b018a82f87820638783ed4b5201a70d34e09758fb092dd791641931d55d023e6

Sharing

Copy URL

Twitter E-mail

General

Target

StarVPN-FR1-x64-latest.exe
Size

67.4MB
Sample

240523-f1lnwsfa5t
MD5

e32e41f43336f6482a7169f757835e18
SHA1

d531987df3dc3aa38ebe1aeebd622e3ba879e190
SHA256

b018a82f87820638783ed4b5201a70d34e09758fb092dd791641931d55d023e6
SHA512

a05da0392cb742382c2bba7ee3635efbb3754a60b9dcc3381b892834bdf637237c7ce542e6ef5470e2c6b1481741a0a54b7f2331725777347f392ca4bf60e8a8
SSDEEP

1572864:x2513yfYHlkNeGEZ8sQcTe/FEd67As/ph6/WaOjZhAD88qy:xW1QYHqMDQcTeOd60shqfOlWKy

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  StarVPN-FR1-x64-latest.exe
- Size
  
  67.4MB
- MD5
  
  e32e41f43336f6482a7169f757835e18
- SHA1
  
  d531987df3dc3aa38ebe1aeebd622e3ba879e190
- SHA256
  
  b018a82f87820638783ed4b5201a70d34e09758fb092dd791641931d55d023e6
- SHA512
  
  a05da0392cb742382c2bba7ee3635efbb3754a60b9dcc3381b892834bdf637237c7ce542e6ef5470e2c6b1481741a0a54b7f2331725777347f392ca4bf60e8a8
- SSDEEP
  
  1572864:x2513yfYHlkNeGEZ8sQcTe/FEd67As/ph6/WaOjZhAD88qy:xW1QYHqMDQcTeOd60shqfOlWKy
Score

8^/10

discovery
- Drops file in Drivers directory
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral3
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  14KB
- MD5
  
  adb29e6b186daa765dc750128649b63d
- SHA1
  
  160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA256
  
  2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- SHA512
  
  b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP
  
  192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
Score

3^/10
behavioral4
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral5
- Target
  
  LICENSES.chromium.html
- Size
  
  6.5MB
- MD5
  
  796505037e030807d9ddd01c93eb353b
- SHA1
  
  79a1eac3b505e6d94a6206d4a5198d3cc11ab038
- SHA256
  
  9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
- SHA512
  
  9435273a4541a579a427a295be47af8b81133896f50c97bab1d8ab391089f90186a7fd057b53e8b74829e4747e98428d8b4d242eb6854b1304a94a2891c2fd11
- SSDEEP
  
  24576:8Pjy5WjWSpgDrAV8gmfwN6i6w6C6g6T+gH3BMbp0W:oJDN
Score

1^/10
behavioral6
- Target
  
  StarVPN.exe
- Size
  
  150.4MB
- MD5
  
  3c63b18fc7ddc2626dc61118093f0f63
- SHA1
  
  d24f921aae3c600cc5696bc142115f526bf648a0
- SHA256
  
  93b638342b85eeb2547eed26fe98b1e418e6d97aff539c71d3006c66b7e59787
- SHA512
  
  d9dbbe71503682487a35e0a413c03ad75fdd4a9c578f38af55bc4f42ec8c753c5494f836a7f66d887b40f3dcce71d9272171ddc6de0df28fdcffe65156e2549f
- SSDEEP
  
  1572864:XlAhthKM29V6LLWANUB9IinJn1cpGN4vM+JlhrZnQ9I4FdUrczKrk4Ze2OC2+S:MtSD64Jnqrt5v2b
Score

5^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  cb9807f6cf55ad799e920b7e0f97df99
- SHA1
  
  bb76012ded5acd103adad49436612d073d159b29
- SHA256
  
  5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- SHA512
  
  f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP
  
  49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
Score

1^/10
behavioral8
- Target
  
  ffmpeg.dll
- Size
  
  2.6MB
- MD5
  
  00ffabbb9438a0da15a021451a9c2d0d
- SHA1
  
  4bb79fe2b09962c6c46b70d7dfb1f9d9604a22dc
- SHA256
  
  aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559
- SHA512
  
  989d8d0afd3ce64c65a90d1046f28b19e5b125f8b5a565b76b8c950d152d3b9a57d68126888321c7cd8a4985249c1ec649c453e7501aaa4ff60d9662afd85f34
- SSDEEP
  
