7b2a949bf460fb37a3888c9048698f43222a185a48323023df1c51e78a3ca1c2

Sharing

Copy URL Twitter E-mail

General

Target
npp.8.9.8.Installer.x64.exe
Size 6.6MB
Sample260908-m849jayflb
SHA256 7b2a949bf460fb37a3888c9048698f43222a185a48323023df1c51e78a3ca1c2
MD5 8b2d475a92e67026afedf1b9e5f51dd1
SHA1 e251fcb743b2e7e4c0b0ee03125f6809d512a1fd
SHA512 52a10632bf5989abe73dd14e50c120240dcf010ce3703569f612923bc51cb9ffcde6a8cc79ac3a3ed43b1b1474857bf062799f85e3f8f24ae1a905282f934d88
SSDEEP 98304:xsvnBaJCKbjLOVLkdntuOLO+fRAllUJlsfX6bnDMzVHn+SSDYZrAFeH+SSzYua:xsMJCKbeVLUUOLvfRAluJlsmW+SzKxS9
TLSH
T16966338436B3E07AC8C189320B7DF3EF9136758D1B64E273B679728B1CE6B405E94691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  npp.8.9.8.Installer.x64.exe
- Size 6.6MB
- SHA256 7b2a949bf460fb37a3888c9048698f43222a185a48323023df1c51e78a3ca1c2
- MD5 8b2d475a92e67026afedf1b9e5f51dd1
- SHA1 e251fcb743b2e7e4c0b0ee03125f6809d512a1fd
- SHA512 52a10632bf5989abe73dd14e50c120240dcf010ce3703569f612923bc51cb9ffcde6a8cc79ac3a3ed43b1b1474857bf062799f85e3f8f24ae1a905282f934d88
- SSDEEP 98304:xsvnBaJCKbjLOVLkdntuOLO+fRAllUJlsfX6bnDMzVHn+SSDYZrAFeH+SSzYua:xsMJCKbeVLUUOLvfRAluJlsmW+SzKxS9
- TLSH
  T16966338436B3E07AC8C189320B7DF3EF9136758D1B64E273B679728B1CE6B405E94691
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation spyware trojan adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
- MD5 7854290f8bc473fb9fad1917b0065731
- SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
- SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
- SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- TLSH
  T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/modern-header.bmp
- Size 25KB
- SHA256 e6c5be8aba1f657fe77e8c9bbfac3536a69530aa5c1411cc3d6c235373203a46
- MD5 a70c3979ab1716c84969eb73618ca7d7
- SHA1 f0b4c8c1b8c59aa0382ae4f65263a389a3cc3996
- SHA512 3d0eba870b91f08a6e7b380d0137f6415d1184a77643521e7b2a01774272971853774b72517921a788ae7c606e3940c39fd36f03a7da76c972d1ef1adbc0e409
- SSDEEP 384:1oacST1ci4MZzWc5bgoUK+RQ0s6SLARs2v/C7zAkAFTqI+4TFWAWGQg5s:CaciEMZzPcoUK+a0sD52HCYkCTTmABw
- TLSH
  T1BCC29F527578003ED2B9823871A99B538D3B8ED82D5ED5771E363F3E2FB5E84181A1B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 2125550c12fa512782f2016e802d70bc51f4a06017cfbd4176b4a994eb2542f0
- MD5 c2cf6928a3ab574a5548b4dc1c38b6c0
- SHA1 8860ff529f60b38a93912f88f234d46eebcf664f
- SHA512 fb6b28f2677b1418f8ebf621dd1e201b127b53b998c02300caa66a9f374f681961f5b9a7f843d6082821890df9e3d91a3403b4f83d70d155e9c841893e1f80e4
- SSDEEP 3072:NKrK243U6RNfWAKVZ17e28FTfWDG7wFlF9:NKW3UMfWTpe2eODG7UF9
- TLSH
  T1C1E3C05623F050244C08167BEA7A6ECC3761BCC2787D75A15F52C36FCAE43CAE6E91A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14