6292d1c55f671aef93c4e8e2df554753e7457b361771844fe92a812801956e3c

Sharing

Copy URL Twitter E-mail

General

Target
ISLC v1.0.4.8_setup.exe
Size 1.2MB
Sample261014-svsapsgg52
SHA256 6292d1c55f671aef93c4e8e2df554753e7457b361771844fe92a812801956e3c
MD5 9b4ad7e81cc727262f8ac08b38d41f05
SHA1 945d2b17067e79282334a93b769931d9c6fe337d
SHA512 e1380236a906025c75251cd49531e584cd1a617095ef7790bdf28e72fce93c05846bc3ca4855429e5091eb0d8d1b5b761e780f8a817075fa064147e66c6d037f
SSDEEP 24576:JyWZClubgsjDIq3rIo+349/am/+h56iV5Z5obGuDryj0JqZV:I34sZ1o+Ism/+H6qASuDrjqL
TLSH
T10145236A5A10D023E58F037228325FD78BF79520488C92CF5B54B2FD25B27E16D76EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ISLC v1.0.4.8_setup.exe
- Size 1.2MB
- SHA256 6292d1c55f671aef93c4e8e2df554753e7457b361771844fe92a812801956e3c
- MD5 9b4ad7e81cc727262f8ac08b38d41f05
- SHA1 945d2b17067e79282334a93b769931d9c6fe337d
- SHA512 e1380236a906025c75251cd49531e584cd1a617095ef7790bdf28e72fce93c05846bc3ca4855429e5091eb0d8d1b5b761e780f8a817075fa064147e66c6d037f
- SSDEEP 24576:JyWZClubgsjDIq3rIo+349/am/+h56iV5Z5obGuDryj0JqZV:I34sZ1o+Ism/+H6qASuDrjqL
- TLSH
  T10145236A5A10D023E58F037228325FD78BF79520488C92CF5B54B2FD25B27E16D76EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 760df89c2341f9c39c0250c283cb9caad185244fd6b76e8157cdf49928dc1d8e
- MD5 5e2fd68a1ce97cc2866becb699fdb4c0
- SHA1 55469bdaea8e9660f69f15107affda81de2787ae
- SHA512 de94531b4f0d85bfb8de5a30390631dca84064e48f1984b7521d54382ddd26e3d886738455a4ed7fcba3f7ee8b092cf01cadcb8c3326b9fa5721e6d952db871e
- SSDEEP 48:S46+/DTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mW2ofjLl:zpuPbO5tCZBVEAWyMEFv2CmuL
- TLSH
  T14BC19370B3D248B9D591413778AB33D36612EE746784504FDB6315AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  ISLC.Core.dll
- Size 48KB
- SHA256 11dc5458940033634e40b855ec117a07edadf78d3c3fe2aca989098a46c590ac
- MD5 cb4361b1389a2f5955532e56e76dc32b
- SHA1 80e63874166f6e0c186819f8374e978011d81d76
- SHA512 5bb5a1786cccacfb0e579eafa2dd0f35ce8b5fe0d46fe4ea7bbcca8b21e93dee748a0ccbc5759e84bc997642566ce3b13be371d0004299342ed1493fcb206b11
- SSDEEP 768:R7ZuEWd0djeGFUt8aAXbJeleKOkg6dmGW1JrA+hLK:R7ZNWdeeAja6JeleKO96dmGw4
- TLSH
  T162233860F3A8C01BDADF1F76A4F281161BB0B6C52812CABF1CD49094AD6BB51077777A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Intelligent standby list cleaner ISLC.exe
- Size 1.1MB
- SHA256 11e4ed0b322adced3214c5a73ca1e807140341be6327b2a47a4c52434e73322f
- MD5 2984e961fe2e6d9183e7fda7d93962d2
- SHA1 ea96c0391c2b5194e44ab41d7a818040c41f3bf4
- SHA512 563f8314f809484232276b59b87da2f76921afd753051da670e412d7246fec9066865a331d05c9a29d291fa5cedb72cba68634428b958055af4bf8799871aaa5
- SSDEEP 24576:RlubgzlubgtBjk38WuBcAbwoA/BkjSHXP36RMGolubg0fV:R4sz4stCSA/Bkj0h4s4
- TLSH
  T160459D4123E88E2BD1EF6B35B4304F1447F9F913AAB5D78F6A44E9A91C93B418E50363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  ar/Intelligent standby list cleaner ISLC.resources.dll
- Size 24KB
