db822797d33cbbdfe20baf862e47f45af4a7dcf6db5d56b5b7005f84a4fc586b

Resubmissions

22/05/2024, 11:41

240522-ntfhasdd3x

22/05/2024, 11:33

240522-nnyrpada557

Sharing

Copy URL Twitter E-mail

General

Target
file_d7602aa3f59843bda8bea0748504461a_2024-05-22_11_28_14_088000.zip
Size 76.9MB
Sample240522-nnyrpada55
SHA256 db822797d33cbbdfe20baf862e47f45af4a7dcf6db5d56b5b7005f84a4fc586b
MD5 be30f66fe0cc39a6d0f8acc4615df86c
SHA1 4fae833216a59337a8595d9d76a70efdfddb1891
SHA512 601c4170defd28990ce2d2c37eae0d414550bd1d67bb8575cf088c49eb91df207c90d5cafaa5dc84362d94ce501d514ecf5b376ad7c86f1b381b2210b6cd249a
SSDEEP 1572864:G5sokJyWZmPc+31JKBJ1CXPoyTPeoWa411tzvRSqADZkLg1j7D5neB:FopsqecQyTSh1Dzk9ZkLgjeB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  entry001/NordPassSetup.exe
- Size 77.0MB
- SHA256 89ad59354417710af24c4b2daa14288c1519e9d2d6f12fdda29f9f8561dde80c
- MD5 14178b76af004e89e8011659d3cdf489
- SHA1 2e4376e3114af1f21c310c5d58361401f9516837
- SHA512 6ab013b0be070c20706645ab75d2d5634357e896dac3f1dfccaba10883666dc34ea2cae418f05aa14e250d610a6af348928b5f25fd986d721aeb512910730390
- SSDEEP 1572864:pSpsIWFvAncL0+fZM9lXU5j4YZFcwmyC1Bdpz/8Y2PPsJpXv503pKY:pRImGckkuYf+Z1zpQnPsJpBNY
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery execution upx persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 7.9MB
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  NordPass.exe
- Size 155.8MB
- SHA256 a06bf9596ffa0659434ed9fe1fe3d71b4b78760ddc6b36dc87fb200054d6dc86
- MD5 4259941d0b76b8b737ef16606d885b64
- SHA1 774a03ce3062bfebec124870c0f3c65f88ca55f9
- SHA512 43bdbfed24c59d50dd00a44422215fb56928176d4a7ee1f3594d98030d8362533842bf86c5b39b6f608faa1d1f60086f4162d5da446489e5ce5b92840425cb85
- SSDEEP 1572864:uVU4t/Ct6JMgabao+nh+bw4FlWMZBZHuoM2t52kOUeEbaVO7GJbdHDexdypGT+L5:YYUJkH0sEQm
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral13 behavioral14
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 fd9ea20379fa089a9b96f8520d259e09b659a188681b8edd41f2c7dd15c5396e
- MD5 ec34938f1f674169ca82898fbb05f9b4
- SHA1 34b0865f872a009d7dc7785b22e194228cdcffa7
- SHA512 0f2420c1732e27e398d3d23b46a337b2311ce30a080790acb61c6816b9567071f36564c905e014a5d9521f4f4bbef36466e9cf96cc7b0e1c0fdd3e1a87703376
- SSDEEP 49152:+CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRN4:tG2QCwmHPnog/pzHAo/A65
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 28b2620eb15eaacb199a3523b20d9cba394c35d420e58201db6a0a589cf29f92
- MD5 804780a083d8cfcbb0a009871e4e8092
- SHA1 2c95f6794d5a4ef4efe7604e8f22147297abce9d
- SHA512 fb75dbfc8a62d84a4daed29710f8219f7cbb045a175c545e4970d921c7043005b765505b7842ed773b1e89b92d11b1891d66ff1df1d129afffdb58855cbd9182
- SSDEEP 49152:wZ2KxYmwFfgQQs0ShPrF0/zO6R0gRhPj3hTUctrRhuwSnKxqgI5IN8N3lzl3hqz7:Eofp1Pyi54wnKxqg4INhhdn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16 behavioral17
- Target
  libEGL.dll
- Size 479KB
- SHA256 cc4338af1cdf7e0b0289ea689c0a897a04b8cda7e36dbf534d0651ea373edfe2
- MD5 d1a3b021c62863334fa7c928b9ad032a
- SHA1 7289e729f2f2aa13e7eacb48b9f8de2b48bae0d0
- SHA512 f201c0cd2fdedccc7bef57cc20ea8feca1b7f9b3a001365f06f986066bf2efc1ac1db6851642e5bf3e52b6ece5498c0be4947fb2b6e5dafd9f11354e9dbe4718
- SSDEEP 6144:n4itlpEJVqKqK5Z5UibKsBHI0Sfnx+lXGpeOQHA93GT3sm2NE:n4itlpAqKqK5Z5U+jBolfnjIyGcE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19
