4b3adc06d37d526d40ca92a1f826012d613ef97dcef87d8c2e3a9c8ce684f9f4

Sharing

Copy URL

Twitter E-mail

General

Target

APmenu.exe
Size

66.0MB
Sample

240201-3xxy3sbdap
MD5

6f77d44201025d45fca334655fd3fcbb
SHA1

490e054f2cf18d83f613ccb67e5ae3ede5e9d257
SHA256

4b3adc06d37d526d40ca92a1f826012d613ef97dcef87d8c2e3a9c8ce684f9f4
SHA512

03ab82c923a581de4819c697009b6678c57f17e5ab2cd567b77bd72353977cbabc322e07cbfba69aca2b3b1842eca25b21d2642fbcb895856604ef17586e355e
SSDEEP

1572864:rrziNx5q5fOneScj+E4OGHCBJKZ2LHQUEebzuTX5eiPFD7:ux5q1ZNJ4EPKSHXKJeUFD7

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  APmenu.exe
- Size
  
  66.0MB
- MD5
  
  6f77d44201025d45fca334655fd3fcbb
- SHA1
  
  490e054f2cf18d83f613ccb67e5ae3ede5e9d257
- SHA256
  
  4b3adc06d37d526d40ca92a1f826012d613ef97dcef87d8c2e3a9c8ce684f9f4
- SHA512
  
  03ab82c923a581de4819c697009b6678c57f17e5ab2cd567b77bd72353977cbabc322e07cbfba69aca2b3b1842eca25b21d2642fbcb895856604ef17586e355e
- SSDEEP
  
  1572864:rrziNx5q5fOneScj+E4OGHCBJKZ2LHQUEebzuTX5eiPFD7:ux5q1ZNJ4EPKSHXKJeUFD7
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral1
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral3
- Target
  
  LICENSES.chromium.html
- Size
  
  6.5MB
- MD5
  
  180f8acc70405077badc751453d13625
- SHA1
  
  35dc54acad60a98aeec47c7ade3e6a8c81f06883
- SHA256
  
  0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c
- SHA512
  
  40d3358b35eb0445127c70deb0cb87ec1313eca285307cda168605a4fd3d558b4be9eb24a59568eca9ee1f761e578c39b2def63ad48e40d31958db82f128e0ec
- SSDEEP
  
  24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
Score

1^/10
behavioral4
- Target
  
  buil.exe
- Size
  
  154.7MB
- MD5
  
  eb4db120164dceb943d6a0dfa3334bbe
- SHA1
  
  375e8322e5db1057ff59615e83ac6befa624307c
- SHA256
  
  c36d9e9168d32ffc1517ae6404899f4372277bac2a48f2190fc04ac706ee1f76
- SHA512
  
  a7f42c27d649441523513fd450592c9a2a7a5b8f015767d51ba8bfe9381ee7930428bbd25486c73fe36d83f36eae8be42142058ab965c69ce734f04c74cc33c9
- SSDEEP
  
  1572864:OCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:0DAgZi
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral5
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  cb9807f6cf55ad799e920b7e0f97df99
- SHA1
  
  bb76012ded5acd103adad49436612d073d159b29
- SHA256
  
  5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- SHA512
  
  f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP
  
  49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
Score

1^/10
behavioral6
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  d49e7a8f096ad4722bd0f6963e0efc08
- SHA1
  
  6835f12391023c0c7e3c8cc37b0496e3a93a5985
- SHA256
  
  f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014
- SHA512
  
  ca50c28d6aac75f749ed62eec8acbb53317f6bdcef8794759af3fad861446de5b7fa31622ce67a347949abb1098eccb32689b4f1c54458a125bc46574ad51575
- SSDEEP
  
  49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
Score

1^/10
behavioral7
- Target
  
  libEGL.dll
- Size
  
  468KB
- MD5
  
  09134e6b407083baaedf9a8c0bce68f2
- SHA1
  
  8847344cceeab35c1cdf8637af9bd59671b4e97d
- SHA256
  
  d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577
- SHA512
  
  6ff3adcb8be48d0b505a3c44e6550d30a8feaf4aa108982a7992ed1820c06f49e0ad48d9bd92685fb82783dfd643629bd1fe4073300b61346b63320cbdb051ba
- SSDEEP
  
  12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
Score

1^/10
behavioral8
- Target
  
  libGLESv2.dll
- Size
  
  7.2MB
- MD5
  
  a5f1921e6dcde9eaf42e2ccc82b3d353
- SHA1
  
  1f6f4df99ae475acec4a7d3910badb26c15919d1
- SHA256
  
  50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e
- SHA512
  
  0c24ae7d75404adf8682868d0ebf05f02bbf603f7ddd177cf2af5726802d0a5afcf539dc5d68e10dab3fcfba58903871c9c81054560cf08799af1cc88f33c702
- SSDEEP
  
  98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
Score

1^/10
behavioral9
- Target
  
  locales/uk.pak
- Size
  
  657KB
- MD5
  
  361a0e1f665b9082a457d36209b92a25
- SHA1
  
  3c89e1b70b51820bb6baa64365c64da6a9898e2f
- SHA256
  
  bd02966f6c6258b66eae7ff014710925e53fe26e8254d7db4e9147266025cc3a
- SHA512
  
  d4d25fc58053f8cce4c073846706dc1ecbc0dc19308ba35501e19676f3e7ed855d7b57ae22a5637f81cefc1aa032bf8770d0737df1924f3504813349387c08cf
- SSDEEP
  
  12288:Yoff7plonpyOKtPXiNcnZx75kB3IjE8EmLvLNiXEJq//GW:YoffaXMd59E7
Score

1^/10
behavioral10
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral11
- Target
  
  vk_swiftshader.dll
- Size
  
  5.0MB
- MD5
  
  a0845e0774702da9550222ab1b4fded7
- SHA1
  
  65d5bd6c64090f0774fd0a4c9b215a868b48e19b
- SHA256
  
  6150a413ebe00f92f38737bdccf493d19921ef6329fcd48e53de9dbde4780810
- SHA512
  
  4be0cb1e3c942a1695bae7b45d21c5f70e407132ecc65efb5b085a50cdab3c33c26e90bd7c86198ec40fb2b18d026474b6c649776a3ca2ca5bff6f922de2319b
- SSDEEP
  
  49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4
Score

1^/10
behavioral12
- Target
  
  vulkan-1.dll
- Size
  
  899KB
- MD5
  
  0e4e0f481b261ea59f196e5076025f77
- SHA1
  
  c73c1f33b5b42e9d67d819226db69e60d2262d7b
- SHA256
  
  f681844896c084d2140ac210a974d8db099138fe75edb4df80e233d4b287196a
- SHA512
  
  e6127d778ec73acbeb182d42e5cf36c8da76448fbdab49971de88ec4eb13ce63140a2a83fc3a1b116e41f87508ff546c0d7c042b8f4cdd9e07963801f3156ba2
- SSDEEP
  
  24576:PR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:PR1l1culw6Z5WUDYsH56g3P0zAk7
Score

1^/10
behavioral13
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral14

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

An obfuscated cmd.exe command-line is typically used to evade detection.

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14