6440c5e69e01da6ec4345a7264145d65221a139a46c13e26a21ad18b04663244

Sharing

Copy URL Twitter E-mail

General

Target
rcsetup155.exe
Size 24.5MB
Sample260820-lrzgaace86
SHA256 6440c5e69e01da6ec4345a7264145d65221a139a46c13e26a21ad18b04663244
MD5 8e6e976ad75b3ffcc3a01d235ffbcb91
SHA1 210fa865f1d6cbe44449648ff68916b8ab894797
SHA512 3fce520a672eceaba3298e829b403772cc6dc5ddb918dbaad946cbdbbe01d9ca8788f59c1ec6890049b3780a0c1a7f131bb44383440e8bf5300454e2c8f72d01
SSDEEP 786432:5/X++6hIRtZqSmUzyF35uwRjaqfdENXw5cyLn424Fxc:5vh6GRtZq15u8FsvyLk
TLSH
T1794733221E68C150E825B43064E3060F3D997BF5D752A30317BA7DAFB909EB5D68732B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  rcsetup155.exe
- Size 24.5MB
- SHA256 6440c5e69e01da6ec4345a7264145d65221a139a46c13e26a21ad18b04663244
- MD5 8e6e976ad75b3ffcc3a01d235ffbcb91
- SHA1 210fa865f1d6cbe44449648ff68916b8ab894797
- SHA512 3fce520a672eceaba3298e829b403772cc6dc5ddb918dbaad946cbdbbe01d9ca8788f59c1ec6890049b3780a0c1a7f131bb44383440e8bf5300454e2c8f72d01
- SSDEEP 786432:5/X++6hIRtZqSmUzyF35uwRjaqfdENXw5cyLn424Fxc:5vh6GRtZq15u8FsvyLk
- TLSH
  T1794733221E68C150E825B43064E3060F3D997BF5D752A30317BA7DAFB909EB5D68732B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  Lang/lang-1046.dll
- Size 50KB
- SHA256 0971b4816be601243d9f971bccc9c9aa2ec6ad704072118afc373b633e00a784
- MD5 115a4aba69cb31fb1df7d560b707a80e
- SHA1 76e589227067ad0731ac8ac3053791660100b26a
- SHA512 15ccb6bcead6cc20be474f9d1e2328d0dd49ca52f776b9f07e3bd9e81ff6c4db2092203de0325d23fa421bea7338efb8919e64f9caafb1c50ce1537c9effea3d
- SSDEEP 768:+P5288+pYzpRNx4RBHc+K2CxmfOP4PKQlS+XggZqnFbLY:+P5288PzpLx4RR8Tf+XxZCFg
- TLSH
  T11E335152A7F85204FAF77F766AB926254E37BDA2AD38D24D0210805E5D71F80CDB4B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Lang/lang-1048.dll
- Size 48KB
- SHA256 5885d0c945f477b08e16c2c65a124539f96cbee1a1f30496200d10cd5bb0de07
- MD5 8142f5b9b2675e796b68b980e31b8c40
- SHA1 568ca6b8b9798e0db494503bf61cbb6cbf199fe5
- SHA512 bae04ef40414d18e13ca8ea1336cc7df0aa82b44e169a433911c3313944c4d451c593f61991fcff1ffba0065cbe8657446bdf9202b73250d384e7064e47ad0e8
- SSDEEP 768:DPr/daIpSFMQE1O7PrWx9CARbhokCxmfOP4PKQl+VXqZqnoybLz:DPr/daxE1UTVARbhcTdVXqZCV7
- TLSH
  T124236042A7F81204F6F77F746AB956244E7ABDA2ED78D20E1201804E5D72F90DDB4B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Lang/lang-1049.dll
- Size 47KB
- SHA256 7e8f600e797464c511b51f0a8d1d556b429158136b7f21301928dc2ca6d8ed3a
