d
- SHA512 6da881251377360d432402b5fc5c6c4cddf59506096bb974ee5e3ef6e2e9ac6ac482a1de4cb7ff1a7b9fb5b7b37462d4a0d8ef65eac05f3805a186801bc4f1b1
- SSDEEP 1536:6NDpQ+e8UEZM8MiUozqQkkEDHkVxH2KVwtORlwFfzlWPJW7qCPCnO9GT3s:2pdhD0opCHkbD+OTQWPJW7qCPCnO9y8
- TLSH
  T178B3386BB76C01EDE26AE1798A971D86D372B4050B219BCF1790431F1F27BE80D7E621
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  Reboot Launcher/system_theme_plugin.dll
- Size 96KB
- SHA256 ab29babfced2e1f897056bec830500cb95d72a80b968d9c0ed87a62b9828dca5
- MD5 2e8f4ebb82de53202585c3b56d674a2a
- SHA1 ec8531b0afa5e088854c6c8ece53d8ce402ae003
- SHA512 1c7613104963a0e1a3c4a65db414d5a220680fd5323b02795e582448daf50922ab61c75e0b6bc610e9171c1d31146e37941a6bfdbd9dd0c0ef1744e31aea58ae
- SSDEEP 1536:hMADtUQWk+wrkVSKQkZBk9Kx9Eekzm+AB6BIBUtkJ1vj3j7qaEUCp8/Za:zDiM+QuSX0BkcqFzmJB6BIBVJ1vj3j7v
- TLSH
  T136A3396B776C00E9D2A6E17D8A664E92C372B0451B6087CF07A0435F0F27BE91E7E761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  Reboot Launcher/unins000.exe
- Size 3.1MB
- SHA256 09476f40b8ef1cc04095631095aa7ceca28e01d50f9c52dadf544e59e41c3299
- MD5 d8ab96de282907482c5af18186abea0a
- SHA1 4de080018c8bbe3b9146c44d0067703030ef6a36
- SHA512 5a992590d30600f936f7ed409c85d3ed5a737e877759a11a0c87f690168d0036885c186e27369429dcecfb7ec1fb6fdbf7574e25604411f93622712dbfb5ef75
- SSDEEP 49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYJ:CtLutqgwh4NYxtJpkxhGj333TU
- TLSH
  T1E1E53A17F38C713ED06B3A364A3386909837FA6169168C2797FC794C8E365942A3E747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
behavioral24 behavioral25
- Target
  Reboot Launcher/url_launcher_windows_plugin.dll
- Size 85KB
- SHA256 0b8a70425144c3f658f64d8c60654af777b207c2ff27d2f8bbdfe26a981c7334
- MD5 667e852af1509b30b2ecbd9de964107a
- SHA1 9f4b44c4e4059596fd4d71dc02ba89f00e1816f4
- SHA512 10f7556391d4827e885bf9e625637637040cf57c92c5ca617cf2ce52c6e02f4e223be50c42d07bbf98b1f0bedb651e52b5838a1b5934562387e796d2eb8fa8de
- SSDEEP 1536:aZwJL1KPmGDzTmnizxgpgp67k5tfQRmsQHij6kHN7VNVu/c47+:pLgBzTsQub7kTfQVj6kt7VNVu/c4
- TLSH
  T14183186BB75C01E9E166E1BC895B5A02C3B2B855172183CF17F0835E1F37BE91E3A660
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  Reboot Launcher/window_manager_plugin.dll
- Size 136KB
- SHA256 f6462f41e64f9cbfee631a34f7f5c2a4fe465adca271c6ad58eebedcba2e86ac
- MD5 e5228b212fa2af5011edcc0e321c706c
- SHA1 489a402b85441a6099b9a0e11de983de46693a5f
- SHA512 1c16b7793c7c03cbfa1bd5a934ef0d95f9fa8e5699a2877a6a53d7244000adec9e2924c9ee86b396f1947c8b76da3d7c2a177d3d39abd21208e26a7f163baa73
- SSDEEP 3072:RxZVj5lgSwNbYomZBOtixkh2GBtVnt/42i3nQ1sxPqaEoTdA1:Rpj5lgnYoW0kkQGBL7ig1sxPqaEoTdA1
- TLSH
  T191D35A2B726802FDD267E17889975E52E772B44617328BCF0791027A1F573E96E3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  Reboot Launcher/windows_taskbar_plugin.dll
- Size 90KB
- SHA256 16e13f83bf6278aed3fb200f72b057605c29853d28eb51235de3f416868dd485
- MD5 beaedde7be2184f7982af9515000db1c
- SHA1 d6910d785e71e6d3fb12ff09ca04b60fca4c932d
- SHA512 7f1642c2da49f4106f6104f2de4dd9336fdcd8e8610d685f568214196c3716df9c015885803544470a14e7c4aeff5e92cb23095de8a0efc90a524308fc3f7e45
- SSDEEP 1536:0kpv6WLlngHvB4kOtLbk9BixZXlcIt9805YWygUzXHAccPqaEnCpl/lR:cWLlngP2vbk90blt980OCAHAccPqaEne
- TLSH
  T104934A6BB39C00F9D167E1BD8A5B5A16C3B2B441172297CF17A1431A1F27BE81E3E621
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31