66c7595184a2b28f4fcbc558bdf0602273cb07fc8dd567a32926c43d687ea2d3

Sharing

Copy URL Twitter E-mail

General

Target
66C7595184A2B28F4FCBC558BDF0602273CB07FC8DD567A32926C43D687EA2D3.bin
Size 9.8MB
Sample260901-3n195stvgv
SHA256 66c7595184a2b28f4fcbc558bdf0602273cb07fc8dd567a32926c43d687ea2d3
MD5 7ed099380068442d29e608c3cd498b90
SHA1 e15835ff77691330291b53859d70aec6d5d5977a
SHA512 5708cf591c1b1843577db6633663332305fd5db2660b0b0a0cb5d1eb66379ed08d5bb4c9b0616e42895627a8b01f3f3f0474464e3960607bd9f77af6fb395b3a
SSDEEP 196608:2U2lwovvSYNA5VVFDv2GSO/KshWEuZztcKeCyPnqCvvb:d3oCYNA5VziGS9shWEuZOKtyPqCb
TLSH
T118A6338B44D3903FE6D841B126FF45A8775DA96AB061E5AEA3C8758F39B5B10C4FC203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  66C7595184A2B28F4FCBC558BDF0602273CB07FC8DD567A32926C43D687EA2D3.bin
- Size 9.8MB
- SHA256 66c7595184a2b28f4fcbc558bdf0602273cb07fc8dd567a32926c43d687ea2d3
- MD5 7ed099380068442d29e608c3cd498b90
- SHA1 e15835ff77691330291b53859d70aec6d5d5977a
- SHA512 5708cf591c1b1843577db6633663332305fd5db2660b0b0a0cb5d1eb66379ed08d5bb4c9b0616e42895627a8b01f3f3f0474464e3960607bd9f77af6fb395b3a
- SSDEEP 196608:2U2lwovvSYNA5VVFDv2GSO/KshWEuZztcKeCyPnqCvvb:d3oCYNA5VziGS9shWEuZOKtyPqCb
- TLSH
  T118A6338B44D3903FE6D841B126FF45A8775DA96AB061E5AEA3C8758F39B5B10C4FC203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan upx
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $COMMONFILES/MyTurboPC.com/UUS3/LiteUnzip.dll
- Size 52KB
- SHA256 69c9c92d36ba685831f08f4cbef7f83ed64603e6b49c76b3fe8abaa59ad016e7
- MD5 625001fc82753bf153ac23b503ba7894
- SHA1 0caeaa1f2f9d5755dde8ace377e0b6b652ab17d8
- SHA512 bb936124b2167518be4db405310142dcb09a652f855e6d147b808e69e13dd13e3d6013633a82a115a2449722a992d23f224c6a5c00b80418959d618ac07a9b45
- SSDEEP 768:q8zd/VxMu48xq5j+HW6D4nf6HSE53CtRGXDpD2F+8edR5xPa/JMd2Lx:Fd/VxMu48YQbtSE53cRGzpz8G0B7
- TLSH
  T143335C87AF9282BED4B28A3954F7273A5C727606739DCCC3D24A085518739D1A33A35F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $COMMONFILES/MyTurboPC.com/UUS3/UUS3.dll
- Size 528KB
- SHA256 a3558f00915f7234b152d0f09f0397bd1f2e7bd34b0a7388aca918ed6897935d
- MD5 bf33be50895f043527ca12d2cf9356dc
- SHA1 68213101264365ca461fd6f8adcaf65ada78f96f
- SHA512 8f82795d631dc04bfc05e5e78a8fed38b938cc2b3c137c9815041f532ea07dbce306046833ca6bbdb91b5e8ebac00aecbbe82c745209b9fd678fc16f79954330
- SSDEEP 12288:bbv5961xdy86rIRqZuyw4NblVW2lKsEr3ZlX5vNwF1ny0X7vVTz9FFU64cVgBdw:bG4zw4JlVxEr37Dw7ny0rvV3FDtg
- TLSH
  T100B46B00B242C139E4BB10B58ABE956E6528FD71072950C7B3C8697F6FF5AE27E31643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $COMMONFILES/MyTurboPC.com/UUS3/Update3.exe
- Size 256KB
- SHA256 0afba2ec514b1bb946b3af0fd9dae82cb87c3d3390906666d064561e7cd284a5
- MD5 d406c555fa3b16fc8041541573081f3b
- SHA1 abd00ec28d56317beb64b47ed3a77378bf226d9b
- SHA512 5595136ac172870522956d6346aa396e3e6349cb128b19be65f6086928ef78800f10cd65e13dfea6abe140bc21ac9613be99bc86fc99834c45a48dda8f2f2515
