e9792c007bff92a64710b689ad9cc390a55084e776feabb781e79aed5cff7d2c

Sharing

Copy URL Twitter E-mail

General

Target
hsipip.zip
Size 43.3MB
Sample260926-xyydcazgla
SHA256 e9792c007bff92a64710b689ad9cc390a55084e776feabb781e79aed5cff7d2c
MD5 7e2e5177dc2305d3561ec8414797a990
SHA1 8704489724092a3d9e2709999408584d2609f7a2
SHA512 08e5b09b8260cc0c4ee0951ed44858d030447aacdd9873cceb4dd6adf5b11c8095fb5d9ddced957daf03fb82c2079d923c67b40093abca00e25b6eec6a63f00a
SSDEEP 786432:i0zZavyLwytFGJGxIVjrk3f0MZrhabdE3G6kjVlCuktYhYEsBJk78pdf5exI2HI7:iBvVJGxIVjrW0MZrIbdckjVEYhyBJkM9
TLSH
T138A7338BB594EBDB12DA846BD2DA9EC44012D3394033F7B366FA16C864DCE772A0474D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  hsipip/HSPiP.exe
- Size 20.3MB
- SHA256 76359923bf030c304256cdc6f8b07c2d7cca73a49749f94c46790ea77e0d9ef6
- MD5 1d86f0ff5c3db498e01450c15d743037
- SHA1 07b9398e744fea26bb6b3a16c89ac324e822c643
- SHA512 9fbc81f5d1da4ac08cbd895baac94467c6cb9f2fefbbad24188ca1ffbe498546e56c57658ec7d0c5449dbe9172f77ae2016e1c04411adcc97d8ecfef9d90cb43
- SSDEEP 393216:yCIz5RRTK4FNQubeJoUnZ7wjcrVFRVnQmYf46TTDvM9jno4G:oNy4FOuqJbMjcrTRVQFFE9jo
- TLSH
  T13727335A35FDA320D7E85D35C2E544CDE2136352E09FA3F1B8B623895878C225E0DB9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit defense_evasion persistence trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  defense_evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2
- Target
  hsipip/HSPiP/CSGL12Control.dll
- Size 8KB
- SHA256 e4aab409f602d10681a2433732d36c24e4fb1ff5fa36edb0fb46bbf3dd8c0013
- MD5 acff828454a8100719e468eeca966309
- SHA1 bcb615576d2cb687e1bf6170334854cf5b2562c0
- SHA512 a9cd5b603753afd381c0c0faa61645f5e7c1e70e6461f896b68db4d6e7df67182c5b317413c51036ba9ed3a7ec557988a752a8e3e127c660632546e92220c8c0
- SSDEEP 96:48Bzo0IITu+uauLNigyAV/EJJxQEuW9NFWo/RtJasqIRSA5yiX7yPdjPuXN:4B0IYRBVgyRB1lg+RtJasbRScyiX+P
- TLSH
  T1E102F919D7988737EC6A4FBEFCE206210378D730A963CB9E056463DE5CA33200512B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  hsipip/HSPiP/CSGL12DLL.dll
- Size 1.1MB
- SHA256 5600786f4dab31fecd12ec88fbc12d7e7f39554eea2a84b242b9d4de2ca94cb1
- MD5 5eeba57af48b2fc0a8a0a58156bdb6f2
- SHA1 553db4fcf8da71f361cf1feda7091ee78c197540
- SHA512 6234b9fcc2980a4b9f0a247040124fd23748d2753f0afaff15a26f4b48bb3fd3e6ea8dbae27a29d2e6b1c124b9fe62315ec6ae7c5adf2bb5261e062eb042f6eb
- SSDEEP 6144:rOExfTRiHRZF1w4hxKJlEz3kaDqmeI45bXPi3HmJQzIuVMb2RBW0afAYsU0NEdA0:rOE5TRiHR24hae2I4xXPYpW0Q
- TLSH
