8f393c9dfbdae09d0b8a967fdfd787189c85a8fb5c59d9239a2e47ee08d58957

Sharing

Copy URL Twitter E-mail

General

Target
Solmetric_PV_Analyzer_4.20.335.exe
Size 56.1MB
Sample260907-n88sdsweld
SHA256 8f393c9dfbdae09d0b8a967fdfd787189c85a8fb5c59d9239a2e47ee08d58957
MD5 29afa68e6eb86f19f7a78f65c07f389f
SHA1 48cf4602fea09d6c10e97b9b79c4179edea13a18
SHA512 51eff1e7faee1c82c6b95d3aba915f984038b5c70667a4ce1e74eee5df5d6d6d35e1db58dd9ffea55a17edb2a32e36f24f7dd9ee98ef1749d599ca3696601bfa
SSDEEP 1572864:Y/jxTeWG2cW4Oe7T0nEkM5sTNgIrEeTkO:Y/j8TI4O4T0EkIigIrN
TLSH
T186D733948AD09752E1A44F3386BCF645BA28B7009930EE5EEF158714671F6D30FAC98F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Solmetric_PV_Analyzer_4.20.335.exe
- Size 56.1MB
- SHA256 8f393c9dfbdae09d0b8a967fdfd787189c85a8fb5c59d9239a2e47ee08d58957
- MD5 29afa68e6eb86f19f7a78f65c07f389f
- SHA1 48cf4602fea09d6c10e97b9b79c4179edea13a18
- SHA512 51eff1e7faee1c82c6b95d3aba915f984038b5c70667a4ce1e74eee5df5d6d6d35e1db58dd9ffea55a17edb2a32e36f24f7dd9ee98ef1749d599ca3696601bfa
- SSDEEP 1572864:Y/jxTeWG2cW4Oe7T0nEkM5sTNgIrEeTkO:Y/j8TI4O4T0EkIigIrN
- TLSH
  T186D733948AD09752E1A44F3386BCF645BA28B7009930EE5EEF158714671F6D30FAC98F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence ransomware defense_evasion privilege_escalation upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $0/dpinst.exe
- Size 1.0MB
- SHA256 181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab
- MD5 be3c79033fa8302002d9d3a6752f2263
- SHA1 a01147731f2e500282eca5ece149bcc5423b59d6
- SHA512 77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea
- SSDEEP 12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
- TLSH
  T1FE258104E7FA4225F9F3AB7DA9B152528A32BC815B34CA8F4240569D1DF3AD0D971B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral3 behavioral4
- Target
  $0/ftbusui.dll
- Size 106KB
- SHA256 0b2ec68836dfe63ba4d7a9bb0f823414cb96f62ad590ae13d7841eb6304c9348
- MD5 f26a5992bb85f44f8549316d3c06c471
- SHA1 e2eab759cecfa93e55c270ed9d0dd50836de91a7
- SHA512 86cb30c94969a014465f79cdb931046c502be2e2cd2bd85adf6fdde096dcc5c52e7e7a26eb22d705b1a3d6d24ba4939c50a7719312f3cca2d7ad2d3469f6d384
- SSDEEP 3072:in4BmLe7izeEl9L0gHysfvCE9Cu7Jzr8c:ijGizeEPYgSsfvJhJ
- TLSH
  T1BCB36D56B3A100F6E86BC276CDD35A81EB72B81A1775138F0224C5962F337E16E3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $0/ftcserco.dll
- Size 62KB
- SHA256 b8e1a00bfc32ff21fde7b4e18a4a0b5c56a9f32c241607c7cd41d4ceb2714306
- MD5 b73f39179dbfd876d334f311d2ada3b7
- SHA1 2ea73d5ff46ff430687947bc7f90653bf2a10716
- SHA512 40d2311032d47803ea22ad38763f933f2d9751b98a9f39199fd99794f3ba05b630f3f4ed99e4462bd9f26ef35b483c2746d56c551bf65b3c76dd0cbc927f1333
- SSDEEP 1536:OdUShQnixg3I391hcB7Gwf3PaQdyU7XgLfs7cMpgS:OeShQnixg3IThMPf3PaQdyU7wLfsAMP
- TLSH
  T14253F8856BE404B9F0B39BB5ADF28655EE72BC111F7192CF12A4806A1D73BD4DA34332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $0/ftd2xx.dll
- Size 193KB
- SHA256 93a4f4b540fcab0cd4943bd579ff2e7df8fcc3e62bc7bb47a8fc630f069ce7d3
- MD5 0733bb807c9b5595da9ae67ac36b207e
- SHA1 b9ea280882870ffdc630a11b03a8948694eeba32
