4e647b04241b944d165a971e526820de139da3f21539cd656e37dfced9c933c2

Sharing

Copy URL Twitter E-mail

General

Target
VOS3000V2.1.6.0.exe
Size 42.3MB
Sample260916-spfdysbd86
SHA256 4e647b04241b944d165a971e526820de139da3f21539cd656e37dfced9c933c2
MD5 ec654d9b6e874a90887147167e92ccd5
SHA1 ce753875de014b7f1a34ae3de915c83425bba92f
SHA512 22ac7e0a9980d8d270c59ff6b9ccb30463a414ac1a7ac336ca499f9f9efe56914bbe57f132ac01519302413b4b1ea6874082935c46cc1111f5e74a4153fc32c9
SSDEEP 786432:mAk9hHAusBb24vLOgjNA1TICaCF76RI7IxbKSn2JErDynlUGfU3XL6Fm+:m3+3bxTvjrCB6RcvSeErAIb6X
TLSH
T153A733CD0C14AC7FF773687571DB3ED2441646401A9689C1F6A28B9F8520CF3AAABD78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  VOS3000V2.1.6.0.exe
- Size 42.3MB
- SHA256 4e647b04241b944d165a971e526820de139da3f21539cd656e37dfced9c933c2
- MD5 ec654d9b6e874a90887147167e92ccd5
- SHA1 ce753875de014b7f1a34ae3de915c83425bba92f
- SHA512 22ac7e0a9980d8d270c59ff6b9ccb30463a414ac1a7ac336ca499f9f9efe56914bbe57f132ac01519302413b4b1ea6874082935c46cc1111f5e74a4153fc32c9
- SSDEEP 786432:mAk9hHAusBb24vLOgjNA1TICaCF76RI7IxbKSn2JErDynlUGfU3XL6Fm+:m3+3bxTvjrCB6RcvSeErAIb6X
- TLSH
  T153A733CD0C14AC7FF773687571DB3ED2441646401A9689C1F6A28B9F8520CF3AAABD78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
- MD5 8d5a5529462a9ba1ac068ee0502578c7
- SHA1 875e651e302ce0bfc8893f341cf19171fee25ea5
- SHA512 101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462
- SSDEEP 192:W4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjAK72dwF7dBOne:3n3T5KdHCMRD/R1cOnrjA+BO
- TLSH
  T134622A55738488F3DBE2003E785237079B995565B492AED2CE275FCA687B08D7EB2303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 6a033e367714ec0d13fca0589c165bdbf4d1dac459fa7ec7415815223fa3c008
- MD5 77ff758c10c66937de6d86c388aa431c
- SHA1 14bd5628eaf8a12b55cd38f9560c839cb21ce77a
- SHA512 319837951be276a179ead69efcd24bd7566061abc7997ea782af50bd4b0d69e5ec1a6e4cdeb2825bafedf87edf03380396b7bcf58682b6a3a824c8dc4b966bda
- SSDEEP 48:im18EhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J0of5dwe:F12pl9NLBAZuYtR0rd
- TLSH
  T197C18537A3C106F5E6944233265363C35713A9707766804FCB6712BA1A208B7ED6EB83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $TEMP/jre-7u5-windows-i586.exe
- Size 20.1MB
- SHA256 9a0eb162c6ae2b7b191fb5402985b8ffa53132774c33b78967edc47d245e9a0c
- MD5 528e15cdb4fa3f9d9bb26c7e2de476cb
- SHA1 504d94c7cc1617b44af8d81de6fd83120b04dfa5
- SHA512 8fcf03fa1e0cdb6a27949c97b41063233e47fe3ca7a394fd5db3a87ddfb33ef67dd0679b72357422ad4beb328a69c4f5ff4aefcdd352907980f43ee294693ba8
- SSDEEP 393216:uK9j2ZaQ4A+VfDpRr4lnk+SD9THvY8LACOxidr/47R8gRe5Le6e:uK9KZj4A0Knk+SD1P9lInGLbe
- TLSH
  T153272211F680B132E46607354DB6DB59427BBEA46B3161CB32C973AA9FF13C31935AC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery execution ransomware spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  V2.1.6.0/bin/vos3000client.exe
- Size 26.7MB
- SHA256 ff2d5a444b4d2c842661d1d22b7a8aee51ee1e9e6770f2a27956390e187485c0
- MD5 f780ae02a973132f4f5a44c2d89820df
- SHA1 39d07afa8554f6a2a97ffd704fe32bb46b55de09
- SHA512 2e1935db4b6e005544427463eda33ad868d1f9eccccee49543df8a82f59fb163378e7963b3a9407d63055315c8f4c259a539dd2d41644ee446aaab925f761bee
- SSDEEP 786432:+N1BG+lK0Pw2BtLUMIQpSHV8EzzAz3+EHYgTBcYNs:GKYzBtLHIISHWEAz3vHJTBxs
- TLSH
  T129571239E68C3C11E433717181E2185638BD9868F3F656626ABCB6A7DE32C095F73B14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  uninst.exe
- Size 52KB
- SHA256 e4ea0adcecbddedbb6645443811ac1673099cd4d245142ad56cadf73676eebdc
- MD5 54a805778f591ac29abccefc9acbcd17
- SHA1 cc3001f7962324608522fffb8358b123619c418e
- SHA512 3958e20180cb32ad3454b747bbb4888b6985b92345b345af86482d38e95bd0917bc3193a1b1b2cd62ea85e38a0d6dc2de59106fb5ae7d8787f1d604e421edb09
- SSDEEP 1536:7BWx2gmwLOuYL12EawcKocJgdLeAyNxAeK/:7BynOpL12riocJceAoK/
- TLSH
  T19433AE1633C0CCB7C5AA07B19ABBDBB6E7B6E6000110A69767A05F7F69316C6DE06143
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 6a033e367714ec0d13fca0589c165bdbf4d1dac459fa7ec7415815223fa3c008
- MD5 77ff758c10c66937de6d86c388aa431c
- SHA1 14bd5628eaf8a12b55cd38f9560c839cb21ce77a
- SHA512 319837951be276a179ead69efcd24bd7566061abc7997ea782af50bd4b0d69e5ec1a6e4cdeb2825bafedf87edf03380396b7bcf58682b6a3a824c8dc4b966bda
- SSDEEP 48:im18EhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J0of5dwe:F12pl9NLBAZuYtR0rd
- TLSH
  T197C18537A3C106F5E6944233265363C35713A9707766804FCB6712BA1A208B7ED6EB83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Checks installed software on the system

Enumerates connected drives

Installs/modifies Browser Helper Object

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Installs/modifies Browser Helper Object

Drops file in System32 directory

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14