af9a6111844f1a963eddbd1af5f3d16876e2013c815ffa06c71855ae69193d54

Sharing

Copy URL

Twitter E-mail

General

Target

af9a6111844f1a963eddbd1af5f3d16876e2013c815ffa06c71855ae69193d54.exe
Size

74.0MB
Sample

240428-cajj3aea2t
MD5

3662809f8fb64ca8dca963b02cd3aed1
SHA1

ee25c2805bcf380345cbd497a2a7e046cb4bc7e2
SHA256

af9a6111844f1a963eddbd1af5f3d16876e2013c815ffa06c71855ae69193d54
SHA512

b163d78c0b4b6ef1cb5ddc2c4a886d1736f326ec0162da22810448cdf0f316ff095541323b66ad012edadc9ac316ebbaa74dfb62b010713abbe4dbb439ef8061
SSDEEP

1572864:NTJ39Knf9MX8B8ceyIS7nqYdd6hIExeIg6q7rQMd:NGf9MM/vP7nMxeIg6qQu

Score

7^/10

Malware Config

Targets

- Target
  
  af9a6111844f1a963eddbd1af5f3d16876e2013c815ffa06c71855ae69193d54.exe
- Size
  
  74.0MB
- MD5
  
  3662809f8fb64ca8dca963b02cd3aed1
- SHA1
  
  ee25c2805bcf380345cbd497a2a7e046cb4bc7e2
- SHA256
  
  af9a6111844f1a963eddbd1af5f3d16876e2013c815ffa06c71855ae69193d54
- SHA512
  
  b163d78c0b4b6ef1cb5ddc2c4a886d1736f326ec0162da22810448cdf0f316ff095541323b66ad012edadc9ac316ebbaa74dfb62b010713abbe4dbb439ef8061
- SSDEEP
  
  1572864:NTJ39Knf9MX8B8ceyIS7nqYdd6hIExeIg6q7rQMd:NGf9MM/vP7nMxeIg6qQu
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  7.9MB
- MD5
  
  8303b3a19888f41062a614cd95b2e2d2
- SHA1
  
  a112ee5559c27b01e3114cf10050531cab3d98a6
- SHA256
  
  9c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
- SHA512
  
  281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179
- SSDEEP
  
  24576:dbTq6T06T5kJWSIRWnBIl70mfT76y6E65606F/HXpErpem:t4scj
Score

1^/10
behavioral11 behavioral12
- Target
  
  ReturnLegend.exe
- Size
  
  154.8MB
- MD5
  
  e4efc84d46d01b89fb589c64206d24a6
- SHA1
  
  d5d413cb8519ff05a78dc9bcc42e8607705300c1
- SHA256
  
  08c8960742364d510001f07a0d35a07dc57e97d78fbd96c5da0f52b893f2ea78
- SHA512
  
  cea038ebe6226b727484dcacdfb41cd4550cbc7e211f95bb36556690a06199c298cd14331a741912fa4dd8e7f41fd17832fda8c5536f2d76eaab2e57888dbbc5
- SSDEEP
  
  1572864:iTmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:Vv6E70+Mk
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  a007299c49fa50aeff594655859780ae
- SHA1
  
  d202f1f617023763a0e9418878e8ecac96be9fd4
- SHA256
  
  b78f0036621ad1d5833289f2ad509963ef78f1a89a3c7df0f1370fd2d35a2804
- SHA512
  
  444c4baa1e1d941bd04f78184cec519c6eb53a83fbc3aa3ea30522bffc9ecde73ebe7b910c1a37c345429298ada3c0ffcb3e3849e21b2009487b5cd1a02cb2a9
- SSDEEP
  
  49152:WdTodIrn9wbFV6Ps2cA7SJ/W1C1fLPzhkE7hjU7gUxGJwDw3lCQTQY/N3lzl3heH:C79fe/CmP6w3lXQYef/3
Score

