8bb7c7e5bbcef2a3f0f9039925de0dfff59086dd170fe830bed91cd402a57e67

General

Target
KMSAutoPlusPlus.1.5.4_www.Downloadha.com___2_.zip
Size 20.7MB
Sample261102-dc5qraev7t
SHA256 8bb7c7e5bbcef2a3f0f9039925de0dfff59086dd170fe830bed91cd402a57e67
MD5 cd6c6559c53c35cc670cadb80195fc1d
SHA1 234b1aa670acaceb5fd60cc31b86644c7b79690f
SHA512 f68a4c9b8752c8a57d48b87bef64991a8142083063fcf72636ca188aaae51c28af0f77448c4c79d65a78c876621e4c16d66b1180ac409c7f9de716de36443ccb
SSDEEP 393216:Pj99aW43pwwpa32bZiuvZiauGJvBLr0+7AXqME4mENf4hhd4pcEKkTF+6Hsq:PhsawQ32RJJpLl7AXNHmc4zd4TVp
TLSH
T1092733752465F150027EAEEB36AF248D3FC1A38F1EEDAB561061A45301BBFC1784B1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe
- Size 15.1MB
- SHA256 30693d020456f4f4b0d2a6c6c13d907787283fcea11f0459e75bf9c55e100350
- MD5 dc363fc9636f9474c44b123afba3e899
- SHA1 2c25821a4106f2ae48b7f8c46d0e1344694c6414
- SHA512 5780c86a6ed0d6f7a4682ac9b471831a2cd9bfd7b4125c7f094dc8e396d454af759ec07f551c209b7299bff2b33acf36b51ce6db36a1d15369a8e1086de8d40a
- SSDEEP 393216:Y2oMfRxxyaqpOeD5lXBMA16PQyp+Ap8KRoM/vR:Y2o2jQaqpOeDfXKA1TypSm5
- TLSH
  T106F6337B485261E8F4813C705A2EFCE4351978232E4579712D47CAE9887AEC3E7DA70B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution upx
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/OInstallLite.exe
- Size 6.1MB
- SHA256 8fce30699b9de40656b887dc483aadfe1bba8e025f079fbb96e88ae3f228825b
- MD5 8605742e929696f5aac1dd37194d8323
- SHA1 8be480d208875a08582c9b4e11bf3ad66ff991c2
- SHA512 69baac6b46bad32cf78a03f2c004e3fd5701dc32224f4dde508205662c988ef5c7fb08cb72488cb4b9018b97695fd382acd92136b7b36266d8b8421027b185f1
- SSDEEP 196608:5bHW796hKqQjgiXuhqprEnIziE0+RO0f+SBoz4H+ty:xrhegiehqprEnIuEfjf+i7e
- TLSH
  T13B5633F58911A07BF84A55BD98396481244E7C0A1C43FC787E57EEF4BB35AC2A49238F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery execution spyware upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4