93bf590a2af855ee00af6b488e97ab1b1ddffe10188a9bd73e8a1117f0366958

Sharing

Copy URL Twitter E-mail

General

Target
Fortect.exe
Size 826KB
Sample260910-vm5xyavyfy
SHA256 93bf590a2af855ee00af6b488e97ab1b1ddffe10188a9bd73e8a1117f0366958
MD5 1af0c4a3d377f96de60a7fd1f0760238
SHA1 125ddcb68afb6319b5d167b2c2ed52171c37c73e
SHA512 f0cfd31d3fde5255282b0aa54675e2a32388642926e30786a3a41b655ce7468d82da43760ac959f3cb7c7bc7bc2c6b906d9fa91a0eb97e33a09da2242e162a5b
SSDEEP 12288:tYl+bLrEzUxNKNIq95DjuWKqxMaYyBePU5777epjLFerRUklT:tYl+bFQIWjuKSFzQRJ
TLSH
T1BB05CF73EA0CC499C05E43BF9361C37B85996D5DA7E780C2E641AAAD103254CFF385BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Fortect.exe
- Size 826KB
- SHA256 93bf590a2af855ee00af6b488e97ab1b1ddffe10188a9bd73e8a1117f0366958
- MD5 1af0c4a3d377f96de60a7fd1f0760238
- SHA1 125ddcb68afb6319b5d167b2c2ed52171c37c73e
- SHA512 f0cfd31d3fde5255282b0aa54675e2a32388642926e30786a3a41b655ce7468d82da43760ac959f3cb7c7bc7bc2c6b906d9fa91a0eb97e33a09da2242e162a5b
- SSDEEP 12288:tYl+bLrEzUxNKNIq95DjuWKqxMaYyBePU5777epjLFerRUklT:tYl+bFQIWjuKSFzQRJ
- TLSH
  T1BB05CF73EA0CC499C05E43BF9361C37B85996D5DA7E780C2E641AAAD103254CFF385BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit defense_evasion discovery lateral_movement persistence spyware stealer trojan
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Remote Services: SMB/Windows Admin Shares
  Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
  lateral_movement
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Banner.dll
- Size 24KB
- SHA256 6e09be529a79118083e62132e891b9b09abc2027dc90b2a14e6fd0d2271c7f9d
- MD5 b5cc66b6e6f18ee1de837bf2ccf87fd1
- SHA1 b71741e05462f3f71bd40bc4bce8250e54082f9e
- SHA512 d9d156a014673013ea59336935b2a0ef6f7f8bc9e4ccadbb4090c5d5361e8829e73e59ceed12427a02e0809cae67fd1feae66f55572cc69c6fffd6dec97842d1
- SSDEEP 384:XCD/NyEIYi2mL4/y8RX4gVo+IIYiqZKy8RbmL4nNy1/:SoYiDLk5ZUmYiqQ5ALj
- TLSH
  T100B26CB388906C45DD679D30B4C0A937FD72B6952AC0C1C7711AC1A5D7813877BED2AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/Crypto.dll
- Size 24KB
- SHA256 490ec3a42d0353a3dca7fdb3f4d2392487a1e7cb2dd30927710e31c7baa75cf8
- MD5 5032a6520bf0142111825f5ca1e5ffeb
- SHA1 2b3d179fa07db3980bc4d8b865dc98ec8be1232c
- SHA512 f633458357d218a6f332ce123fbbcd3ab7d8ed437b1547ba91f7fb0e559c893af8617b9108b2d34cf7f1c4df25bde9b2e5468ad5da615b037278eada7f38cdc4
- SSDEEP 384:1CwKj4itsglNyEIYi2mL4/y8RX1PjIYiqzLwQ+y8RbmL4nNyHl44C:1CxbtYYiDLk5ZKYiq4P5AL1C
