6501f4b95651e742d2bf41587625b2474455087b238d31eefcabb832922a69c9

Sharing

Copy URL Twitter E-mail

General

Target
Adobe.Audition.CC.2017.u2.Multilingual.iso
Size 398.5MB
Sample260910-txhpqadr7z
SHA256 6501f4b95651e742d2bf41587625b2474455087b238d31eefcabb832922a69c9
MD5 f577865d1a1c24cf7b619d6044812b82
SHA1 34b78b342ad64f0cc0182c0889ccbf7f8e9c654a
SHA512 f2128feb68cd0cbdee4f451a49a37d1730f1026a02d0b3aa096b5e32e5afecdf642a325f158f583ae1d3a3edfb6253ebcdb60f001a403df8b1922a8f048d6d77
SSDEEP 12582912:cyaedlXCkcUXrwY5ZdsHFkFLD644WqP9v5/0W6y/0Wn:cRedYkREGZyHSPp4Wq15/0W6y/0W
TLSH
T1E119332F669055E2E173FFF1AD145A15AA2DAC38673110E372FC4F2A17B31C6563B222
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Adobe CC 2017/Set-up.exe
- Size 2.4MB
- SHA256 0f8ccdf2162915f2d056702e9df32c65e4ed2e0c0d5d5ea606aa8803b4ef5d9b
- MD5 a810f9c99d82cb8d15667e2494020ebe
- SHA1 e816848423a57939181651be0074de942b700f32
- SHA512 2731e617800a326d01ffd0a764765bb96675e8ad50285cad77e86f4e8749a5e6a00c21a3173f560a62c3c9d55b9ebfc5cf1d2cf42fc0896f476f74e0b56b3721
- SSDEEP 49152:H2RUvjn/TCGDQiMDpU/Sb8HDWSrbmnidPtrDEKhPlGRr4909Q7Kitj:Wyn/+GDhOcSb8HDhrK8rwGlGRr4d
- TLSH
  T10BB5AF217BA19272D57306706E1CB31DA0BDB5B00B3546DB63DC1E6D2D704C2AA3E7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1
- Target
  assets/EULA/cs_CZ/license.html
- Size 84KB
- SHA256 ef2332be8b0c47c1757e4e7b8a6e043fc4bbc2c8fc77041e4e335ed13274c062
- MD5 b2de89458410868ffeafd6ff653e5f4a
- SHA1 1acd32ea01957eb03c45b6bc3a651e0d48cb5f68
- SHA512 f3e3ac320dc446bf2a8b716f0c58d1617627e80635d7161005f683e8cbf48bd08260e9564ada658f1ed9a45242d4c1019b3869ce96eadfe9c938befde3331965
- SSDEEP 1536:0l5BhA/ZepV/AZlyAVElbet36tdSxuDHsk4iniZ981B9bZYQDpg60:0HdpV/AZlyAVEktKtdAaMais1B8kpg3
- TLSH
  T16283F92F8942BC1BFB9B43DC67A99718AD5E8638013D94653E8B564F4072F789EF8C40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  assets/EULA/da_DK/license.html
- Size 79KB
- SHA256 e436c4684b67a0c6a58d5b0269adbd1d05fccefacaa3bdbaa5ffac42794c69e8
- MD5 e45e8f78cf8fd0d55103ea62d918ac61
- SHA1 79db613f7ec531cff01dff9e7111bf9c89718215
- SHA512 3c84aa262e8dc8bdf158ad9b8bfe47c629b5104e19bfa457710e172d520382e06b212597fa41bc51c24b76311a3b07ae287d5c3c47f68af09261ead4ac849b7d
- SSDEEP 768:0lHPs9VJJVBlYoOqXUOqQHcEDHDk8T6KKeyY9v6rq11tketGWl9x+ahvkIfE0czx:0VfQI8T6KKevqJet1lUvrB
- TLSH
  T16583E581B4183B3EEA6F4376E5110A6FEBBFA62CC0655195B1C4C1EBA0D3CA4537E1C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  assets/EULA/de_DE/license.html
- Size 88KB
- SHA256 e5897b8e01ddae06bf10ae8951ee5279a7b64fbe7ac5bee07e030be8565b78b3
- MD5 9a255533cfa70804ef7e9e0110ed95e2
- SHA1 31b9dc3e278242bf46273d91fb9dc3cfdae7780d
- SHA512 93de20fe65c741a61ec7e8fe45a83a14fe59d5afa4f48a5f80de1e9dd9266a454354fc930cb30810099cf02d966d6d4358fc59d122a7efc8adbf78ca694581e0
- SSDEEP 1536:0Ay5LWMwA14tUa2jKcsYmVn7gfPyBzADuvOKphs8A3pGKVsJu76xuObh3:07dKcjUWa8C2AoRK
- TLSH
  T154932A91BCC91B2E928B73B6B301DEAA776CA379C3827055F29CD1B363864F0417D469
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  assets/EULA/en_AE/license.html
- Size 75KB
- SHA256 a807551a6e095e1941670d0bfc0c4e95eb9747f7d39cf97f56ce033deeda80ec
- MD5 494ee75e9f5c594619a6acd3f62c5656