- SHA512 2a0e443a1d45bb4285a6eb53d685505ec03e6708d4ba52aaf10273d95fb309194bc9c75943ba8ac46ebaf0d1fd133097c891045bf0f640f91dd3adf710708bec
- SSDEEP 3072:DluJqwf6BFIkYlkjxcrcXDuzJiF8Ii2D49WEmBmvY7dChfL5QLpxY5sSbe:DluF6GkwreDv8Iu9WDBmvsClynYa
- TLSH
  T1D1147C013291C0B6C46B24344167D7720ABEB8B65B659ACB7FC85EB95F34BC1EB3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $0/ftd2xx64.dll
- Size 226KB
- SHA256 9c65e3ffdb81049d912f8c57578d90d615fb873553cff0a675476debf6594082
- MD5 3522b23c7f3601dc9c0c40a44161d319
- SHA1 61558650e8632a9c77edb4fb39fe24e970a887b0
- SHA512 62bfa9bc4b96b97a3d2f89646b679803ee4ddd3f80144332fd1ad4eea8afbb6f46ef46b7e9dcf50e33d2e3a83d3deb1ced50f4c1623c13faf02dd7008e86c849
- SSDEEP 6144:rRrO7qJxuoGVE7JmJz2mcIzS4jcsOvefnXYP5:hslW7JEjcDr5
- TLSH
  T120347D1AB2A508F5DC27D139CDC34B5AE5727C09936193CF026486A66F33BF1A63E352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  $0/ftdibus.sys
- Size 70KB
- SHA256 3e507a02b491d5f7d3036165d82fbe2be13393b15cb770aa06664f0bc94a5873
- MD5 ed07200cff78facfb66ebb0b89f503a4
- SHA1 7d988fad9dfe286439befd1a6df04ccb48de8303
- SHA512 3aaabbcdaef748c435dd92116aea7eae9be3f30505b4aeb828c82b8c859230fad87cd327d00f7031a673793ac7764767a6aaebb78fefe5ce42554d641825251f
- SSDEEP 1536:5ri9VYYBbBuK9t4R3X2qS6dkHABct71HV0cBH0jog:5NYBNxf23X2cy1HSoH0j
- TLSH
  T1AF637E42A3FA199CD4AAC179C6D745B7FBB0B4405B504BDF01A0CEA94F13FE16A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $0/ftlang.dll
- Size 206KB
- SHA256 bafd7b016437205d6abf18752e16656501dca564d7a77fc15b1d24dfff3293c8
- MD5 d01615d10a747cb2b9e27383e0ac922d
- SHA1 771f76dbdbcc8ce1f8bc94cd747c3670e99f2d87
- SHA512 815cff5f1c5691663d17ced3aa5a083f1bae4ccca899317353a1c76dcd45591e3a2afa5ae5e2b160a3a37d2c76cffe85bf567daea86c650cff6e9b940f22be4d
- SSDEEP 3072:E1/eDZ3hrrLlGlJntXpVYT1L+cIs8zFjeTrSmHSfGE9drJJ6s3LOk4o/TlETy:nVRnLiJnFDYTlws8sy372G
- TLSH
  T11024A146B3F94139F5F7BB3499B616958E3ABC9AAE35D20D0254049E1D72B60CE38333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  $0/ftser2k.sys
- Size 83KB
- SHA256 b46e9b40c9e3f84e074bf192d272372b5b345ec416675665f486090180cd9278
- MD5 9980e7584484a009e77e9bfa14c0c18a
- SHA1 7db27953681c253c8797f27717028c8acc83e1ee
- SHA512 05f67cbe5256aa750788556232fa1ca63be435f092cc4f061c3c47268e1ef402467b09bd042546a7255157c267c59fe2a372e4ede85cd0c4c8b4a04113654329
- SSDEEP 1536:Q8ZTB7nwVo5zr+gGZgUCT7OF6Q117dQUkGmO4v6+EzCqgUmGg:vZTB0w6tZaTKF71XQUHV+k+
- TLSH
  T12683F65293E501A8F8B7DA78CAF59527EB727444673992CF0290866E0E73BD48D34337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $0/ftserui2.dll
- Size 53KB
- SHA256 b52b3a0f943629d651c7c374c7bfaa368b5b735f322e292df049202aed80c271
- MD5 091f948b0dabedb5a09a07f0c943a75a
- SHA1 03f29601abb56f2d8b47a5cc73dfa219b7c4de4c
- SHA512 c72735adf7c47d4d9d070d4e94f8f4ddaf3d1d642b6109dbcc85bae8a100703d4c8c04cbc2b56b176bf69e7c0f46187c3c703f98aa82ed91a0565bc18b0e8749
- SSDEEP 768:CNBv3431dYE1OAAHGf8V8eMShGjDe2vcyIgpzfYQc0b80zPQGK6FYaeLwb46s:A81BO3H4AyIgpD20/YGdSpgy
- TLSH
  T1C6331A8157E44159E4BAEA3586FA8632DE72BC506F3587CF1120C6591F33FE28A38717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  $1/dpinst.exe
- Size 531KB
- SHA256 9ef92cfeed3a6589f64eca6a0edf32335f5f97509ee6051a7ff68f7780a60180
