dfc4ac4c72fc3443821894b3de9064d1dd80ad4a24b39d15c9afb1f68049c9a1

Sharing

Copy URL Twitter E-mail

General

Target
IriunWebcam-2.9.8.exe
Size 2.6MB
Sample260828-xmkccasdnc
SHA256 dfc4ac4c72fc3443821894b3de9064d1dd80ad4a24b39d15c9afb1f68049c9a1
MD5 c8933b2997cd88fc70b2dc36b307c5d9
SHA1 47e95379c1cd9cb60db654d66b98fe38cabfbc0c
SHA512 4c1647b3df3e34f927853b112dcc65e04454579050b11de10a66db11a900df83a3dab7fc1540e7af15547af7a723509d33a91fbc63481aeb373b80d4eafaebc8
SSDEEP 49152:R/pk1XYnGDiMtI8LQCzUWDT4orWk0YVp6v+4UdCS7wIEVaHvsP:RGisBLWBorW6VgUpwIgaHvs
TLSH
T126C52384E268C9D1C8404A3498BBC57355377CF74BA9421AAA5CFE1B693FA318DC731B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $TEMP/devcon.exe
- Size 117KB
- SHA256 8b9bf2c01136e203732dda5232924aff40ae67d6168d05ca80efd19902cb8fc9
- MD5 320e3210bbffe99e5f0b6ce4dc943b9d
- SHA1 23c131c8603ec8f9e064c05d302a557714cbe806
- SHA512 6e6d58995f5f668ebba52b51c73fa86839a750acd35c7daeeec5ab8371ca660a3077cabfaadd8b80b0463055b099a4b2c863fdadff75eaa553e8611ac91b692e
- SSDEEP 3072:C4xbslWCBChVAyJCMhcuk6cqp2vJVx/6TuOp4oEk4ZBMHWxS:rbslrBChVAyJCMhKQ
- TLSH
  T1DDC3C60263E85659F6F77A3069B552215A777CA1AF38C6CF0298912D0BE3EC0DC74B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  $TEMP/devgen.exe
- Size 49KB
- SHA256 7a8503cb534e005ef3c756a59758e6404dee22faea047dcf5e7ba32f4813ca9b
- MD5 161545cbd1d5f80cc8fcc577b418f0c4
- SHA1 8ee77b283e8ae47d07931a6fd851a2a8870a1841
- SHA512 ca8a6ca5e9f0df1be74f0aa842dc3177b6c5dfda3a8c9bbf0e2af6286910a201004f33156c389481c6d15240a737c7c5220cc320f68b00a76e7b39e21e7da662
- SSDEEP 768:C9f2BdPbvMpICaDuDElxeo++Va+6KQsoFAsXszi9zZOT:Gf2Bd7KaDuDELN7Vj6KkFbcyzZQ
- TLSH
  T18E33F78123DC0545FAF67778D9B4485A583FB9A68834C61E2179818E8FB7BC0D9B03E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  AdbWinApi.dll
- Size 95KB
- SHA256 d60103a5e99bc9888f786ee916f5d6e45493c3247972cb053833803de7e95cf9
- MD5 ed5a809dc0024d83cbab4fb9933d598d
- SHA1 0bc5a82327f8641d9287101e4cc7041af20bad57
- SHA512 1fdb74ee5912fbdd2c0cba501e998349fecfbef5f4f743c7978c38996aa7e1f38e8ac750f2dc8f84b8094de3dd6fa3f983a29f290b3fa2cdbdaed691748baf17
- SSDEEP 1536:Jwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCP:JwqD3L8Tezq0et+ui1y
- TLSH
  T17BA3592138A1C172C8D261B90AECF76193AEF4B10B3599C7379803DEDD653D25B7528B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  AdbWinUsbApi.dll
- Size 61KB
- SHA256 25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97