- SHA1 1c4b3c213815712b2abb650e5169960b08680c3d
- SHA512 0fe3bf2bcf82bec4293f9ea0aa00a5c0be333f239aaf3d0fe42344bb9536a2d9bf311d424ea0f3b474660089df1496297ddefc6cae64dac59ad075974bcd512a
- SSDEEP 1536:0Zi96qlGqKsaYOV0hugs2HWTtamTimwhWnFqo6kwpGYxvgK:0et6stOV00OWUmwhWnFN6kwpdmK
- TLSH
  T1B673C55673252BB71AC303B26A8F9ED4FB3B807863B15684719D809B23C3C64537B6D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  assets/EULA/en_GB/license.html
- Size 75KB
- SHA256 1234e7564644aee675f1e12cbef89c4a2588f6e8c4418328cf474efaa403626f
- MD5 b3c77cbbe94b6d4f26c9eb6be887ed44
- SHA1 e91a5e56cc76ca2ae246cb0400a99aca36becfd4
- SHA512 1012a5676a132529f582bc1e5aca21497536c7aeef59daaccb7a876c70bd5c42e843cfc960ebaa297d3ecbde79b8d338896f8c214629870743d9c083fb3aafef
- SSDEEP 1536:0FU96qlGqKsaYsVEhugO2HWTtamTimwZE1Bqo6kwpGIxvgt:0Yt6stsVE0YWUmwZE1BN6kwppmt
- TLSH
  T1E673D55773252BB719C303B26A8F9ED4FB3B807862B25684719D809B23C3C64537BAD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  assets/EULA/en_IL/license.html
- Size 75KB
- SHA256 009f17827534e89044f89a3c99251694e5f8a73f408059832e438e8a86f3020f
- MD5 9a47f0ad8b02130373c9f6a086f99c62
- SHA1 dec280d13a6694e4aa34f00034a40e77feffd4c3
- SHA512 2652885c2f705744c0016f44bb8e427a0d8c206b401995e0a4644e938833999a4142a26460eb19671471e534618a56bed2764833ac79ce168fbaa7cb29cbe743
- SSDEEP 1536:0Y896qlGqKuaYQVOhugI2HWTtamTimwDSfXqo6kwpGyxvgh:0Tt6utQVO0aWUmwDSfXN6kwpzmh
- TLSH
  T17873C55A73252BB719C303B26A8F9ED4FB3B807862B29684719D805B23C3C64537B6D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  assets/EULA/en_US/license.html
- Size 75KB
- SHA256 65d6e88abe954be714af5c2528e148bf6fba3d39cb2873b801c1e1ca81d87cf9
- MD5 32a00190cb8676f849b5af53ccdcf3ad
- SHA1 9124c52c0f872bb8695e6445956b26c92c868983
- SHA512 de99484bea7b262f0ff8c34c9aeae5bd820ff6224a82cd81d727004525f9595aef19d656d9622313be56c039245c07bb859e978c7f8dfd27edad73aab25c7e80
- SSDEEP 1536:0FU96qlGqKsaYsVEhugO2HWTtamTimwZE1Bqo6kwpGIxvgS:0Yt6stsVE0YWUmwZE1BN6kwppmS
- TLSH
  T1AB73D55773252BB719C303B26A8F9ED4FB3B807862B25684719D809B23C3C64537BAD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  assets/EULA/es_ES/license.html
- Size 83KB
- SHA256 b6c1c20dc962670aa4d2faf2af43d674f7bd26e1dc8a9b2111861eea345550b7
- MD5 7d6ad948a3b82f8f5d92aaf194fa378a
- SHA1 8a846ab87fcc0d9f1926a70369cf03fce2480f2c
- SHA512 0f6d72161f1c4cfa00a6e8dfe199f3d72fbcb152aa07c03dc06a226cf20fa0f80d74e4230e47305d8134df8ac75e217b3000bc9a3b90de037adcd7692eac8830
- SSDEEP 1536:0dd6CmwDl1fk4m5WrFpIYus44Urz1pBxKt+w/t393Mz1wuTm0H+bxewGW3igHblo:0lDApLU+wlN3MZwuTdGxjdRDmd
- TLSH
  T18D83B63579C82F679583439DF282C667F9E89194B84DD082E29953AF11CDACCC33EA94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  assets/EULA/es_MX/license.html
- Size 83KB
- SHA256 443f76b84f65ba27102a268bbfb573cb9c023421242501ef2dd3f1e11caff616
- MD5 c596e3c46a175de6592d27a2a14926ba
- SHA1 41b80cbbc207d58f486c3765c087f4ad69bd4089
- SHA512 360175c23f403ef1bc75b861d9adf9ecddf5d8c01f945bc78ac3d04a8a5195c8907e79e16b40b42179e920299562358a51308ffdb95229e4b294283c01304eca
- SSDEEP 1536:0dd6CmwDl1fk4m5WrFpIYus44Urz1pBxKt+w/t393Mz1wuTm0H+bxewGW3igHblD:0lDApLU+wlN3MZwuTdGxjdRDmO
- TLSH