  T1934552ACA3D92EEBEE16677DA4D644E301A9FC60370EDBCA845F85451A8033416DBDC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  hsipip/HSPiP/ExtendedRichTextBox.dll
- Size 24KB
- SHA256 0c3258f7afe82400bcf2e8b3d37ddbcc81177402fd2e5d1b6c57d6cacf11602b
- MD5 d46d523b8d602850b794e759d06c1bde
- SHA1 27ff4b27f3ffc3b70ebdf4b25065800b3f3f8e66
- SHA512 37a7a8c71b1e4970e9888c69a17f09106cef8bc4e5cd90f11bf4f606ed6a0ae475f8d48569ca266914081f5e9f8deaf1f72710a9a4b2e70c493e9306fb165a6f
- SSDEEP 192:QKA4cXi9pGWmvN/qB8ZV6oNnlYJL/ertIc48SlbLROVTGsZTkwi:QKCUpGWmvNfWqBo8SlbLRuNe
- TLSH
  T180B2D76A87C2C274CF294B334DA397604B31DF444A666F7F4894369E6DB32840FA2A75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  hsipip/HSPiP/GRV11DLL.dll
- Size 1.2MB
- SHA256 de45e0f982aab3c8dd246a7f1e5b140e805fc0a1c60879c2c386e405ac2c89e1
- MD5 a0dbb28419527d16d9d948c440ef3ff9
- SHA1 98adb943a5c13b781f0c730c98ee947f3e70994e
- SHA512 d4b6131db1ca339f55c42ecedad4f7c2ef96b4c84db980ea8fc91e29cb38bdb2831f10151a69a991a6dad14302b55b5f012c6f3475b650e56b58dd3bacd92dcf
- SSDEEP 12288:pY2Gl+HnPhx0x17bdwIRyrnAlsK+PwKwt5kA2XpCvF9ouiW0Q:u24YEPGTTM+ZMa
- TLSH
  T1B4454146B3D93EA3D52C87FA758043A206FEF951F746CB8A620F94870AD175326EB1D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  hsipip/HSPiP/HSPiP.exe
- Size 31.0MB
- SHA256 9511c89650e72991d612f9374cdd5b83ae0c26c3e20213864ca78161133d0a81
- MD5 3fb594432a33752e4467a9d3a584f079
- SHA1 b0dbeb3b39fedbd89224111949d05a22412ac930
- SHA512 3b6b95424cc420bb3077dddb27f206ed81d8a5d3d3b1c7a3e61d17cf4f36988707ed0d0419073b8be187768d7b2a87c28a84b26ee65a6741e51eee8e832a65ad
- SSDEEP 98304:mAzIuZABonpvTEbIyR69TEbIyR68BTEbIyR6:mAUTonpoEcELE
- TLSH
  T1AD6729F6DF9931C0CA254ABD442F7EEA3E7CD82F4CB58F6A1050FAB25871A51D781428
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  hsipip/HSPiP/MB6.dll
- Size 912KB
- SHA256 209dbe1aca6fd54688e979b514ed7b0590d6a9b52d580c4f79d4d390e48b8372
- MD5 63eb2ce9080648e638478b0194b652bf
- SHA1 4b2ce63ac0f6e987d294645a0f2876123d34f5fd
- SHA512 ba45e9de8457c92c5ae3c32bcb9f6a1e29d069206b034f3715880385d3f5b8e3dd7d3a15edba735e80e6fe81cc2d6eb9493d0517f753b1fecedb823abc9a1d05
- SSDEEP 24576:np0jfYw7f1IH87s+y+IiM2ksbG1viNUFMqLojNHP9W:UwcIH87swYmUviqFMUENH
- TLSH
  T11615FA0CE9D1F767CC2A2EF42E4BBCC88B514CE5650AFDAE9C5F86E247157484482E63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  hsipip/HSPiP/MathNet.Numerics.dll
- Size 1.5MB
- SHA256 4c9803a4b0673b93a99a2237e35543be2f6741fbd54b0ff045cf92e877be09d4
- MD5 aaa4a85a44ad90a5af5c4cdc69ca5c19
- SHA1 5e8329e47c7f9775fe6b492d59f0f22f7009966b
