679247e5cbface3d26a0c38a9c37cf032e01a2fe3a9cab865cdf8087e846b4ca

Sharing

Copy URL Twitter E-mail

General

Target

JavaSetup8u401.exe
Size

65.9MB
Sample

240526-mepxraeh8x
MD5

a2e7f42e604cdd2cb800968f99ac1d05
SHA1

35e230ad73640d1534793e5e7f8a31b96bb50232
SHA256

679247e5cbface3d26a0c38a9c37cf032e01a2fe3a9cab865cdf8087e846b4ca
SHA512

939216e53faed1043927263d2b1669bc696d739cbc41bd317cca2332379c825156210918d78e1ae40872a2dab52661a9e5e6b935dd9844611442d0754683608a
SSDEEP

1572864:jrziNx5qQ5g/KnZdMXXNyNYb5hR5wIeWZQj1/M7:2x5qQQngNGhwhko1/M7

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  JavaSetup8u401.exe
- Size
  
  65.9MB
- MD5
  
  a2e7f42e604cdd2cb800968f99ac1d05
- SHA1
  
  35e230ad73640d1534793e5e7f8a31b96bb50232
- SHA256
  
  679247e5cbface3d26a0c38a9c37cf032e01a2fe3a9cab865cdf8087e846b4ca
- SHA512
  
  939216e53faed1043927263d2b1669bc696d739cbc41bd317cca2332379c825156210918d78e1ae40872a2dab52661a9e5e6b935dd9844611442d0754683608a
- SSDEEP
  
  1572864:jrziNx5qQ5g/KnZdMXXNyNYb5hR5wIeWZQj1/M7:2x5qQQngNGhwhko1/M7
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral1
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral3
- Target
  
  $PLUGINSDIR/app-64.7z
- Size
  
  65.5MB
- MD5
  
  6267bd27bdf4253a6ddf9c94f55336aa
- SHA1
  
  545336896df748f1e88482322b8ccec6df0d8554
- SHA256
  
  d1354e63a1960ba620dde3519b2386e17fc53581d8d62e4db6b0b328d70e5abb
- SHA512
  
  29f3ae453f186a2404e32cf5cc101a64505a579d0c4f3c09a8a7ad52ec936101a650dbb9d048c5135efc168cfa5a34ea02c10cba1222faf66ac7093919dcdb42
- SSDEEP
  
  1572864:srziNx5qQ5g/KnZdMXXNyNYb5hR5wIeWZQj1/S:nx5qQQngNGhwhko1/S
Score

3^/10
behavioral4
- Target
  
  Java.exe
- Size
  
  154.6MB
- MD5
  
  2beb641212c03b08daf544eafed73e76
- SHA1
  
  a1edac12ad1e3768e6ce75d95094140273f81c53
- SHA256
  
  3c953071843486b88e3da4dd7a3e7c0a4cb162f31d6c6482fb91f9249d37d5e0
- SHA512
  
  9a5787b730aa240eaf18e4589f11aa5b6e8c72b88a7669aedfecf69ab091ed0d83a51b38975ff685deeb0fbde8166735edcdff4dd33804d62eb5fd0f4e563464
- SSDEEP
  
  1572864:8CquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:WDAgZi
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral5
- Target
  
  LICENSES.chromium.html
- Size
  
  6.5MB
- MD5
  
  180f8acc70405077badc751453d13625
- SHA1
  
  35dc54acad60a98aeec47c7ade3e6a8c81f06883
- SHA256
  
  0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c
- SHA512
  
  40d3358b35eb0445127c70deb0cb87ec1313eca285307cda168605a4fd3d558b4be9eb24a59568eca9ee1f761e578c39b2def63ad48e40d31958db82f128e0ec
- SSDEEP
  
  24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
Score

4^/10
behavioral6
- Target
  
  chrome_100_percent.pak
- Size
  
  126KB
- MD5
  
  8626e1d68e87f86c5b4dabdf66591913
- SHA1
  
  4cd7b0ac0d3f72587708064a7b0a3beca3f7b81c
- SHA256
  
  2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59
- SHA512
  
  03bcd8562482009060f249d6a0dd7382fc94d669a2094dec08e8d119be51bef2c3b7b484bb5b7f805ae98e372dab9383a2c11a63ab0f5644146556b1bb9a4c99
- SSDEEP
  