1^/10
behavioral16 behavioral17
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  ca5bb0794b7700601e9438283d458665
- SHA1
  
  7fcf090b19820b9450937be800575c526448b581
- SHA256
  
  4a8be3b4d9fe790efdce38cff8f312a2f8276908d6703e0c6c37818e217cf1e3
- SHA512
  
  36ebab858fe7e014837548575389e7df2e86676888e4a9039c736d0f2e6463102e68989b794d949ddb16d9bcce43ce55737fcf2a4b09b1667bf968a9540e9f32
- SSDEEP
  
  6144:afuE2DT96QHENooSYBjLkt4sasMHemPwlrX+nZiML7hn:afuE2DbkGoS2jLku/wWUiNn
Score

1^/10
behavioral18 behavioral19
- Target
  
  libGLESv2.dll
- Size
  
  7.3MB
- MD5
  
  05b585464f18fe0e3bddb20527697d66
- SHA1
  
  8bcec2f0b409afa9ff054e25f3ce85eb9bd50010
- SHA256
  
  0bb7c6c08b569c1d2de90a40e6c142591e160a7c6cb15d21807f3404a48c4287
- SHA512
  
  f680ab9c3070f443c7359bb3f0c2032f5c58c88c7823e4592e8212ce8815ea5f463c86df113f5320944c62d3cb4e8d45b9b4dcaadccc1ac9bf203ae4bb52083c
- SSDEEP
  
  98304:WJTPQhRQ4t2fzqJ3IZ155Rl5F/tpcAgsOMN:Wm2foIzRJosr
Score

1^/10
behavioral20 behavioral21
- Target
  
  locales/af.pak
- Size
  
  368KB
- MD5
  
  7e51349edc7e6aed122bfa00970fab80
- SHA1
  
  eb6df68501ecce2090e1af5837b5f15ac3a775eb
- SHA256
  
  f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
- SHA512
  
  69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d
- SSDEEP
  
  6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
Score

1^/10
behavioral22 behavioral23
- Target
  
  locales/uk.pak
- Size
  
  688KB
- MD5
  
  e4c4e3700469704b936460ca1a90fcc0
- SHA1
  
  e809990fc07a1d39fe623046382699e648e343c0
- SHA256
  
  29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
- SHA512
  
  68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6
- SSDEEP
  
  12288:FkzOqMnty/KiZswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:muGN35EEK
Score

1^/10
behavioral24 behavioral25
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral26 behavioral27
- Target
  
  vk_swiftshader.dll
- Size
  
  5.1MB
- MD5
  
  750cbdfb01943e28e08708183ec208b5
- SHA1
  
  1bee0cd3d0970834b2a47daf384354f243fd1ee0
- SHA256
  
  a6d295dcc3afcb55aa79eac5f896bceb15ccb2b798db3bb076ceeea78073791a
- SHA512
  
  dbfdf76f40558ce2f23ca315b8719e283f0f22f46e733f37c2ae237fdafd23cf7962f36547ba1bb2d5b219de11546c3dc06859fac498a7da97df41018c0d80c4
- SSDEEP
  
  98304:5aTPSALpajr/PMMPTZTOWvYQ7klZz8Wd4iRk:Elajr/PMMPTZTOWvCJ4Z
Score

1^/10
behavioral28 behavioral29
- Target
  
  vulkan-1.dll
- Size
  
  906KB
- MD5
  
  6c70aab071c4febc5921e0d39811937a
- SHA1
  
  20d87b3a5333ea3f6d0d7b0333f2c30a281937aa
- SHA256
  
  2233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825
- SHA512
  
  7f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf
- SSDEEP
  
  24576:yGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7a:GwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu
Score

1^/10
behavioral30 behavioral31
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec0504e6b8a11d5aad43b296beeb84b2
- SHA1
  
  91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA256
  
  5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- SHA512
  
  3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP
  
  96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

An obfuscated cmd.exe command-line is typically used to evade detection.

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32