- TLSH
  T1CFB24BA788906C09DD67AD3075C0E937EEB2B19529D0C1CB711AC255DB903837BED2BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/EnVar.dll
- Size 30KB
- SHA256 c8f7a62d677301e465b808fae51f4a78d11c4a1ac835daf778f3a3c9e65a6ed1
- MD5 93bafae8231a2765bfc173bfeaba961c
- SHA1 97d64a93844f423b71d483f8f54ebe9cf6e19e9c
- SHA512 acb047a5a06463d0e853911baa2812cb03bc8044f4aeaa92bb305c82a4952c136a5198ead56503d75eeccdbb0c80ae013306c14e6a6cc4249044f1552a12181e
- SSDEEP 384:v9BXI4cqxCa+WFAzUeC6CNyEIYi2mL4/y8RXP/UYbIYiqUEy8RbmL4nNyihTkb:v9BoeSzNC6/YiDLk5ZXJkYiqn5AL2TQ
- TLSH
  T190E24A53C990DC75EC639AB0B1E4947FBE75BA841BC185C32156D1958B803823FBE3BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/ExecDos.dll
- Size 27KB
- SHA256 511b74f60f5da3ee22f869340f5f2250ab13e7a1f3322e98ad4aad888304c4f2
- MD5 bf306fe60fabf7f619929c7ae4cb58ac
- SHA1 d002e9a421ecdb7ffa059623dd2cd22dbb541a1d
- SHA512 23e1631e0662f6e83883c8da867baa61b0283acb2f688751d34a01585ba83d171cbb40059a9f08ed6ee198dd2098e53bf8f3ef282df87871d312ae15f1ef6853
- SSDEEP 384:/CqAUtwYjH1cEXhxNyEIYi2mL4/y8RXrhucJl0rIYiqQnYy8RbmL4nNyKJpZwY:/FcIFhuYiDLk5ZtTGUYiq35ALG2Y
- TLSH
  T1F8C27C7389D01C02DD7B9D3078C0A537AEB6B5951A90C1DA321AC1968B90782BFDD3FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/INetC.dll
- Size 45KB
- SHA256 1b5e463950832acb7f9c0706e844182e63496c09984db8d73bb9beb20fd37183
- MD5 6e083c476a77a08076e48817d53056a6
- SHA1 4f386e3293ef3be8d111d19aadc729d98b1dbc5b
- SHA512 80de01d84391f210195109962ba873478f7d7e95b255ed309a3dd1d0dd18ad52d4f95593c363db814b8259651e85e6cdf24c4f98e4d167b4fdc22b4a9b561ffc
- SSDEEP 768:wAvE90GuY2tO93oLrJRM7Z4EFYiDLk5ZvGoYiqMB5ALDj:PE+GjnmbM7F78Go7i
- TLSH
  T15A235BA24AD41949FAA7AF3074E4E6379D7ABC511890C8CF6127824D4762342FE7837B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LogEx.dll
- Size 64KB
- SHA256 91a421c5ef3f37bf82b351fff7881c6b4e02c216617dcb88e598e432810aea9c
- MD5 c53181ec8eb8771dacc78badc5db9892
- SHA1 ccc464d51c45bc7c4696e6e88e8885ba12eb321b
- SHA512 d02cd7b4608a1949821318ed5d6e89ba8ed2d7e34b7b594e21c52b06545378f04821819f0f06909fde06b7ff877af8a6b9dce341361a1f66a233e273680e4b79
- SSDEEP 768:/oaF+ATCQye/I3KWmxj00Jyb8EnovpYiDLk5ZBOYiqL5ALa6:zF+ATCNmVjj8pox7gO7Z
- TLSH
  T12D5390A298800852CA5F9A3074D0DB37BEBB76502AD084C37769C5964F613E2F77E35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/ShellExecAsUser.dll
- Size 63KB
