58fbd805984e6dae53e615290d2047689be7b682645ab4fa57c148206b34594f

General

Target
Win11StartAllBack.zip
Size 2.0MB
Sample261030-nzd7esyths
SHA256 58fbd805984e6dae53e615290d2047689be7b682645ab4fa57c148206b34594f
MD5 fc578cd7141e4a81a179fb7592b09d0b
SHA1 dde8a9b869944151fca4a269cfc4c8fcbee99cb5
SHA512 5efa1e1864251f874a1a2834abb0eb3d9a2d53a97e70e9c83b31b5d324043b699008b849de7d6e117ab92031ec802cc33af0ee10c0a4cf3a9ca7e56899b69b1b
SSDEEP 49152:l2NpUE7GkPcwit7tfKNiebxM7aeLqJng9X/WeHrKgK8Q0q7:6pUE7GOeFUvbbyqJsO1IQt
TLSH
T1BEA5331D8144CBA717D895E138A29F72A4B249EB610F35C8D713CAF2272F5D2C990E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  StartAllBack3.9.27.5412-Stable-Repack.exe
- Size 2.1MB
- SHA256 2b04a36a6440b7fc9ddc32ce166c95e4ba022fdd61a50a621e9186d865faa62b
- MD5 68f39dcd0334ba5d428bc40b8dfe15e8
- SHA1 f6c0041b24b88db1f056ac96bb26f83f07d5713a
- SHA512 72434c995cd70547acc9ad87f4b957d1c3ab6785b7652cc074c0dc32bc78d1b5a7d46b525f14692de541108d5908d798b87f47ee3b9d43dfc120703be80ecb7e
- SSDEEP 49152:6gwRZBlNOEBce/cwi/1bbgN2mrRwLsqPqF7wN7L8etBmg8c+5:6gwR5NOEBc2ed4Rr3EqFsYV8e
- TLSH
  T16AA522C7A385CEF5F1AC14B024826B3E55B78AAE03DB16C3864F9D161F751CD89F029A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution adware persistence privilege_escalation spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2