721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6

Sharing

Copy URL Twitter E-mail

General

Target
Portmaster_2.2.1_x64-setup.exe
Size 96.8MB
Sample260827-p6ebfavelb
SHA256 721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6
MD5 e02558ef20c81a5458ab6a1aab4ade42
SHA1 9718d566336141ce99f1034451c9ea882bfaf258
SHA512 e838adf9a3509a88d0003336e1cf86ad8f0aa52880a52250fdb22f785c6c3c5a81c1572096d0d353458b032ea862ff8e7981c29c73c5b8dc83d2e1eebdcc4946
SSDEEP 1572864:7id1zV/kXljlvgA6D8thDxMWUxkhK2yHUs5M4XxDaGUcNhSS+ChPj7m40bODU:7cPCl2AY83DSRkwQMMKUfoSSZ5/mPF
TLSH
T1312833AA9898D745C764C1364C82D57E42ADFDA01BC3D81B39E37C07F63A10A8466DFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Portmaster_2.2.1_x64-setup.exe
- Size 96.8MB
- SHA256 721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6
- MD5 e02558ef20c81a5458ab6a1aab4ade42
- SHA1 9718d566336141ce99f1034451c9ea882bfaf258
- SHA512 e838adf9a3509a88d0003336e1cf86ad8f0aa52880a52250fdb22f785c6c3c5a81c1572096d0d353458b032ea862ff8e7981c29c73c5b8dc83d2e1eebdcc4946
- SSDEEP 1572864:7id1zV/kXljlvgA6D8thDxMWUxkhK2yHUs5M4XxDaGUcNhSS+ChPj7m40bODU:7cPCl2AY83DSRkwQMMKUfoSSZ5/mPF
- TLSH
  T1312833AA9898D745C764C1364C82D57E42ADFDA01BC3D81B39E37C07F63A10A8466DFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution persistence trojan spyware
- Adds Run key to start application
  persistence
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
- MD5 ee68463fed225c5c98d800bdbd205598
- SHA1 306364af624de3028e2078c4d8c234fa497bd723
- SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
- SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
- TLSH
  T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 1.1MB
- SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
- MD5 7b89329c6d8693fb2f6a4330100490a0
- SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
- SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
- SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
- TLSH
  T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- MD5 d070f3275df715bf3708beff2c6c307d
- SHA1 93d3725801e07303e9727c4369e19fd139e69023
- SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
- TLSH
  T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 30KB
- SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
- MD5 fc4691e51cdfac476b2fc63bbe951e82
- SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
- SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
- SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
- TLSH
  T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  WebView2Loader.dll
- Size 162KB
- SHA256 609c974a8cdd6a76a745b3d81b62f321d79f2dc8f4929e1eea8469d9d78baf79
- MD5 6842f2ebf863ab8ee1be470794d1f703
- SHA1 26242ced6ddf005e0ea1073409a058121636fc9b