- Target
  libGLESv2.dll
- Size 7.1MB
- SHA256 3d840043287b1e58b3a656b43879a607b627556324a7065a9306b52d18da922a
- MD5 7c549596c80a0b03e87bef382bf5e5d0
- SHA1 3f5b7be18137892872a7b002fc5219f62c8d2cda
- SHA512 572f74420ee40207443b86d0e81041611873aad5b9371ce0f205f543eef5233731b39d09bd25ba0d8b5c1d45bb7883e049284086686184c661f43f1c0974c2f1
- SSDEEP 49152:p2b3imtb1uWsvZRUCXQNMBbGUa/XFfOpvQnDwX+xjA7LAIgRg37QiI+id3pFJs7O:p7RWft4NV+sduHox6gWE5lHaFXN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/dist/desktop/main/binding.node
- Size 182KB
- SHA256 c1ad5c32c78201a4cab8eb67d8096c23794f8a917b897b68c50e429c792fb61e
- MD5 376794ce37f88a279eec96f39fd6b0ff
- SHA1 33186a247d3da93630cf58329cc0b3a92ac8aa14
- SHA512 0bc99055fd888639b2d4b1e759af5beccef4cc5fc0efc95274bd3a2fa2982bc728652ea90c1873e7db678fc057f4b5aa7162095601387e4b9859c131635dbd6c
- SSDEEP 3072:3mgJiVVFt2HLdKUlphlGYOV4soikTn0NbS8Gcy:3ZiVVFFUbhlG7V4mkj0v7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/dist/desktop/main/keytar.node
- Size 691KB
- SHA256 90e35de89ab5e5f9290e4ff1bbadcf221a82b2aa0d9b922187dc980adff3c831
- MD5 c5c99144e2e1589628e14999ba59ad73
- SHA1 9c80f8de6b5cdaf38677d5368b5287bacb9e465a
- SHA512 0bcb99953397c6604d8e08bf2ba89248ee82f92436c2dcc779157b65227b0e1350927273a1b6d150a9db914d0a8830680df05ef651ee291b40657a3025a721c5
- SSDEEP 12288:cRInDhSzUpqDDa2XX05VNpk4th460iQlp1Qk5wUFPcvKKR0JQQ8jKOx8:cOnDHpqnaskrdx
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24 behavioral25
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26 behavioral27
- Target
  resources/nordpass-background-app.exe
- Size 5.0MB
- SHA256 eda8f1e0a676b3187d5e7eda5679ee582ed09def2fe97d7b44ddc95a0e351b5e
- MD5 f9dcfd7751c26ba697d18bc497cb9789
- SHA1 ee70736afa764b59aebf7124acaf9e5950409d8a
- SHA512 348bbb879957f6e2011d40d2af68cb9d27917813435e2715eaba40ba6c24df984aa9c43cba70628ad088bfeaf1c417e714300e4e5dceef86f1505de2d32b95ae
- SSDEEP 98304:5NIuu8+zMoNU/yzqCJ5ulnEjlSSt3Mqlf1mDnFNDqm:JuNAoNU/IqCOlnEjUDGExB
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28 behavioral29
- Target
  vk_swiftshader.dll
- Size 5.0MB
- SHA256 126f74e55e9548caa391afea8bd18025661b4e30b26485ef992aaa05163f238c
- MD5 d0942619482bb7f3281460624ea3f8d2
- SHA1 c923ca37bdf9a144a3b73981b202a64054c70767
- SHA512 4b3d035f194187ecf15893f32ed063194d2f95d76980447f786f66900827da009f6afe616f3c8a766bef0ce589b4decbdd57e3fe9fd7f151bb1cf0f0a26d9d90
- SSDEEP 49152:eb03fn3GIdr1DO1N8jvfWSrvOuyEE0+w7rz77gpxbhk0H4t38mvttDpSHUoeygsA:L3v3xDvRTGVgt38mvt1pSH0adUJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30 behavioral31
- Target
  vulkan-1.dll
- Size 920KB
- SHA256 fefbdfd53e1b6ee87641067ecdd155bb5ca3154fb15d254c918c0086030e11ed
- MD5 59b5dbb0dc584adc1bcaa9fe192ab486
- SHA1 5b83109231863bd72f0f774f8f329ab933efe102
- SHA512 160e867c24a1357dd3109d4daa01d85a5fc00e2644feb5803e61ed20bcef78bab0a521a786099302e26cf217022324fbe02d23b16385c65a5e6d231bd488ce78
- SSDEEP 24576:NoHDVVdrfQ09CPKuy0O0Q6Z5W0DYsHA6g3P0zAk7s+j:NuVdrI0GKuy066Z5W0DYsHA6g3P0zAk/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Checks installed software on the system

Checks computer location settings

UPX packed file

Adds Run key to start application

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32