- MD5 82862b768a80880a2f22c44c96c20596
- SHA1 4dc3930646fc584fed017132da5aa4661d7fec01
- SHA512 142a413c0a90d37767146689d34868d409fe5734ae6ff718dd9ac01d5b127b78dc723c86b3d0a2259d2e26954224911bef6e933f330bbbb8838b5f4890b4afdb
- SSDEEP 6144:D2BG1lkWPDmh/CsOs5Un05pJg6fjlhFbLdG3sBtmmP0OPx68:ic19PCCsOsCn01g6L9bP0OPx
- TLSH
  T1CFC4F721EAE78139FCF22ABD587D52200A75BCA15F70C78F67840A6D59F5AC18930F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  $1/ftd2xx.dll
- Size 193KB
- SHA256 93a4f4b540fcab0cd4943bd579ff2e7df8fcc3e62bc7bb47a8fc630f069ce7d3
- MD5 0733bb807c9b5595da9ae67ac36b207e
- SHA1 b9ea280882870ffdc630a11b03a8948694eeba32
- SHA512 2a0e443a1d45bb4285a6eb53d685505ec03e6708d4ba52aaf10273d95fb309194bc9c75943ba8ac46ebaf0d1fd133097c891045bf0f640f91dd3adf710708bec
- SSDEEP 3072:DluJqwf6BFIkYlkjxcrcXDuzJiF8Ii2D49WEmBmvY7dChfL5QLpxY5sSbe:DluF6GkwreDv8Iu9WDBmvsClynYa
- TLSH
  T1D1147C013291C0B6C46B24344167D7720ABEB8B65B659ACB7FC85EB95F34BC1EB3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/GetVersion.dll
- Size 6KB
- SHA256 7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
- MD5 5264f7d6d89d1dc04955cfb391798446
- SHA1 211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc
- SHA512 80d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7
- SSDEEP 96:E12Z84uiwpGTVTDSpaHYfniz0R3GhCvXY6Ix5vdR7pBi46AQ5Vu4:2STVTGwYhR3GhCvy5vH7pBi46AQ5Vu
- TLSH
  T1F4D1C3F343E50BE0D03751BE40D64A9B0770E6684EE0E46A48478DE264E731AEF3BB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 17f0946e0847bbaa6a06eb58aead13fce22a8606e9b3744cd2241debdf8d8bae
- MD5 7e49eb67f1f3c62bb8c4b0a868b30645
- SHA1 2be42e3c6059485bc3b624a537ab1fb36a10a263
- SHA512 469c28b6da5b9499fd417f8cd74414d6c6edcbe6567eecc9421a69797a77ec323936deb96cd151611da57e311074ec0c56d82a9800d7aebac9538a947284ff9e
- SSDEEP 192:/6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTSK72dwF7dBdcQOz:/6JaVh4I5rpPbTS+BdhO
- TLSH
  T1A1523A51378888F3E792053EB45237079F9D5226B8925ED1CA371FC62D2B19E2FB1302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 e53b5f58dd9e1a25a973efc378b552e15fda6e79b3fc67062f556967865a8bef
- MD5 7344a89ef365ee3cb14e3ce465257a17
- SHA1 5714b1b7e16225a23dad0ef5d10ec6382553e05b
- SHA512 5d993ccc6e66d728902c375facfc0e3df8f45773eedbcb043f81d755ad33b6e29d1d39be0fb446bc4f49dcbbcc3e8a875c793985c9ed1595f407930e63f37c91
- SSDEEP 48:SnrQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJeABofgMGKO:fz+MM4eqmvz0JScx56mpwzAhWWGV
- TLSH
  T160B17072F3C005B5D5A44A73146BA7D33663DD302B9A021F9B67041B2800E93AC3DB83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/NSISArray.dll
- Size 18KB
- SHA256 df94b7ddd98a35fe306c1140103bf255b80a348f0f6f2b9c0191d8663ca3d59d
- MD5 1fb4f5bd18bee813e634f0637d672bb8
- SHA1 1e138a10acb0dc5168664c96e88ad8c78803af5b
- SHA512 1183a2e735488c94e7eca372067128394ae295c59ead50e7e7e51b64c9b6bf403f94b845b263aa8785191e8a195986863af4fc48b956210192df755175069122
- SSDEEP 384:xWLRG7rXtzfE/kCw5z1GGsv5VD+V/MuZLB04z7Qg:YRGfXtA/Pwrr8VDWPLBlzj
- TLSH
  T15182E92A36F28CF1D63D0B7D76925D0F66366890B27188F39B595F982F213481B391A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32