- SHA512 4a72174c1aabc83b87779931d6ddcaa4b013d99c4eb066759d9402f90fbbdf481c310068fa734d395c4580e58ac7cd53a3c3d9d49aeeab7e4fcab3863167cf1f
- SSDEEP 24576:Ub4JonaLld02vBED592IxVu5L3tNYz0B:Ub4mtbyH
- TLSH
  T11F758D0EFBD8DB67DD2E76774462142D2330C5A6A3CB772B26849AF42F1A7540D482E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  hsipip/HSPiP/Microsoft.mshtml.dll
- Size 7.7MB
- SHA256 88488e5280c65eda30d734ffb47b071c3f8a9a2ebc801246196b67e6c979bb5d
- MD5 9cfdbbb9d533ad3b87953d085fb1591e
- SHA1 2ab321ff8f04c2b8819c770bc91ea4ee8b2f92ea
- SHA512 e61508b53167a90b2c1af7d6d4d9304141837e731bddf0b42ca7e32b9c914dd6581b2e4299af7007b845914745473e409c9843cb0a620dcb237a06961779c42a
- SSDEEP 98304:fpkg8hn8RiyAB84gPjKVuH62NhND7BMe8Alt:fpkg8hn8WStD7BMe8Alt
- TLSH
  T19A869210B7106460DEDED33BFA9B0E546FBD92120735EF52298CB6B2D25B3825D82376
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  hsipip/HSPiP/RDKFuncs.dll
- Size 11.5MB
- SHA256 ed72ad108887dddc872982493a54603090e5e355c4557287adae986cf8bdc321
- MD5 2f42bdc6b2f59afa491538bbb65bc933
- SHA1 8f30b5a432b7ac19b059904d82a00542d5d26c3f
- SHA512 6e6109111dace84cc01ce1abd6d437713d5c30a786e8481b2315fd28ac79debcb5e6267d2ed13bf4b76358c46970d3fc530bfdca393ebd2aa86acf2263ec7013
- SSDEEP 98304:Lm4LN1r8mIP56PRcd+IQkX8s5307XfifLpuA6:Lmiq1PkPWd+I5/FV6
- TLSH
  T19CC66D13A66601ECD0F7F1B88B1F6922D7753456473596EF02A085B12F37BE29E3AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  hsipip/HSPiP/RDKit2DotNetStandard.dll
- Size 1.4MB
- SHA256 b46f523c067dc2ae7263126394fd69a53cde78ffe74770bf17d6539163861d2f
- MD5 f45415b6b60e1bf0bbfe66f5801a7448
- SHA1 261aa7350ea2d75526c1e638e022968484f0e3b5
- SHA512 9528a1e61ba59b63ccf6b784aca841f7909fac2a0581481b21833d9dcc113dc5209c0ef9b0ddf72f6010b9da2e5a219f9c2bf017e6fbc787fbd83cd090f9e340
- SSDEEP 12288:a/y5bmW6/Q396u++M60dUcUXs86eDxSuIZFjgpG+tHkKDHB5azgIXWtCdnX6okQi:aB6hDfaM++3Utymszgw
- TLSH
  T133654116EB928CE3E8C9633E41370E35D6B4B3A66713E35E57A0A4711CA57F98801DCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  hsipip/HSPiP/System.Diagnostics.Tracing.dll
- Size 34KB
- SHA256 a39dce786ef0882bf5ed70574b1c7c0da7bf55aec4d898d0c9326b2b4268be16
- MD5 049e9fd8203898f1905160fb87e1b5c4
- SHA1 c13b3a369cce4199f6558887a0b5cd6ef6d52b11
- SHA512 ffa73411aae0b5e55f54137938c46a0a1e4e18316c6199aaf967d7781685936d0e42b0fcca08b45634a46d13e27e4dc21006f9560ea2ddb0235a18c5a4932deb
- SSDEEP 384:sd78ol6G2TYMooUy+EAzHjzgfgBFPZJ9WydWakcaGABvJrR7i1R9zYFaGxqHRN7n:hvPgfT31gbZBR7in9zq3waxD+9zG6
- TLSH
