44c62d71296775ea5636dfa6ec95d80ccf228d012846c33a4ec894005e70596a

Sharing

Copy URL Twitter E-mail

General

Target
AvatarLockpick_v3.0_win_full.zip
Size 7.8MB
Sample260910-fbz5zszzdy
SHA256 44c62d71296775ea5636dfa6ec95d80ccf228d012846c33a4ec894005e70596a
MD5 f2cdc39d9a77a154c57f3f7203a5b268
SHA1 9eb6dfdc4ebb000024532e6c6bfdd951d8cf4096
SHA512 e5de03f59b2f45331c311c3398a1337dd0cec6371ef50c589304ed5cfe267b1ebab8f856c8c2061f308002fa13779f6838686240065adc346af0813cacb6176f
SSDEEP 196608:ThR8baoNcBgakUFIWqYTIXMWM57FvVYzMfKx8JaFtKqA:VGbgSaMWqPARFKzMVGKqA
TLSH
T169863368CDFF59FFDE0F88B7A1906897622CDECD6167DA1D0A1174EBD031078431A98A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AvatarLockpick_v3.0_win_full/AvatarLockpick.Service.exe
- Size 5.0MB
- SHA256 3bf67ae99bd9d5738d865f73ebc3ec41e80b62fb44e52bc831ac96ef2c9847d2
- MD5 33b0c23d3dcad42295556ea807759163
- SHA1 ef26a7df6dd30f02412b781a8ca6c247691c9c68
- SHA512 24cd73a9c033d56c8d334c7437c7ec81e8f9a8643d42284fd738272c3a518e6b9f98388afb62fcfd56a0dd3b2550751361b1fa98abff197a24e1cf53c90d0c0b
- SSDEEP 49152:4kulJqeBBty0KRF9LAKCk8tTEHE3YcviCaTpmvHQThB5P:4ZJewHQThB5P
- TLSH
  T1DB3649026FB84329D7AE4674BC2177F697B1B4075621A78B15C4D1A93E23BB04E213FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  AvatarLockpick_v3.0_win_full/AvatarLockpick.exe
- Size 4.6MB
- SHA256 0a58ca943872a8b198c42f2178943bd89a279a1139f1bbcbb0a3ede38aac3f1c
- MD5 01a4ee9f51c3445e23eb675a86dd2cd2
- SHA1 b83b5142411864b402dfec5d4a19ee70ba4ed8a9
- SHA512 c537633225940cc4c5ab809f7349ef2d350246f12b59b6233a4c7dc119b0dcb3d680507136e6b9b276fffb0851ba5e2250c43db5551e861d93714a3da2012b19
- SSDEEP 49152:h9cdqeBBty0DAJa+qZ9cX/OsuF9LAKCk8tTEHE3YcviCaTpmvHQThB5W:Ikj1HQThB5W
- TLSH
  T1B6269D0273F8427AE5AFE374D4365646CBF1B8066760E7CF5640A1A96F33BD16E21322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery trojan adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3 behavioral4
- Target
  AvatarLockpick_v3.0_win_full/GUI fix tool/ALP_UI_Cleaner.bat
- Size 1KB
- SHA256 5c56dcf6bc7f034cde487ea5484696f42127895e758d2d166cab403aaee233d7
- MD5 53d185195f893604ae68fbeef9b2c856
- SHA1 9b7dac8fce0c11a999fb712f810513350887b8b5
- SHA512 97a41846dad5439d2dfc38a414b0fcf7c80c29273b2b331f493f20958bd31969025eaabf63e3566d9953841270d5988286581361f8ec0d9afa80af546e61975b
- TLSH
  T15C31CC56B1BDA16116BEC75C0EB680A2FD0A60CF42821E6C7D0FC0794F607C67AF91D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  AvatarLockpick_v3.0_win_full/UI/AppScript.js
- Size 87KB
- SHA256 618d12fbb2644371fd1ddbb0dec70668012afdc2f16427c30bf1f02475ec3ab8
