781a844f04d3e48133c61debe4338f394ce91fa1e6e74bb3b38a1e71ed2d5022

General

Target
AdwereCleaner.exe.zip
Size 176KB
Sample260908-p2gk1a1alg
SHA256 781a844f04d3e48133c61debe4338f394ce91fa1e6e74bb3b38a1e71ed2d5022
MD5 5b27805576e21de708e29e9f1a4c3e9d
SHA1 5d0d3adcf4c992d77c78a0c1897f96e0747a3134
SHA512 b3d194123475bd7fc84f565920de724f45cd361f698ca90ab975f904b60654a025ef8351b0e46b2443d1ca2a7d6053afb8b562f03483776396618134a24bc70f
SSDEEP 3072:gcALQDVeW2cP5kavFAToBFLgzn2tqxFGzADcOEUF1GObacuVXv/Joum:N/UUfoHatCESxEUF8XZX5k
TLSH
T1F104225E73C14BC1D2A6A96CAF5D22215E3AC6CE5F0043CCD5D363BAA180BD242EF55B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  AdwereCleaner.exe.zip
- Size 176KB
- SHA256 781a844f04d3e48133c61debe4338f394ce91fa1e6e74bb3b38a1e71ed2d5022
- MD5 5b27805576e21de708e29e9f1a4c3e9d
- SHA1 5d0d3adcf4c992d77c78a0c1897f96e0747a3134
- SHA512 b3d194123475bd7fc84f565920de724f45cd361f698ca90ab975f904b60654a025ef8351b0e46b2443d1ca2a7d6053afb8b562f03483776396618134a24bc70f
- SSDEEP 3072:gcALQDVeW2cP5kavFAToBFLgzn2tqxFGzADcOEUF1GObacuVXv/Joum:N/UUfoHatCESxEUF8XZX5k
- TLSH
  T1F104225E73C14BC1D2A6A96CAF5D22215E3AC6CE5F0043CCD5D363BAA180BD242EF55B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  AdwereCleaner.exe
- Size 190KB
- SHA256 51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc
- MD5 248aadd395ffa7ffb1670392a9398454
- SHA1 c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5
- SHA512 582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e
- SSDEEP 3072:15TDpNFVbxDSXJFFGhcBR1WLZ37p73G8Wn7GlDOg+ELqdSxo5XtIZjnvxRJgghaR:157TcfFPB6B3GL7g+me5aZjn5VlI9T/
- TLSH
  T17B1412524AF05AFFFB4384712AFDE1B9E7B7828C5274A9974B148E323B440D74F8611A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral3 behavioral4
- Target
  6AdwCleaner.exe
- Size 168KB
- SHA256 4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61
- MD5 87e4959fefec297ebbf42de79b5c88f6
- SHA1 eba50d6b266b527025cd624003799bdda9a6bc86
- SHA512 232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9
- SSDEEP 3072:sqp6y91BH91Be/MbNBQ3MypF06N25xOT5Ng2WV4:Oy/BH/Be00Mypk5sYp4
- TLSH
  T1B0F3AE1437C8AB0BEABFAB7610F283659777B8756970C98C0CAD10DE0DF1B610960B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral5 behavioral6