7bd580bdbac0aa6843f11c2a4d283f2bb08276af779ea499c7564f6df1a4c166

Sharing

Copy URL Twitter E-mail

General

Target
push-hack-installer-windows-latest.zip
Size 23.4MB
Sample261027-bc1exshw8s
SHA256 7bd580bdbac0aa6843f11c2a4d283f2bb08276af779ea499c7564f6df1a4c166
MD5 3eef0e33f09aaf5329a13f03fc4fb46b
SHA1 41901ff92d3896b6d0de61b445ca04d42df5a456
SHA512 022d3df87288b64932ff5d729f84f89170c10ffdd7b8c804df9d2930517e7c1f15906515a4e9f609fc965ba1a7d7ae558154528b33f6f89afd508ecb1c95fd3e
SSDEEP 393216:mUTfEOUPRYCfwF8VLuHA388ihEzaK5KRPn3GIso//E0Oh7p2vHPXXrj58lGDzQOl:mGcN1m8VLOa88G65KRPWNh78P3OiJ7JH
TLSH
T1C337330F817ACA5B6459D8746B2910ECA0BBBC5C2A6434D2246F6B024FB1B7DC3D39DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Push Hack Installer-amd64-installer.exe
- Size 12.0MB
- SHA256 5651a573fd41d20198b064649641ef607df552a471e93802604735febc22311d
- MD5 7bee1ed0a3f4952eef3a8b5d59d00f5e
- SHA1 70a5da87b8c33a8daa037be605709891216d978f
- SHA512 cec606151ed91ab96c565f9feb6d2567fb7f7362032598c9e151dabb0d18359c3a4a087cbba214db810d10b9a1d28bc3aae32cb61731a40b9562bea53a79a315
- SSDEEP 196608:j970yAyMGS9Y4J/l/G3pE48yEeAPsnv/uFNKaiL9tvYclIXPi1lIizSDTZh6nkLn:j2Ool/Ggdejv/uHKaWtPlIfi1lIizSDX
- TLSH
  T156C633FE8373AE78D868C5703E2871ACD5762CBE2ED41466310B27531F756FA8B92148
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
- MD5 ca28ddf732c58331d10b840600b2e519
- SHA1 e18db6b0e858b2f3e6d1cb89df1ed973710f1f34
- SHA512 2d833fc745e8d7036a2ca500bc0a8274e61338382c4437700510b0361661202fdba36c1ade6fef7591ca4b591568cebbccdcb03830e32b00364eb3705d35420e
- SSDEEP 192:EMGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTT611929WtshLAzgSrX8:EMNt+4t7uJalUnGesY7Lt8nCT6/Yosa
- TLSH
  T102624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4638565846D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  Push Hack Installer.exe
- Size 26.0MB
- SHA256 4928ee62a447e7831e1653121ee15a5933a3975d959067e5b270c75fad4d8427
- MD5 c5a29b2c864ea46c91a2c3aaf92fcb03
- SHA1 beda8a8af1da5dcf2ac102548b49d68cc0cd9edc
- SHA512 ea041574ee8b123af4fd584cbed0ba43861e5ad15d9408a1eff676be93d95b0ce8b82d813495d1bc79664e1e1f0ab034f75494537729e5664b041c809c170dda
- SSDEEP 196608:nyqo/drFW7/dHaTgD5EdlAciBvtF15ISFTV9ZzcDJsJUUaO:n5Udr0N2lwcKF15NFvNs2eO
- TLSH
  T142575A57FCA515E4C0AEC1348A629653BBB17C894B3123D32B50F6282F77BD0ADBA744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral10 behavioral9
- Target
  Push Hack Installer-arm64-installer.exe
- Size 11.5MB
- SHA256 4d9a8bcfb61c4a9314295da953c585b2aa722cec196f2efd623164390f36a05f
- MD5 251635693ad36d2dcc8577d8313ff5d0
- SHA1 a2d7cf5db2761f2ee432a01615725554a9fc5d88
- SHA512 7894a95f2a45bb1ed764abb502de2de30d3767eacab9abc4811909a6f1d20bc42df10dcfeb2b3076649eb2ee49811cd6be08873c9de55ec7d5f14a5ed7c3a300
- SSDEEP 196608:jd70yAyMGKAgylcGCJBVESE/lquBVPCSwuSVCzuNLWccwt6AA8s14S3RhEGLXO56:jWOG8cG0VESaYyjSVorcj6AAz+4h/AlM
- TLSH
  T1F8C6336944F55106E6FA5ABC242501FCB1F2FE0F752060E2126C6B05AFB25BD83E5CEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral11 behavioral12
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
- MD5 ca28ddf732c58331d10b840600b2e519
- SHA1 e18db6b0e858b2f3e6d1cb89df1ed973710f1f34
- SHA512 2d833fc745e8d7036a2ca500bc0a8274e61338382c4437700510b0361661202fdba36c1ade6fef7591ca4b591568cebbccdcb03830e32b00364eb3705d35420e
- SSDEEP 192:EMGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTT611929WtshLAzgSrX8:EMNt+4t7uJalUnGesY7Lt8nCT6/Yosa
- TLSH
  T102624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4638565846D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral17 behavioral18
- Target
  Push Hack Installer.exe
- Size 25.1MB
- SHA256 7e8da3a4b7d809a53a723007c75b59b959deff5ebe2a351a597fc0a30020e3ca
- MD5 ffd28db72dd12e3959e019ea6885a390
- SHA1 401c109ce7881b6c3f7201ff7feb4ec13b76e6c5
- SHA512 a2fcb9d5012a17a347fd612ef5981aabf205fc739c5cdbf3ffe5b22f156ffa648fe9db4997f42d8b404ffec8be6d3bc15f6a0ce96740de3af26fee9c09d382da
- SSDEEP 196608:hyqdcyB3XAUH2W8+JDPciBvtF15ISFTV9ZzcDJsJUUg:hyypZ/5JcKF15NFvNs2E
- TLSH
  T10B476A47FC5D64E9C5EEA1358A6292527B31BC484F2193D32B14B238AFB2BD09F76350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20