4f6695fd621c1d5f4849b2d2b66035917c542b6452d6c1da76b203916c43903d

Sharing

Copy URL Twitter E-mail

General

Target
push-hack-installer-windows-latest.zip
Size 23.6MB
Sample261027-bb6wbacd34
SHA256 4f6695fd621c1d5f4849b2d2b66035917c542b6452d6c1da76b203916c43903d
MD5 cddcb58419cb40cebc2034a14e476aca
SHA1 f65a339ca01e1c6c19fadc79be0718b7c699f6eb
SHA512 b0a7c27628d3673613e19146bc22dec04a6fcebb24980bf78d8dc148daeb6cd79bf69461f82aa3c212452d6361efba2787cd80539552260547d05f4fd2caeca0
SSDEEP 393216:caEdRmxp47IipLMv4MuEnRvm08Bwp3nH19iOMImPcXoiCt3KvqIvYAqqQRXa/IwT:v8tpO4fwvm0Dp3HG4xXn83KLAAHBXcWF
TLSH
T16247337781B76B98380FD26C29F7748C03A3A40D92D5D4A9B997272343F4DAE23D6B44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Push Hack Installer-amd64-installer.exe
- Size 12.1MB
- SHA256 c93d6d53c31aeb4e4630685a73646c999fa67e02e1997ab5e7fd8b3c21cd80ad
- MD5 f60cba86e0ce4cdea047ad6dc6a98236
- SHA1 ba180b623070e4536b36895f68c45ff036e6e5d6
- SHA512 e3482112fddd50f71f4c83e7e76b176003952dbfc1cb88e4f65532948123520231037ce0d06154e9caff267c122c2c33909aebdaf0ffd741eb03a1a32f5911de
- SSDEEP 393216:QZO87ZTWoTsiSjLq5rvkG+z6a/Ssrvjmvq/mRbVbndk6JX:QZpBTGQvcV7Adj
- TLSH
  T13BD63324F0308AD8F88A54303DF768546A939517C3DFC66378932B175B66CE6A7B4B38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
- MD5 ca28ddf732c58331d10b840600b2e519
- SHA1 e18db6b0e858b2f3e6d1cb89df1ed973710f1f34
- SHA512 2d833fc745e8d7036a2ca500bc0a8274e61338382c4437700510b0361661202fdba36c1ade6fef7591ca4b591568cebbccdcb03830e32b00364eb3705d35420e
- SSDEEP 192:EMGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTT611929WtshLAzgSrX8:EMNt+4t7uJalUnGesY7Lt8nCT6/Yosa
- TLSH
  T102624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4638565846D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  Push Hack Installer.exe
- Size 26.1MB
- SHA256 0ac45b97afd4aaf744a5efac7005336d54a038e1634cdcbe8d04c5f2f171ef09
- MD5 1133fa882ba1be7d007536a961835ff0
- SHA1 0fc56aa494104400ce4544179387602ef81e676d
- SHA512 acf0fee7b1d1c6bfd667da1e29ca2359fae5f2e5ca1a29b3ea67c6d1a988211e25c017dd939905847e08288c67e7066f309ceca4a3e6f823244eae058885915f
- SSDEEP 196608:1USsLBNEgbGpcD/balZDRQvfxQciBvtF15ISFTV9ZzcDJsJUUadl:1DMBZm6GlsvycKF15NFvNs2edl
- TLSH
  T159575A47ECA555E9C0AEC1308A729663BB717C894B3023D72B50F6282F77BD0ADB9750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral10 behavioral9
- Target
  Push Hack Installer-arm64-installer.exe
- Size 11.6MB
- SHA256 a95db288c53bd549500dc461d1b839637db9ff71f702ecd37f96eee6b31f0343
- MD5 28913a126f4d7521f39fa0f18341f39a
- SHA1 0b760f6773fce1d03bba63acdd25546f720aac85
- SHA512 851bcb2c9dfbdcada2b9012168d03dbdc28a68e75419f8d314e862b245251e2413fbfcf11a32041538605414a3b5ec95ec27be0f2c6f159c7bc1cbcc45880cab
- SSDEEP 196608:Qe70yAyMGdif/tGKrFiM4QZp/GOz57NQKHIJQz70Wz1PvPDHLH+aUj+mYPMve4Qd:QlOCGM4QZp/Fz5pQ42oPvPDHLeh+h4Qd
- TLSH
  T114C633A4A1B59234E96CC9F57D337BE8C6C79C3921F7484215A10B232970D173FBAE98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral11 behavioral12
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
- MD5 ca28ddf732c58331d10b840600b2e519
- SHA1 e18db6b0e858b2f3e6d1cb89df1ed973710f1f34
- SHA512 2d833fc745e8d7036a2ca500bc0a8274e61338382c4437700510b0361661202fdba36c1ade6fef7591ca4b591568cebbccdcb03830e32b00364eb3705d35420e
- SSDEEP 192:EMGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTT611929WtshLAzgSrX8:EMNt+4t7uJalUnGesY7Lt8nCT6/Yosa
- TLSH
  T102624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4638565846D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral17 behavioral18
- Target
  Push Hack Installer.exe
- Size 25.2MB
- SHA256 feff1d6f1775eb7525d6ef17eaa2003c7c5ad0e7c5df41b94ccd8c91cf47ac96
- MD5 f4224f4a8bea49dce9047d25c1879269
- SHA1 eb2110b4b697a560469571674aefea29ac91a742
- SHA512 402b6abab0dfcbe9552c65e8a29a297deb4faa48939f716de66546556e30deef51cf65e12d57fa18c89cd68afba678ef9ada8af964118204d7242756c07f8f4c
- SSDEEP 196608:R3hKe1ISHQlJ5k+rGciBvtF15ISFTV9ZzcDJsJUUg:REeTwlJ5hCcKF15NFvNs2E
- TLSH
  T172476A57FC5D24E5C1EEA1318A6292527B32BC484F2193D36B14B638AFB2BD09F76350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20