- SSDEEP 6144:4XT+8nHsfuhcLMP9BfLPaz9F3VU6QxcsnL:4j+d2hcYPTfGz9FFU64cO
- TLSH
  T16F442A01B641C135E7A706B189BAE6ED5628AD30076690CFF2D83D3A5F716E3693324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/AdvSplash.dll
- Size 5KB
- SHA256 0990902460ec38bcd605b518bffa081942c6f4c5fe1828a61ba3965bbf15d8bd
- MD5 41be2441ee7c684eaa76a62d4223b4c7
- SHA1 05de8220e296db1025f7bd4d9de1f44370018162
- SHA512 fec074a2196141e497334b57563dc7863a0b949d348164aec8c4f21d1b3c4ed795e03fd6e5726a2e90da7015abfbb4e28102647c0e343e84a707e99271a1a938
- SSDEEP 48:i/UYdq4ThVJttIETQ1lk+MfSvZcLLefNDpXq65wtBpuRNanZNA6zu6cv9n1MFM0C:qvTFfSc+0OeLLefNDE6OuXaZq6VG6MJ
- TLSH
  T146C1C43BB6C0A2B2E16F02B13C26334383E05571236291354D77ADDC6AE6EA6DD58783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 27KB
- SHA256 6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9
- MD5 6f73b00aef6c49eac62128ef3eca677e
- SHA1 1b6aff67d570e5ee61af2376247590eb49b728a1
- SHA512 678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938
- SSDEEP 384:DZoRF0XXUuJReQg0Tw67ADWBTgmldIogUD3GLgFmyaX/fVYcWJQCDmrinogRdBl:DZaF0HtTwuz9yu3KgwRX1nWJ1q+noI
- TLSH
  T12DC26C107C9042B7D28E5671A1E50F075B3F6E512AE65883CF256ADA2D612F0FA3F31B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/GraphicalInstaller.dll
- Size 38KB
- SHA256 7a72a7a6c28b9127d38cbdf14672ed1feaec86b72c83c0302cbcdbd03341da91
- MD5 5691d9412413d3cff6c19f9e4c07e0f3
- SHA1 6679230811fe3ba8fdf145e9a93babff66de8e70
- SHA512 28c44a956a6951ce11fd03dac7f9b1eccde24720c385077315547d6b36e6df55fe5d19175f53a6e44068c6688400a52be10c720c1e4db47d57e75a6c8925b80e
- SSDEEP 768:FsHjNDKSDTlZMXAy4IIZmr+FLtYCsKQPvatRNPjZjrQQEHZ2U7ReFH7:FiD1nlZMXJ49S+FJaKQPC7N9vQ1Zl7w7
- TLSH
  T16303F14C3164287EFDF2077CAFA8C7A36854EC28361A536D3387580F1E7964A16247F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 36KB
- SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
- MD5 1cc87d2b5a79b18f133b4f944e2f2f74
- SHA1 98e0ddb727c76e06be1668434d754e5b80a0c154
- SHA512 d8fee1c09fef9af4e1f38baaffa3a6d059713b14ecad900815c086cc22855644fcdeacd6bba31ea6e6925831e650f7b0d34e6dea4c57a978fb4f5bf0cd6d72a9
- SSDEEP 384:JLmJwO50x66T9JOpOUT38YZvml7xoKdyuwlx8xSiorppugBwUdJopS:JW50hJwwUTsXdPwxvtpDtdJo
- TLSH
  T1DFF26C507C8144F7C28E4235A5A9AB179FBF692036E55983CF269EDA1C311F0E93B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/License.rtf
- Size 95KB
- SHA256 cc7d6ab1c15e286b84c7fb6ad147842634d4ddcdab819854eac1a73168499119
- MD5 d19a08a38ba5cd8050e4713a621ff7ca
- SHA1 576e85eaa44bcd26da62b1bdceab819d9bcb5530
- SHA512 d852aa9b2361331bf67fbfa6e2bee9e35be8da2e81816f5e39e4e1223e867dff3b94e78235553734f4c1e2dc3cb2ff50d2ec69c834fd81be20bd3802fb93f011
- SSDEEP 768:b2jLtrVpbfqiCitQiMqa7wmZ3qme7wWJcCwNC9TVdNnUoKd7ITMiEvUMZNAWbFhM:buVY4TVd5Vo0/JDF
- TLSH
  T12693E089C84B9BD2D371D3C19DA1F0DDED67F0A021AB48D2397BE1BB309389DC499991
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/Math.dll
- Size 153KB
- SHA256 4e540d1d8ca1c7564753232d18a884b0597fd7e5df88f8b5d370824d858954b7
- MD5 7fc4a4937d364d42d4d06ff3554a464d
- SHA1 ad7ddfa47d0abfa0f3e9546db4d6fd6d40a39b41
- SHA512 da80c681fac9497d2002ceec33fee63f3d6ed0ef4a62213405f87343e3723b27ab0f51c98cf6f588a48d9edf10e68bbbe8856657e630bd6a15252ad96ede2da7
- SSDEEP 3072:2REe7Z38wWD1faAg0Fugz//BNABN6X195j8e3:NwZMweZaAOg75yw+o
- TLSH
  T19FE39E25B4A3C4B3C5BA00B40465EF991F7B543503B988773FF81A6E4EB47E09AA3256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/SkinnedControls.dll
- Size 77KB
- SHA256 5f7998711ea856730139c4dac403f11b947ed94a464dc6d2d4b22f928c3a8536
- MD5 364bb3c9218429dd1315ad1db47e152d
- SHA1 3253c1a381161c268bce8c487e892c8e5dd29dc3
- SHA512 d9084068a259acb9a1691d10da8610053d3abdf6dc78d7357d80d1ac794d940478d2b05c3050484680ddee4c832ae30d71a67b2c2978845e298aca48058e01f6
- SSDEEP 768:Q0p2dJFs6nYFg0vxrF9jd+IpMCGC8BnmmfJmLVp1aB5tEEThyX7QirbTGgyhTFDK:Q0YsX7vxGjBvJgVTadaXBTeh55axv
- TLSH
  T188737D417288C9FADCDE083A0C2AEF2595BE591247D2C5C33B5E6D56BE323CD9674382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- TLSH
  T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
- MD5 d16e06c5de8fb8213a0464568ed9852f
- SHA1 d063690dc0d2c824f714acb5c4bcede3aa193f03
- SHA512 60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a
- TLSH
  T10281577B23F44473D09A4BBB01E60CD752A2D9309316442F498B4D6E14C1AA7FD6EB17
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
- MD5 f7b92b78f1a00a872c8a38f40afa7d65
- SHA1 872522498f69ad49270190c74cf3af28862057f2
- SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
- SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
- TLSH
  T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsRichEdit.dll
- Size 5KB
- SHA256 add71c2a8ea08ca5a9ef7eb9e725443ae64939f7db0ad80e8adfb89267feb72b
- MD5 e81c4534fc882032078b39a01eece599
- SHA1 4afd2f33f97ddd825ae0d7e22ad10e15854c093e
- SHA512 73874d23ff9c2eb573e961e730f17ba804734d79059d0b42c141be11c4cb923b9e377c4b17717e3acbfa00d0f3ba85d5addf933b54747b4b08434de956dc1f60
- SSDEEP 96:ubs6zRonEMjZERSXL87ceU6AhOhB7lkZ3hBjB6wZ:azhMJLheUf+ZkZX
- TLSH
  T1A2C12A521BB4516AF0AA02766F724B16352FFCA0DEF6877EDD54600F7C702180A11B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral29 behavioral30
- Target
  7ZipDLL.dll
- Size 550KB
- SHA256 5e5450f0096f2a2463a14f40badfcfb4fae222a3db6d6ce5afe19440aa499085
- MD5 bdf3e96cd28824e41baa2e75b252f96a
- SHA1 3e20a193c683c203d62f64bf810d4efe9b1337e6
- SHA512 c6989bbb50637ff621a1219f8b28a438686c9d4b254abe258832c1d0b751cd1a8183367f61f083916ef9936549bb6ec3ecfafe76c95d3ebb39dee43f431d82d8
- SSDEEP 12288:32MvfS+YHC1+jheuOUoVXusOlN5vL/Tw:pi+MC16euOUoAr
- TLSH
  T10EC48D227690D1BAE16F0331AD19B7A860FFA3714934A6177B980F3E6FF04C29605B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32