f946a279c1e123b6a97112bdbbfe65e4e669d0ab11dae82ff6ced8229df2f268

Resubmissions

07/02/2024, 01:24

240207-bsv55sdbgm8

07/02/2024, 01:19

240207-bpv1zabbb6

Sharing

Copy URL Twitter E-mail

General

Target
privacy.sexy-Setup-0.12.10.exe
Size 80.6MB
Sample240207-bsv55sdbgm
SHA256 f946a279c1e123b6a97112bdbbfe65e4e669d0ab11dae82ff6ced8229df2f268
MD5 5c303276dff10d8c2f2c780878db8114
SHA1 47f034286b8430a085b41fc059be39b00aed301f
SHA512 7d4947da9ddc38c4fe8d68e6e060daa29de1afba75dfc21eb9c6bff6307611a919a84878b81a7a93b85107e7dbd1c66e0357517665c576c8fd675591df5d7121
SSDEEP 1572864:hs+e4h7hwdMTqlmjUjbl4nmfbYI7VNbfaDLEd2bppu5MEGd2dEqGWRcwd90JxKKk:h9e4iuqlmYf6k7DbfaDLEdvWZ2d7jMo3
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Targets

- Target
  privacy.sexy-Setup-0.12.10.exe
- Size 80.6MB
- SHA256 f946a279c1e123b6a97112bdbbfe65e4e669d0ab11dae82ff6ced8229df2f268
- MD5 5c303276dff10d8c2f2c780878db8114
- SHA1 47f034286b8430a085b41fc059be39b00aed301f
- SHA512 7d4947da9ddc38c4fe8d68e6e060daa29de1afba75dfc21eb9c6bff6307611a919a84878b81a7a93b85107e7dbd1c66e0357517665c576c8fd675591df5d7121
- SSDEEP 1572864:hs+e4h7hwdMTqlmjUjbl4nmfbYI7VNbfaDLEd2bppu5MEGd2dEqGWRcwd90JxKKk:h9e4iuqlmYf6k7DbfaDLEdvWZ2d7jMo3
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery exploit
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10
behavioral5
- Target
  LICENSES.chromium.html
- Size 8.8MB
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- MD5 2675b30d524b6c79b6cee41af86fc619
- SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 867d1603ce21d3a135a78c8c7f29f853c56fd467658350d1b54b41b082ddf681
- MD5 6601901bf920765e3bad8b9ad298d190
- SHA1 124fbe9dc721f4ec6e216a7dd8ee65be4f016373
- SHA512 85b94dba5a9a5017d7d390ea86b04a67eb694eb7ef14b948f564d397d2d431281fa06cde847799f49745ac8a7f8e37f7d92bf2e4429b621e9eca52a324978169
- SSDEEP 49152:0p6y9IKJGN2IVcmLsKRqPkObnx+TnpZTf6yfwrh1AicLlj8iisw1k:0pZGo28KgM0nxGC7iiVG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  libEGL.dll
- Size 477KB
- SHA256 c314020ca113d2a912f9787d0e702416d0c2bd7a43b5edafb111bc56eaa35fac
- MD5 00be28ae5238bcafa11dc921c2d6cf85
- SHA1 b30e15ef8c420bf7a56e4a1f237d8580d15e30cf
- SHA512 5a236c366acaae6b4f779b4764afb380dd8cfb9daa88dfd00eca1dddb55169a261c36dc8f4a4f97c8129dff14851bbf8cfc8cbb975117f95ecdb15663a3a2bee
- SSDEEP 6144:b8hI4BSjuMmof2SEXVVfgV8hxN7h2NNIEOgK1f0FticyQ:b8WmSjZmof2SEsmN12NNIE2f0FticyQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 d2bb0379c686b50cfdf98f6f41d0c36694b4bbcb8d68e4c9a9f9104b0c5c4813
- MD5 5066eccd717539ce287ebce935db7ffd
- SHA1 03c4502c7bf2b5c63f68ec9a2568afb6d8fe655e
- SHA512 1e3ba0fa24e77f5d56b9154004f2c89420794c5a17457959bd386b3fdc6be17f44780f3342797d378ac7fce15d2fbb39e867912e423af1a08e959920929a6c11
- SSDEEP 98304:C0kLED4OxChTxGrbOK+iU8tn+deFnct5zZ36/3H:C0kLgtgh1yb4W+BFAX
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  privacy.sexy.exe
- Size 164.7MB
- SHA256 56b8a20dc6f55a914f606c60f7b5da5a9a9b646619257577e2235f36275a4fdf
- MD5 f3dfee6121cf22610a28e10051af05e1
- SHA1 a5e31be516c80191d5a2fb095de07e58878a16a7
- SHA512 d59eb89a72fe90be4a9f151cf5e51ed841f16dd9bdba66b1c3378aa048c77601bf800b8fe7eb14000988354d1f398fae54dce5c1d27d5c054d0392fc3324bbef
- SSDEEP 1572864:fTHz0kMCujI1eyC++kaq+PJ++4Z9sDlOfZo4ZpiXMeoSiSx8r6fF7B3kULdr0fcD:7BgyC+h4JK3WP/+
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  vk_swiftshader.dll
- Size 4.9MB
- SHA256 22075f53a28c922b0db3191117004b1c6e8a3c249861650bbf572661bbb9392f
- MD5 6bbe7ed03b69b768ae56fe567527c895
- SHA1 eef1850ef23c7183578e7c0fa215010e01a86186
- SHA512 bb21900ef1e99a727981fcfe8b4c3d3b6b27b358fdcd0668b16dc0a630fbb49252eb909506bd0490ef91e0038a49eeb749966151b94edd60e5dcd015eb8359cd
- SSDEEP 49152:Umk3591xY8JVUEpcxScQljT5HAeoDftT9n3G6KvgCvjZrexIVXXKFI8TTZUW31xl:Nk35ssGyPqhn2axtAm/u
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  vulkan-1.dll
- Size 931KB
- SHA256 af1634ce8221a19dbe09f2713875478cfb12f5bbe5d10763c3c905f608489e49
- MD5 678f12a18eacfaa12f58dbdc07837715
- SHA1 219730f5af17ccf252fb4f3e64ad00f650c693f5
- SHA512 c125f2ca6a7375754512dfdf8e2cd71f8c686fec627cf3006d9093f0c0999004b60cfb3ae025fe2fad6be89346c6e7531b8dee6da9b74a86841fe68c05495036
- SSDEEP 24576:lYWOq/4Kt/Ku8n3W7ecbFb6Z5WoDYsHY6g3P0zAk7sH:lY65/M3W7R56Z5WoDYsHY6g3P0zAk7s
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral16
- Target
  $R0/Uninstall privacy.sexy.exe
- Size 196KB
- SHA256 e8db7bd8a89c17ab8f1ac5459d9f37dcffe84a36367b624d476606c4952068e6
- MD5 78a9f5c96edc87d5fc554b3913e7c377
- SHA1 6b455ab9f70e0c8bde674d87d6a9ab54c8a22868
- SHA512 a7539718858b6939514ecaa1fd792122cd84ad8843728a31e19c7ab34214696431e36f2340c603a13cf80e21a0046e3883bd478ffea4445413747dbb0bf25171
- SSDEEP 3072:An77v00hEoDEtauvdVT71Z2TEaMCcMPYKdRWXqQ1GPpEk9aH2tvhOEA1RJCir86R:A740IFR1ETMNMwX9gP+os2t0EyL+yaW
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral17
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral18
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10
behavioral20
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Possible privilege escalation attempt

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Checks installed software on the system

Checks computer location settings

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21