- SHA256 c9fa24f38a92a005ef34996ab6862c442226e62c66e346c5068ec208118cfd19
- MD5 543cc2b4eddfc2b828a926605e9c1717
- SHA1 e8f82bcdc24918d09fd7fce0739639942241a55b
- SHA512 45779cbb1d19a9167d4f18d50198835bc2e3b5f9c1ce650338f91dc10a63394ea033d2138958360a8040e47c3e787c2663bd0738d42154c0ff83690ed6562722
- SSDEEP 768:9A49ATJ9ONLkh9J5lDYDzG8yVAf7hiJFkkAqnTEDlV4vihdkxYiDLk5ZDpYiqj5v:9A4CJ9OFpXf0AfNiTkIMrhdkx7c7C
- TLSH
  T19B538D0165E08872E967593064E4A6325E7EB9416AF080C73F6E837A9F713C15B7C3BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/System.dll
- Size 32KB
- SHA256 afa34914c1fb8c094d21c62d8395f5d1ea2e2a1ca4ec91caf565d92ac61cb318
- MD5 bf0fb6c72c526969ac4f989a0ec1818c
- SHA1 97237e90c2bd646de85dc2d6fc4af415a808d998
- SHA512 7086d7445168f8148d60639949b743340cc4f473180ac59e3a2d394435ba5c0da7d75cdd92c0b9a3fe69acfdff708fdf872dbdac7bc1da00d3fa451194bb3626
- SSDEEP 384:6HQlt70mij/lQRv/9VMjzrpNyEIYi2mL4/y8RXHjBtIYiqbzejy8RbmL4nNyL4m:6iqmijmpcWYiDLk5Zt6YiqGj5AL6m
- TLSH
  T110E28E6389904CA0ED539D3074D0F93BBFB6A5992AD081C3735AC1569B403C36FED2AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 24KB
- SHA256 211bc1bdf322751acd5cc2b2fcfe6fd3f88cecb662d687ce1655d8f02a4f14b4
- MD5 c2c2cd1ef628cc3f4c8377eac8e36523
- SHA1 8370a3d47bcb586ef627555a8381883882788f71
- SHA512 9520f6fa3b750bf43b96f725e78286ec4b36d1023ce5be60f15d0445ae7103b0a20b61c1ae82d0a1133169fe9211912230774d4dee8ae1e7be869f9c4c25594e
- SSDEEP 384:7WH+DNyEIYi2mL4/y8RXMmGx+t+IYiqSuwvy8RbmL4nNyJfu6:7hgYiDLk5ZsaYiqZm5ALru6
- TLSH
  T185B25CB789901C05DC679E71B4D4A837FDB2A6951AD0C1D7321AC26687803837FED2BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/fUtil.dll
- Size 243KB
- SHA256 34208ce8735852fd589010c51f18be1814a1e48c59eda19475324eb68045ad2f
- MD5 fce78d97db2b39c0a99f5d1b07c56219
- SHA1 929e98a45d866fcc6db9052e984823c6d4235b8f
- SHA512 fb4bd879547263ab29d8129abe46f05ff5ac8d488f0ffa4a27d2de5b0b7808b0e6b1a3efffd83461beb4a889de774ed6ac69bbf5412f7a80995a96a5bee99ffb
- SSDEEP 3072:ebkagTeOEvxaBcbrQli2fzn+7Mf8txAnRDznBhPiflPGHpQqWvS2j7USkeIcjgq2:tkxaBc+lpfoKhnBhaftyAUSk5cv4Nvr
- TLSH
  T130348D017480C431D8AE16311574DFB65BBEB8704FE1D6CFAB944D7A8F312C2AB35A6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 30KB
- SHA256 c8e3952e66bbe4947dee852592a40d362dc7e33eed5b9b85a761801ed5e51798
- MD5 d706af80a3f0527000c28eecb9c9ce69
- SHA1 08ad5171b6900740be9150484263a934332a539c
- SHA512 000e79913db8efb1d94d466bb3ec0373cee7afed7e6f44346d7573237b0e32a320155bcabc0daa11c9c3b86de0144913a2b792f7443a36b95c4a999899358322
