24ef9b6d2decb7f5970dd4478a35796517e4322341b27c26eb0543ab656c6776

Sharing

Copy URL Twitter E-mail

General

Target
AACGUARD-v0.0.13-b02.exe
Size 76.6MB
Sample261018-vbpftassbx
SHA256 24ef9b6d2decb7f5970dd4478a35796517e4322341b27c26eb0543ab656c6776
MD5 5bdc55ef01212d25739f4d63d299b25a
SHA1 33fc4f83c322c4fbf74b7259bc748a12a5d13cdf
SHA512 a090a4adb5107641a2fb79ee5b5756c738cbb181ad61942c0869b274aaed6551fc43a519b6f0067e7302f62e90cc4a892230372cdcacf9877e38234ef0755165
SSDEEP 1572864:miaPeH3wzXgXsbY2XFWvFwNhTJzAjAInFLms4twq7JAlw0hsfFCvNbZgymAKBzz7:miaPeXmX6sbYm0mNz+dtwDwmfQvNbZgb
TLSH
T1760833E4C0F18442FCB3CBB58324681317CB562ED97DEB558DBD92832473E93A2A165E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AACGUARD-v0.0.13-b02.exe
- Size 76.6MB
- SHA256 24ef9b6d2decb7f5970dd4478a35796517e4322341b27c26eb0543ab656c6776
- MD5 5bdc55ef01212d25739f4d63d299b25a
- SHA1 33fc4f83c322c4fbf74b7259bc748a12a5d13cdf
- SHA512 a090a4adb5107641a2fb79ee5b5756c738cbb181ad61942c0869b274aaed6551fc43a519b6f0067e7302f62e90cc4a892230372cdcacf9877e38234ef0755165
- SSDEEP 1572864:miaPeH3wzXgXsbY2XFWvFwNhTJzAjAInFLms4twq7JAlw0hsfFCvNbZgymAKBzz7:miaPeXmX6sbYm0mNz+dtwDwmfQvNbZgb
- TLSH
  T1760833E4C0F18442FCB3CBB58324681317CB562ED97DEB558DBD92832473E93A2A165E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
- MD5 d1eefb07abc2577dfb92eb2e95a975e4
- SHA1 0584c2b1807bc3bd10d4b60d2d23eeb0e6832ca2
- SHA512 eaffd9940b1df59e95e2adb79b3b6415fff5bf196ebea5fe625a6c52e552a00b44d985a36a8dd9eb33eba2425ffea4244ed07a75d87284ff51ec9f9a5e1ac65e
- SSDEEP 192:E6GQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT311929WtshLAzgSrX8:E6Nt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T186624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4678565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36
- MD5 549ee11198143574f4d9953198a09fe8
- SHA1 2e89ba5f30e1c1c4ce517f28ec1505294bb6c4c1
- SHA512 0fb4cea4fd320381fe50c52d1c198261f0347d6dcee857917169fcc3e2083ed4933beff708e81d816787195cca050f3f5f9c5ac9cc7f781831b028ef5714bec8
- SSDEEP 48:S46+/sTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mWofjLl:z+uPbO5tCZBVEAWyMEFv2Cm9L
- TLSH
  T1D5C1A370B3D248B9C591413778AB33D36612AE747784504FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $RESOURCES/AACGUARD/AACGUARD/AAC.exe
- Size 183.5MB
- SHA256 fa9306aa6043a02e6a945ce988d60f4adc3da6eee265e78f32ad7c3771b7f0f7
- MD5 c0f7648918ceacbc9c797c317f71193b
- SHA1 67aab195c96b084069d362166c3a9fa5143dfd0d
- SHA512 0ac1d56666df8a8236672d0e3ae77e11ca5b72b8ef8889601fd1d4a5b8df1dfcaa46b2e9c1f943eb3c67ac5e0311f27781309927209337f68b1ec7ec13229f3d
- SSDEEP 1572864:s+Jjhd0zXulehSaq9XR7yLqp2iGLfztINXbCw9n6O8b:sgJ7aq9XR7yLgjGXtINdO
- TLSH