- MD5 4ab2ba3d0236ea5e64b53b9ca2b0eeff
- SHA1 4820a0203597ccef5b11952f4d4a1c7aae44d5fd
- SHA512 0da2f96601608c600d34ee25a003bb796cdd8abe46e7b36bb0cfa733386ffe120a257d66ca769661a54d80e0a3a7758d6ec0d6ce6bf906d8d23a2bd595b9c029
- SSDEEP 384:zP3SNt+VgSUFGNWqQqdi9hbPkl4PCAdFjImaLkW1sQFrDpwKNsZqnFGkMwx7bLMK:zPvqwnQqdiXPkl4qm5QrwZqnUAbLMYx
- TLSH
  T10F23DC4FFA7C9251E594E3710B968AD310B9B710772D96CAD68FBC78A01C63633252CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Lang/lang-1050.dll
- Size 52KB
- SHA256 c0ff3756695eee3ab0de3bf9bfe49a87b8674c350f12469076835bac438dd5d6
- MD5 61776183ad61beb6735057a65c692617
- SHA1 81468298253ac3c8cf1cf3ea03645c0d0bfb8b8d
- SHA512 37403fddd7fe63be67fcfc4e16099385b84d127b215e811435a6ae6f664dfaec5d3d3fd65f084c9dd9e7677e369bfc3be4b78479413acfbc10faca88cc69162e
- SSDEEP 768:ZPL/50JWM99WjRR153+uepabOS+OF/ZqnT0bLB4:ZPL/5OWewRjEu+a6bOBZCT0O
- TLSH
  T15E33764666FC2249FAF7BF3066B917604A7BBDB6BE38C11E1150428D4D326C1DAA1733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Lang/lang-1051.dll
- Size 47KB
- SHA256 e59fd3bb0b6a710ae3b1ab98de22ba31bab191549d99bfb0651fec787d24b366
- MD5 821dae9b5ae670744c42b1957c322079
- SHA1 5f3843c1daa3a3e2b7844fc6df56d4ef7bcbf296
- SHA512 a24fe4184c9f0e5ac4a6caf30fb80324b263cc4536c6d6355f47d1ecf339a60d2b90f08554b7d958bc49726fd192028df1da0b56990f84235439fd42483af887
- SSDEEP 768:QP/xG3IihdjVdBHgFRPt6LTOpnNvXS+ZqnuzkbL8:QP/xGYihdjVDgt6LqvXFZCuwU
- TLSH
  T12F23861567FD0645F6FBBF7565B501A48E7B3CA6BE38C20E6640C24A5C31B80E9A0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Lang/lang-1052.dll
- Size 49KB
- SHA256 a0cd9ebb0cdeee26bd74741cd97278c597827454e9450a1e4ad42a50223de291
- MD5 9ed0b835368d65e345e8bcd5e51cb44e
- SHA1 f84135f4cb0f0d5b58c049182a547c4e6e781da1
- SHA512 304ad7f5a92f4d3dce16c8de7247a5f4981a71af057e59302a32f82caaea7d3694844f5b5b0d7236dbb5a060df6456bff669d03355ee9f4d24891c44a8544d4b
- SSDEEP 768:jPMi7lUsO//isOTXx2LIM1N0o/GDlQsbgefOP4kpGNxOXXoZqn1VfbLR:jPQydbWXYZCzfp
- TLSH
  T154333D52A7F85249F6F77F3169B847606A76BDA2BD78C21C0600A10E9D71B90CDB0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Lang/lang-1053.dll
- Size 49KB
- SHA256 9f49a733e202fc65c0d5172b3dbc0e9667f7df1c4cd7a9b4505c6f53ab315956
- MD5 616c88b75dc1b57c331ec805c60df891
- SHA1 ef993c2b6101ee5d8042166b1be6d8bcd257ba5d
- SHA512 dbf9b8bd43c0e0132779a2a26a30e91904b856800df27a50a33228807e72e204dc66b8ad34a3a64e149a3cebf609bd5cd6646e561c95285ca1ba1aa871c696a3
