b47c896d78a61fb5bd0f0d2b1b9db6ed2c63a30a78565d234deda49e3f23826a

Sharing

Copy URL Twitter E-mail

General

Target
ING-Antifraude-Windows.exe
Size 41.1MB
Sample260908-gz1l4a1zhy
SHA256 b47c896d78a61fb5bd0f0d2b1b9db6ed2c63a30a78565d234deda49e3f23826a
MD5 ff016f8bb78e6e0e2689b1108f168531
SHA1 3be6b71b77d22d7589c2d20b4a3013b3e9e1cf57
SHA512 49b989cce6d944a87693a296b4bdc510cef146e4e5f088f28dc31d2b9c567e3e85fc60571f25fc95f234dfe8d43e3e4dc2f028092a8c03d35b9e409438d3735a
SSDEEP 786432:kIxgC/eoZBb36qcdH51FB2BuMDbNtBGvtHrk/v0BSYCNT0SGv70m5xo:kIeZWV3Rcdv76DDbDcvNrP8Z4PYYi
TLSH
T10097337C1E305AC7F411A9342872E2CB79235D61A0A9091F6AF139FC2670F94DC9BB76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ING-Antifraude-Windows.exe
- Size 41.1MB
- SHA256 b47c896d78a61fb5bd0f0d2b1b9db6ed2c63a30a78565d234deda49e3f23826a
- MD5 ff016f8bb78e6e0e2689b1108f168531
- SHA1 3be6b71b77d22d7589c2d20b4a3013b3e9e1cf57
- SHA512 49b989cce6d944a87693a296b4bdc510cef146e4e5f088f28dc31d2b9c567e3e85fc60571f25fc95f234dfe8d43e3e4dc2f028092a8c03d35b9e409438d3735a
- SSDEEP 786432:kIxgC/eoZBb36qcdH51FB2BuMDbNtBGvtHrk/v0BSYCNT0SGv70m5xo:kIeZWV3Rcdv76DDbDcvNrP8Z4PYYi
- TLSH
  T10097337C1E305AC7F411A9342872E2CB79235D61A0A9091F6AF139FC2670F94DC9BB76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Base64.dll
- Size 15KB
- SHA256 0f694863848c9eec20d58d371b5e067afc35ed9e73baeeb1cef72d1a38e1d945
- MD5 b820d9873b27c312dc5aa00efcda02a0
- SHA1 6ef126f5051f56aa36b42fe9a74de96f74d4229b
- SHA512 82bfee4c21b744ab95a2f966cafcc356845ca6703363662550cf8dc196b683e0d274605fe577f3a14d824c4c54ca4fa7372de089343937545e49f38f480db394
- SSDEEP 384:Ky9TnjXZSf+VIYiWLXL6SPxh8E9VF0NyIK1tZ:Ky9LjW/YiWKSPxWEKstZ
- TLSH
  T195622A678A146C02DD0ACE3071C5857A6FB9B79368D1C1E7A31AC1119B813C6BBE86BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InvokeShellVerb.dll
- Size 15KB
- SHA256 54e5ff48ba664ef363ef52c7edc604e03aef2019b78f38a83afe31431f10ae59
- MD5 dea32fbce958f26cd002f2727347bbfa
- SHA1 920e5a3bda0c7776698e78cff107d210fad1674c
- SHA512 187c839ef4b28020aa7b7495fbe9942a8c9d510fbd588ba1cf3ac7c64b9684c33885b079b5b5fcb5f59062bb9c9cd29121c2f8012e46551790b2e8a93eec7538
- SSDEEP 384:zDnO0ZSf+VIYiWLbLb1Pxh8E9VF0NyzDrJxfK:/ng/YiWP1PxWEZ11K
- TLSH
  T198723A338A646C11CD978E3175D9447A6FB1B78169E0C1D7221AC1125B917C3BFEC2BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH
  T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH
  T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/UAC.dll
- Size 29KB
- SHA256 b5bb8d301173c4dd2969b1203d2c7d9400ba3f7f2e34ee102905bd2724162430
- MD5 488819f838abfcad73a2220c151292ee
- SHA1 4a0cbd69300694f6dc393436e56a49e27546d0fe
- SHA512 b00d6cf712fe4cefce41479f6e6f4aa5ea006694d10f2837204de5bde1c5a4bef1368f2b0eb4b66d57a66e8ce6dc335fa91e9c8017e8e125c27eb1f5df4de9a0