- SHA256 d060968a5bbff7a8ce6752371c01dbc340f524937bc62faf7c82dcd92ac81a92
- MD5 fd77ae9cfaba2a2f3f56bd1ec3527692
- SHA1 dbc2d5a17f799cf1f1d99cf9dc544e273abc0f04
- SHA512 c72e332076571f294ddeb697da61afe18d7912dce87e61167761d6f0dd49d0e737b066c3674626cdbffbdbcbe71434b21520b7ec85f34dc4209103a1235ec58b
- SSDEEP 768:T79p15vOw8Xf4GnCJJ4vt/TpOpiGLdmGW1Ac9rA+hL5V4:TRp15vOw8Xf4GCJqvt/TpOpZLdmGwAkW
- TLSH
  T18FB20A521B744031EE979F3EF4F27925E872BD33BA46F8792026410889E3792E65D237
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  cs/Intelligent standby list cleaner ISLC.resources.dll
- Size 23KB
- SHA256 710ac98e39c675c1ac5ee5c6df2de638637e71da0b1734a9e344ce938b8dc370
- MD5 01fe492cec55bc1e379170ac3022cb7b
- SHA1 d16b8d1989a13d895593b59a1f8f4f3024d941c8
- SHA512 1def0f401652c351163bb197da6c70d35780bc3ad41f0773243f71faadb4830b5a8981a0c0f053f04a74d63eaccbe4bff6f6d0c06cb8ebc642c2284c8dc95c6b
- SSDEEP 384:NQrQUt6qaREZcgfrjdfd+ffSdkctci/BxOqyKc5XcB9z8oAcQfUTkQpwKNsdmGW4:y6smafx+fEyi/qGpB9zXqakldmGW1Pxo
- TLSH
  T1B4B25B1257D42615FEFB1F75BDB183266D7AFB203A20C4EE1859800C8972B816EB493B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral15 behavioral16
- Target
  da/Intelligent standby list cleaner ISLC.resources.dll
- Size 22KB
- SHA256 863e6d484a7dcfa5eeab7b4e915fc71c69d8af4f8aae964f3146bc08c4e2ca4b
- MD5 9791e030a14e939555fd6b7ef3a38b0e
- SHA1 24c53d2f44ed06b1f18fc88f6345f428d477e6cf
- SHA512 83a5753c74ee9e622e393675f183e9c9c675da6f78c6a056f243749bf99bcedb17cc14510d412369a79efbb5c449a20cd20a76775acea55335fd4ea39da3a368
- SSDEEP 384:mQrGT+cZWHzHfH+yHenIxsVTWqpwKNsdmGWcMAqZrA+gmL4nNyT5v:HcZgLfQA4WfdmGW1AGrA+hLT
- TLSH
  T1C9A23B02ABD44609EDE75F3978F589339E76FE253F94C08F1158804C99B2391ABB423B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  de/Intelligent standby list cleaner ISLC.resources.dll
- Size 23KB
- SHA256 1bdddebf8587e26a1aaddfea77522c439e12fbe9218a9f4bd094a7c3f6c10e80
- MD5 8739b0af27d8faffaf715b72fea9d143
- SHA1 44bf70b150f4910e97b531ae78a87dc03deaa75f
- SHA512 7a3925c893be08fd92041ea29990e668ba639074e03cfdb9966d31c76b552e426f9fd451562f9822e5a832f6ab50980e8a5cebba048bff682bfcdba7e818443f
- SSDEEP 384:IQrdaQFItcmsKnT7FpwKNsdmGWcMAKj3hrA+gmL4nNyDxdG:3FMcbKT7admGW1Ak3hrA+hLrI
- TLSH
  T1ADB26B136BE51546FEEB6F347EB58A736C36FB226E90C09E1000C18D8E713921A79637
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  el/Intelligent standby list cleaner ISLC.resources.dll
- Size 27KB
- SHA256 7cadc0376149657516541f83d8ed588c5dff030ff7b6875d4334d56fb85ed92d
- MD5 ab7a49f705b769d9e467d050ca47b3e8
- SHA1 8cd2e3a0db78a2db4e1bc32340b2fa4fe39a8b41
- SHA512 714cc95de107b4e8b719f5361c8926fe7bb499ecce3b46492719795cd7bc547c73145dfa35e4bf10c9cc6d77a64c6f00e8ee8c022aa9fc8e38f312c8f1b34275
- SSDEEP 384:ZQr2Cuy2ve+20fBRvSXhKGDJTB7pwKNsdmGWcMBWtKqrA+gmL4nNy6dZ:Ny2GSSXIGDZBodmGW1BLqrA+hL6Z
- TLSH
  T142C219DF73A82D5DD49B5E3398E8A07B37A2BE347B00C1DC5128C6147DF52919921A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  es/Intelligent standby list cleaner ISLC.resources.dll
