382ed12f391f845ae4b7aa7b08115826dfd82df8171180f2911b3a395fdee2b4

Sharing

Copy URL Twitter E-mail

General

Target
Decanta-Setup.exe
Size 11.4MB
Sample260924-qe4mpaec97
SHA256 382ed12f391f845ae4b7aa7b08115826dfd82df8171180f2911b3a395fdee2b4
MD5 49ad4015a27f8c80abf521273578ebb4
SHA1 4d666e75cd6d1fbcb755bd61d7735951ef0f8954
SHA512 147aa3920847891222d6a193f30d3ae60176bb2c62b5d4b1977ee2417b61cf29f4b9a61474fd9d37bc54a779a7fd3ef7385dd3dc2b79f6b91508225dfc0579d9
SSDEEP 196608:vyCeTWkH3qVSNK0+BhRDVH+bHXKjXWdnHuCGXjWcwdZzOJSu+CbGXqs15v+915DE:KCvkXqVB0+BhPH+b3KLWdHeS/CExqCBH
TLSH
T12DC633E5B7C14492CBF444303366F63E448AAF6A2AEB1F4B5356DB38CD39379A764210
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Decanta-Setup.exe
- Size 11.4MB
- SHA256 382ed12f391f845ae4b7aa7b08115826dfd82df8171180f2911b3a395fdee2b4
- MD5 49ad4015a27f8c80abf521273578ebb4
- SHA1 4d666e75cd6d1fbcb755bd61d7735951ef0f8954
- SHA512 147aa3920847891222d6a193f30d3ae60176bb2c62b5d4b1977ee2417b61cf29f4b9a61474fd9d37bc54a779a7fd3ef7385dd3dc2b79f6b91508225dfc0579d9
- SSDEEP 196608:vyCeTWkH3qVSNK0+BhRDVH+bHXKjXWdnHuCGXjWcwdZzOJSu+CbGXqs15v+915DE:KCvkXqVB0+BhPH+b3KLWdHeS/CExqCBH
- TLSH
  T12DC633E5B7C14492CBF444303366F63E448AAF6A2AEB1F4B5356DB38CD39379A764210
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
- MD5 2726673c720a296442c8ed134b41d169
- SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
- SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
- SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
- TLSH
  T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 10KB
- SHA256 0d7f702c518286a2d87db689af169c3857142324de4c9d76d51ebf639dced3df
- MD5 e78bcd3208bff839e612041895bb8d42
- SHA1 4b21b475b21d8f8bb2655d8e8e7d47548825831f
- SHA512 eb38959a877d1af4ae53f25407ede3172f990f8c824624f5a2f385cddbd71a437b9033d45042a0e40f7fb611ff48836be166d97d42f3c169babb063ef48e8e35
- SSDEEP 192:MItx8GSBYnUMu3Oad973Ykv/RGwC7ocJ4D4:bx8GOYnBu3Oad973YkvMwC7ocJ
- TLSH
  T12A22B8C9BA1579F5E0239838B18AF12F4D5D7C31DA2B840EE89A1E35B81F5E4571DB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Desinstaller.exe
- Size 128KB
- SHA256 d4c0567c7464900bb20b71e8e7dc120fed1f669a2cb45d23e7d4b79c66702dc3
- MD5 c2392105138c1fa4e6a9359f76af4b64
- SHA1 69524c3ef0b4cf51ddd8b1ddd0c55bc8667e7796
- SHA512 a86908999f53f399ae360a0c5775c7b5c060fe7ce15659d4654af07e1f7e79efa236cd89f3494fc52c5c9664e3f0919fe7662163957bd199ddfad9b0d699123c
- SSDEEP 1536:ETnvHeLrwe71iakGFHmpaoOTb9abxQT+5U3SuxF+itDAktQ0s511h:Erv+LsMjvFsOTb98xQT+5U5qwlQpT
- TLSH
  T1B7D35AD8BB169CF6D8F2C5310582F57F45606E73BEEA9E0BDB10CB269C3257D960A201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 10KB
- SHA256 0d7f702c518286a2d87db689af169c3857142324de4c9d76d51ebf639dced3df
- MD5 e78bcd3208bff839e612041895bb8d42
- SHA1 4b21b475b21d8f8bb2655d8e8e7d47548825831f
- SHA512 eb38959a877d1af4ae53f25407ede3172f990f8c824624f5a2f385cddbd71a437b9033d45042a0e40f7fb611ff48836be166d97d42f3c169babb063ef48e8e35
- SSDEEP 192:MItx8GSBYnUMu3Oad973Ykv/RGwC7ocJ4D4:bx8GOYnBu3Oad973YkvMwC7ocJ
- TLSH
  T12A22B8C9BA1579F5E0239838B18AF12F4D5D7C31DA2B840EE89A1E35B81F5E4571DB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  decanta.com
- Size 17.6MB
- SHA256 09a124574e08530af8616e39f673a6b190859282c615230d6cfac8f60dd6cd1f
- MD5 64b047d018a210846cfc75e0d871d7c0
- SHA1 7bcc4a851321a7d5588f1d5f342efdd1622ac30c
- SHA512 99e2e8947a04f34945cd66899d428a5e784346aedc6f8e030340df3c9bd9afefaf6cb6bea993c688f2ae487725781dcfeb677062b80b927f4530785ded1299b8
- SSDEEP 98304:F7ZQrZb++j+m+FnzzIO/Ac64QrQvSnM/5dGqRNY3lHlO5FQQidW2eku13dpToBot:QoLsP0S6NMHlsidzu1Np6F0
- TLSH
  T14D074A07F8A519E5C0AED175C666A1137B313C89877063E32B54F6242F3BBD0AEB9718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral13
- Target
  decanta.exe
- Size 17.6MB
- SHA256 e0ca535ec530ab732b29461aee4badbfe40dd4aaee747bdea5ba2bac98455842
- MD5 99a46f27f0a3710d5fb4cc86b2e6cdab
- SHA1 2e80a6650b926c76d0c58b9682b9cb214c318c05
- SHA512 2aa130c5050bb43a7d2c9366f65849afd6179e19f060f6dd8a1aca06f3aba7f3b2a25c3ccd6580b8503abd61270fbd4faa8fbb59a685e3c8612742aaab7f4be6
- SSDEEP 98304:X7ZQrZb++j+m+FnzzIO/Ac64QrQvSnM/5dGqRNY3lHlO5FQQidW2eku13dpToBot:2oLsP0S6NMHlsidzu1Np6F0
- TLSH
  T1EB074A07F8A519E5C0AED175C666A1137B313C89877063E32B54F6242F3BBD0AEB9718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral14