15b2122dd721d0a8e9056ed6d5c8ba88a5d15703caf6a273608e22e8568a5b72

Sharing

Copy URL Twitter E-mail

General

Target
utweb_installer.exe
Size 20.6MB
Sample261002-n2dzfazdrc
SHA256 15b2122dd721d0a8e9056ed6d5c8ba88a5d15703caf6a273608e22e8568a5b72
MD5 0db13f56d3dc940c602df8700ac9c8ca
SHA1 8150d5d16550bded4876f9d90805deb03865842f
SHA512 e1c4b3b49b41fffef52c24e20b91bbf4a464d68d03af401179b945e8cb8d1e6c9f94ed95de79f1e3c427c3738ae212792ee96d0f6c2624b413da483599475829
SSDEEP 393216:SjK65jo8j14/Uuqsik/1cCQN5eEGvlGFoGUvBa+FcazaN5KA4nICZ8aTJqG8p5:SjV5jo8Rqqsi21IBUG767WNvK8KoG8
TLSH
T12327336E3A361FDDE4F6E2F9C805F943B8C57EE326F20C96A3A0761D497C0920979146
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  utweb_installer.exe
- Size 20.6MB
- SHA256 15b2122dd721d0a8e9056ed6d5c8ba88a5d15703caf6a273608e22e8568a5b72
- MD5 0db13f56d3dc940c602df8700ac9c8ca
- SHA1 8150d5d16550bded4876f9d90805deb03865842f
- SHA512 e1c4b3b49b41fffef52c24e20b91bbf4a464d68d03af401179b945e8cb8d1e6c9f94ed95de79f1e3c427c3738ae212792ee96d0f6c2624b413da483599475829
- SSDEEP 393216:SjK65jo8j14/Uuqsik/1cCQN5eEGvlGFoGUvBa+FcazaN5KA4nICZ8aTJqG8p5:SjV5jo8Rqqsi21IBUG767WNvK8KoG8
- TLSH
  T12327336E3A361FDDE4F6E2F9C805F943B8C57EE326F20C96A3A0761D497C0920979146
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence spyware trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
- MD5 b4faf654de4284a89eaf7d073e4e1e63
- SHA1 8efcfd1ca648e942cbffd27af429784b7fcf514b
- SHA512 eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
- TLSH
  T1E07186BA56E54FFDD1541A3030CE7003EBDE75B416AB625AC93B261A7BD0191D83CA22
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsisFirewall.dll
- Size 8KB
- SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
- MD5 f5bf81a102de52a4add21b8a367e54e0
- SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
- SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
- SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
- TLSH
  T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $TEMP/ut_web_redist/vcredist_x86.exe
- Size 13.1MB
- SHA256 b7ae307237f869e09f7413691a2cd1944357b5cee28049c0a0d3430b47bb3edc
- MD5 d3b594464f2312cde31af3f2aa516f9e
- SHA1 15fe8e70c3c5582b70df173cd9b580331677735a
- SHA512 ccb19250b90eb629c35a897aba6d0ab16402305d9ec16b97b902fc810cde5d215cf8149a273cc8f8cae5a4b0665b116c085fe3b01a3ab3860c44f20ca95d6e83
- SSDEEP 393216:7/H+lptVYmfr7yBG/4tWp4uXK63Ntq+qS:7/upttD7yBG/cy4Aq+qS
- TLSH
  T164D63333B498843AD7F30533E964FA246E3DA128130089BBE6DCEC5E5B7415227FB656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  Uninstall.exe
- Size 258KB
- SHA256 5068dc04d6350419acdf812588ae28a1cd95c3cad4d7102b3f4b9650abd19a5b
- MD5 8ca954726c774692a26087cc0e858117
- SHA1 631a188ed8827453b8b773f68ce6789e4f3f9e80
- SHA512 36ec3d504c0bdf4d63106797199376e5e6e4db7a5916516010b856f27e81d746f5e1dd66960c85961c0eb2599ad5f63a65006d31cdc768a42faf42d5398fef56
- SSDEEP 3072:Z1NjcVVnLpPu8FCQWVvhtHZx2BdTeh9R4mdouzw16ysYrlMRZrwN2FB3k91HE2H7:jNeZWJhe4hEvl60I/3SLHqLw
- TLSH
  T19844F601A7F8865AF9F75B30ADBA96965A77BC912E35C19F2300BBAD0C71700D924733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  avcodec-58.dll
- Size 1.4MB
- SHA256 8b527770e0580ee328f8c91aae05016b174d15e13f28befff5a6b6a6f4837084
- MD5 9d7585d920144436fd23b5397ad20abf
- SHA1 396b69f02b672b2df8b630e0690c440f17e7cd8e
- SHA512 c6fce0b220e319c8c91739159e9870302240e734b15c1721bb1357b6e62772b743d62f0a8b280aa285d8adde10e1fe24056ccfd1b05b9bf220e7f4f9434dd356
