UgPhone_Setup_2[.]0[.]8[.]1956[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
UgPhone_Setup_2.0.8.1956.exe
Size 103.4MB
Sample261107-pyc4eaxz9m
SHA256 fb218a4b7c65cef7d35b08d0a22bc0164b1f2efa2e6751ac7a16b1dd20456647
MD5 8a3c37ca7cd2c7c4c81f172c374fc235
SHA1 4ce0e647766184f58cf39786a4e4d283bf1120c9
SHA512 196805f633ea67bd967e06209b5cc3bf47e3eb78a18a7e50868ef646e1fde3c16f51f1e49f44fd39f30eeb883afb21b65c8e0b50ed44e1035859909b086ca725
SSDEEP 3145728:dJRJYTZnSf1r2XqiSwe5whkuXHC3OyJKYchaD:dJRPJ2XqiHpi3OyJ5
TLSH
T106383372EE2467E5E6CC7078533A4016AFF57C06074028DF1E9CBC558A362AF8D36AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

UgPhone_Setup_2.0.8.1956.exe

.exe 103.4MB

UgPhone_Setup_2.0.8.1956.exe

IMPHASH ab40d7084d45739bd5795b0d70107d04
SHA256 fb218a4b7c65cef7d35b08d0a22bc0164b1f2efa2e6751ac7a16b1dd20456647
MD5 8a3c37ca7cd2c7c4c81f172c374fc235
SHA1 4ce0e647766184f58cf39786a4e4d283bf1120c9
SHA512 196805f633ea67bd967e06209b5cc3bf47e3eb78a18a7e50868ef646e1fde3c16f51f1e49f44fd39f30eeb883afb21b65c8e0b50ed44e1035859909b086ca725
SSDEEP 3145728:dJRJYTZnSf1r2XqiSwe5whkuXHC3OyJKYchaD:dJRPJ2XqiHpi3OyJ5
TLSH
T106383372EE2467E5E6CC7078533A4016AFF57C06074028DF1E9CBC558A362AF8D36AE5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

5e:21:96:0d:d9:ce:8b:49:f4:95:ad:66:07:55:80:88:84:c0:21:6a:98:ee:54:d8:fa:d2:28:b4:4c:cc:b4:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3141796,CN=OGCLOUD LIMITED,O=OGCLOUD LIMITED,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Chains

Nov 3, 2026

SERIALNUMBER=3141796,CN=OGCLOUD LIMITED,O=OGCLOUD LIMITED,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Digest

a6:37:0e:f0:0d:5b:b6:45:90:3a:ed:bb:30:eb:7e:bc:0a:cb:49:59

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3141796,CN=OGCLOUD LIMITED,O=OGCLOUD LIMITED,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Chains

Nov 3, 2026

SERIALNUMBER=3141796,CN=OGCLOUD LIMITED,O=OGCLOUD LIMITED,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=3141796,CN=OGCLOUD LIMITED,O=OGCLOUD LIMITED,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Serial Number

a1:a5:1a:05:9a:60:62:3d:12:7b:77:e5:c3:cf:92:10

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 11, 2024 - Jan 10, 2027

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

285396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

VariantCopy VariantClear SysAllocStringLen SysFreeString SysAllocString

user32

wsprintfW MessageBoxW CharUpperW

kernel32

InitOnceComplete WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind InitOnceBeginInitialize GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW RemoveDirectoryW GetTempPathW CloseHandle GetLastError WaitForSingleObject CreateMutexW GetExitCodeProcess CreateProcessW GetTickCount GetModuleFileNameW CreateFileW GetFileSize ReadFile SetEndOfFile SetFilePointer WriteFile GetStdHandle GetFileInformationByHandle GetCurrentDirectoryW SetFileAttributesW SetLastError GetCurrentProcessId GetCurrentThreadId GetModuleHandleW GetProcAddress GetModuleHandleA VirtualAlloc VirtualFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetSystemInfo InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW WaitForMultipleObjects UnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount

vcruntime140

_purecall __std_terminate _CxxThrowException memmove memcmp memset __C_specific_handler __current_exception __current_exception_context memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wcsncpy_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode fwrite _fseeki64 fread fclose _wfopen_s __p__commode

api-ms-win-crt-convert-l1-1-0

_strtoi64

api-ms-win-crt-heap-l1-1-0

free malloc realloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit _set_app_type _cexit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _exit exit _initterm_e _initterm _register_thread_local_exe_atexit_callback _get_wide_winmain_command_line _seh_filter_exe _beginthreadex _initialize_wide_environment abort _configure_wide_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

UgPhone_Setup_2.0.8.1956.exe

oleaut32

user32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic