ef6679d76001656a8a896a2298a38a102e849569b50a856140af6ed243b5a0ea

Sharing

Copy URL Twitter E-mail

General

Target
BlurAutoClicker_3.9.6_x64-setup.exe
Size 7.8MB
Sample260912-2ldwdsgp4z
SHA256 ef6679d76001656a8a896a2298a38a102e849569b50a856140af6ed243b5a0ea
MD5 cc5bd5d3764d51955200f405d015c4ea
SHA1 0b868e5d80a62fe793af76d473b4a8a4471ff291
SHA512 a40dfca61847ca55cbdde35a3c8640b4e77cd05a2bfec4be472797494517e33fad103fa40934ae5ba197f6b664095cf345fd6dc41fc0ecb45c4708df8483d5f3
SSDEEP 196608:wWYfIEWNyoCCybDO676CZjN5x4Sa5J03vDbNIX8QTAQcA:w7IE11Cy/f66jHx4hf0LbNj5QcA
TLSH
T1298633908FB3106BF198483459F4B668F76A6E0FC5220BCE6A09B595B4F37165FC1BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BlurAutoClicker_3.9.6_x64-setup.exe
- Size 7.8MB
- SHA256 ef6679d76001656a8a896a2298a38a102e849569b50a856140af6ed243b5a0ea
- MD5 cc5bd5d3764d51955200f405d015c4ea
- SHA1 0b868e5d80a62fe793af76d473b4a8a4471ff291
- SHA512 a40dfca61847ca55cbdde35a3c8640b4e77cd05a2bfec4be472797494517e33fad103fa40934ae5ba197f6b664095cf345fd6dc41fc0ecb45c4708df8483d5f3
- SSDEEP 196608:wWYfIEWNyoCCybDO676CZjN5x4Sa5J03vDbNIX8QTAQcA:w7IE11Cy/f66jHx4hf0LbNj5QcA
- TLSH
  T1298633908FB3106BF198483459F4B668F76A6E0FC5220BCE6A09B595B4F37165FC1BB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 94314d8b20c8a370df81c5cc3d8d7a3e23fe5de14ef5e988229ff3208e449146
- MD5 43e3459db70a6b4f1faf92b3cf732ca0
- SHA1 991677d682dd41c269ea35aba9380290ff1a2008
- SHA512 cf6ba1857bc04b0c835a3f38dfe5ae89081cb8bca92a9bfe2d27c42f54d44e503ee783e67863f47f62046f015bf2bb901e827a440e0229a55e1608550bafb211
- SSDEEP 49152:3iGE3AynSYgNiXB6yT5b67xSBZlpEHA19:3i6yRgN65blhCA19
- TLSH
  T1BF85220176E08031E1F65A3095F4A7B12E39FC708B70899B13816E6D6E74AE1D63DFA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral6
- Target
  BlurAutoClicker.exe
- Size 18.6MB
- SHA256 2a85ba896ef9e5b56b1a514d4cafa94c8affbbc8430c52dfb598aba417c35272
- MD5 4c60f9bfafc4886c66ee562a83adc22e
- SHA1 92cda8327084f51de21df9cb706bc6f12a294a95
- SHA512 a77cf874e0905a9b6af95ad08db79ce121fda649aa24fd603f87ce2017793883d2e1860b7a385f3d3b5aa71a08188b023b0c788f19cd85fe4cce54c5c762bf7d
- SSDEEP 196608:51dVWn5bYwPQOcuj8X9VmBEgWZmQpDpkZwp9tMrKoEqXdHwT7HV:1VWn5bY3/bjp96rKIXdHK7
- TLSH
  T1391709916F5B55A8F196C8F083964E7FAF6038CB0A3579AB0494613C3F7B7E05A38349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral7
- Target
  concrt140.dll
- Size 365KB
- SHA256 54716f0738af891f283d213b5c8d11b25896bb8ee3097d301eae718560cf974e
- MD5 e6d97cbdba1cbff8a5f48648839d3e99
- SHA1 e9999d2d3c0ec93c6dfcbe59f05269fb947f9973
- SHA512 7dd4516e5f3f611bfd875d97d2fe3fa8b811537854d1b5ce366dd370921f2454fa7188dc440d5aaf99991f985cdf9d8f292540dd834930080df1c81a3cf5698e
- SSDEEP 6144:5MSmCGGmbaY0dDZAdJUX7uEwtiXAPfionWzgVqdJz/:5F3mbaYaedJUruczbJz
- TLSH
  T1E2844B9A72680CE5E523D07DC693C60AF6F7B9001352C6DB0660865E7F23FD5DA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  crashpad_handler.exe
- Size 537KB
- SHA256 6ba74597b41ed54f7576c01ec2145c8869d160fedfb6382f0d555c0ea850fa73
- MD5 9b3d46c4a81436473ab1f03c7928b5b5
- SHA1 2e616328fb730a812bf975039f6be975ecdc9a68
- SHA512 f24914a0cd6e59c8c9f30d6e5879e958d81be193af0bcd7625f793645765063f0481e2e3fe5632d4ff5b85a5bc0e574ca3969533dfc50aa42f82a012b9964bb7
- SSDEEP 12288:oBodwPcTwS4dFPgzrt8MlN7VXEN5efZjHNtBNDCnr6CB:rdwk8fd5gXtXZVXEN5efZjHNtBNDCnrx
- TLSH
  T11BC44A23F61511FEC49DC0B8A747991279B2B88A47717CDF638087322E66EE46F39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  msvcp140.dll
- Size 628KB
- SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
- MD5 4796bb351c00d47717906bbee4e20837
- SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
- SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
- SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
- TLSH
  T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  msvcp140_1.dll