- Size 23KB
- SHA256 07ee99c930fd91547a9c24ce17ac8c480a2f6868e5bdac523acdc123f5ce5520
- MD5 e22788331dde5f923189537f0f36f592
- SHA1 ba0a5865a981c38c2497b469a0594a9f697a8890
- SHA512 fb5549d76160ae1e296ce449e382087a2ad45a1584df614cbb62f276c920d8240eae40b5c4bf6e7eefa55188212fb031a98fcce63d1d266b0650abb574d45bbc
- SSDEEP 384:LQr2D5IagvWUqsF71f1WvhuZxgTcT9apwKNsdmGWcMqoPXrA+gmL4nNy2Uo:aagu5srNWvhuB9vdmGW1VPXrA+hL8
- TLSH
  T139B25B129BC81751EEE32B39B9B1C663A874FE213C64C5DE1218810D4AB17D4FBB9277
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  fi/Intelligent standby list cleaner ISLC.resources.dll
- Size 23KB
- SHA256 a5ce1aae6f30e66562f59b0957b6da2e88d98cd05853bf267253ae1b5b2f28a8
- MD5 232ffb1ab61a2da3a806b45764842432
- SHA1 6bb1a618dde5159c9466944bcab1e5a4002d6b99
- SHA512 aa160bf9bae1a0d0ac8d1824eebde9e0757ee0cb40511b3e9ac30562ecc690e5646db1b65beb7a897e66ea5db3b3127d6edf3d2c0685a6a53ead8c5910d02e47
- SSDEEP 384:2Qrk0FeK2rq5jH9uBgb2VSd+TMHpwKNsdmGWcMAa8JrA+gmL4nNygm:MK0uH9mwuM8dmGW1ArJrA+hLN
- TLSH
  T19BB25B2267D0950AFEE76E787DF1816A6CF5FA253E50C48D8254C28D8EB17C0697423B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  fr/Intelligent standby list cleaner ISLC.resources.dll
- Size 23KB
- SHA256 1a33d962781137802b4e2b62faaf2642ef78c1c456a1aee7821da5b7e0992459
- MD5 00176862b5a32a2582d8a8869f31a661
- SHA1 66d6b79fecfe61c31041826472291a854a433fe2
- SHA512 9ebb9188c8d1688af6b7c01c09a49f60ba31b576544d2b4e50763e873482aba5c623ccf12bce8d8d514d4437b0b6e8466351f59f1e6c30c9b91c2d439cff2449
- SSDEEP 384:YQrv4eqxUI+CrR+UFsEWTPuT99opwKNsdmGWcMyj5rA+gmL4nNyzvcySN:tq+IBSnTo99ddmGW1ydrA+hLJvcN
- TLSH
  T16EB26B0667C81542FEE31F727CB28A33EC34FA557A60C08D0158C20949B2BD9B7B96B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  it/Intelligent standby list cleaner ISLC.resources.dll
- Size 23KB
- SHA256 3b927fe08bca984d321419f04e874938fdca9bc0569a62f57d959716319bc7e6
- MD5 4f78915a7ff0c1e49f5e19d3569ec925
- SHA1 2b990a29f879f2665e410f8b2410b5d7a89ce56a
- SHA512 31940563b3b3b08a44ccefbb8f5e7a1fef4792ef8371f00ea0c7d700ae0d69979a9fab2326d42e3dafb6a195270959d1827e526b1e2f4a874ef002e202750041
- SSDEEP 384:9Qr5pbivyjvBMNQPFgRpPPMfETRSpwKNsdmGWcMAOADQrA+gmL4nNymu:eikvIIgvPP6KRHdmGW1An8rA+hLb
- TLSH
  T1FAB26C2557D41405FEF72B75BEF18563AA36FE99BDA090DD3208C20C99B1780B6B8237
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  ja/Intelligent standby list cleaner ISLC.resources.dll
- Size 24KB
- SHA256 28f90816523bbede7bcd928bd2c35ea58660ef02ff0073681ba3b2bd64b7019b
- MD5 e8b94943f293eb2c38e65eeec1f233df
- SHA1 22a2a752633ef9e2cb8ac2c078ea3c58ece159fc
- SHA512 5b05eba03934a39115e9579271c3977cff131d1d1d70ac670583d872228963412a4ad5808308e099203c3e76b48f13bbb5c129fe35ed47173d3e5141b3ee842a
- SSDEEP 384:cQrBJDf26Z8G1gBTcPpwKNsdmGWcMAMgeVMrA+gmL4nNy5Zu:5fFYcEdmGW1Am2rA+hLJu
- TLSH
  T1E5B2391EA7C41510EEA3AF313CB956A27932BE5AFD10B1AE012CC1684D703CFE974672
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32