b8a9cd519010666def0ef6e119eb42b33b5b811216f34e4f6c8e2e25ac290fbc

Sharing

Copy URL Twitter E-mail

General

Target
parsec-windows.exe
Size 4.2MB
Sample260905-e8645atvbw
SHA256 b8a9cd519010666def0ef6e119eb42b33b5b811216f34e4f6c8e2e25ac290fbc
MD5 50847efa95d0d1062777c6af8285c425
SHA1 ff7f99cf99c4438cd0b930157fa121b9699695cc
SHA512 993b26b4d1b39c064bd1eb4bddb442d52feff72daacde51e17ce61abc8f1b7a0445a8de17d1a39555916779c8e49e64786454c8c73c845e11d5ccb7aa647f775
SSDEEP 98304:b9+nof7+RYaPtNRgb/A+0gCzt2J34phK5C10Ny:b9+n4nKPRg8oCw3Eqk
TLSH
T1431633B7A9F0F131D8A202BD4F68DF1E06E2BD5B2ADB57B7A71031481235D828A4C577
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  parsec-windows.exe
- Size 4.2MB
- SHA256 b8a9cd519010666def0ef6e119eb42b33b5b811216f34e4f6c8e2e25ac290fbc
- MD5 50847efa95d0d1062777c6af8285c425
- SHA1 ff7f99cf99c4438cd0b930157fa121b9699695cc
- SHA512 993b26b4d1b39c064bd1eb4bddb442d52feff72daacde51e17ce61abc8f1b7a0445a8de17d1a39555916779c8e49e64786454c8c73c845e11d5ccb7aa647f775
- SSDEEP 98304:b9+nof7+RYaPtNRgb/A+0gCzt2J34phK5C10Ny:b9+n4nKPRg8oCw3Eqk
- TLSH
  T1431633B7A9F0F131D8A202BD4F68DF1E06E2BD5B2ADB57B7A71031481235D828A4C577
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/ApplicationID.dll
- Size 196KB
- SHA256 1462a072345e86318b981089b08b613a34027ddf527bfb66606c683f218fc3b4
- MD5 a858c1a57e32485505b1977cf0a125be
- SHA1 25d86c4b51f7cc10fc70e3a0493a39c4460cc350
- SHA512 32b597fc2412a9407fd12ac77c556ff9740f1dd0d2055426d11a7baf21b09c536a84cfb97865b4e94168656514e7ce71eb2bc4122aa340100f4ce483bad1722d
- SSDEEP 3072:2pBNN6AmU9cDlKd3P6V9nSm49WTgKg4Fa1V3FuXRAuAg0FubA9cVsL+73:2pzxmQ3yL+9MgKbxAOEXY
- TLSH
  T1B9147D10B491C472D1BF16340979ABA15B3CBD600BA89AEFA7D84D6E4F781C06B31B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH
  T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH
  T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  parsecd.exe
- Size 506KB
- SHA256 e1181c0ee31fb49e19038081c111387fc70be880fa1e3a783e6ec62004c5b4e0
- MD5 2a6b810971b984cfd38be91ebbf5eabf
- SHA1 6fc949cee6fffe7a66b24e633099485249427e48
- SHA512 dd9b8a47ced70671f742fe91f30f6d65c26ee27a1412e4ea1edfbebe3d826f9b7d5756a142404fd42f093b13353860d6cd7d219f34d857acc1ee3eb68c481a6d
- SSDEEP 6144:g4y4ocWCbt3nLSWoWe2A5YN2+ym0osCNVZNy/2KjvGms7X5IC:i9k9nLOzfYN2+yH1cVZNyuM+msjGC
- TLSH
  T17BB4287BB2E5B4B4D4A2827D8F14861DD6E13C1317D387BB2360736A2A23E81493D677
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  pservice.exe
- Size 431KB
- SHA256 566f3dfd079b1c3129aae68645f0005a869544078aa86b0a14864a36ad7aa9cf
- MD5 caf28164339526deddce7a329974f8dd
- SHA1 27fea5b3bcdd3fa2c10d1f0a5e76af1840d97678
- SHA512 16302a8394aeb0025cc4deb72e255e573fb41e595a7ef8ede31409084d24e4ed28c57a1ee706536287d9c8de204b0ddcfecdb904d6bb11a21b44ae0878ae67cc
- SSDEEP 3072:NQBE7Bj5dl6BAxLGGIvUNUzudpVovaE9aMU+DxJ8U9Ug1+UTvGmRe8wn7slKT5+r:Ns6j3IBADI0u5eU9Ug1jvGms7X5I
- TLSH
  T1829418BB32E5B4F4D4A2827D8F50861D96E23C131BD347BB2260733A5E32E81592D677
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  skel/parsecd-150-104a.dll
- Size 5.9MB
- SHA256 8c8c4299ddf503b2c25c0905b0a0820f3e8238c252e9ace37bf25964ef4a8f6f
- MD5 9d822ea0a064147ab5a88f8ad01b3193
- SHA1 7d8ebac3b2848f0dd5a7661816290c3250758b5c
- SHA512 08690a3f50a894ab315fe0c5f6f94d5bd1d639b329276c42e5b325d581c0ef1116589792cc5948bb54493295b7e798b7aafd0673be11c3f8115c97fe50700cae
- SSDEEP 49152:hgrPRiNAwlgvLJhhHdMSNkvGPVezddRQusF1YaVRKGxnkBeU/TTlzlAuCq3fWCC5:h2faPeaBz0ocUzKEQ
- TLSH
  T14D569D3763E511B8C66681388F07531BE6B17C4617F197EB02E456692F63FE00ABA732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral15 behavioral16
- Target
  teams.exe
- Size 342KB
- SHA256 6dc71b2e92b770dcfeca4a32c8f1787210311f731f1124754df193ec22d5d13e
- MD5 faa24223985abfbf64e4ddcd43f062d3
- SHA1 e1374dc7c98405efc5a44aa3229b97eabdd69bb2
- SHA512 23324afcb51508f5ea3f120a5787b150a8226d677c5a55fef219674b4d619fd0d7300d2b4cad917864d5f54788b9c8546db2a77aa4f0d666a956014169c4a6c9
- SSDEEP 6144:GAR9duE83BYjyEbU1SDgFg8EwkSdbAxD22y6jvGmp:H9gp3WjyEbU1SDAgJw40c+mp
- TLSH
  T1BD7429BB72E478F4E4A2423D8F11860DD6F17C1346D38BBB229072669E23E905D29777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  vdd/parsec-vdd.exe
- Size 505KB
- SHA256 e23332448fdaf5aa017cb308db5ef6855fac526a7ded05d80c039404126d5362
- MD5 4b9a3048286692a865187013b70f44e8
- SHA1 eefe91d9702314341acccd828fe4edb6ee570d7b
- SHA512 a38b9a0a1626d9f40ff2c718717a793108c7e773b25493cc53c595e6b9840cc4de66587549f43ce00569b368834327184a90d55da3c4ae0e269e1d0edef6238d
- SSDEEP 12288:QbLQNEFqf6MouZQqdF9zuAkDjdCjXHSZz2AKhAOYYA:QbUNEFKXrZ6ZjdFZxKhAOYv
- TLSH
  T1B8B423629E70C033CBF70F3152B9E55A0B7DDE2DE5159AD30314FD4A3D32A84992AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
- MD5 675c4948e1efc929edcabfe67148eddd
- SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
- SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
- SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
- TLSH
  T15EE10A3574C02CF7D0CD49743816791B83F4C52527BA05B04A7B1AD576E1AE7FE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  driver/mm.dll
- Size 169KB