  T1FB83B63579C82F679583439DF2C2C667F9E89194B84DD082E29953AF11CDACCC33EA94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  P6Native.dll
- Size 1.1MB
- SHA256 1610423c08c170fb78ddf1f797ea1f788ddb7b4efd8f4175ed531b4a87d9691a
- MD5 42a8e780bf55dc398b389fd77a85b328
- SHA1 541320eae0986986e8d6100ef9e2520670740a82
- SHA512 8d251dff866b15bb93900a152990385d3a626d9b0883e2c3748c652e88d62e093bb14fd8fd2c62469d40efe466af0533e28c1e5b0ec8cb15173bea0832bc20cc
- SSDEEP 24576:YwS5WwyPk7jPzOYUAi4vWP2CPZd1W0/gTSstYt9eMfAx5x4AIw:YwS5gk7j7iOCPZd1W0F4Yt9eMAx5x4rw
- TLSH
  T18F357E2177E0C035F4FB26B19A392B694D3AF972273080CFB6D4195D9D706D2AA39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Adobe CC 2017/packages/setup.exe
- Size 128KB
- SHA256 c5fa5f1dea6cccb256bdb292ee949731f01c42cc11c92892c104b95580f311ca
- MD5 15ac0d62aa21a2bab12996781bdc0c50
- SHA1 aecb07ef8fae7df4a7bd7fcf9fe748be28c17dcc
- SHA512 4923d4cdf2b55fa712ba07643f0009d1ca20f5f31128f5ea83f02d5793409a27f99970fc9c364d403422f6f19903b7462541d799cfc32eef9fe4dd6931305bf6
- SSDEEP 3072:Cyg5QeNeW2MVhTB/3ilknk6M3BFSXkndowSmm6MyC/Isrz:Fg5RNDianZM3BFIkndNSmmByAz
- TLSH
  T141D38E5377D2C5F7D0E212B109912F9161B6FA3D071B4983B780790BBB729C8E63E686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral12
- Target
  Adobe CC 2017/payloads/Microsoft VC 2005 Redist (x64)/vcredist_x64.EXE
- Size 3.0MB
- SHA256 0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
- MD5 56eaf4e1237c974f6984edc93972c123
- SHA1 ee916012783024dac67fc606457377932c826f05
- SHA512 f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
- SSDEEP 49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
- TLSH
  T17DE5331262D08137F6E3A7F11AEC9DB31631FE932AB2161A0212687F5CA73E4517C71E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  Adobe CC 2017/payloads/Microsoft VC 2005 Redist (x86)/vcredist_x86.exe
- Size 2.6MB
- SHA256 4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
- MD5 ce2922f83fb4b170affce0ea448b107b
- SHA1 b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
- SHA512 e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
- SSDEEP 49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
- TLSH
  T1DDC5331259C4D23AE0A213F45DFD2A734B3D7CA8B72027AFB78250968D262D164357FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  Adobe CC 2017/payloads/Microsoft VC 2008 Redist (x64)/vcredist_x64.exe
- Size 5.0MB
- SHA256 b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
- MD5 e2ada570911edaaae7d1b3c979345fce
- SHA1 a7c83077b8a28d409e36316d2d7321fa0ccdb7e8
- SHA512 b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8
- SSDEEP 98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet
- TLSH
  T10836337146138770D1E443B2789607CDFEA3ECA004226A7B9664FE2B5C05ABED59E70F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral15
- Target
  Adobe CC 2017/payloads/Microsoft VC 2008 Redist (x86)/vcredist_x86.exe
- Size 4.3MB
- SHA256 6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- MD5 35da2bf2befd998980a495b6f4f55e60
- SHA1 470640aa4bb7db8e69196b5edb0010933569e98d
- SHA512 bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP 98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
- TLSH
  T1982633EE1E32462AD70B42B2E4352783D578F0A68C7B8DD79D93553EE1E3266FA10046