- SSDEEP 384:QqVibvTh4qnFP+OPEzinclP+RZSf+VIYiWLglLoPxh8E9VF0NyH5TV:QqVavVfPkzhlmg/YiWLPxWEFX
- TLSH
  T156D28D6617E4492BD9231E3036E665325FBAB871097180EF1527D6C53AB0B83BE7C31B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH
  T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/nsArray.dll
- Size 18KB
- SHA256 8b8be21fa7bca491c93683c9f84bb49370ca7e1e864bd0658ff9e1d2809b67e4
- MD5 9761d708ea7c49662a21f6690d439e06
- SHA1 b2e757e7eee5c788f16d666fb6cf9d41caccb04b
- SHA512 25990a993373009ccbd9e89cae3fc601928121775d0d5fe326c55a305ce8de51f35a2cb160e9dfbf3be82a53ddf7b9864116e7f5d3325afd7403cd3b7740c652
- SSDEEP 384:nqqedh6EHFRksp7KpFX1ZSf+VIYiWLALiqPxh8E9VF0NymgEy:Ted/FR9mXc/YiWMPxWEspy
- TLSH
  T1BC827C638A682C05DE634F7071D8863AAE75BBA1DDE1C1C22309C1215B91781BBEC6FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral21 behavioral22
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  TVWebRTC.dll
- Size 10.4MB
- SHA256 3ef234b70874473dfbea1d536449d9a95f9ed2d3174e3535b26d198dd564c883
- MD5 5d81b0656f37c7945b8c6dec65f4dd80
- SHA1 1d10a4572a215e499e5b7ce8e6dd97e8976d776b
- SHA512 d02098faee53e5c2cb89056f63f1cd36ad62691f46f8d9b053f315a51aa30a6a7bfc7bca04fa7d188067c9fbd1b86dd4e04f816646bbbe12641fa86a38590aa1
- SSDEEP 98304:EYQFfbnx5X08m+LznWMIm5U8s7OAkwHyo+y6Bnc:EYkx5X08m+nnWMIm5U8EbBQc
- TLSH
  T1D9B67C6EA6AC0099E4BBC17DC6879617EBB27419177057CF0AA486F90F23FD41A7E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer.exe
- Size 65.2MB
- SHA256 c3badeffbbd65f9622c1e3b5fe09d3c36ccac15a76196c006519baa27f6fc21a
- MD5 b60bdd3ed7b411748d969ea16fb6d649
- SHA1 42650afef92c5971e6aa59a3f5222de79f14a674
- SHA512 78105c656283d824ecbd3d817b177e830c67350def815a8b55f4494a234aa320d49002d61d088dad5f90a98623380a08273f430f7383cdebde8600689a78ecc9
- SSDEEP 393216:YvcejMryyNy94t5P9wVhrw4aV133pXrMgdeB/uvj2O6cw2rdEYyRhazH4RWXE5uM:Y0aqbY9A33pXYqeBWhX5fGHff8wB
- TLSH
  T13CE78D17A2E801DDE0BAD17ADA9B8817EBB27809037157DF05D0825A2F67EF05E7D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer trojan execution persistence upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral29 behavioral30
- Target
  TeamViewerAutomation.DataBridge.dll
- Size 1.7MB
- SHA256 68a46d3b8ac9b963b1f226d60d070cdc34ddd4907cba09c121e7851d9350e320
- MD5 98ff6cae34f6e051084c7ce7f240f8f9
- SHA1 0ef9e4f2b93db5244a9895437a613f8133754d37
- SHA512 8b64c5ca4990b58513d79d5eab74b064a65154aba540a5018d37619f695bf79f79a35c70b2d48a05595a07bd6f75841e6b4371511ec39dcb0ac5e5a7de89b03c
- SSDEEP 24576:Owk3f4HULiUjJk4lcJTf6Y6uUlUBPkIUFUSdTq3eVaO3fBg7+ih0lhSMXlMrGgWC:OwC4+iUjJk4+JT4uUl/IGUSji7M
- TLSH
  T116859E07B3B901ACD46BD37889175A0BE7B2741513616BDB06E0866A6F27FE11E7B330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32