- SHA256 96db6ae2f950b56e52be3e68f92893afa94645eae09fea2abd5dd1985758150a
- MD5 f09967cc8cc9bf03612ddecb6bf86daa
- SHA1 166f8e3000b6a1e2b13b46e85b7559b9837b9aa7
- SHA512 190d2edea81c42a2d7a5bc69cb98f03368e702a5fcb3fc1dcd4e9c387687bab542e4b0e5de67292e8b8a7efed7fd9e30d1efdd35bcdfea28417de71db0e13864
- SSDEEP 3072:3zx0G2cnU93aR9bN9m3KUrru7qqybewIvUZdRfCzzr/:3zS9w9m3KUHAVvUZWXz
- TLSH
  T1FB042964B7B420A1E9FB8670CBB209D3F6B971022F2056DF11A481690FA7BF4A53D35C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  nefconw.exe
- Size 574KB
- SHA256 cf746d1b0bbb713993d4a90dccd774c78d9fff8c2ba5a054b6c8f56c77e1eee1
- MD5 e9f2bc8c82ac755f47c7f89d1530f1a1
- SHA1 7ce5938c4b8a3eb4de49f7a7e34972f5f2acfcb5
- SHA512 86ed0a391d22631da9bdc7eb9cb096ba4de4c6619c6c4326030cb03d196b63e5aa156bac264a48d5b4cda7401844a3b5050259b41859d32e0c4d39b96913c2ce
- SSDEEP 12288:o27GX/DYwTLMcdMcYsWpP86/6L94gsleElgEo0JFoG:o27GX/DYwTLMcdMcYtF8S6L94gslbOED
- TLSH
  T162C47B56A29403F9E9BB813888864502F771BC5607B49BEF03E046672F277E16F7E760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  vddinstall.bat
- Size 420B
- SHA256 1e7c35eb6c296f96aee5ae4bbbd40395e8019bde95ef9bef91260dd8ef03c6d1
- MD5 ee1bfb5ccbb3949e3258155e141a68a5
- SHA1 b79dd1e75e3e7acd8d21d7b17c86673a6c6383d9
- SHA512 b37d680f5dab52536926c718eb1b4c1f0e78552c061756f998e3a3ccb2dc4fbea15dd1a4b181646a68a2987a22ce225c185c2ef2bb1d10a70c780ada8cf9f9aa
- TLSH
  T12BE0AB2088B2ECF7583685393C275B01F417C1BA02E3DA80B8A16504BA4BFEF6B44107
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral28 behavioral29
- Target
  vdduninstall.bat
- Size 272B
- SHA256 8f503e40a32959d9d2ee5a9e2a3da627f6ed158e6c87c47ef17f1e5d74f47b9a
- MD5 fbc8d5e19f89dffccd165f44abf114b4
- SHA1 a07501ea396a4e29654352cf8ed71c7819109e5d
- SHA512 08739f57b74ea457f505d416c5cc6c50539343ee33e80d76b95ca1a9b8760eaef9e97712a5824d8c22a7287c819149a6b60e6a08511e292cac71ef064ad168f6
- TLSH
  T197D02B104CB39CF76C6549243C639716F507C2AA02E39A54A4565500B60BFDF5B44107
- MD5 SHA1 SHA512 TLSH
Score

4^/10

execution
behavioral30 behavioral31
- Target
  vusb/parsec-vud.exe
- Size 892KB
- SHA256 f8db024b61c36e5d45ca5b485bf855dbfe1d0523333158e873d7deb4d86ec0e4
- MD5 fa2814c8cff38b2f4737085c70154b8f
- SHA1 e8e075c550dcbcf9b97aa7562d0ef26fa611f2a9
- SHA512 199530058e78b6aad7a6fc77017c864edf9173d50ed7db1d0770486db06cdc8f59c682da3a896bbc87517e5a3d9727fe934aee972aa6ffdc2926d3021cf8c9c2
- SSDEEP 24576:hfYjdl9QaRG2zB9aKXrZ6y8EZJIp8vbNCbW:t+uWGcjLPV5
- TLSH
  T1601523B5D6F0E730CD2B363320BEA91F65A1B3BD4045DACB875835E47A509818EAF760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral32