Overview

overview

8

Static

static

5

avira vpn crack.rar

windows10-2004-x64

8

avira vpn crack.rar

windows11-ltsc_2024-x64

1

avira vpn ...ce.exe

windows10-2004-x64

1

avira vpn ...ce.exe

windows11-ltsc_2024-x64

1

avira vpn ...om.url

windows10-2004-x64

1

avira vpn ...om.url

windows11-ltsc_2024-x64

1

avira vpn ...om.url

windows10-2004-x64

1

avira vpn ...om.url

windows11-ltsc_2024-x64

1

avira vpn ...er.exe

windows10-2004-x64

8

avira vpn ...er.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...64.dll

windows10-2004-x64

3

$PLUGINSDI...64.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows11-ltsc_2024-x64

3

App/images...ap.svg

windows10-2004-x64

3

App/images...ap.svg

windows11-ltsc_2024-x64

4

App/images...PN.svg

windows10-2004-x64

3

App/images...PN.svg

windows11-ltsc_2024-x64

4

App/images/svg/de.svg

windows10-2004-x64

3

App/images/svg/de.svg

windows11-ltsc_2024-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    avira vpn crack.rar
  • Size 4.3MB
  • Sample261004-ngsxvswhne
  • SHA256 6496d5d8a479b27f660d1965e7a71e435baaee22c809c07bef823037bf4ec35d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryinstallerjavascriptpersistenceprivilege_escalationspywaresvgtrojan

Malware Config

Targets

    • Target
      avira vpn crack.rar
    • Size 4.3MB
    • SHA256 6496d5d8a479b27f660d1965e7a71e435baaee22c809c07bef823037bf4ec35d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywaretrojan

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      avira vpn crack/Avira Phantom VPN Pro 2.5.1.27035 Final + Crack [SadeemPC]/Crack/Avira.VpnService.exe
    • Size 478KB
    • SHA256 2122b0b24ccb8df003d5d260e4ca3a9e9a587c5584bb35cb672f2e042bca421e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      avira vpn crack/Avira Phantom VPN Pro 2.5.1.27035 Final + Crack [SadeemPC]/SadeemAPK.com.URL
    • Size 205B
    • SHA256 fc5b36947e7151704ae339614d4ad15a2bba155f883d0a6f8ab3f3ad0818bd0d
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      avira vpn crack/Avira Phantom VPN Pro 2.5.1.27035 Final + Crack [SadeemPC]/SadeemPC.com.URL
    • Size 208B
    • SHA256 8924634dc43332d8289bee28389a7b0f96d085bc5cd6c945d90d6099fdebcdd3
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      avira vpn crack/Avira Phantom VPN Pro 2.5.1.27035 Final + Crack [SadeemPC]/vpninstaller.exe
    • Size 4.1MB
    • SHA256 d394657e515d559f77e629f5fbd398996bf0d4fc044419ada73b34cfc471dabb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarediscoverypersistencespywaredefense_evasiontrojan

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Downloads MZ/PE file

    behavioral10behavioral9
    • Target
      $PLUGINSDIR/FindProcDLL.dll
    • Size 3KB
    • SHA256 7ffc549e7f679a08c77fa230654b77cdffb3444296bb7c6b8b5769db374b61ee
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/INetC.dll
    • Size 21KB
    • SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/base64.dll
    • Size 40KB
    • SHA256 7e10ef2723a50b7346449f8bb39efab8a99e2815d33d311ecb8112734f91519d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 70KB
    • SHA256 8f80ef429ce7c8a1ac7958ab36ec177f732dc924d14b21230da045e5ed1b255a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      $PLUGINSDIR/nsisXML.dll
    • Size 12KB
    • SHA256 77aa1a74a556f00f16baf9b94637fa997bd4085695ba81bf496223644e43e815
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      $PLUGINSDIR/registry.dll
    • Size 24KB
    • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      App/images/svg/Map.svg
    • Size 1.5MB
    • SHA256 e1973d2c3bb9b2ab74e48f15fc0b54748a9fa3be297fa2bd8d29419850e8c15a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral27behavioral28
    • Target
      App/images/svg/VPN.svg
    • Size 5KB
    • SHA256 775687b3290b465ebdb517abf2599c5eb77c5c489c77a5d02bbd64ee2512a69b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral29behavioral30
    • Target
      App/images/svg/de.svg
    • Size 330B
    • SHA256 e0f7a5fc74337903cd5bf6390e62719856adaf54a7a32ed4694d42327936c63e
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

svgjavascriptinstaller
Score
5/10

behavioral1

adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywaretrojan
Score
8/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

adwaredefense_evasiondiscoverypersistencespywaretrojan
Score
8/10

behavioral10

adwarediscoverypersistencespyware
Score
8/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

adwarediscoveryspyware
Score
3/10

behavioral28

adwarediscoveryspyware
Score
4/10

behavioral29

adwarediscoveryspyware
Score
3/10

behavioral30

adwarediscoveryspyware
Score
4/10

behavioral31

adwarediscoveryspyware
Score
3/10

behavioral32

adwarediscoveryspyware
Score
4/10