ae3ec63290a5b41c097c00b5904d024f00a1ed8dca921e2d0cc965808688ff6e

General

Target
dreamspoofer.zip
Size 7.9MB
Sample261102-28lvhszy3p
SHA256 ae3ec63290a5b41c097c00b5904d024f00a1ed8dca921e2d0cc965808688ff6e
MD5 34934994770750cfda9e7a49795b931f
SHA1 04da59bee72b155b2b1c36f56314b91bdaab7c8d
SHA512 3fcaead99da7134540197d55035275f5533941ec6f2ba480ef4469dbd155e7c7604539a2a5f30660c3b75a66e4b8ba882520f255f67a2f9781c0a6621bedffed
SSDEEP 196608:FJanaW40Y+X54dIrn7anaW40Y+X54dIrn4:WnabaX54dIrnmnabaX54dIrn4
TLSH
T11D863340CE00BEF4C45B2B746236DA67191BA59CA372EC660927777E71C143B6EA30F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  dreamspoofer/resources/dreamCleaner.exe
- Size 224KB
- SHA256 172f6c873b246e71c6ecf1c0fffb57ca96bc93b7c55046433b4218f514eddf29
- MD5 1c55c014e426a853488ceb2b9e3e1e4c
- SHA1 e818495d167286154a36dab6e98c7c7a434bc6c1
- SHA512 b9534a16f231d94ccde98ee7515e1f647a1672fd17adee49c1dd79370c06ce7710edaa87262c06c409c8cad0c14e9cf54f7dddaf18ebbc860fbfdf2b38657ed3
- SSDEEP 6144:rt5hBPi0BW69hd1MMdxPe9N9uA069TB2ayKcDtbqGN8P1erIjECij:rtzww69TQayKcRbqs89eztj
- TLSH
  T18E249D57B2A01188EBF581F6D9920746E73074321725A3DB277852B71B2B8CA9F3D3E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Stops running service(s)
  defense_evasion execution
behavioral1 behavioral2
- Target
  dreamspoofer/resources/udmapper.exe
- Size 3.9MB
- SHA256 57ed53ba0ac715c8de18c67eb2e8dc0d04a061208f4a9947fed350e83a5fda72
- MD5 b7a6aae627a16e3e67825503c826933f
- SHA1 3b5385e392aec43b4507e145f50c895db31e9525
- SHA512 369e83401930695c2a01a307294727a3b749e991dbbf707e34842c930743ad334c5242a8cb062b31a4caddd2c70465cc3a75fec8c8919f04ef62f6397e46e0a3
- SSDEEP 98304:utftYwaghIxulQullaedyxX5zujLOn6ocWwywq/9:PDvMCxX5b6ocewq/9
- TLSH
  T1601633BEB7A14703CFFD33B59309CB4A8A37A9059444F5E73A32FB66885A53F8054168
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral3 behavioral4