Extracted

• • Target

    7bb922f34437a2358f5eaa01d7f6c04dc2194e22e3e84f62ac8e5066defd2c38.exe

  • Size

    75.8MB

  • MD5

    743b4778dd938d714200ba3315718126

  • SHA1

    da9c47505e0dc6e084843def46c4782dddbc24e1

  • SHA256

    7bb922f34437a2358f5eaa01d7f6c04dc2194e22e3e84f62ac8e5066defd2c38

  • SHA512

    476f4829ce823c511a18ffd24060396fbd4334a94bb776daeb4e838cc05eaa5923c7e979c9dcb44629a1432f6a0e7ae3d337ef233d22712571e0e146b1f233dc

  • SSDEEP

    1572864:F4ghQjAK0ODEmhYVUw7GjjiMZNh8lHWQBsAt8PStSkzXJt2d3A57qhMf0tf57:F4vAFOHOU5j/h8l4Cy8FGd3Fnf57

  Score

  10^/10

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/StdUtils.dll

  • Size

    100KB

  • MD5

    c6a6e03f77c313b267498515488c5740

  • SHA1

    3d49fc2784b9450962ed6b82b46e9c3c957d7c15

  • SHA256

    b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

  • SHA512

    9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

  • SSDEEP

    3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

  Score

  3^/10
  behavioral3behavioral4

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    0d7ad4f45dc6f5aa87f606d0331c6901

  • SHA1

    48df0911f0484cbe2a8cdd5362140b63c41ee457

  • SHA256

    3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

  • SHA512

    c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

  • SSDEEP

    192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

  Score

  3^/10
  behavioral5behavioral6

• • Target

    BlendyGameBeta.exe

  • Size

    164.6MB

  • MD5

    4172c5248c4743a9c0196f489b3bc2ae

  • SHA1

    a2324a017f5cc49cc1df594306f0e6afdb7572a4

  • SHA256

    a6571580c4c0248112c4cf4def6a2f7d7b12eea6fa47d503c8bd4575d2eadebe

  • SHA512

    c093fd7f04ea19bc6e8840449abe42780a410acfae591adbf6139e013e5a51758e3d0d881575684099d6e7176913bf097619dedcfb0af374c18c5b0c59c1b92d

  • SSDEEP

    1572864:dTHz0kMCujI1eyC++kaq+PJ++4Z9sDlOfZo4ZpiXMeoSiSx8r6fF7B3kULdr0fcD:JBgyC+h4JK3WP/+

  Score

  10^/10

  persistencespywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral7behavioral8

• • Target

    LICENSES.chromium.html

  • Size

    8.8MB

  • MD5

    2675b30d524b6c79b6cee41af86fc619

  • SHA1

    407716c1bb83c211bcb51efbbcb6bf2ef1664e5b

  • SHA256

    6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081

  • SHA512

    3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485

  • SSDEEP

    24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek

  Score

  1^/10
  behavioral10behavioral9

• • Target

    d3dcompiler_47.dll

  • Size

    4.7MB

  • MD5

    2191e768cc2e19009dad20dc999135a3

  • SHA1

    f49a46ba0e954e657aaed1c9019a53d194272b6a

  • SHA256

    7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

  • SHA512

    5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

  • SSDEEP

    49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l

  Score

  1^/10
  behavioral11

• • Target

    ffmpeg.dll

  • Size

    2.8MB

  • MD5

    6601901bf920765e3bad8b9ad298d190

  • SHA1

    124fbe9dc721f4ec6e216a7dd8ee65be4f016373

  • SHA256

    867d1603ce21d3a135a78c8c7f29f853c56fd467658350d1b54b41b082ddf681

  • SHA512

    85b94dba5a9a5017d7d390ea86b04a67eb694eb7ef14b948f564d397d2d431281fa06cde847799f49745ac8a7f8e37f7d92bf2e4429b621e9eca52a324978169

