6202635af1dc2be4c67532bd0b3923419b59297c889c28b5d86ef7e8039d6645

Sharing

Copy URL Twitter E-mail

General

Target
push-hack-installer-windows-latest.zip
Size 23.6MB
Sample261027-bb9l7scd37
SHA256 6202635af1dc2be4c67532bd0b3923419b59297c889c28b5d86ef7e8039d6645
MD5 8cc43bf245f48839ba4a0c6c1db93876
SHA1 4d2a3d880ec912fe7571fb0262915b45a66fa83b
SHA512 8c7dd814560c31836de6b20151b387be991b1bfaf1dd990595396c714be5963c67626e30f7155a47f0a58531d96a64c5231ad28bd7cd657e5e7f9a85ac9b6678
SSDEEP 393216:QKabR6pdcifuyqsMGZetlY9uogHLVX933XMbx6aP6XwJFdgxThFn9SUyszbkfv2G:Qbt6lfudUZh9WHLVBK8XwJFdKnnsUH8p
TLSH
T13A4733FE0FBF1FDE6868C069107A565872617425A25D08A0B8D81377C3D9A1FEDD326C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Push Hack Installer-amd64-installer.exe
- Size 12.1MB
- SHA256 1d61b74e55a69fb44429b2dfe9164896ef3ee6918d1ecd64b8d5d07225984523
- MD5 619fff9a69d01edf4c1e59dd86e4112f
- SHA1 b83804196daa0c5ca2c55ef2a498eb54bb9b541a
- SHA512 be63d3a73af171030c3bbae2259289ddf882d0c8ba2e37703e8a2e96a5e86915f433d2ef65ca775b60b4fb26f28f0f236df20f1d7565cee36b9995139fe06444
- SSDEEP 393216:QxOGRSyWFFPotXLMzITlauQtPpzEOZcJr6myg:QxvSyWFFo7MUTlauG/g
- TLSH
  T1E2D6338999EC9A67CDA4517C2B3C3B9831E7B85253896B87C1D84F67418039FFDC2638
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
- MD5 ca28ddf732c58331d10b840600b2e519
- SHA1 e18db6b0e858b2f3e6d1cb89df1ed973710f1f34
- SHA512 2d833fc745e8d7036a2ca500bc0a8274e61338382c4437700510b0361661202fdba36c1ade6fef7591ca4b591568cebbccdcb03830e32b00364eb3705d35420e
- SSDEEP 192:EMGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTT611929WtshLAzgSrX8:EMNt+4t7uJalUnGesY7Lt8nCT6/Yosa
- TLSH
  T102624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4638565846D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  Push Hack Installer.exe
- Size 26.0MB
- SHA256 af85669da831eb286a9b488834b6326516c7b0cf4f33a0044f1d2f78666de733
- MD5 0f2475689bebae57a35bcb57dbd6276a
- SHA1 29b69b43bdfc4b024030db071538dce348254782
- SHA512 0ecab34f56bc4899737d28e4d6d1a757fe3790e70c9f34d9deef3f7232c5f8e2933506bec6c6e4f0d153df2e767e1ed46e61fb99c7e99b1677ed946534ecfb5f
- SSDEEP 196608:NMkjR8Uxbo8dUZDvODtwC3PMqiwciBvtF15ISFTV9ZzcDJsJUUa:N7juUq2oDvbYcKF15NFvNs2e
- TLSH
  T1DC575A57ECA555E8C1AEC134CA6292637B727C891B3063D32B50F6282F77BD06EB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral10 behavioral9
- Target
  Push Hack Installer-arm64-installer.exe
- Size 11.6MB
- SHA256 f74c44be683616c79ef84916db96b9aa7d1e0c64c08b04981a67d070dab976cc
- MD5 508076da815a801ae4ecc292a9e8924a
- SHA1 61ae67bf6825cc93f2edbf750bcd199662042063
- SHA512 8f5b264f9ccbd833a70c33ad47e68ef2e65eca532aef98ebe71c83848a5ad5edeca3366b9ccad76d4dc988202ccb80df0324c1a46d4765c6016cbf5c764b0ec1
- SSDEEP 196608:Qy70yAyMGlMwIMiR+aiLtEKOEnocb7oLbs0UWHnjH/RBIKiNYqJmbBXJjRABYp:QhOSU2dutEKpP/gpU0jH/RB8aqJqJjCm
- TLSH
  T151C6334D4F771E8DDDB418F11A6A0C749212723373FD00A4A2983B5B47A66AF8FB71A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral11 behavioral12
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
- MD5 ca28ddf732c58331d10b840600b2e519
- SHA1 e18db6b0e858b2f3e6d1cb89df1ed973710f1f34
- SHA512 2d833fc745e8d7036a2ca500bc0a8274e61338382c4437700510b0361661202fdba36c1ade6fef7591ca4b591568cebbccdcb03830e32b00364eb3705d35420e
- SSDEEP 192:EMGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTT611929WtshLAzgSrX8:EMNt+4t7uJalUnGesY7Lt8nCT6/Yosa
- TLSH
  T102624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4638565846D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral17 behavioral18
- Target
  Push Hack Installer.exe
- Size 25.2MB
- SHA256 b14c151f5e1322aa2589da2cec5c482afd639b2f57ac1c5e5c66fb0323222b26
- MD5 8d2398e2061ed0ad33b9bd0b027da944
- SHA1 73e287f90b1a8241eb7ae59223d6f68f877686e1
- SHA512 51fb6a88f4a7c9610d9e664a1fb4ceb91783700fd05879c228aafb96562fda42e33d987a75d7c058e61e7114596c8b5173662283643dc638415519bd3edd709b
- SSDEEP 196608:XgsA15bibf2xh+6amciBvtF15ISFTV9ZzcDJsJUUg:XzAfiL2y6ncKF15NFvNs2E
- TLSH
  T1A4477A47FC5D64E5C1EEA1358A6292527B31BC480F22A3D36B10B6396FB2BD09F76350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20