1002b1af8d44a395083e97ce9b1c5b4023c7523cfda85804c207fd6c92d779de

General

Target
RollbackDolby-v1.2.0.81-20260626.rar
Size 5.8MB
Sample260919-pkgjns1sax
SHA256 1002b1af8d44a395083e97ce9b1c5b4023c7523cfda85804c207fd6c92d779de
MD5 6ee1baa128b387c0f87ccd44a3e7789a
SHA1 2de10772f6f7ac78ad50ff004bdacf435ac31052
SHA512 14afbecda190b508e487fb4d69d346d30776346caf7cfe8f8903bae278a8b48864b80b88f6b72a5943fe2dd419c2c9a59d9b65ed4a243965fc702830cdf56499
SSDEEP 98304:q/THK7kDOqoJhJOvtnbOrAvgVDd4+K7mUf6pqNZ0naS/PqUSz4nsw99jVd7roq4S:aK7kDoJQtbOrdVDm5TqqN2naS/PqUSzK
TLSH
T1025633BF391A001967ACC1BC4B566ADE9D0839FFA1C4FB577902A2D5A14B37101FB94C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RollbackDolby-v1.2.0.81-20260626.rar
- Size 5.8MB
- SHA256 1002b1af8d44a395083e97ce9b1c5b4023c7523cfda85804c207fd6c92d779de
- MD5 6ee1baa128b387c0f87ccd44a3e7789a
- SHA1 2de10772f6f7ac78ad50ff004bdacf435ac31052
- SHA512 14afbecda190b508e487fb4d69d346d30776346caf7cfe8f8903bae278a8b48864b80b88f6b72a5943fe2dd419c2c9a59d9b65ed4a243965fc702830cdf56499
- SSDEEP 98304:q/THK7kDOqoJhJOvtnbOrAvgVDd4+K7mUf6pqNZ0naS/PqUSz4nsw99jVd7roq4S:aK7kDoJQtbOrdVDm5TqqN2naS/PqUSzK
- TLSH
  T1025633BF391A001967ACC1BC4B566ADE9D0839FFA1C4FB577902A2D5A14B37101FB94C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution exploit installer motw persistence phishing privilege_escalation ransomware spyware stealer trojan
- Contacts a large (582) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  RollbackDolby.exe
- Size 7.4MB
- SHA256 45cbc4c70c22d67f12a648a1e23f2026e6b3e21bfdb824765fbb3ec69c5cd7b3
- MD5 516e1641075437f7612226e0aace5b06
- SHA1 9d1a7d13f37271bb7697fdd9afdf26c233759a1b
- SHA512 ba2f2c8f6f5f79e3a54a5a32a89ade7112919b76f35a52d4cddaa2e3240810c5afc0da6b998532da474b915d3acdf61912801e569a2e107b6219ca785e22cfac
- SSDEEP 196608:V26oiVEmXl+mJTBXgk0UvKklH+t3CyKcmnhr2gm:V2nia6vppgk0UvKv3CHcmnAgm
- TLSH
  T12A762335C64018B2C53B3531327A8615E15A5E032A2ABB5F1729F2583C763C2EFB5FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion spyware trojan adware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4