  T118988D02A3EC1A55E17BA6B4E6724692D6F0BC525721E1CF0484F90F2E77FD16A36332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  $RESOURCES/AACGUARD/AACGUARD/D3DCompiler_47_cor3.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  $RESOURCES/AACGUARD/AACGUARD/PenImc_cor3.dll
- Size 154KB
- SHA256 007cb9a6781801c5ed071127314d12b40f8778356b1bce4316309a1be8c42c51
- MD5 f6d90660727ded4c999ac7e74060bba4
- SHA1 4736c8ecb5a65b35a45f9ae9671a88e74d859d77
- SHA512 3c4387104fdaf802a4a4619067af4ed07f5cb5f7c1f34ba6abb811d80a1d0d01130049e54e8349d6a6fa2842d37f4a6b1e387911148f5687adc4cb3cf4351011
- SSDEEP 3072:grndTvsZbCHO0A3I62EpLgUGhFoD5GqTuE9ZTTml7OMTjkpBygKzsvADnJ07Y4LX:WndDswe3D2yL1D57uEdVinJYN
- TLSH
  T1D2F33813B69C40ABC029D27E85D70645F772BC111B228BDF2261932E1F7B7D4AE3A395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12 behavioral13
- Target
  $RESOURCES/AACGUARD/AACGUARD/PresentationNative_cor3.dll
- Size 1.2MB
- SHA256 091609705a031d5832f21548291c2670f06eadd781d465d3e1a5fad3772adc91
- MD5 76c57f8f951306b6fe29c83f9844cb6f
- SHA1 9aa8c8bf7af042ac0d95f6169d71a5ddd6a0cc4c
- SHA512 019050f80430ae459e6fd6ffce5cbff4af49073834169d40083f6a9b22abebac1d605ab8b409449d4313a3bea08bebfc62c9b93905bcc327e8b20016414133c1
- SSDEEP 24576:XjOnXauaPQDzcpsVOE4PU5tbg5ChWmAjHSa+YrHAvlFk8TQh6p1zwPwYffvhXYj5:ZuaofcpsQ5PU5ZhWmAjHjAvlF5QhURwA
- TLSH
  T10A453A22D2E642E5C47FC1B8C646972BFBB1740A131C66DB47608B592F27FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral14 behavioral15
- Target
  $RESOURCES/AACGUARD/AACGUARD/SQLite.Interop.dll
- Size 1.9MB
- SHA256 1111916dc329a13bd627b2cd90c9b2263de9923fd0bb6059c69c52332f360c37
- MD5 4930777866b1fdaed2ab80b0fb8793b6
- SHA1 e2686b9ac7c3867c644902805142f1f42bae7645
- SHA512 d294e9d638fb6d579fdfd69a9f098b2d8087fc6c1c240496cc99804980284352299b52b9a2d6b1d1289ffdc5f5ecf364e67eb32e7b4a9a8ddf20c723f9fa28d5
- SSDEEP 49152:tQ/IZ0sF2Ou+pqnX3lJ1nCHmWbk8d7hLJ:tQ/rHnkJ
- TLSH
  T1B4958D4BB2B400DCD6A7C17CC6475B0BE7B174051754ABDB07A486AA2F23FE516BE328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  $RESOURCES/AACGUARD/AACGUARD/vcruntime140_cor3.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH
  T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  $RESOURCES/AACGUARD/AACGUARD/wpfgfx_cor3.dll
- Size 1.9MB
- SHA256 ad1c9dbbc2fcc2b274145727e8f04d5adf49a0c9ae4d1a3c33ec969fcd5b4bf1
- MD5 b6eebb14edb8b16eb982a731331c759a
- SHA1 50c20f74d0e075f30918a59e645edc7d3a7482e3
- SHA512 53063c0877430d5f4e730d032a298f61d4591ba0dba4c13765e461489853685aba74244a622f1adf34752b0e677333a2eeff0367f8f479ddb435b7a45ab83a44
- SSDEEP 24576:VyRODwFC9CCgNeccEi/aRmE6xdyo2QL5pbhAj7twvEebfaL6kKaij+pblyfU:RwkUNNeco/auxZLPFAjGvEebSL6hhRM
- TLSH
  T1C6954A4AB6AC40E9D07AE33CD9D7861BF63178151761A3CF23A4479E6F27BD0097A360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21