  49152:cqMAAYNDEmcTfAZMHkwfPYX6Edxhi1uGaVrFY7Q9b5hpN3lzl3hHLNoJX:cGDfRMHR8rFYU5hNA
Score

1^/10
behavioral9
- Target
  
  libEGL.dll
- Size
  
  473KB
- MD5
  
  ef4291ace01485ee773183ee3c1ed5c4
- SHA1
  
  9c9d32813a733ebceb25c0dbb9f85ef27f6e0a0f
- SHA256
  
  85f238fb7ace3cbdf7c29c72b01307c440f13491b07a509cbc5b9f257a637164
- SHA512
  
  a98bfe1845a712943687f0b20d1904bae1b6836ea37f8a2053872f938dceb2f391fadd3db034c0b8563c0b1ab3d4506d13b613ed51780ef10e813c085c830f82
- SSDEEP
  
  6144:VTv0fq4dz9B4x4w/jvtGW9ZST3BypG48yOnb4pgsHVlAYnReZRO8:VTN4dNw/jvtGW9c3BypaagYnKRO
Score

1^/10
behavioral10
- Target
  
  libGLESv2.dll
- Size
  
  7.2MB
- MD5
  
  60e42e83b260582fc96aaf43293d99e1
- SHA1
  
  c548a10873f9a57e18c7fbb1fe89685f4cf1ba84
- SHA256
  
  25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
- SHA512
  
  6a905e2b9427fb6e4a53080afdc2ae9dc32c54aab5460f88f7d3fd16e7e9a841d332057f58942d54defe91361a54d3cbedba295399cead754f353f80f92f238b
- SSDEEP
  
  49152:Rs95E5fqF3q/xEpLJgw7yQj1+lSWsucneTA4fwEmN428bbvbgNqay6q/iyGtxJe5:2lq3ZieHhogDbBztUecv7r7frgsOMG
Score

1^/10
behavioral11
- Target
  
  resources/StarVPNService.cmd
- Size
  
  132B
- MD5
  
  5fb66ddc54d5d390c97c98894feadcd8
- SHA1
  
  df95a98549a07b49a652c60b7d0f49555614d03a
- SHA256
  
  7e4e9fbd7e7cff709225d8af4abe2cb95de3e56876307c4a14008c6dedd5b103
- SHA512
  
  1d797e880dfa8d50de9082758068d9cab127fdd6d4e4010289e5342dcd37c273f2e7d82001301c7007f346644b70674f6ff69d49b6ad22c9de30419f34cabda9
Score

7^/10
- Loads dropped DLL
behavioral12
- Target
  
  resources/app.asar
- Size
  
  2.5MB
- MD5
  
  babaa1b5f25831ad2930e1994ae62125
- SHA1
  
  d4c6a5829a67ec5cf6326e26dc53f69a4264deae
- SHA256
  
  2c65fabc4a51709e868a4d095abac71a76f61c268cf5c245ef09a668149d6f0f
- SHA512
  
  c0bc58c5bed05ad55e8b6d87ad39a4dedd20e62801657421d5ccc7d82b27ca0e9c4ffec0b3970dfdb426c07d4354b2cecee41a3d763afbab1c4e1b7b4c21f3ef
- SSDEEP
  
  49152:FKxySajUXBElC3AwPhyHb4T3OUuLbIU8z313cYYMhp8+5fLDrPV1eCjr/9r+ON6Z:tHb4T3OUuLbIU8z313cYYMhp8+5fLDrM
Score

3^/10

execution
behavioral13
- Target
  
  resources/elevate.exe
- Size
  
  127KB
- MD5
  
  45eaa6389c23d4c73294a6133396b1f3
- SHA1
  
  463fd2771e8a0a4390aa5419fff5dc1078c35c3c
- SHA256
  
  aa6418d97356dca8fcc0dc843f7e62fb22b98a11b6fffaeb76a0b8282910615b
- SHA512
  
  108f8eed7d69493e947f7d9e38e9c7c65033218690797091ee514980e1163976fe0d936c01359df22ddd707d78ce3638b2c7962b7c081b57e8b44fe353087edd
- SSDEEP
  