  3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
Score

3^/10
behavioral7
- Target
  
  chrome_200_percent.pak
- Size
  
  175KB
- MD5
  
  48515d600258d60019c6b9c6421f79f6
- SHA1
  
  0ef0b44641d38327a360aa6954b3b6e5aab2af16
- SHA256
  
  07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce
- SHA512
  
  b7266bc8abc55bd389f594dac0c0641ecf07703f35d769b87e731b5fdf4353316d44f3782a4329b3f0e260dead6b114426ddb1b0fb8cd4a51e0b90635f1191d9
- SSDEEP
  
  3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
Score

3^/10
behavioral8
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  cb9807f6cf55ad799e920b7e0f97df99
- SHA1
  
  bb76012ded5acd103adad49436612d073d159b29
- SHA256
  
  5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- SHA512
  
  f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP
  
  49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
Score

1^/10
behavioral9
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  d49e7a8f096ad4722bd0f6963e0efc08
- SHA1
  
  6835f12391023c0c7e3c8cc37b0496e3a93a5985
- SHA256
  
  f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014
- SHA512
  
  ca50c28d6aac75f749ed62eec8acbb53317f6bdcef8794759af3fad861446de5b7fa31622ce67a347949abb1098eccb32689b4f1c54458a125bc46574ad51575
- SSDEEP
  
  49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
Score

1^/10
behavioral10
- Target
  
  icudtl.dat
- Size
  
  10.1MB
- MD5
  
  adfd2a259608207f256aeadb48635645
- SHA1
  
  300bb0ae3d6b6514fb144788643d260b602ac6a4
- SHA256
  
  7c8c7b05d70145120b45ccb64bf75bee3c63ff213e3e64d092d500a96afb8050
- SHA512
  
  8397e74c7a85b0a2987cae9f2c66ce446923aa4140686d91a1e92b701e16b73a6ce459540e718858607ecb12659bedac0aa95c2713c811a2bc2d402691ff29dc
- SSDEEP
  
  98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
Score

3^/10
behavioral11
- Target
  
  libEGL.dll
- Size
  
  468KB
- MD5
  
  09134e6b407083baaedf9a8c0bce68f2
- SHA1
  
  8847344cceeab35c1cdf8637af9bd59671b4e97d
- SHA256
  
  d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577
- SHA512
  
  6ff3adcb8be48d0b505a3c44e6550d30a8feaf4aa108982a7992ed1820c06f49e0ad48d9bd92685fb82783dfd643629bd1fe4073300b61346b63320cbdb051ba
- SSDEEP
  
  12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
Score

1^/10
behavioral12
- Target
  
  libGLESv2.dll
- Size
  
  7.2MB
- MD5
  
  a5f1921e6dcde9eaf42e2ccc82b3d353
- SHA1
  
  1f6f4df99ae475acec4a7d3910badb26c15919d1
- SHA256
  
  50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e
- SHA512
  
  0c24ae7d75404adf8682868d0ebf05f02bbf603f7ddd177cf2af5726802d0a5afcf539dc5d68e10dab3fcfba58903871c9c81054560cf08799af1cc88f33c702
- SSDEEP
  
  98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
Score

1^/10
behavioral13
- Target
  
  locales/sw.pak
- Size
  
  379KB
- MD5
  
  67a443a5c2eaad32625edb5f8deb7852
- SHA1
  
  a6137841e8e7736c5ede1d0dc0ce3a44dc41013f
- SHA256
  
  41dfb772ae4c6f9e879bf7b4fa776b2877a2f8740fa747031b3d6f57f34d81dd
- SHA512
  
  e0fdff1c3c834d8af8634f43c2f16ba5b883a8d88dfd322593a13830047568faf9f41d0bf73cd59e2e33c38fa58998d4702d2b0c21666717a86945d18b3f29e5
- SSDEEP
  
  6144:24pV6wBz58kN6vhq//3UZFBIzDWs8ADjLKrYNguA/h5aS0DwV+ChZYeeq0e1k4H5:24bVd5B/3U/BLs8kMKguA/h5N1hZY+0u
Score