- SSDEEP 1536:QPrKxWuFLyQykEW1P9f4KU/7OtVxQEzqZCnumt:sovFLyQNEW11f41/7OtVxQEzqZCnft
- TLSH
  T11B33834267EC5618F9F39F707DB9465059A6BCE1ADBDE20D0A00909C4C31BE9D9F0B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Lang/lang-1054.dll
- Size 46KB
- SHA256 475915231e9690b90d32411e97325e4257d99e39b5bb4632fbe386b630a9abce
- MD5 1792f8a95e211a645807a8bff700d68c
- SHA1 06821fbeb836abfb5fa73af04dd0d0819228204a
- SHA512 f29cfbbf20a86ad6dca4afd7d8514eb28d09ad29e00d062d1e3043c9cd9093d695c3918db492f81cf821b6edc699a47d654486772c63986c6c0953e8df42142b
- SSDEEP 768:HPb1FfwaC3WAeiaWbO4pxIWK9g/Kes8TdRIusi9pBafxU84NV+sifSXBZZqnByx1:HPb1FfwadAeiVbLxIWK9g/Kes8TdRIuL
- TLSH
  T1BD232135A6B61301D55BD1F0D3E04A32BC38B916D46FD159C43BCB2865206BAB7B8E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Lang/lang-1055.dll
- Size 47KB
- SHA256 2fd2d337cb4f5e615d2c4911fed19bfe55666ec69e9e3414cf750e28c486d574
- MD5 fe8036d6737778d24fd2388bc21fc81b
- SHA1 db699ccc3b1ba62604d2a121b9ff50d8cb8ab877
- SHA512 4c8d0d7c045bb1345d5e11f9c1b08b4acfd742a476c9ba3edb8d1f1b3f8e2659b0bc168d68d155bee0e5da828e9b3266a7d74e13dab0c990bb65d25687847570
- SSDEEP 768:YPG4I1rVX0MShwKN2vPEsM6rUozEkpCkLvWHG5rqbwFLhZovQJSGEmqmfGlZdmQb:YPdI1rVXdShwU4sF6r35CkLvWHG5ObQ+
- TLSH
  T16923940087EC5606FAF32F757DB962910AB67DB2BE39825F261090594C31BD0D938BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Lang/lang-1057.dll
- Size 50KB
- SHA256 b54a496cf24da99734713081e42b5ef80cf495a7c202718715c17e7f9b3ec608
- MD5 41fc63174b0a31719212a1564050462b
- SHA1 66f05b9db50f97345488d7a639b51c6fe959ca83
- SHA512 3cb587654ca22330a825e2505e10d620feb15cff3eaef2647f54aa6207cf618355ae2d891a31dfa0d7c17762207aef7faba4e69621de61379999837bc2810757
- SSDEEP 384:OwP3TZhs5BTiDJMqXmIprJ0kj1jQ0gyC/3jWDvQChz8Zdc8Ts+7Y3KNl0daT++tt:OwPF65GsUVQNdDXhBQZqnOaHbLU2
- TLSH
  T1B2333155A2ECA609FBFB6F306EF956911E6BBDA2FD39D24D1201901D5C34BC08D60B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Lang/lang-1058.dll
- Size 48KB
- SHA256 fb234c6d0cf9dc571401d6d05ed2d8c9e20a43e24ceebe34e1072262881a2bd2
- MD5 70cf018feb86647215f15b8ef8a403cd
- SHA1 537d032bcba39e6d3f2c7170098f5c7fa872d060
- SHA512 70cb86c40cc049096fd9e2c644551b5b3d22c930ee0b1bae4a181b883ff45efafe54be8465d3c8c837b906b938b5f43dde58b7648cea31803651950ffd82c5a1
- SSDEEP 384:ZP3PXmdjW8WoIz8Q2VvYRHzMOn0vFL1gJa0jjQpDdi7WCpXlpwKNsZqn8LxwqXMU:ZPfdzZivYGRlzpDEVF6Zqn0xwqnbLeWb
