3bfa9512d5a3dd8c769a5b31079370e8f2b6f9c9db29ed93722241e2dec03781

Sharing

Copy URL Twitter E-mail

General

Target
Proxifier.v4.14.zip
Size 13.4MB
Sample260824-brl6vaxtcz
SHA256 3bfa9512d5a3dd8c769a5b31079370e8f2b6f9c9db29ed93722241e2dec03781
MD5 bd0babacb237f409ac3750aa8b4c00e1
SHA1 495d95aa579b4a7b8876af73f331ee5983ba1c5a
SHA512 405b1375d3dca900bbd354c520c3cc55fc1a2e2e2222a6d3855faed6549a3909d0d8550230d682182542e7fdefc624d3144f6b6de6901d4375a400fd4dfdc3c1
SSDEEP 393216:KZe+k55IbJbvrH5wvWaZe2kmo9DkLnKFj:Kd0gcWa3mDE2j
TLSH
T10DE633E11148544FA6AF8675C5BF845CAA11DFD23BAEF497F39232144F8363A7089E38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Proxifier/Proxifier.app/Contents/Resources/en.lproj/Credits.rtf
- Size 323B
- SHA256 b0cf3ebe3a134c839b1e8999af1d2097e3e06bcb5adeab3ebd6b1215edc18e91
- MD5 8ea8aad8bb1ac173bdb1ca773c36b017
- SHA1 dd5d9df16bcc584c95607820dd31cbc7637cfb1a
- SHA512 f9740ba8e0e8f202eb580c7ac44cbc2d11e5f9edb549f2d6023b07194053762a5e6b2b8f42bcdc778708862845a3f657ad6ee14eee267fa14d5a7518788dfa1c
- TLSH
  T15CE0267ED04000F252DAE22AA5E6CB7E06825791F30AECE6A4A03EC466144293291C04
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Initex.Software.Proxifier.v4.14.Incl.Keygen-BTCR/BTCR/Keygen.exe
- Size 363KB
- SHA256 0617e135f671589bfe24120b3112c1918eea2db717d75fc69a255df8e84b9e1d
- MD5 68d062e523903ca2dd4a0ec6660d70a6
- SHA1 1caaab131057fbac6da93047602e5457c11f2b41
- SHA512 0eb634a75d07195564bb7e9e4a9b4dc4551db8f1e3982a7566a3f24cac7ae0e13251ad0ac5b43afe72c6eda1038d62fa8366a781b9577cb02d465b322ddd6b4f
- SSDEEP 6144:A5i0kMlP3ewiHr8SCgZ/YEZT4KPEDPPIckOGlGcl3V:AVk0LiH3CgZfZEKb7OG/
- TLSH
  T1AC84BE5E67C88697D1187CB2B383520DD11F5EEF85BF33046AA57E7CF8AEC249120668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Initex.Software.Proxifier.v4.14.Incl.Keygen-BTCR/ProxifierSetup.exe
- Size 5.2MB
- SHA256 db20473361892bef8a3516b7017ea414790edd12ba2ef1b41a7350375c31b4c4
- MD5 b0555419cfcc370e7e724593ca1e149a
- SHA1 9344e89d85b87d9f6219b9d8165d8454a813d854
- SHA512 b60c14b65c8a56b1d02fd3864de2285b9ecd0a1150a7b4828c0e88f4718a5103dfc00c13dd3839ad4ebda54fc039cab4dda0923161b4e896d5b7345199b514d7
- SSDEEP 98304:VSiyEqQwhGKDqYmtK7JVPy3fFDIT4CkAKPf2z7J:UEihGKmQn63fFkcCktPuz7J
- TLSH
  T19446023FB299E23EC46E063141B396509CB7EF91641A8D1E43F0B57CDFB65202E3A616
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery installer persistence privilege_escalation spyware
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  Initex.Software.Proxifier.v4.14.Portable.Incl.Keygen-BTCR/BTCR/Keygen.exe
- Size 363KB
- SHA256 0617e135f671589bfe24120b3112c1918eea2db717d75fc69a255df8e84b9e1d
- MD5 68d062e523903ca2dd4a0ec6660d70a6
- SHA1 1caaab131057fbac6da93047602e5457c11f2b41
- SHA512 0eb634a75d07195564bb7e9e4a9b4dc4551db8f1e3982a7566a3f24cac7ae0e13251ad0ac5b43afe72c6eda1038d62fa8366a781b9577cb02d465b322ddd6b4f
- SSDEEP 6144:A5i0kMlP3ewiHr8SCgZ/YEZT4KPEDPPIckOGlGcl3V:AVk0LiH3CgZfZEKb7OG/
- TLSH