  • SSDEEP

    49152:0p6y9IKJGN2IVcmLsKRqPkObnx+TnpZTf6yfwrh1AicLlj8iisw1k:0pZGo28KgM0nxGC7iiVG

  Score

  1^/10
  behavioral12behavioral13

• • Target

    libEGL.dll

  • Size

    477KB

  • MD5

    00be28ae5238bcafa11dc921c2d6cf85

  • SHA1

    b30e15ef8c420bf7a56e4a1f237d8580d15e30cf

  • SHA256

    c314020ca113d2a912f9787d0e702416d0c2bd7a43b5edafb111bc56eaa35fac

  • SHA512

    5a236c366acaae6b4f779b4764afb380dd8cfb9daa88dfd00eca1dddb55169a261c36dc8f4a4f97c8129dff14851bbf8cfc8cbb975117f95ecdb15663a3a2bee

  • SSDEEP

    6144:b8hI4BSjuMmof2SEXVVfgV8hxN7h2NNIEOgK1f0FticyQ:b8WmSjZmof2SEsmN12NNIE2f0FticyQ

  Score

  1^/10
  behavioral14behavioral15

• • Target

    libGLESv2.dll

  • Size

    7.3MB

  • MD5

    5066eccd717539ce287ebce935db7ffd

  • SHA1

    03c4502c7bf2b5c63f68ec9a2568afb6d8fe655e

  • SHA256

    d2bb0379c686b50cfdf98f6f41d0c36694b4bbcb8d68e4c9a9f9104b0c5c4813

  • SHA512

    1e3ba0fa24e77f5d56b9154004f2c89420794c5a17457959bd386b3fdc6be17f44780f3342797d378ac7fce15d2fbb39e867912e423af1a08e959920929a6c11

  • SSDEEP

    98304:C0kLED4OxChTxGrbOK+iU8tn+deFnct5zZ36/3H:C0kLgtgh1yb4W+BFAX

  Score

  1^/10
  behavioral16behavioral17

• • Target

    resources/elevate.exe

  • Size

    105KB

  • MD5

    792b92c8ad13c46f27c7ced0810694df

  • SHA1

    d8d449b92de20a57df722df46435ba4553ecc802

  • SHA256

    9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

  • SHA512

    6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

  • SSDEEP

    3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l

  Score

  1^/10
  behavioral18behavioral19

• • Target

    vk_swiftshader.dll

  • Size

    4.9MB

  • MD5

    6bbe7ed03b69b768ae56fe567527c895

  • SHA1

    eef1850ef23c7183578e7c0fa215010e01a86186

  • SHA256

    22075f53a28c922b0db3191117004b1c6e8a3c249861650bbf572661bbb9392f

  • SHA512

    bb21900ef1e99a727981fcfe8b4c3d3b6b27b358fdcd0668b16dc0a630fbb49252eb909506bd0490ef91e0038a49eeb749966151b94edd60e5dcd015eb8359cd

  • SSDEEP

    49152:Umk3591xY8JVUEpcxScQljT5HAeoDftT9n3G6KvgCvjZrexIVXXKFI8TTZUW31xl:Nk35ssGyPqhn2axtAm/u

  Score

  1^/10
  behavioral20behavioral21

• • Target

    vulkan-1.dll

  • Size

    931KB

  • MD5

    678f12a18eacfaa12f58dbdc07837715

  • SHA1

    219730f5af17ccf252fb4f3e64ad00f650c693f5

  • SHA256

    af1634ce8221a19dbe09f2713875478cfb12f5bbe5d10763c3c905f608489e49

  • SHA512

    c125f2ca6a7375754512dfdf8e2cd71f8c686fec627cf3006d9093f0c0999004b60cfb3ae025fe2fad6be89346c6e7531b8dee6da9b74a86841fe68c05495036

  • SSDEEP

    24576:lYWOq/4Kt/Ku8n3W7ecbFb6Z5WoDYsHY6g3P0zAk7sH:lY65/M3W7R56Z5WoDYsHY6g3P0zAk7s

  Score

  1^/10
  behavioral22behavioral23

• • Target

    $PLUGINSDIR/nsis7z.dll

  • Size

    424KB

  • MD5

    80e44ce4895304c6a3a831310fbf8cd0

  • SHA1

    36bd49ae21c460be5753a904b4501f1abca53508

  • SHA256

    b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

  • SHA512

    c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

  • SSDEEP

    6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck

  Score

  3^/10
  behavioral24behavioral25