- TLSH
  T18C23114FBE7C9650EA88D2710F4686D710B8B71027A996C5F28FBD34A42C73973256CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Lang/lang-1059.dll
- Size 49KB
- SHA256 faa7e0445b427f9c13f09c5686e012ec26d81fdf6d49f461d626ca421a0f82ef
- MD5 55a4b2d994c6f3620cf93e2437370e91
- SHA1 93695effe78af245d894152c1d2947107a104aac
- SHA512 ca0afee84a69bb470906992771b36cb8a8f9f38eeba7b76a31d9787dc5901a01a7d90398fa6e3b78104e9b17e5e46eceb8ca347c0b06238660429f184e52ab02
- SSDEEP 768:rPpjSyK/Jv8Vh1wuJEKsCXoAHjFMQMmh1HDlZqnifbLj:rPcySuqKf9ZCifb
- TLSH
  T14133ED0FAE749771F699D2B1085207E315F6F30063B99ADAAF1BF424A41C2397B146CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Lang/lang-1060.dll
- Size 50KB
- SHA256 0bac26ee82917e18369919461cdeaa5b121173f63b2c757fde595dac14664497
- MD5 1ddbbf249d29032788a1870becdb1e56
- SHA1 bc22b97446c7de89155019566c9981df3f47a2e7
- SHA512 b4d264d04f2067d961f13aec1a75a5156d88b219a2a43444a1aa58244212754b3bf81769f8d4453a8304d0fd9242d1659e59ac0d2db6547b0a74860232d3b14e
- SSDEEP 768:G2PLlsaiDLCUEMP17l4EBI7Eez1bZqn0XbLY8x35:5PLls7LCUjPL4EBI7dz1bZCCAEp
- TLSH
  T14633764662F82349F9F7BF71AAF806A44A7B7DB6BA38C11E1150428E4D326C1D5E0773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Lang/lang-1061.dll
- Size 47KB
- SHA256 38f70f0a5c16d7229c1ff6e48d32d8742cfd51ade2e3875cd425fec0731055ef
- MD5 1a1e1e0afae6a459f3164f6a1f3a9361
- SHA1 3176889c926e2a2e147b681ba808e5313f627c60
- SHA512 56fcf687554cf9bde545e7f2c5f0df14f9a70778a8991806be2709a0d45b188d10ca747911883d104d6175d4be588e17e7e6a0e4e1c129d04f12742405f15d54
- SSDEEP 384:HP3XyApJ0dFXK/Vm9H72Kuwsc9NT/XKMDl/W93CE6Y8mEZn3RpwKNsZqnJLMwx7Y:HPnfJ0XaM9p9mCEf8Vp+ZqnlbLet
- TLSH
  T18F2374956AECA114F7F7AE307CF412054E63BA97BDB8C26D1600805EAC75BD0E9B0727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Lang/lang-1062.dll
- Size 49KB
- SHA256 c1da3a427966a40ae2108868a2039b106f314d3bdb898f2fa9a76029171a89df
- MD5 e8cd419da979b1bc5b3ec665de9b81e3
- SHA1 2cb8522bbf2479dbabb52d08d975b79bdb369400
- SHA512 d33443f03efded50e3d89b69661f969730de129de6b6522115e64f5760a5c4189ce3c058861b4295e7af23cedd4b30772d0628b626bd41ac21cf1d17cb98824d
- SSDEEP 384:FR2P35UphMHzBlaga+OvSLtDqQBE6X8UJ9g3TiJ2bBkT3yU+tuXcpwKNsZqn07Jw:yPyphSa9gtDqOX53WNuXJZqnMVbL1S
- TLSH
  T14033B88653FC1216F2F35F75AAF407121E3B3D96BE38D25F0210815E9875AA0D9B4B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32