- MD5 0e24119daf1909e398fa1850b6112077
- SHA1 293eedadb3172e756a421790d551e407457e0a8c
- SHA512 9cbb26e555ab40b019a446337db58770b9a0c9c08316ff1e1909c4b6d99c00bd33522d05890870a91b4b581e20c7dce87488ab0d22fc3c4bbdd7e9b38f164b43
- SSDEEP 1536:l72doFmOiHizFbPlspcsbj5ZsP+YeTs1p:lSSfN9+YeTs1p
- TLSH
  T1C8534B227991C072C89661B909FDE651A27FBA601BB184C7779C03EBED303D1AB79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  IriunWebcam.exe
- Size 503KB
- SHA256 a321ce1ab7516afaf6de60097f5967cb0d899d781b3eadbd10dd8942c421b292
- MD5 781e6f76d202842e1b989f56a6c224ba
- SHA1 dcb8a8850fb22789c147d687f0c48961f81d298c
- SHA512 f154233c90536ec4120f9c0e9ab104dd78d62848ce52ca61361fb7a856b55d8c2e307cf00d41225bfcca588acae623058144fd45db12c473b6eb503a64718631
- SSDEEP 6144:bMXF+7Gh6xcl4btYpl1wfxRf5gXQDdrmY5Ky5:bMA9q4bQufxRf0QZToC
- TLSH
  T1A3B46994F28585A2D511067284376AB7462BADF39B2492E327ECFC5B89733B10DE3713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  adb.exe
- Size 1.9MB
- SHA256 766bd599dc2012ec79826cc54690276b46682d067ca8723e322a65a921a24226
- MD5 96c1a1f9ece6eee131f57117717d5990
- SHA1 304fd11cd4fa1694ad572c44edbae34a5d2be7e1
- SHA512 8995af1b47e115c249619634dfead94193b979fb53b923b822f56f3f94e3bfd0dc5d8cad3333c5b7987eb717fceddce072fdf722255e22399994f29ed7c4809c
- SSDEEP 49152:0RiLyc3hcPSsYKKRo+EqGxhznNhYnQk3:Ii9WkxEfxhzAQk3
- TLSH
  T11A958D0EF6C3E1B9FA8714B0512EB3BF7E3506009526CEF7C6808D706D625126A9E76D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  avcodec-62.dll
- Size 1.6MB
- SHA256 f0d91729a24dba84020badaaf7bb6f429b8283840e8f9239d0c8bb69fdc183a4
- MD5 c3296cd76144c7c69d7633e04b6122a0
- SHA1 9e8cedb2520dd9b84528c56811f262464b4f9873
- SHA512 0c757fd9354ffc512478f4d1e29d42027ecaf9d1d3267c92007e9e655da66789f44dc7d41e98b48436b466274d1d7838a65fca2b3116cb96214cb8422e5ba4c0
- SSDEEP 24576:Jt4HOgRuXRuqO6yonXQpr+neDGbzK3cu9c16XmVkml3cRRQR6XmH+MKuuJKC55v9:qOgRuXRuId5TcgRYTCsVh79rAbwz
- TLSH
  T1A3759E81E69713D2E94A14B4426B773FA63C2E2D0310DAF7DB846F61F872BC0953B649
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Drops desktop.ini file(s)
behavioral10
- Target
  avutil-60.dll
- Size 865KB
- SHA256 8cd48c0566ce5cd67172d0f38ece80f4975ed23309a58db0fc8b0331c1041b4b
- MD5 bfc5b541343a76e5bb80d3b1ca4a6c2c
- SHA1 564eb6629234e36b5295eb756b094fe2c24ab210
- SHA512 00ca35496e997b6c8b1fbd05f61da029a8450ae64e3e52dc9ba9a02dcf0759efb10e8bfe6a3e5d18a4ad0a7962f2916b9f6ac4dc38be3ca07a048c92d10fc2ee