- MD5 b4792bf708cd41da7a01017b34a5ac16
- SHA1 a021f74767258c65cc7aaba0ab115d922c12773e
- SHA512 4463130263ef35cc27d5f19e4d2256334cebb0cf3dfff81a5d7cb0a3693613ae47d39725355c02a671751f9f323816fd382618671a82bb5c16d95e5530a6dede
- SSDEEP 1536:fL0V7XX1dauaN+iNpKYddB5L35wYGI8YhpPl+39MTK/FYxd7uJldIWkI:j0apKgdHbmI8YhplmMK/FjJldP
- TLSH
  T1A293836A3126143549BBA7BFAB93A248FA31600337018215FD5D94442FF9DA4A277FFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  AvatarLockpick_v3.0_win_full/UI/Explorer/ExpExt.js
- Size 17KB
- SHA256 758a3edfc38df5f1566ffc6784f172d47d32670708b6aabdc14d71c442bd8228
- MD5 07c66bd9bf6ae4a054bd2ed53e83c5ad
- SHA1 df50604007115acf3905e7de09e08c72502534f9
- SHA512 1cbfcf8df064df188511657b9255c9674aa016b4defe120bab0d0e7c65012c47fa90c299306f3cd5f0d02f2dd39e9b58e06253b11e4e839a4ad18b1bfd470af7
- SSDEEP 384:T6gUcO7qS6iKQVfaAoD3JoHvuCawShyQYrywSvI8Ho16VwV/:ThUz6iKQVAmchy9rynohZ
- TLSH
  T191823E713DE3083B466BC2C76697C367F8A0702BF647A9087AEC96C45FD6C50B22E591
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  AvatarLockpick_v3.0_win_full/UI/Explorer/ExpScript.js
- Size 16KB
- SHA256 bcc768d98034b9791b1a43769f238542a2fb57253f75aacadb0b75f0cf9c33ad
- MD5 2faf0d402d3003232d0f3a94c54b7ae0
- SHA1 9877045ab0e3f1bce49cf6ca92859b7a41ee0a0e
- SHA512 dc092aa6d9d14a19c59edbcd4f57754c1863ce917c2acf6eaf151f4c31e8f8acaf96cabef4208734174f4f7a5aca47ca6335b958b5e742ec9af44dd25ad97d63
- SSDEEP 384:uOOvSu4rScWkjTyygy0JpnQEGEQUc5Q9ztVcntUzWXzn6IiI9CAkC5cEGENC:uO7WkjTyygyKDFWQZzWhFI
- TLSH
  T14D7272997E9121314BB7D7FBB663C6A8FD302023A9010245B95C86921FB1DA0A57FFDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  AvatarLockpick_v3.0_win_full/UI/Explorer/i18n_loader.js
- Size 2KB
- SHA256 71086e55000d81961c811210dc18f182b4e09eb8f4fda68ca7ecb78972d2f043
- MD5 123fb76ae59cb5a71b09753519931f5b
- SHA1 91ea9d2d3e4fa192d5dad291437f5658ef049e76
- SHA512 1bf47993eb9d1110eccfc1cfabf2893c0f4022d8ad2bba9dcb9eaaeeb65d562ccce34e6e66fd3e37064905faba4314413784a249598ee6ba6ed2a543f64565ea
- TLSH
  T17B41E16D69FB2021422360BCC3CB7241B238B4172295F9587F1C96049F9557CE6F1BDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  AvatarLockpick_v3.0_win_full/UI/Explorer/index.html
- Size 10KB
- SHA256 550fcfd7a7eec1025b006302b30487eaa0e8c366dff7a1822bba36efc9b4da4c
- MD5 0b60d14c0bc1844c9fe04764c3842c56
- SHA1 1b29710aea949ba099815cd3bd914ac6b73ce161
- SHA512 0816a3f81bbc9915f0a9475accee04eb16ae5e278d6a004482579743f2e986921fd55165a9021fbad9e8c5a1d10891e09fe16fdc27cbef5e7644f8ea1321d1bb