  T1AC84BE5E67C88697D1187CB2B383520DD11F5EEF85BF33046AA57E7CF8AEC249120668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Proxifier PE/Helper64.exe
- Size 101KB
- SHA256 c7a55d0acc91d80313bf81ad9d70f883d6cb4b5346aeb08c9ad249285190a52e
- MD5 fa3fac46bbe8e993c8c16522ae13cd80
- SHA1 e39c88e64119d47809c95c96d3b171cc8bbf2ef8
- SHA512 d41996852d9ddf27d82edd6577d85401b4fb8b6b1f31cc184c7687a6e33e37adc1b5524423edb17a2c770c82e541cccd29d7032930d32a58eb65514703be2277
- SSDEEP 1536:WD7Ra9JUeqpNTOLvrNnNqX5msWjd09dlCQiUOGB7WfqTmX3hYa:WDVKUjpNTOLvrNNqXAMRiUOW7WfYmua
- TLSH
  T1F3A37C5763E124EAF1728678C9A18558EB32F8610A719F6F0778029A5F773C18E39F31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Proxifier PE/Proxifier.exe
- Size 5.3MB
- SHA256 86b11fa1930c3c56939151d67552783826da129349cbbb383714394c68fb9583
- MD5 b589e3c955eb8b0490f1aea0f5e8a8a9
- SHA1 d8b5e3b43a9fc3127b05a28266c5d86628f581ce
- SHA512 b93ba73c61f80c3dc5dc4e8619d2b842fb0a3608fc7a0e2220c94176253fe31159bb9da3ec5c459bbcdf1a68c5183710555ba815e683223a987a842e1a7b4d88
- SSDEEP 98304:14KwyQF96L8mf0X6dA3MhnG9+/oUTLVsD39FLOAkGkzdnEVomFHKnP0:1NFnf0WvDTLVsDNFLOyomFHKnP0
- TLSH
  T1E8465B103E49D019E0A551B14A78EF6A98EFFF742EB4A1CF2192F1AFD570B822D24717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  Proxifier PE/ProxyChecker.exe
- Size 795KB
- SHA256 bbc86a816f4f01a49cb4fd2b7139ca6696e068c08a83b361f8c6bafb6eee78ad
- MD5 6d183fda2f78a2c67b4f67c9e8f33d9b
- SHA1 5db8eee8d587436d30a08efc6592e728ba4ba74c
- SHA512 f11bcc96d95ce267710ee6f95eec34b49ccdd7d06c5c91eae5c96093373d4803ae1a7f33b7624778de7fd1cfcf2431677e02d4ece4db01be8dba0f75f6446419
- SSDEEP 12288:kp5ReMuin/VJDdwy2+OJyAGkAD/tEdVtDoj78+Q4:kbktinexJyAGkcMIjQ4
- TLSH
  T19D052A5236A0C026F9A185305E79EE6419AF7E780E3987CF23C7765FE9B05C16A24733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Proxifier PE/PrxDrvPE.dll
- Size 135KB
- SHA256 3a751b62ae5786c625529f5d181ccee8bd01179f907f3ac4657e2fde8dcfe5f4
- MD5 50104dfe24f635280c348a5823ba7337
- SHA1 745452a069c15751c8467695b0dc0df9d761a45a
- SHA512 745a6515b935dbe4a9f61ff557e3319f6d814ab25d791243c72b0815d42a784fab0a65861b4a567f0eb79fc245196370c355df6994c9177e37675c68a9e13764
- SSDEEP 3072:bcDl/6e64AeVah4834Ym3VWsrH2ciP2GydYJ9rYvb:YDtkzZ3UV7uyCTrYvb
- TLSH
  T1C0D36C007591C072E5BE093848A4D76A5B3FB930DEA48DDB6394027A5E707D0EE35FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Proxifier PE/PrxDrvPE64.dll
- Size 161KB
- SHA256 67c72e9e008859e05350a386cce5736af7a5746260490127613148739cc32221
- MD5 15de6a8b8e564ed2df794e40796c9780
- SHA1 37dc72212ad22a9d795ee711b46f5c63d6e67b83
- SHA512 3861629b49c25595bc403da179d93aeca3901dca9e643dc87049ff6a81e9228cabde0ae2828c11dd85facbd765a4d89b35f2b4b2a78aa701091183d714d66e72
- SSDEEP 3072:OyWsbRRyvra+FPTEFlLKNqboDEEQ5vHOPnTVJRk2nIYr9:Oy7iHrglLMjEnOPnTZkVYr9
- TLSH
  T1AEF35A4773A500BBF5B78238C8A34A06E773785547649A9F03A4437A1F673D0AE3EB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18