- SSDEEP 24576:cE8XclfxoSJogsbNfrVuuwM8Jjbx4bRu:cE8X9gsbNfKBbxwRu
- TLSH
  T14D65AD12BA608552F9C20236E2FEAE377D3C4B38139981D7A2C474FDA9B05D2757274B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  avfilter-7.dll
- Size 150KB
- SHA256 aa89af1bc9ddd990c0f51313f69864fa55e68c455b5027e7d88cf754cdc9f4aa
- MD5 6cb3a6fe8d27893061dbe9711c6a857d
- SHA1 caf804fc72ffa69d768ca34078e64126e77a8bae
- SHA512 9cb72ebb97f485254e3df2ad9769fa87a81a2efc5ff285cbb508c613b0fbd6b2382b9744e9e787f11699100285911f4de48fcc90dadc7df8199b55bcd950cd17
- SSDEEP 1536:O/piv02NctxTH0EnB5ElAq7lcTVY0xktVuuAqaK8uId5FAs9eCscjyxCDwEXCnZb:O/p5lVnkAstVuuDIkYY
- TLSH
  T160E38D56BD808032F9E3107FF2FD2F778E2C522A072955D39B8899BD46A44D3B63A705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  avformat-58.dll
- Size 927KB
- SHA256 4e8d418e6b1345c05e08a4b88e78a84a97c9a8179ca851bd87c93836c2409f31
- MD5 c123211331c1f98b8a679ecbd5048997
- SHA1 4b6807dcbbb0160b191cba08413c79ce557921ed
- SHA512 4232c5f759109cb71a5c5833cb3de2b641c71504f62132cced98f56f792c11d9d5a84ac96c91c8dec6b4d19021b9ba555976779957faa3a6c6438f0abc51a6e8
- SSDEEP 24576:70gpCJDvl1ceBW6MAgi5t5UW6HyZyJJV9999usE:7La1BDfmNHyZvV
- TLSH
  T1D2158D62FE518411FDD100B6A3FE4FA29E7D5338172890D7AB8464F49A344E3B63672B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  avutil-56.dll
- Size 620KB
- SHA256 47a1c21d501b81a93088ae081da08e74d098ac82e0dbae7a909f39af5bd24815
- MD5 e0cdb9bbfa7a22ef965d55161945176e
- SHA1 1d0929e86b838f02025552cd4e0f6eb91f769d75
- SHA512 813c9b18aa7e8d8794010cc40eda839db324079a87a784b9ab8a98c3f318e9c12d2d86eaa8bd4ec1e4ec6175a9e12efce243c0d0daa193b802ed0cc4739173f5
- SSDEEP 12288:Dt3KFuWVbRZ6Mv4Sf1tCoReru8EuJlFTCttioB:Dt3KUWVbuMASfexA
- TLSH
  T1D4D49E11BA80A25AF5E1017AE3FE7BB32A386334136525E35C942CD99DB00E37977763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  crashpad_handler.exe
- Size 874KB
- SHA256 de731827c6471456b16bb01396dde74273d25c0fb701d33038188b8cedb67324
- MD5 199880ec2d189ab52f7c23995ae6d83e
- SHA1 db27aad9507ef6a9876bb010e084e883e25cb551
- SHA512 e51df1829ae2242e971db6b5365d658d66a47d2970cd115c25d1ca1a3af0f236bb6ffd420a611c83c67d27f72ad76188e5ee9b6b483ce85dc2e4c8f3383c4c67
- SSDEEP 24576:mcvi/5iYg9XGituR6kW1Tb1MyRivndSMTaByG74:mxn6c6kW1Tb1MyRivndSGaB
- TLSH
  T133156C707A19D136EB9201F2D9B96FAA817CA41A0B7315C7A1CC172D56B82D33F33A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  libcrypto-1_1.dll
- Size 2.4MB
- SHA256 b8453da0de5aefb1b775486cec41011c4877ebd1ffa8089d89bce2ee8e3d5eb5
- MD5 cc316f02b1166ba92e53788ab269a639
- SHA1 f1ffc069ffd1abacd9b3378a2c40599b8a3d0f85
- SHA512 0a86400a472c4ae91a051dde9b260b630f81028aef144f6b6c37754801049958cef3545f903427b0ad1af8c380c8267d95dfd8144601c7c6fedc239ad4a397db
- SSDEEP 49152:TpZMOyiFMqZL1ktvLF819w8SP1CPwDv3uFfJghigAW5y:TpZMKlkFF819w8E1CPwDv3uFfJg
- TLSH
  T13CC5AF03FB961591E9CF463D12EA573F4E3A5A18C328DAD38E612891DCB16D0773E398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  libssl-1_1.dll
- Size 525KB
- SHA256 2129c263ad08f415ac40abce658e13327ab5911f59a21767dab56d3167083020
- MD5 88228668dfd302da82a2ce585db55f38
- SHA1 30092d8680c184726e45879f6c7340ecdf98b388
- SHA512 8b88a1cf14ef47c39c00568df9b421a45936c74989b428e668ec737438fe993f0c08f65a1f164d54594ea66b49e976c3991cc9a9bc2d56c0bce90e589e142bda
- SSDEEP 12288:qk1kk3yOpd4pZHLDQ23NvBA4JqkMt2DfU2lvzQh:/kk33AY6vDq7t2DfU2lvzG
- TLSH
  T13FB44B52EF425BA2E4C5857A12AF13BE0E3EA7102724C9D34B9619B9CD712C1633E3DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32