- SSDEEP 12288:H8WW3TFEgj0zvIHxRVUuFTgh8pGe4fvVtJ9uZyMkePo1HYNEulOlSs3re16eypXW:OCpzAHxRVUv1pnh9SZs3rA6eYNQtx
- TLSH
  T1F015AE40F6D785F1D49D247832ABB37BAA3A22550B2CDAF7D7D05D6A9C302D09CB7284
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  devcon.exe
- Size 97KB
- SHA256 d86b7c46ab155a3193de84a6c0a43233d3653d765ccc0a106c6ca9e8b8f0c9eb
- MD5 f323b3df9ecae3ce3760e44542648874
- SHA1 c19131801cf3028f7d6613219cbf710c0bf4e662
- SHA512 91a02761f9711c8ccfb5bd2bed2df88b1db56b33ea6a95c381991dbbd3b0f8c7259f07e33130377da017a5ed8a8ff30534daaf97438e1aad75b92a1aa9aba2fa
- SSDEEP 3072:QuqZLvoHxwGse6ch8cqp2vJVx/6TuOp4oEk4ZBMHWqQO:UboHxwGse9Kt
- TLSH
  T133A3D50263E94649F2F77F3468B556215A3B7CA59D38C64C12A9911E4FF3E80CDB0BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  engine.dll
- Size 479KB
- SHA256 27df9a33f6cb7f9841cf4ec3315dbb9fdb10efb9f17ee4331c9ae81110d2078c
- MD5 ee33b76419dfa907b9c2aa66026c5e2d
- SHA1 2d10bbc8ec8f15eda0d0abe88167d67f19f52250
- SHA512 8e299544958b11684d045b87bf6b0268ff832588eb6aa315cd827a13407dfb9cc071f3ebf50b43f292b0ca2dc0fb3d12818bf3c016d8bd4f853c628440bc73dc
- SSDEEP 12288:tqEuiUeriwaR9qbOzjZ+0FCEDYY9hkPr+Dm1Jda1v+kGY7vmVRNzVyLEH8dAZTM7:tqdhX5+kGYanNzM4cd8Mh
- TLSH
  T1ACA4AE11F581C033D4AD0171567DDFEAAA7DAA310B64A8CBA7C46CFA8D701C1AB35B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  netcorecheck.exe
- Size 107KB
- SHA256 ef10850b31b3dbe9ad6cf8cb55fb1f81a60ea9c5c0694b4b94b283601eb17c20
- MD5 92e65cd72cf9f57deeac5c0c4186a5bd
- SHA1 b187a4f6c84193d17fd79506206955dd6fabe897
- SHA512 ae70051d857d1a7398fced3e12ec708e5580d60a3e1a39e89f5fbafce7da499d5d47ed8402db5d21a0994354673c1ea82acb5f7cedd1703e3562eb378c3c7bbe
- SSDEEP 3072:s30DYngGsrM56P5oL4jeEdu3G7Ex1tTqlR5bx:2nbsMIPSG44Tn
- TLSH
  T124B37C21BAD545B2F5B21A714CB4AA91C37EF9B45F318ADB1344A20E0D346C19F31FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  swscale-9.dll
- Size 777KB
- SHA256 01b93855544b3ad835c491ad3427777ff100ce97750bce90940f5f746099293f
- MD5 2e52393777214fabb1a4a833350ce0c7
- SHA1 bddddd756c067f2c04c5fb8b03369b3db2290904
- SHA512 cb3dc1254a7867a7d5e5b5ed355e834fafbe7bc984fffebd226f7124c6dbd89d084862f8ed4b8940c45ea38305dd1900cf9c87468815a9fbf161dd0ef5e5ae93
- SSDEEP 12288:IlE2ZykgTfifAEAE9utgFzQAMTTbUTLxLO7f8xXBnS8VrLRaQSC0IV91rKv5E7VQ:IlE2ZykRfAEAESgFfxq7V7eLOT
- TLSH
  T103057CC196CB61E5DD4D18786165B39FAA31263A0310CEF3E7C80E62EC717C229B7799
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15