3^/10
behavioral14
- Target
  
  locales/ta.pak
- Size
  
  964KB
- MD5
  
  18ec8ff3c0701a6a8c48f341d368bab5
- SHA1
  
  8bff8aee26b990cf739a29f83efdf883817e59d8
- SHA256
  
  052bcdb64a80e504bb6552b97881526795b64e0ab7ee5fc031f3edf87160dee9
- SHA512
  
  a0e997fc9d316277de3f4773388835c287ab1a35770c01e376fb7428ff87683a425f6a6a605d38dd7904ca39c50998cd85f855cb33ae6abad47ac85a1584fe4e
- SSDEEP
  
  3072:S3YCY5ynH4ASpuCkCxSiP84Gb/v5nB7zztROcA2P:SnVUdQO84Gb/v55zztROcA2P
Score

3^/10
behavioral15
- Target
  
  locales/te.pak
- Size
  
  894KB
- MD5
  
  a17f16d7a038b0fa3a87d7b1b8095766
- SHA1
  
  b2f845e52b32c513e6565248f91901ab6874e117
- SHA256
  
  d39716633228a5872630522306f89af8585f8092779892087c3f1230d21a489e
- SHA512
  
  371fb44b20b8aba00c4d6f17701fa4303181ad628f60c7b4218e33be7026f118f619d66d679bffcb0213c48700fafd36b2e704499a362f715f63ea9a75d719e7
- SSDEEP
  
  12288:iy/yX8OsABW3p1F9SviTlwJAg5NFO1Tr/p54JAQvfEC28+58XoX0DTq9OyU+0Ak1:vu8OkDY5YMZb
Score

3^/10
behavioral16
- Target
  
  locales/th.pak
- Size
  
  753KB
- MD5
  
  a32ba63feeed9b91f6d6800b51e5aeae
- SHA1
  
  2fbf6783996e8315a4fb94b7d859564350ee5918
- SHA256
  
  e32e37ca0ab30f1816fe6df37e3168e1022f1d3737c94f5472ab6600d97a45f6
- SHA512
  
  adebde0f929820d8368096a9c30961ba7b33815b0f124ca56ca05767ba6d081adf964088cb2b9fcaa07f756b946fffa701f0b64b07d457c99fd2b498cbd1e8a5
- SSDEEP
  
  12288:5ZY31Mkgs3s5UvfZLRflsjj8FCG1LDoAGkEeuLAD57Kle9d8nyj9FR3o09XAyFHa:57yU5K54
Score

3^/10
behavioral17
- Target
  
  locales/tr.pak
- Size
  
  385KB
- MD5
  
  5ff2e5c95067a339e3d6b8985156ec1f
- SHA1
  
  7525b25c7b07f54b63b6459a0d8c8c720bd8a398
- SHA256
  
  14a131ba318274cf10de533a19776db288f08a294cf7e564b7769fd41c7f2582
- SHA512
  
  2414386df8d7ab75dcbd6ca2b9ae62ba8e953ddb8cd8661a9f984eb5e573637740c7a79050b2b303af3d5b1d4d1bb21dc658283638718fdd04fc6e5891949d1b
- SSDEEP
  
  6144:xxl+G2KPlJi+kKD80GlTgAI7WTge95j/0+Vi1havX9vwiBrVmI:rlt2IlrRn57m5j/1
Score

3^/10
behavioral18
- Target
  
  locales/uk.pak
- Size
  
  657KB
- MD5
  
  361a0e1f665b9082a457d36209b92a25
- SHA1
  
  3c89e1b70b51820bb6baa64365c64da6a9898e2f
- SHA256
  
  bd02966f6c6258b66eae7ff014710925e53fe26e8254d7db4e9147266025cc3a
- SHA512
  
  d4d25fc58053f8cce4c073846706dc1ecbc0dc19308ba35501e19676f3e7ed855d7b57ae22a5637f81cefc1aa032bf8770d0737df1924f3504813349387c08cf
- SSDEEP
  