  3072:I9bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl1cD:4PrwRhte1XsE1l1cD
Score

1^/10
behavioral14
- Target
  
  resources/openvpn/x64/libcrypto-3-x64.dll
- Size
  
  4.3MB
- MD5
  
  22a17af7f3965cc53a53ea8c52a8341e
- SHA1
  
  b3f21d247be28bc8d4861995a234fd1f212dc6c9
- SHA256
  
  58064e37b75827f6c09e8bc394054fcf7cf503dd14188936209bc35601eeb26d
- SHA512
  
  86171f4ed8f7d3a1c3620afbe3b1c08beba5ae624b298cf2d96e54262130da09c08cfe839e23819ff0b702c51ec44a9b429c7ceeee18bed79d47adabe35b59f5
- SSDEEP
  
  98304:Nx+TCGM+r8q4wCWxbOvc7kPWP1CPwDvt3uF+DCUL2:DECGM+rFCWxbOvc7k+P1CPwDvt3uF+Dg
Score

1^/10
behavioral15
- Target
  
  resources/openvpn/x64/libpkcs11-helper-1.dll
- Size
  
  111KB
- MD5
  
  8c1ca4cee2b894f912e521bb03eb26a6
- SHA1
  
  7b9b3d08c3ea5c00a534deed4f9f62a72a557d90
- SHA256
  
  227dd30f1f822ef3a4811a8d4996b511a625eb4047ed0c6f42232adc182e5f2e
- SHA512
  
  a2038e036a37c58637c0b9415307501736ecc60021af4f1e297e72457e3e4b8c6c260e15ba9b4ef909ac7da78b89e575b64573325f726dc2dff7c66c3212bbd2
- SSDEEP
  
  3072:fpWHiqxUG9g14as4Rsqvy6JfPrZQGEYB0Oj48/oM:RWHOGi14a973rZQGEYBoM
Score

1^/10
behavioral16
- Target
  
  resources/openvpn/x64/libssl-3-x64.dll
- Size
  
  545KB
- MD5
  
  d021de4eac5284a1a2658fd43fdd4341
- SHA1
  
  f770717b2b27a80f998b16e6135c485cf472cf2e
- SHA256
  
  569484dd6b982e56710e71dbcc477a2b5b087d187ab944d1697f99f0c86a0355
- SHA512
  
  319c9a37f657ae7831cbe759108041c3a9c2db74a7afaf0b8cae503c5714e766e08d563542881ec9676d62ecdeabba63c6255600ecac87440fc17feeb2463eed
- SSDEEP
  
  6144:8ZT6EG2K4D9EImRbgtuqt2wI54heVGUiiqaZKRvBVEMh801sQi7POTNoW:kWvQEIqEuqM47woDEP01sQiiZL
Score

1^/10
behavioral17
- Target
  
  resources/openvpn/x64/openvpn.exe
- Size
  
  1020KB
- MD5
  
  740c3f83d6076a6f114def998f29c66c
- SHA1
  
  f4329649ccef980805a2a137b662b734ac13f659
- SHA256
  
  779922e30608e92d8471cb96b42edc2d86f6d8d94e438675be61bbe4107bef9f
- SHA512
  
  285b7711a9e9efbbcdb70f9238e4ec5eb7fcba3fa9517acf44c9b824057d921287013e7cff11dd7173990cbf1eec8399b7885603311f46780e836580ceda3f27
- SSDEEP
  
  24576:lkEPPhpfYUIhMuVqZfP6il4dJJKCn2LUVebuOAeirE5:lk4P/fYhNqZn6e47kYf8
Score

1^/10
behavioral18
- Target
  
  resources/openvpn/x64/tctl.exe
- Size
  
  53KB
- MD5
  
  e8063708daffd3e1a2c1ca1041f5b0fb
- SHA1
  
  c2d001cf20776f2374e7998d93c6d48ca225a0cb
- SHA256
  
  1b48b37ea89744bce667bf078872b08e760f83f09eaec057a38cecca20ae7d80
- SHA512
  
  49a3e364c57192ee483ad6d4a021b2d531eb71fa70dc428c0aab15b6b1319a0d0f28c2697c18a32d5394baac9bd6cffb8131ea438f0a4c7da2fe11f627cf7edb
- SSDEEP
  