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  Adobe CC 2017/payloads/Microsoft VC 2010 Redist (x64)/vcredist_x64.exe
- Size 9.8MB
- SHA256 cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
- MD5 c9d9eebccef20d637f193490cec05e79
- SHA1 15d032d669078aa6f0f7fd1cbf4115a070bd034d
- SHA512 24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6
- SSDEEP 196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8
- TLSH
  T189A6332DD2128E2EFEDB3730E1EE94EAD064D244C25722C3F15BB186B6B768D171E641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral17
- Target
  Adobe CC 2017/payloads/Microsoft VC 2010 Redist (x86)/vcredist_x86.exe
- Size 8.6MB
- SHA256 67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
- MD5 1801436936e64598bab5b87b37dc7f87
- SHA1 28c54491be70c38c97849c3d8cfbfdd0d3c515cb
- SHA512 0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c
- SSDEEP 196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC
- TLSH
  T1789633D714300ADFFC07BB70F7568555D8E9496233A8D7EA4AC60CC89AEEAE4C0B6750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral18
- Target
  Adobe CC 2017/payloads/Microsoft VC 2012 Redist (x64)/vcredist_x64.exe
- Size 6.9MB
- SHA256 681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
- MD5 3c03562b5af9ed347614053d459d7778
- SHA1 1a5d93dddbc431ab27b1da711cd3370891542797
- SHA512 6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75
- SSDEEP 98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk
- TLSH
  T1B876333286989427D1A32073F618D5217FBCB15C1F1048ABD3549A6D3B68AC6BEFB347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19
- Target
  Adobe CC 2017/payloads/Microsoft VC 2012 Redist (x86)/vcredist_x86.exe
- Size 6.3MB
- SHA256 b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
- MD5 7f52a19ecaf7db3c163dd164be3e592e
- SHA1 96b377a27ac5445328cbaae210fc4f0aaa750d3f
- SHA512 60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
- SSDEEP 196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
- TLSH
  T149663333B9549032D26214B3E555D670BE3D70282F2048FB9794DB1A39B89C6BBFB247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral20
- Target
  Adobe CC 2017/payloads/Microsoft VC 2013 Redist (x64)/vcredist_x64.exe
- Size 6.9MB
- SHA256 e554425243e3e8ca1cd5fe550db41e6fa58a007c74fad400274b128452f38fb8
- MD5 96b61b8e069832e6b809f24ea74567ba
- SHA1 8bf41ba9eef02d30635a10433817dbb6886da5a2
- SHA512 3a55dce14bbd455808bd939a5008b67c9c7111cab61b1339528308022e587726954f8c55a597c6974dc543964bdb6532fe433556fbeeaf9f8cb4d95f2bbffc12
- SSDEEP 196608:19OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:Gz5x7jLXkmkU4cFe
- TLSH
  T131763331E7B05023D6F201B2E411D528BD3DB2291F109CAAD794DD2D3AA9AD6E7F7213
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21
- Target
  Adobe CC 2017/payloads/Microsoft VC 2013 Redist (x86)/vcredist_x86.exe
- Size 6.2MB
- SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
- MD5 0fc525b6b7b96a87523daa7a0013c69d
- SHA1 df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3
- SHA512 729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d
- SSDEEP 98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
- TLSH
