General
- Target iRemoval PRO Premium Edition 5.2.1.zip
- Size 50.2MB
- Sample260819-ltgz1sec59
- SHA256 98394246dd9772aa12023a577f5662ce9fe5805db62deb16171b39c32385b100
Malware Config
Targets
-
- Target iRemoval PRO.exe
- Size 2.7MB
- SHA256 07452a1e12fe3a36519611b3932ae43cd2c64093981c047a788fa1939e424db7
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target iremovalpro.dll
- Size 32.8MB
- SHA256 d15effa6dfad0e49cde444cec49f41cb81405d5266558333aaf4674b90a76701
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target ref/toolkits/idevicepair.exe
- Size 384KB
- SHA256 6834732c5e4bb21e9ae87d03522e50ac4125c70a1d19e5037a02045388f62f18
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ref/toolkits/ideviceproxy.exe
- Size 23.2MB
- SHA256 f7a621a90ed8b567d27b55717adc1d9e1577cce06911406320e0927ff82d8231
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target ref/toolkits/libcrypto-3-x64.dll
- Size 4.0MB
- SHA256 069a32a2eb6648a15afac0a309d554af7a1585ab681fc6f4e177716be57ce352
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ref/toolkits/libimobiledevice-1.0.dll
- Size 1.7MB
- SHA256 e06d5c0601d1080297682d1c1f5a0830b4c6991763f6a83004298002ddaf9e4c
Score1/10 -
- Target ref/toolkits/libimobiledevice-glue-1.0.dll
- Size 491KB
- SHA256 0a93d74db0bf21e55c5974fe5c85268b63de1048b65a37ea27aff9341dd81313
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ref/toolkits/libplist++-2.0.dll
- Size 778KB
- SHA256 bba856ab500b6af27ccc6661bf65c08035d981a3522fb5fbf24ab89cadbe62de
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ref/toolkits/libplist-2.0.dll
- Size 905KB
- SHA256 e04f2c69c320844be4bd4bb56e5fa1bfa5fae8d3dd4e7183944f96c94a0e92da
Score1/10 -
- Target ref/toolkits/libssl-3-x64.dll
- Size 640KB
- SHA256 a6b329c66bf0b14fcb671555f21df7c6a7bf9b97938356ff252ba1e0ccaf3881
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ref/toolkits/libusbmuxd-2.0.dll
- Size 317KB
- SHA256 11d84e7ddd8638b85b779494a5eb817404184fdd8b07af8d40f3fb77f68d6fa6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.