  768:yKkpxZjODIay0ru7E9hv8a+F1X331MENAMxYt16tLUwAMxkEv:yZjgCE9hv8a+F1Xn1pxs1CLlxj
Score

1^/10
behavioral19
- Target
  
  resources/openvpn/x64/vcruntime140.dll
- Size
  
  94KB
- MD5
  
  5797d2a762227f35cdd581ec648693a8
- SHA1
  
  e587b804db5e95833cbd2229af54c755ee0393b9
- SHA256
  
  c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7
- SHA512
  
  5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e
- SSDEEP
  
  1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j
Score

1^/10
behavioral20
- Target
  
  resources/shadowsocks/x64/sslocal.exe
- Size
  
  6.1MB
- MD5
  
  aa91dae58c533706ad15d3ab62ab5383
- SHA1
  
  19bdd6b58bfef88ba55dbe12914a9ce21053b55e
- SHA256
  
  e4343e4d2d48cd9ab421656f1a44dda2b24ce10704fcb972242cfb0b8d66d1cd
- SHA512
  
  e4f00f56e1406254c41d8886dc4254e1e58e9f209c5fdee617f7cec36535e078635d96b31b4954ea09bc0b4a219018d6026da471e177820e577f086c54fe8b8b
- SSDEEP
  
  49152:TDBTkhs1MBLup95XWHEXLy4iTJLXY38sHpUkO6/vx9lGa4ax1H/aJ+Ey6X3C075d:BwcKWlJGJBqJBAajy3lz7/
Score

1^/10
behavioral21
- Target
  
  resources/wireguard/fastlist.exe
- Size
  
  232KB
- MD5
  
  0311460f9c96343dc53a6db26ed8f468
- SHA1
  
  d76509b4ff0659ff74bb3a4454cdd8ee382af6b9
- SHA256
  
  4811a2181c9820ebf130a100bb50f57d580a0baae4c6b1044ea0d52efb9e91ec
- SHA512
  
  71397d3042009a5d0f21a07303e77a01eb0edc633ede0303e04b86134016af732395f89dfc76521cb55d854f8ac388bb2352d43009b54de612ea28f1a01894f8
- SSDEEP
  
  6144:GuP738wut5T2/efnO310+Hfd+ueCuMvMLAOgp+HQfE:GuPL8wut5T2/eCHF+ueCQeQHQfE
Score

1^/10
behavioral22
- Target
  
  resources/wireguard/x64/wg.exe
- Size
  
  154KB
- MD5
  
  82d490393a18a87b4043e4774ca7a6b8
- SHA1
  
  64958e6f5ed80b7073e67c0003bb8c6818850708
- SHA256
  
  f6cc7ebfbcf05ef6db54ba793eb4b3bccd874f7d3d465e616c5155ed6c522b50
- SHA512
  
  0f3788e02c623c19d0a1b879d3a449c3cdd9f75556b540c952e1ebb5af72efdfe6ddafcd2656f7119b6b4cfb59b066f4c823e627d86c8f9e639806f0bd7f0ca1
- SSDEEP
  
  3072:484stuWEP3ZeKCcmmLETHuUoy4ZouLWMB:n4stvLKCcmmLETHuKgTB
Score

1^/10
behavioral23
- Target
  
  resources/wireguard/x64/wireguard.exe
- Size
  
  7.8MB
- MD5
  
  681221b2a7490b91a1ddf03b3cf62177
- SHA1
  
  1bcb3e19de477a6a9c9b7660cb1c16665f82fcb4
- SHA256
  
  4ed70e64a72e7c81a50dce103d227f526013d1ac30a3a991f0bcd86aa4a114f7
- SHA512
  
  67053d20a482e6e4237a0c4c5bfd17cc25c18cd89626a621c048f6e9a890507d8cea2083b9769d55268d466f1b3199276ff272969fdf676b1ef6a25ec471516e
- SSDEEP
  
