30b89ccb5ddb559dd962bd419986fd66a7e119dfb8eca690adc25686be525f78

Sharing

Copy URL Twitter E-mail

General

Target
RoShade.zip
Size 562KB
Sample260916-vmcldstaqa
SHA256 30b89ccb5ddb559dd962bd419986fd66a7e119dfb8eca690adc25686be525f78
MD5 7ae348e97a19e4fdb734221be8c32e19
SHA1 49c5b2f19dc8016627cc023c1b7ef2291ea3f28c
SHA512 deaa09936364cc5e73e21cd39a9fb3e88cd34e241c3d0eaa8b65c843f321cc1f0cca2c29bd272a7a41b75c6325a5a4989b540a8e1ce9e4fe19d52ee9023ee496
SSDEEP 12288:IR11zrhoXqsdo04sR11zrhoXbmSTAZRIP2qs1jH2xvwhLI1fY:IR113hNs1R113hVPRdxb2lwhMFY
TLSH
T1CFC42311025C1623E793687D7B888A389836BAE1CA01DBC66F7AB41145992CFF3CF15F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  background.js
- Size 17KB
- SHA256 5ac44cf81ec4e139b09fe0837b8efcdbff7464f6a5dfab8af048a3f0ae4d74f0
- MD5 935b185eadb67f23fd9956cffaec689f
- SHA1 e6c3b91813ab73473e1bb552aae7ba45dea730d1
- SHA512 c04b410f5bcb8841222349a8345cc6cbe56635c5b1601fe283b82554a190a2a692617cff3b249486cf117bc9033ebfe7aed8911741452a3154707b71ab763d2d
- SSDEEP 384:E+ErlFbRA5McmT5ONoLDbsHP5jxILQHUdKdYRqoFd5K05ZUaag4S5fae58HS+iEw:yrlFbLFKvJ/0qHSAwHC7vsl0c
- TLSH
  T14C72A9BE34FA20295522A0BD455F9025B221E01375CDED78FA5CA1703FCC62949F6FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  popup-shader.js
- Size 13KB
- SHA256 532968e40e582f28c0e5c05920d4699e4fc869d62d3fb60ec3cd3f1cb30c78cb
- MD5 2441b1e07bd59dc29b8be223e517e61c
- SHA1 51484d89e236537b94138453f01cf7bcb4942da8
- SHA512 ffce596848b2b4dc87a114dc194cacaf5f732bf53bf1b9948c212d80363e7645a62d9ebe2a2377779c3525c0106094edc3320abfd18c7a89c56b315e1e507cab
- SSDEEP 192:JId7CslbAefsjVTlA/A1Fe7kvk3xaM8P/zRBdOcyRySLBT8RdQGuobp9zGeP9BgT:iZjQBkgDXAT8RTP9BgVIf8CL3XNN2
- TLSH
  T11A52846D34E3287A9073B0F99B8F959975116853084ACD207C2CD624AFF04BDAF71BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  popup.html
- Size 3KB
- SHA256 981f48fee5ec84fee5b94ac449e396b2c7b3b5a552d58b4e8d38ff3a1d2cdab5
- MD5 4043d0edee2521e9f12e35321ea27e24
- SHA1 f26569fbe61d266611e968f95925e2cb73badf10
- SHA512 a294f64e5ef0558cdbc522aadc5f94afe909d69b071daf038225fe9036fe199caa593141709180b073d9f3c6edad94126cdd7cc5f796949b4bb20f411e56abc1
- TLSH
  T181715D6051F0242A005380C5A7A55E5B6D85EF47DE9E4181F6BD5BE80FFBC92FC2B11B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  roshade-icon.svg
- Size 305B
- SHA256 8e515d1fa638d8339415b2a1b182785fa04d8dbd077e794aa0e0c03ca548c275
- MD5 8ba1d54787fe3ea90215b8fa80e8fcf7
- SHA1 233733835884f5bb80258b5680e2dbd2d85a25f2
- SHA512 86263b7ff3c3bfd331345aeea2593152c19b150eb907ccd95296cbf5346f6f4c21c26eda7f26e8d8ba255df5416c0e6288c59774558596234fbffc1ebb907bcb
- TLSH
  T1D4E02BA7E14C11148D2087086728E4A9D413F5CE8B44541CDF90B9A4BCB80EFBDED2DF
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral7 behavioral8
- Target
  roshade-mark.svg
- Size 287B
- SHA256 f12560b86e86f1d9128fabe7525fb735d8392b08781832b2f836610b7658da84
- MD5 7b23c367de4c6b91343e096c7ae91e68
- SHA1 415499ba7ed45bd58981e26cdf541d929228cae4
- SHA512 4f50ef139e452c0db5cb08dfff36789a5c941852e81f17cb537ece9dd9a619aae5fee5d8a543e5ea9ab9270f3f78f9eae578252f43005b5cbccb6a490ebf95f9
- TLSH
  T187D0C269E0AC6529D610DB026DB834ED7B0FA0CD9306C18AB6C51F71426A8AAB4059A8
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral10 behavioral9
- Target
  scripts/popup-bundle.js
- Size 290KB
- SHA256 9aa12218d21091729afb521935668b83b84ec12d3af7ec97eee8884fed7a66d9
- MD5 45214fa1466007e493a5639ec27f3e91
- SHA1 eed0de066ef4ed9f18da6af5c33d8374a31da691
- SHA512 7bdac29132e17db14c743bb1bd09bb634e278404f1ec33f8cf0007c9bcbf6882f459c5e39e3897bf5c38b13b48d71914cefcf307ee9653dca3ffed8d6e740a18
- SSDEEP 3072:PnTrhybjqHz0vPA2kwU4JG+u+f1m9GhjWLVpmeJ/xeA99X1h1777b7Ya:PnMIz884Vu+fMIWvesJ
- TLSH
  T17C54DAAE24F720260563707C9B9FA005B235D023288DEDA4BD5C9324AFC5E3956F6FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  scripts/sw-bundle.js
- Size 154KB
- SHA256 ac14d98fc3ad19595e94ae00f34aed7c603bc11089a866e2d10af42a4aab0f42
- MD5 90fc77d5074f300a986ccf12c6b81ee0
- SHA1 a7c08b5b1bafcd6752be5ae1d6cf190783564494
- SHA512 b81da1c2576d65728dd9a82573a1f3646b2a82b3c7911724e14c61b0d532181b978cef46733dfd30f714982dbe41215fe4369c6bb88823d4584b01ad0b0aa45e
- SSDEEP 1536:y5oDFVrPO3i2kb47Q7QLBXxzUlkXCib/40EaCvGQV+n1ki/ZQZDUikOtWsBKBKdi:HrGybjqHz0vPA2kwU4Jw
- TLSH
  T1CDF3A8BA14F720250A63707C5B9F6005B23590136C8CFDD4BE9C8624AFC9D396AB6FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  settings.js
- Size 75B
- SHA256 0fab9d2404cce92d448c144ab43a7f13812718520bc578ab3f77b3ad8abf5502
- MD5 7429047ce0c4b5048506c8b178dd7946
- SHA1 7bd029f721e5d85fca213161e3c2e05192761836
- SHA512 7ddee83850d6ecc499c41ab6e7f007fdc55760caa0cce40d030fc3bea36b8695024a6fbbdca47e84781459a3fd0f72497aadbbe8d5535b7fa18a0255a822b782
- TLSH
  T130A022232C3223CC00002B008F003880A80CFA0E0B33C8003880C0F0C02BF032C80CA2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16