- SSDEEP 192:kKfVJeE38xOON3oIOONQyYUNZBRI7c/PTquTQ9ycvZhNfTeid6JLPzIkRQ9l9sfK:kSTOCOA7uCy+ZhNfTeid6JL7IkRQ97OK
- TLSH
  T16832FF30A0E42B77063782C56D95E343FD91B10BD79A4A4436ED93E76FFBC61A80781A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  AvatarLockpick_v3.0_win_full/UI/index.html
- Size 69KB
- SHA256 29a36f6554fedac3529d46575190cea4e8ee60b38474d0d44d7dfec3cfcbbcd8
- MD5 f3b5b55ca32ed664d4a845ae74fdeb66
- SHA1 e56184f5c88069dfe8335a12bbedeabe97719171
- SHA512 430954988dc7e8b0f42bf56449f894cda9439d5415cf28ebba2980ae553b082f9664ed216a20aa8ffcf317b5b8bfcba332ea727ad24ea2300caa51cb4af90acf
- SSDEEP 768:6psgtNclSXgUHWz8OWhCjH/9FfiG8CCMb1UjkVWkIfAvf1GxswBEHOuH/icjMY6:4sEgUHW7ecVFaGTCMb1UoVWkS0/iND
- TLSH
  T128636360A0E52E37813B82895E82CB46F9909547D74E65947FFD23D79FFFCA1880B086
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  AvatarLockpick_v3.0_win_full/libs/AdbWinApi.dll
- Size 105KB
- SHA256 120bef587119c6cb926b86b9be90fdfbce38937588eae28cd91a94ce63c7b965
- MD5 47a042211f076ac2ec64a8959f455d02
- SHA1 ddaf6836e376c7a5d649e7c66fb0f7f193097ab1
- SHA512 134a9484acd567957a6e35fc0a872ed6f8bd3ac6c1526cad2efe2ce392879c5bdf467dd994be4d2c7e78e9849f37710a91d506702a7df5e55e0d852f5734572b
- SSDEEP 1536:Rwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCPj7+9o:RwqD3L8Tezq0et+ui1yYco
- TLSH
  T130B36A227891C072C8D361B91AECF76593BEF4B10B6589C7339803DADE643C25B7529B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  AvatarLockpick_v3.0_win_full/libs/AdbWinUsbApi.dll
- Size 71KB
- SHA256 6ca69a2ca0e31309c087d288f058977d421ad03500e4c3e1dbd981241a069c60
- MD5 70d9408186450f9aae9b284428593017
- SHA1 af00109a1596f5faa7aa0038d535c3ed54dfaa76
- SHA512 157354d5a866378f854eb3c1e5cb4d3ad8a8dde93931c0f9ca0e786bfda3edf58178212a066c8cf19ca22225363b08eaf68f6d30c986dae52bca512b39804811
- SSDEEP 1536:b72doFmOiHizFbPlspcsbj5ZsP+YeTs1pT7+w2:bSSfN9+YeTs1pT4
- TLSH
  T1F4636C237990C472CC9651B819ECE621A67FBA501BB184C7779C03DB9E203D1ABB9397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  AvatarLockpick_v3.0_win_full/libs/adb.exe
- Size 8.1MB
- SHA256 957e46b8615f7af5b7292a2ddabe98d2e61940c3fb2b0545756507f080613e71
- MD5 f62bbae3edbffbf33f913a536c37f5c5
- SHA1 c8cb0d5720e2d34d359a89f4250e0971ba4f2da1
- SHA512 f2b79507c0b83006c304c5e3e0fce19c9685465f9e487fc0992e8447a6f43f47a18aa39cfe0d21b2e4a29f134c16b17285d5463547ca82347eed9f72d36a5577
- SSDEEP 196608:hQbvGuN6MGAaC1spB/fZEf7t/tg/78gPPvSQpZjXvDD+cNGwFZN:hQbvGuNtGAaC10Xi71tjgPnS0BfyMZN
- TLSH
  T1C6869D06E153A179C90310F1212EB37D6F244A148B258EFBDBD4EDB86B659E0353FB1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24