  98304:ED3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78J:ELzUwsFYc9OG7ZE78J
Score

5^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral24
- Target
  
  resources/wireguard/x64/wntn.msi
- Size
  
  308KB
- MD5
  
  4f9855957a9e04023166e3619d233e26
- SHA1
  
  45478661f419b425a06380c3e89f101247fc53bb
- SHA256
  
  fb73b8c3034f2cf44b2a82f2820f1b6975b4e8bb63aa8b5e476063b6797174c8
- SHA512
  
  817ecf32b82b2dcb5d78082e9f02e191c7d09a1c799391906aa83ad80f016f55e8ae7a5248eb5c8a3e776e4cc9b519ca0b13f03775e77893eb520080da7db76e
- SSDEEP
  
  3072:q7N6bBrGsu4ldGrlmxElEmNoPl4+eDhIVJkRZ5Br/NbvcjKX5mMgQSeRocPvuocM:q7N6UWldGrlmxEDNMea+H5R/B/1lp4x
Score

6^/10
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral25
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  afb174ccd1abb292da14779a079d4282
- SHA1
  
  ddd74e61c48c4445f1b3fa886b7c28b0de3f1859
- SHA256
  
  a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69
- SHA512
  
  fddd4d70dc6b8d424adfa509ad145845d13d898eaedb1706de357cf1dcd4eb25fe581c9dc58c1de0954b1a10b232934d219563a1e2e8ed1bc01412bfc789cbfc
- SSDEEP
  
  49152:/GrnxGr9pGmj8pGtA/bVVku6KZlxsMOtVKOkc4FjHjAW3vZ1B93k1RE7SrLop8cJ:YnxY9NURayzxX61u0Lflb0wrD
Score

1^/10
behavioral26
- Target
  
  vulkan-1.dll
- Size
  
  894KB
- MD5
  
  7ba000aece0d376e6f77e4c2f48f69c8
- SHA1
  
  24b103a2d9d5d742783ad3ecbfeb2cc57bd711c6
- SHA256
  
  1f8b647f161f20d45d554e349b3e5ef0b7b5da8c7bdbc1ff631d37dc9c819503
- SHA512
  
  d051ed9d1b9c28cd38da020cebe8b58da53c520f8686dc08fb9e626a9751c23fc43b97b2c309314e3f9a94f1eea448b77657c955c7b22aaadc6c0753b85f744c
- SSDEEP
  
  12288:3P1VNNJPqXu9D8xeLoCzG4JsZGS5ld/YlmQAuYvyRnsBsoj89C29h:3PXJPq+9QeLpDpmQ/YJBseS9h
Score

1^/10
behavioral27
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1
  
  eb607467009074278e4bd50c7eab400e95ae48f7
- SHA256
  
  1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- SHA512
  
  7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP
  
  192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
Score

3^/10
behavioral28
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec0504e6b8a11d5aad43b296beeb84b2
- SHA1
  
  91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA256
  
  5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- SHA512
  
  3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP
  
  96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score

3^/10
behavioral29
- Target
  
  $PLUGINSDIR/nsProcess.dll
- Size
  
  4KB
- MD5
  
  f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1
  
  b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA256
  
  30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- SHA512
  
  f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP
  
  48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
Score

3^/10
behavioral30
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral31
- Target
  
  $R0/Uninstall StarVPN.exe
- Size
  
  284KB
- MD5
  
  5e3cc53b23ee9c1b4a7f40224f1ed122
- SHA1
  
  6c9945c4070bc508e1e719cd70e281058914627f
- SHA256
  
  ae789996d958491bad0cad65ebb7bb16d30646d8ef33f07be71fda21984fdfa3
- SHA512
  
  fe83e0d3846d3f672eff114cf770510e0df1626cca541676dce1988214575131fea600aace334bfd87a889c3a37308c63f37ea764a2849653209c6d3c3d75e73
- SSDEEP
  
  6144:L740I8V11ejUrsL2Ua1j2t0EyL+2iafZK:3X1ejlyHRK2ZfZK
Score

4^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Enumerates connected drives

Checks computer location settings

Drops file in System32 directory

Checks computer location settings

Loads dropped DLL

Checks computer location settings

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32