  T17AF27D629B6C5213DDCF6D7053F9E9832D3AA7D31C50EA2A16D1FA841C53384AF2163E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  hsipip/HSPiP/System.IO.Compression.FileSystem.dll
- Size 27KB
- SHA256 d64d677300ff3aa35229cb1b2418307c593c1417b3f49df9315b14a935424950
- MD5 ae6ac9ca370c7baa0b6cf2c7f492314e
- SHA1 4997a95a597fe556aded6cdbbf7cdbdfc3cde8e8
- SHA512 64694996f31f34e192c5a069cd08a4cfce5955edb474566c3bf51d8d25bc15dc2bf8bf86c987f8fad5af0f9483561f0316d1486eb241c135adea8973380cbc96
- SSDEEP 384:vnZAy2Qea6LaHw9PFeoobtwJs+xsPZu2+WxoWHT7nHRN7DNviCksR9zedVz:RAy2da6JmooKm4MTRpRio9zcz
- TLSH
  T1DBC25B6557DC8307D8BF1E7091B8E8425938B7D29D52DB5E1D8AF19C2C63380EB30BA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  hsipip/HSPiP/System.IO.Compression.dll
- Size 66KB
- SHA256 c68d37a11a072affbb50bbfa7299e6410811a24c946b11f9f430d0a5f66bd2b1
- MD5 5fc45c93fe0ba9ef574de32492e85e1f
- SHA1 bf67571ff260e879314d5285e6551426372ad587
- SHA512 c621f8172567ab9f44522c95504d848610da1516455b8dfbf1b49b9b506474a406f80ece2b483d91ba093f0d279e262469323e0d8470dab767077871763538ce
- SSDEEP 768:WTRv3kTDIONgG0DPDfinKI5eRXoKdUD1GZsSue7MwqfGIyb3Qh9zDbTc9zUu:WTRGDIFG0rzG5exsy1qfByQzDbTUz7
- TLSH
  T18C635C5563BC030FE9DF0AB46670E1031A74B3A61A03EB9E1E84F5DB28637D58A1537B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  hsipip/HSPiP/System.Net.Http.dll
- Size 195KB
- SHA256 d7ce24424f16bd410179bd202b3e375b2b731a6bd57d5d03a8d38cf9062a14db
- MD5 5c8bcd11f6ae0f0023577196a6825a7c
- SHA1 a414a36f5ad7b0a08c06ab5d1958bf1359db814c
- SHA512 307dd8c27c964782332c1d4e198c1e5be320a981196bbeb6e551ca19ad18085d7d4f97353add2c7d5a4a84d7f7a77968034dce9fc69c5908f3d6779ee867ad95
- SSDEEP 3072:Oz79v0/yejq+HNbjQynaWIhB4MAuzvqWAH28dZOjc/S2UsFRo2iYIswEszDY:OIq+HdQfDhB4LjNr2w
- TLSH
  T1B8145A1463F8476AE3BF4B78F0B8558586B5FB827416EBAD6C8491ED0853BC0961333B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  hsipip/HSPiP/ValidText.dll
- Size 24KB
- SHA256 cdc237586b3b427311854f5aed7b57297cd253c758d7a3cd9c11450b91b5b419
- MD5 46dfb58b6c0c2dce8f4334533fd60248
- SHA1 b89e8591a05dc89ea0859797405182dc0b681d7a
- SHA512 84c8792e42fcbc98b5918a4d3a9096e4f38d40157a3e86cf6f00dc07f199a699e75d7a9588921c1b084cd92be7e56021dc584d392e7f7868f386c6a26ad718b9
- SSDEEP 384:zL+xIGaF3qTm3iIbSwUpC4sAeNVqzImVmTDgBp:X+xIGaFumSIbS/pvsAeNsIqL
- TLSH
  T10EB2D61AD7CB8137CF6D4A391817531103F4CEA45A13E7AF1A9871BA5EB3B40CE52A13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks whether UAC is enabled

Writes to the Master Boot Record (MBR)

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32