- Size 34KB
- SHA256 206c931bf90fdad8816de3b5e2ef80b2bcaa9406c89ecc05fe6fddffe251e982
- MD5 d2b43663ed95d09af78bfab3484b1916
- SHA1 52f87dc7563078c0b9f839ecb1f9bea11ad608df
- SHA512 8984cff1c8f6eec407dd4cf7599950f42fc7dc9926e6ed3120cb1a4ab9f4f6ca5b3d040c8451adf2113ecbd4301d21f1ca88c9878618ceb5f3da3b4edce71663
- SSDEEP 384:FtXxBY5SA78zxAXUaWdWcu5gWAJk6St+e2KxaoR9z/bcIH2y4GlN5vEMgYR9ztDh:FtXrAh74RsuJc009zZXdrgE9zRh
- TLSH
  T157F25BD6A7688442ECA6183482E9CE437C7DB7D60F20A6DB12A2E51C0C937C5FA3595E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  msvcp140_2.dll
- Size 268KB
- SHA256 d50d7883f20d1dc6191768d3746f52dd9cac89c346ffaed5be1f110c2f34a838
- MD5 80d633b41909290fccc9cda534ca7128
- SHA1 72d779fdd27916e918ae4c15323d8c336074dac4
- SHA512 ff594e63fabaae58da7383b57d4d90322e6d2b2da42f99e58e3210931e043f8236cc8dd1f437e3d343da63af660b9299dee46a8d6e8aa27a096e8bdebfabd817
- SSDEEP 6144:m7KX1bsaPn3JrdfsUOEw/tpn76cAYQWO0H:iArNdZ9W9
- TLSH
  T1A1441615B94A1EBFC8E6E8B085397402FD2229014765C4CB1BC31D5E6B2BBD77EB341A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  msvcp140_atomic_wait.dll
- Size 56KB
- SHA256 3d0cbfaa1bf3eecf5a3f4491d2960ee803cb994f30292c6adc4a07c498f60e2b
- MD5 cb5404c8773b6a3758d05c9c8b551339
- SHA1 8544021005709c682ce4d2430fba88aff0fc7eb3
- SHA512 691dc781dcfe2ad9f1e324ad31fdd55dfa120a4a56e6dad9f61e62029c9687a7a3806d920a3eca2dd2c8e3fa8a9c420132b342d74d59cdeb3c749be5630a05f9
- SSDEEP 768:E23X0bNO5FEEsn/H2QzRclqoLJcb9zP4s9zW3:raUfcnf2Q1clqoLSxzRz
- TLSH
  T11E435A19CE39E017E74A8D74C616C806FD72BED78B90B5CB67419CCA0DA6BC8DB39205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  msvcp140_codecvt_ids.dll
- Size 30KB
- SHA256 8a65c7596ef2e6938731f5a1058e7e40145b6d97967cc649231a076b9a608d78
- MD5 c6aa14b90f156ceecc4269537df73530
- SHA1 3bb5afd909c5271088a223191f38ca916c7d81f0
- SHA512 3d402af4a1f21542012bbf46f1a94f5e71a37191b94bdd8e30c816f1fb0af9bff938fa9f0f998e784e094afa91059c9120530de390a867b7c226ecfab184ec43
- SSDEEP 384:mwEkrtLNmH9j0jfVWi8EWmJk6St+eScDR9zgzzDD2y4GlNvKMgYR9ztDjPQ+:mwEkhLH+UJcJ9zgfDr3pgE9zR0+
- TLSH
  T130E26CDAD36C8086F996A97092A9DD473C3CB7970F10A6D712A2E01C1C537C5EB3916E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  vccorlib140.dll
- Size 342KB
- SHA256 09f93d5ff96ae09767f3e1af3cdd43a5a58f2598654fc63089429bb6f9f4737f
- MD5 95513ddc9980568940387d16af447ef7
- SHA1 fc827331baac99d775470022fac2b111de24db0d
- SHA512 9b3a7380a0de5a7e5e8bca618d07945dea37d01fc66ce1a8b382c3bd0d6f820f34dedf06c272871c14271c6600b4eb33d69f45f7a44a976fd9eaa3c9caed734d
- SSDEEP 6144:iXKqjR1OmXkRLO1UPTMXhPEbUbeUG1bPQ0D:ipOmXkxHw0D
- TLSH
  T1C874D5277B9C4CC3C935A0794A878309E372789107A1E2CB1194570E9F7B7E8AD3B679
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  vcruntime140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH
  T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  vcruntime140_1.dll
- Size 48KB
- SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
- MD5 bbfa92d8173376c972fd58dcf5ca6aaa
- SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
- SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
- SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
- TLSH
  T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  vcruntime140_threads.dll
- Size 37KB
- SHA256 40f39e8cee5f5a531b4010e18b807e8fe265b908dc58f959ecb7ebc6ea6cb11a
- MD5 26f75596dd43b14e7a5d639ab6fa190a
- SHA1 5dbbfebab5c4ba6d8046bbd733ccc7b20161431b
- SHA512 2cca83c39747c4ccad7a1a17a882d1b2e915f689951f0eae0e3cd8df8fb09924ac92a75ee380ac9b7174c68339870bcb711048efdd4b420657f0d30bad906b0c
- SSDEEP 384:ZrOFknwOd6LJSpEpMnv7FJzwa93wlH/Wrk+WmJk6St+eNAFR9zWlW2y4GlNVdFbL:IFtpMv7j3kbGJcoX9zND9z4SiK
- TLSH
  T1D6039DE6DB684583E8679874C2E6DA07BC78FB821B2151EF4392F4590C73BC0EA3454E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18