99bb19f1cc82576df3c8b1cb223c731a67da0b733e6ff36e2ebd59ef1b88e709

General

Target
3ntr_Perm.zip
Size 17.9MB
Sample260826-salx7a1cpg
SHA256 99bb19f1cc82576df3c8b1cb223c731a67da0b733e6ff36e2ebd59ef1b88e709
MD5 aac40d53ff3da64beb3b80e58ac4da53
SHA1 38842e6f99533ab0a40ee881f1c93b7941349da5
SHA512 81d7317b9856d91ea800f97fba2c1dd9cfdd3b5003a63fa12673c78c6769044642a3a0e859a9ac8a405b4edcdfb31d6501d1858e2d65541a3adf06129356b308
SSDEEP 393216:QXosSXUVLI6s8XriMmQFGawZjuOA8X2GawZjuOA8X29:QYZXU+6j3mQFGawC8XNawC8X4
TLSH
T1F11733D0C0923EA8EF9BD0E50FE567675E18BC92F35954A647B393CBA249C529FD0320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  3ntr_Perm/#2cleaner.exe
- Size 5.8MB
- SHA256 6b4a52f825acb200d074d0d4d464952f505ef215b9d1741424c3bb9dfea748ea
- MD5 c0a59b27d3d53bf48fdfde5427ac0055
- SHA1 030ddf0d4538cc7c46def291de2d500febddcce3
- SHA512 6d3a4d4227a102df4f25c2fa823608aebda5d7d0e1b6be49a7579fa9d29ac0c256bfbad09a084fceb8ddc90b95a87301c08835fdf3ebf9e0ee4a46f78ac2b486
- SSDEEP 98304:0Bqbsoulraw/oMXa7Mhq+0EclbMzRRIh3JIDnkhjXev18ijoQaqGJ:2FjXa7Mkoc6IT8kh3QmJ
- TLSH
  T12B5633C694032DF0DF9A1479BCB19536D794BD272718C387A553BBC82E6A6E8AF30701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Drops file in Drivers directory
- Loads dropped DLL
behavioral1
- Target
  3ntr_Perm/Perm Spoofer.exe
- Size 7.1MB
- SHA256 edb665b5abbcba04ead33e62a5cdf9775f676741aebf212428ad7b51a157eafd
- MD5 20abdd54c5388ca67f816b289ae0fa61
- SHA1 cb4a6c01b02e1cfd5b12b5ebca0520391f0f5cc2
- SHA512 5982c781dbd1d2c7c26436b2c6be8af24cc4f663d56bf4f55cf40ae685bc1c7985eaf309ce2d3fe9a873c61e48e91879626403087a9827f765ab8417aabc68a1
- SSDEEP 98304:IqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBxS:IqHhAk1f/FI//E4WSpQ79nBxS
- TLSH
  T1E776AD16B3A0C0B9C4668538C9A6C7F6E771BC14972097CB22E47E5B7F336D06A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral2
- Target
  3ntr_Perm/perm spoofer.exe
- Size 7.0MB
- SHA256 d942aadbefdfc52006302bd893666ba0ec83cdc1e0cbd3e7989f659b9e1da3b3
- MD5 4f40c7ebb4914f9bce64ef75da7dfe44
- SHA1 d8a116160944f06aa025e770b1653faa6ca86911
- SHA512 5bd5867d59d73ec12e2cc2a2fba4f6ab4ece70f7b33b54570485888114c29b000a5f7e1f85695843bce262cfb67504684899a77b507f15fbf01a7573a9cc6692
- SSDEEP 98304:JqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBx:JqHhAk1f/FI//E4WSpQ79nBx
- TLSH
  T16776AD56B3A4C0B9C4668538C9A6C7F6E771BC04972097CB22E47E5B7F336D02A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  3ntr_Perm/perm spoofer_v10.exe
- Size 7.0MB
- SHA256 d942aadbefdfc52006302bd893666ba0ec83cdc1e0cbd3e7989f659b9e1da3b3
- MD5 4f40c7ebb4914f9bce64ef75da7dfe44
- SHA1 d8a116160944f06aa025e770b1653faa6ca86911
- SHA512 5bd5867d59d73ec12e2cc2a2fba4f6ab4ece70f7b33b54570485888114c29b000a5f7e1f85695843bce262cfb67504684899a77b507f15fbf01a7573a9cc6692
- SSDEEP 98304:JqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBx:JqHhAk1f/FI//E4WSpQ79nBx
- TLSH
  T16776AD56B3A4C0B9C4668538C9A6C7F6E771BC04972097CB22E47E5B7F336D02A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4