- SHA512 339be4521b27e29e457e6d662a7ac98320729ad75df976ccdc9c83596c8b1bc7888ad465e7d38276fb5c0cfb597e7e6e9ba377c6f42db850c317f89e218ba5b9
- SSDEEP 3072:DrQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Ty+EtJfy2aQQtq:nMMTlTRTzWiThTNTFSzjiBM2h9P5oZaQ
- TLSH
  T18DF35B5772E4407BE16A8274C5A34A11E77778510B60ABEF03A4477A1F23BD4EE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  favicons/head.html
- Size 1KB
- SHA256 13ccaab556d81a9148a7c98e093da4c95f84c6762a9e790665ee01a6a7229eb8
- MD5 92cf95bc22fbbabcf370817e99cade37
- SHA1 d7f616e344c56cefb9a51ca44936921e76f87855
- SHA512 5668a450dd49d198efefa1b349d1197e0efd493d10863555aed8eff128bda29c436275d151468124d0daeafdd6062d266aa4b560bd25cea4c906cc8d056d6d87
- TLSH
  T153210B431808CC063731765ED72B55DAC043A5A9CEE6FD6C98E3456260F0DA10DB3977
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  fonts/Roboto-300/Roboto-300.svg
- Size 48KB
- SHA256 bdc613d60655fab5e7f78d7a4b573e8a72cd3110176d4cb85ef0ebd7e658d211
- MD5 1edaa6e50c2302bf0221d252e1caebb4
- SHA1 abc9fdf63e51f3b26f13302ed14525f1bb052d73
- SHA512 86a15c30d94bbcb43711cbe4f9bfa114676a9fec08ee9102c6b1a4083341d19ba4aa8490c924cc70638c2e37ab65368628b1193b58dd313e2b66d54f260e3060
- SSDEEP 1536:r02QwKVLM4NyZdrlFIq/fAVkDHKOO9PXkfPjA:YjIbZtlQOEXkfk
- TLSH
  T14E23A4FAE10146C66E5FD3C0EBA0B5ED446EA17F50122C918D0A95F90C1E7ADEE0BCD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral18 behavioral19
- Target
  fonts/Roboto-300italic/Roboto-300italic.svg
- Size 53KB
- SHA256 25ee6421749191a8369ceacc23b56df4a78bd09cb0210e15e549b11d0e38dda7
- MD5 290e6a6c01f4703f351415432980aa2f
- SHA1 e3332d81aba170da7ba6f37014c50c2aa2fd1fc1
- SHA512 f0edeaa2cad28b9e3f844e1baecbd08fbeaa66c69742bf006d6b119dba6c94c1f2d9ff0fce2381cb3729c51529b4ecde61db64f8c4adc1426b9676f9c565227a
- SSDEEP 768:TG07cG8GhGos7258wiHd5rC86NlbtFkRKUzTkkZGjUKkk3Qn7KvKmKWKzKhJ+wAo:AyG2U5Eb/kRZzYk6UKOU+wcWYhG
- TLSH
  T1A13383F6E94141C26A9FD3C0E691B1ED842E917F620728958E4DE5F50C1E7ADEF0B888
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral20 behavioral21
- Target
  fonts/Roboto-500/Roboto-500.svg
- Size 47KB
- SHA256 002be2764e0c7d4d12e0f5854da7b4f23ad584a519e6ab1b781815fd65d38120
- MD5 f1d811cdfaea49c969500d4bbe52251b
- SHA1 2920b9eb83fcf21d18001acf38fb74e0e3295121
- SHA512 08b935b6783f26d72e7b7b955943c63232ed776e20a1f48af2e815c4cf6701eb72c7460a68a5b9f8629f35f84aaf08d09feb6b56d6120c7a4bc9971b87446404
- SSDEEP 768:TlvQa2mHGVSeTz00O4GzSm3i2Iw8BDF7G7N+xl5N2A7U6:ZjASeXr7GzS9vg+xXN2A7U6
- TLSH
  T16E23A3FAF54045C16A9FD7C0DB9174ED402E527F25162CA58C4AE1FA481E7ADEE0BCC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral22 behavioral23
- Target
  fonts/Roboto-500italic/Roboto-500italic.svg
- Size 52KB
- SHA256 9ae3e9709dcb42edc1fa758b7c9c512f9dc90a5a64db39a9757d531251e9ded2
- MD5 084d5c434250ba4b6aaa634908eb4b15
- SHA1 e9f40016b8290ab5ca6a7c1c2f7b7cfbdeca459f