- SSDEEP 384:Wo7Q8F8pMv0WAgkBuIFcdNyEIYi2mL4/y8RXqlVLYfIYiqgAy8RbmL4nNy2ZSq:TRapMv/Agk0gYiDLk5ZdgYiqb5AL3q
- TLSH
  T1ABD27DA3C8D06C62CC975E3174C4A93FEEB6625524C1D5C2722AC6599B503933FFC2AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/nsExec.dll
- Size 27KB
- SHA256 5428cae896558131a2a3409453663732f84754e8f4a7dc388b4b30659169eaba
- MD5 45a7b21d49191d42e93e5f47cb7cb26b
- SHA1 5bed2652f85f0a5ba5b532f4e0099b9f1d527fe9
- SHA512 248a91c563073bc92fa774515328ac8fde742eaf6bb6d140277251970e04cef9999114fc823e06c9b5f02fcb6becfe48c55fc91883f83f99bbc3b86d2cff2845
- SSDEEP 768:yDrkoernAGRHYiDLk5ZtP7Yiq9f995AL3R:yDrko81H7MP77CiR
- TLSH
  T161C25C7388C02C45DC579D3074C4A83BEEB2A5951AD181D2722EC1A59B91783BBED2EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 44KB
- SHA256 767d08af275a46029feda2db75055027cc692eebb69199afee15be1b519556f3
- MD5 5d703c4aa51edab4adb1ad4e7c5cf705
- SHA1 338b6f9372e1b49b08121e35178a391cc0c1366a
- SHA512 38f3053a7417f0bd3fdf415fc66a7dd7dd21a5984fb8dd042a4d0aa2fe4c34f01d373ed522a68190e4dd160873403c1c338c81bb1600c4fbbeb581a9aa0ac3f8
- SSDEEP 768:soZ1ZnhrTfldqk7Yyy94RxOcVQJrT3YiDLk5ZRYiqxqc5ALm:Zpi52vOcqlT37U7Yt
- TLSH
  T1A7136B5389A05C94FC379D75B4A06D33AE7EB9092890C1CBE22785199B50743BF7D33A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 26KB
- SHA256 d805b5712b959b350d695dd520720284f20be7fb1aab7043ae8e85864b912a91
- MD5 36062cfb98d5ea486dbe1adf44cb8bc8
- SHA1 4d997445bc3ca9c841ebd614c8b89d03d6ac1afb
- SHA512 320eb6e18b059d8d56ba3bc5925390cdf543952eed6a449ed8e716eac5a01820b99f5f55373f35e0f6376ae9e5be650818050cef692aab23b17e6799ab089e0b
- SSDEEP 384:Jgz60LitAZGlxNyEIYi2mL4/y8RXTHL3liiIYiqe9t4y8RbmL4nNyJd5j:JgOYihuYiDLk5Z3EYiqi45ALPj
- TLSH
  T1A6C24BB38AD05C44DD576E70B8C0E437BEB562A51AD081D6321AC5668FD0383BBDD2BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 479KB
- SHA256 fd572b7d3a4be030f68a661461ce66831ef56237b5d0635010b4e29e4dfa328d
- MD5 fbc5319c1df03c1ad2faad46734f675b
- SHA1 7a7870e622e8a360d1c35444186cff7d7dba29cf
- SHA512 cb0aea9a9d7502e7534b88af21646c1286bc7fbe2b141cf92ffc510522dea7e6ce34031229dde58d5eac22821b2e95ddb002e25d3aa728cf8d3f8c9e83421b63
- SSDEEP 6144:qb2ny5pcPMln1+MtUEVNRRUF7wvFg5bvaIJzsOiNF+3BgL8ysyekcI/5o71crHK:qb5Dl9tU6/ve9aiZcF+3S3ekcMw1SHK
- TLSH
  T1E2A49E23B691C076D62E03308A19F7A929BFB3710A2999DB77985B7F1FF04C19718607
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32