  T13566233296642033D6F10873F469E2217E3E721C2F1188BAD294DC5D3EA95DAA7F7352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral22
- Target
  Adobe CC 2017/payloads/Microsoft VC 2015 Redist (x64)/vcredist_x64.exe
- Size 14.7MB
- SHA256 7ba670314e78037a1ea7bace8a8dd82a814f8760102bed26955140a7e1a067e4
- MD5 ab85db1a577cc93f8464fc117c914c5c
- SHA1 5a48855775f70c492fc663482b36f93e6b19982d
- SHA512 be2438cc56c0f6a1ff49d8b7a6245bbc68b8b8dc57aecb6d9003eb2660e024d27a61d3dbebc37f7c87ebeb4cbf02c31470885ba0b3238b36bf1eff8948ba2919
- SSDEEP 393216:j7Ulp+dkBSuF2SfUfn6VmyMj5zaTMOvf9e:wp+Ty2SfUfnWMFWoufY
- TLSH
  T1DBF63332B6DC813FC7960533A955FA647E7DA128231140F7E288ED5D1B792A393FB212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral23
- Target
  Adobe CC 2017/payloads/Microsoft VC 2015 Redist (x86)/vcredist_x86.exe
- Size 13.9MB
- SHA256 fb076333df3d242cfe0a490014d5c07297d994a407860d45d9e4acd2d3d33b28
- MD5 2fdc47706033900505d12c63aef97bfb
- SHA1 7f35d9236a794b3d4b454be519c21386c050bbca
- SHA512 22dfeb32c6adebf3bc333f0a0c3cd0da964f394cf0bf3fa2064b6eacd7954be05edb6fc038e019a4862862aab903856d382f78b06080ed67f044a38eb03c0ca2
- SSDEEP 393216:PJElp+dkBSuF2SfUfn6SdtZdffTMunioR2n:Sp+Ty2SfUfn3ZtdZA
- TLSH
  T122E63372BAD8803BCAE70473F854F9707E3A652C232045B7D3889D5D2A7529767FB212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral24
- Target
  Adobe CC 2017/resources/AdobePIM.dll
- Size 1.3MB
- SHA256 e6e2d06d3079eb31699808cd146262c705d35c93b3b2785b9ca0025da98a5628
- MD5 d89cdbf1a64fbe024390bfebb21239dc
- SHA1 59dee85b8a5c54c2d3bf4b70d44b54a17a223355
- SHA512 98a13835845b04b4df3e0386b8931ae7690c62b1297f977e8c903b18b22b934957e52334994fe5f22cbfdf053318f9c3a2d0f7a7ea0f1e0a19afcc69ff27dd27
- SSDEEP 24576:OUNDH3N8P/R588WVBdysOFWO+5rLhRT7YDBTpjGp:DH3GMVG0JbYDBTVGp
- TLSH
  T156558D11B393C171E8EB11F01A7D7F9A193C6915072489DBE3D82C996D301D2BB3BBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25
- Target
  Adobe CC 2017/resources/updaterinventory.dll
- Size 457KB
- SHA256 f33c4e3c40115b85cb7ca2819804a059ba386a10c9827d6b8923a8d2bb76b922
- MD5 9165642b427738f5787a752657bd32a2
- SHA1 5c9d4d7d1d210de5ffc00aee96ab320e3e2d614e
- SHA512 528c696525c87192940bda863292aaa1724033e1ec5828032695d9fbf12bf1a5a6d96ca2cb0c14e73d902e7c21021c81d75f47a1ce3098f588a3b74731028ee7
- SSDEEP 6144:LV0SIgsfpeunGrrednB7ZCn87L6B7FocK2Na7pxeW821+xSj:LV0SIzEwZU8/6B7yjyKpxeWp1aSj
- TLSH
  T1F8A4AD11B9C1C071E82E02B0712D9B2605BDBDB14B698AD7E7D8AD4F1F72AC15B32B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  Crack/Emul/amtemu.v0.9.2-painter.exe
- Size 2.4MB
- SHA256 cdc95d0113a2af05c2e70fab23f6c218ae583ebcb47077dd5b705a476f9d6b96
- MD5 8abdc20f619641e29aa9ad2b999a0dcc
- SHA1 caad125358d2ae6d217e74cfcd175ac81c43c729
- SHA512 90999eb0bcb76a3d21e63565e332f1ac8a6fbc1e3dfe147c4ba2b5f8c542e21da3a43df9f5074eb7f7107e0e66d48e21cedda568fa1960502645f1b358d1550e
- SSDEEP 49152:+kLvWlT+7CZ1k+1T0RSkXDE+QO6oP4DQ4E7U+:+kCZ1bad4+QOJgDQI
- TLSH
  T1F1C5D062F2818437C51729345D17D7A9A925BF201F285C877BF93E0CAF362D278396A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral27
- Target
  Crack/Keygen/Activation_Keygen.exe
- Size 109KB
- SHA256 c5d9c52583eefd03728ba877baf21725f9e2da4435e9433b87dc82b77b695edd
- MD5 8c03fbbef9db991bb02ab35bf0d2718e
- SHA1 d0caee799f530bdabeccdba7f329f6fbc027c395
- SHA512 ea05c4d9dad4087589cb39ea9421bf0215f6567ef7de3375b87eb9ce4953b812a01fa1b92514618a534f04c8fea1518a76307c10a2c914b345edb34122a721f1
- SSDEEP 3072:0H451OJpM1uOcIbqaORUF0/+8v51AwGoG94dF:l4pM1uLIbCKFq++RGT4dF
- TLSH
  T1F3B30296BE920C84C510BAFB6163E97A7C82EF13A9C52713CBEE7C5B79F0354254904E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28
- Target
  Crack/Keygen/Check_Disable.cmd
- Size 2KB
- SHA256 6d12d961ac8e7ed617e8a46e837a4810baa124aa149e2ffbcd3511afbecf7e1b
- MD5 86e1d0c712554c1871a78f61b5d194e7
- SHA1 62c5a5d7c8873d33634f2e30dbcf43046badb74c
- SHA512 627e605f42e006dfca7b221a20fb73ad66fa86a489844fb013c1cb8c1113a72a9fdf47d20df893eaeb69239fe5bae920fee3fe35e4c72a12c9de707a80189ba6
- TLSH
  T10351680D1F48E92E44703134498B55BF2B2BF356EA9EE844352A9C47D322AED4539CFC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Drops file in Drivers directory
behavioral29
- Target
  Crack/Patch/adobe.snr.patch.v2.0-painter.exe
- Size 587KB
- SHA256 256c2a409c97448d168f3eb1bfb89af3d259dfc05a510a3f464d8e4b348116d4
- MD5 b31679db7db878992b4553290a9e6c7c
- SHA1 7d0d2b434b51abe91e5b16e4c8dc8d26143b138c
- SHA512 a9c65a280c5bfcd9a221a47237e96f454c85cf0a2222cd0469d2326a03cfaaa5b69424c4963f128affc91c8861b9aac236289578a94629717d81a7e3b08a75f2
- SSDEEP 12288:0MNVzzbgNRk1Lq+TC0YPxfqswK/EH1WYEmMC+jsEdf8Zdq0Cxmj1A:dLE1+TYPljwK/oY9se8Zd8kJA
- TLSH
  T1A9D4120CB9D28207FB5395324BD7C717422CCE7A58A457232AA776B22DB0C547F92E62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral30
- Target
  autoplay.exe
- Size 185KB
- SHA256 3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82
- MD5 76ef16e94f77454aaffdfa4c700be85f
- SHA1 9b45b3826706337a11e43248095fb2c62e42d14d
- SHA512 4185cf9393877fd6d80ecfb7290c10d40a62fc7013d175e5fc91df56870500ea33b518e4f55b4e7d8a7865d3f7707fb5f49f621d5d944bb1edffda4734f99d53
- SSDEEP 3072:fNCpBPbYsMn1mx6nWGdN6YROBxQo6PfSPgHvUJjX1qINSxT3OIpkApPxn:fNiGC6nWGdN6YO6Pf9vAjX1qINGLdRz
- TLSH
  T18F047B6232D050F3E49368B299999BB68776FC74433D85D3E3743D2A25222F27B38365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral31
- Target
  unicows.dll
- Size 239KB
- SHA256 22f23cc65698741184ec34f46e6f69717644e0b5aabf5d5bd015101f2d72e56e
- MD5 e1102cedf0c818984c2aca2a666d4c5f
- SHA1 d8d88ea7083aee9c40f6fdc6c56451a018d21a83
- SHA512 e58b35815801d6d3797f95c986834d2ca5450ccc3f1fa1d27d127a8d1d36f8e21279173715a00686c9c831d22d7c5b5b9cc5874170223a4d78f09c4eefa390a2
- SSDEEP 3072:fEWAQKw38JvCAib0uT++ICSQ6UOX/mQhYQXS0FsmaiUZZynGJ5x/59XH7PMYV1Nz:qwgvCAib0PAOOQhS0/s5x/R1PkOFB5
- TLSH
  T180344A19BCC05E43EF6733BEF9207B74D7DB8A241538AC8646CE5E0E25B1681133E5A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Loads dropped DLL

Adds Run key to start application

Badlisted process makes network request

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks system information in the registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks system information in the registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

UPX packed file

Drops file in Drivers directory

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32