- SHA512 48dfef49bcae1e9d5468348f389b5a59149965fdd49bed5c69d52af64eda696835dcf32ccbc8776c28660c6ad47fafde7e28509c74a68585b1cbb0282bd48639
- SSDEEP 768:TREbHnQIEP1ftknwLEdE4X1VesL6POaYjIypc7jJzDedUazNnuvv7QW:qta1TaT/L63WIV4fBuvv7QW
- TLSH
  T18E3395FAF50145C25A9FE3C0DB85A4EE446E827F625328A48D8DD5F5081E7ADEB0BCC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral24 behavioral25
- Target
  fonts/Roboto-700/Roboto-700.svg
- Size 47KB
- SHA256 8af2654240dc0e632782a4f919c6fe5885c7b9e6b856efa0a7ea989a14fb56fe
- MD5 7f57c4c0f3b44acbe338d7ff6d6ee5b1
- SHA1 35101c237ad0763d1e552b2d414e022e1e2a279b
- SHA512 988b5138a8f55dc842b815e8b17bfa3707624f789364ede2ca78bf09ef44f78070fabc53f2fd7ab59be7a39000ee3b306ebba111b40fbb22a68482b18c463880
- SSDEEP 768:Ta2NZRuu3g1z/LoM8BQmNQEazgnOM9I2U1A64LmDf6vKLroUQ0QF9Q1qQRQkLo2x:bNFg1pnmiE/OM97U42Hro1VI1nWulX
- TLSH
  T12C2372F6E64185C12AAFD3C0D750B1ED443E827B621628A58D8EE5F50D1E76DEE0BCC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral26 behavioral27
- Target
  fonts/Roboto-700italic/Roboto-700italic.svg
- Size 52KB
- SHA256 186567c03751c23366133102964442b995e209690f97d9763e83c36fb95cf76b
- MD5 bf39ef96a254805657605c016263db25
- SHA1 547bb7c6be969beecbf19040a6b31159895d9cc8
- SHA512 a7d80198a2b5a41dd894b21223b612df67e1ada9a023b80f6d4e9fe49c53cc10a5ac72e80a1bac97cc75deeb868cee0ea38a7d07ac2029b1d1a8b971f548fdd0
- SSDEEP 768:TE4f4d5tb4Sqk9WBBcZtX5UBs3BBKjeLIxnMltOMEfRakuZo9at+psC0dS:Yltbj9W85UBSf05xnMzOMEfRHOdCN
- TLSH
  T1773385FAF94180C61AAFD3C0D795B5ED406E527B551328648C5EE5F50C1EBACAF0B8C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral28 behavioral29
- Target
  fonts/Roboto-italic/Roboto-italic.svg
- Size 52KB
- SHA256 ea2903eaf37222d05d2c812d4305ae4107ace6a0f62c80ab331952f047e17740
- MD5 13fb9544bc459a2351bbcf844f5763d8
- SHA1 39737bde7cb3e9910282b3bb94f1c83d08f64e23
- SHA512 aae50a864809281fec59510c6d7893ef691aea933c8db683afc624e93bc9621910ff333f623712ac1e6285dd2ca22b0b3f960b4e7ad4687812280637f29559fc
- SSDEEP 768:T44Yj1Xo9SR0teHicPLIcFJRaZc7fbTzGa3smne+vMvovOvPYiv8ocB2I7H1RFua:05ZHicPcSJRtTZZBEg230Bb7dT
- TLSH
  T1293374F6FA0185C21A9FE3C0EA81B5ED442E927F611728A58C4DE5F5091E75DEE0BCC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral30 behavioral31
- Target
  fonts/Roboto-regular/Roboto-regular.svg
- Size 47KB
- SHA256 cc9d8f0f4fd1364ef57762589dce1c56c97c744043afdde55ca68ce977906a3d
- MD5 3d3a53586bd78d1069ae4b89a3b9aa98
- SHA1 148fe3b2ffcb825efff40a8378f22125ccf88cb0
- SHA512 8e7a4900bba7e679d3f4405da7ce2bb05e90faad064c7da420c203ff7515608debb2dffd4df9c3e308fb3de5074ee1989acd8ec4297de373c266b59d9630455a
- SSDEEP 768:TZPhZCupDrez67/jOgoo3D68lxC61IMzBq0yTN+KQOxKiWo0tV50gtpFh:VZ4WDgiuo3Xxz11h3Oxgt8cFh
- TLSH
  T1272382FAF54182C25EAFD3C0EB8474ED442D513F211728A58D5EA5BA081E7ACDE0BDD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral32