9264e7b3f8c9025c2e5f27e46556faed269b9505f44fea617046f335a9006257

General

Target
hangar-installer.exe
Size 2.3MB
Sample261018-rq7ddsft2w
SHA256 9264e7b3f8c9025c2e5f27e46556faed269b9505f44fea617046f335a9006257
MD5 3176b708f8254561e6838a12d2b6005c
SHA1 a5c37980cb2296504b7bd0dfb5fce046605f2e0c
SHA512 26a7017f8137efd5a149b7460033f0fd13b24ebf696b97be3a4f719ca39e30a0affc83772e2975a29ac56d48f9450ca1ccf06490c991a8e31a6593939d46833a
SSDEEP 49152:YI+A1B+2P9dc6i99xgFv/yF5zS/yc0vXv8KpizN6Ll4VXo3GiwcrpEgE6w8+yX7H:YIZnVdcriFv/OSL+QBylSY3XrfH
TLSH
T104B5332467D2CA7BD98584B273A2CF6BAECCB40321786782424DD27E35D4394897F7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  hangar-installer.exe
- Size 2.3MB
- SHA256 9264e7b3f8c9025c2e5f27e46556faed269b9505f44fea617046f335a9006257
- MD5 3176b708f8254561e6838a12d2b6005c
- SHA1 a5c37980cb2296504b7bd0dfb5fce046605f2e0c
- SHA512 26a7017f8137efd5a149b7460033f0fd13b24ebf696b97be3a4f719ca39e30a0affc83772e2975a29ac56d48f9450ca1ccf06490c991a8e31a6593939d46833a
- SSDEEP 49152:YI+A1B+2P9dc6i99xgFv/yF5zS/yc0vXv8KpizN6Ll4VXo3GiwcrpEgE6w8+yX7H:YIZnVdcriFv/OSL+QBylSY3XrfH
- TLSH
  T104B5332467D2CA7BD98584B273A2CF6BAECCB40321786782424DD27E35D4394897F7D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  skybound-hangar-updater.exe
- Size 4.4MB
- SHA256 0a280ae06183cbc29ef8cb938d068991df976f6d637b2d3febd23e2802decf56
- MD5 fdd2df3dd9d45ce26847cbb847c0f8fd
- SHA1 2c0cbbe282377b6b1853e05f5e90056764754d4e
- SHA512 7533ffd6802206c8435c3dc9b347d2a20bcddd1cb61f2d7bdcf995e42f6d066537ad55be9a61d14e5bcdc65d14bdcc6a01d0d37d0a9aacdd007295d45a73b658
- SSDEEP 98304:kLQrhgK2xSpCixqKwh+lB+hvkQ8/3j7KZe0fJtZNQImYn+b:B+SsD7nfZNhmea
- TLSH
  T1D8267D07F29081E9C09EC078C39BA637EB72B8CD0925B69F17E45B112F26F906B1D759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral5 behavioral6