  12288:Yoff7plonpyOKtPXiNcnZx75kB3IjE8EmLvLNiXEJq//GW:YoffaXMd59E7
Score

3^/10
behavioral19
- Target
  
  locales/ur.pak
- Size
  
  571KB
- MD5
  
  1ca4fa13bd0089d65da7cd2376feb4c6
- SHA1
  
  b1ba777e635d78d1e98e43e82d0f7a3dd7e97f9c
- SHA256
  
  3941364d0278e2c4d686faa4a135d16a457b4bc98c5a08e62aa12f3adc09aa7f
- SHA512
  
  d0d9eb1aa029bd4c34953ee5f4b60c09cf1d4f0b21c061db4ede1b5ec65d7a07fc2f780ade5ce51f2f781d272ac32257b95eedf471f7295ba70b5ba51db6c51d
- SSDEEP
  
  12288:UA3OsGF8Pz0WEJytlkA+7Z5QzUExbW7DQQYrhu6co/9NjjFpvJK:UAe3A85oWB
Score

3^/10
behavioral20
- Target
  
  locales/vi.pak
- Size
  
  455KB
- MD5
  
  db0eb3183007de5aae10f934fffacc59
- SHA1
  
  e9ea7aeffe2b3f5cf75ab78630da342c6f8b7fd9
- SHA256
  
  ddabb225b671b989789e9c2ccd1b5a8f22141a7d9364d4e6ee9b8648305e7897
- SHA512
  
  703efd12fcace8172c873006161712de1919572c58d98b11de7834c5628444229f5143d231c41da5b9cf729e32de58dee3603cb3d18c6cdd94aa9aa36fbf5de0
- SSDEEP
  
  12288:3CwEs5kAfnzs0ACmwSxXwzIJWl+58Qagi7+URTJziV53f:3qOFfnzs0AHwSGz5A5rri7+UtliV53f
Score

3^/10
behavioral21
- Target
  
  locales/zh-CN.pak
- Size
  
  332KB
- MD5
  
  82326e465e3015c64ca1db77dc6a56bc
- SHA1
  
  e8abe12a8dd2cc741b9637fa8f0e646043bbfe3d
- SHA256
  
  6655fd9dcdfaf2abf814ffb6c524d67495aed4d923a69924c65abeab30bc74fb
- SHA512
  
  4989789c0b2439666dda4c4f959dffc0ddcb77595b1f817c13a95ed97619c270151597160320b3f2327a7daffc8b521b68878f9e5e5fb3870eb0c43619060407
- SSDEEP
  
  6144:fmLpS8IeOL27M807pnCKjEWkE0G5xNlEPeVplD:fmLQmK2I1nCKjEjG5xNlEPe
Score

3^/10
behavioral22
- Target
  
  locales/zh-TW.pak
- Size
  
  330KB
- MD5
  
  2456bf42275f15e016689da166df9008
- SHA1
  
  70f7de47e585dfea3f5597b5bba1f436510decd7
- SHA256
  
  adf8df051b55507e5a79fa47ae88c7f38707d02dfac0cc4a3a7e8e17b58c6479
- SHA512
  
  7e622afa15c70785aaf7c19604d281efe0984f621d6599058c97c19d3c0379b2ee2e03b3a7ec597040a4eee250a782d7ec55c335274dd7db7c7ca97ddcfd378a
- SSDEEP
  
  6144:zQmZEIQee2hZuwv+2440f5lHz8wMCM/9ylTN:cvIpn+2440f5lHzgT/C
Score

3^/10
behavioral23
- Target
  
  resources.pak
- Size
  
  5.2MB
- MD5
  
  7971a016aed2fb453c87eb1b8e3f5eb2
- SHA1
  
  92b91e352be8209fadcf081134334dea147e23b8
- SHA256
  
  9cfd5d29cde3de2f042e5e1da629743a7c95c1211e1b0b001e4eebc0f0741e06
- SHA512
  
  42082ac0c033655f2edae876425a320d96cdaee6423b85449032c63fc0f7d30914aa3531e65428451c07912265b85f5fee2ed0bbdb362994d3a1fa7b14186013
- SSDEEP
  
  98304:/Zgm9tHEEIcjWbEvKfwa2sEJFz993CNh1QeHQF5qrwrw5z0uxRRrY2kuDYj9ds:RgAtkEx4EKfatyNhHwFkkrw5IcRRtkFs
Score

3^/10
behavioral24
- Target
  
  resources/app.asar
- Size
  
  11.8MB
- MD5
  
  55fb016099fb3559230b2f190f035a73
- SHA1
  
  d8477e921d17abbe1dd3f5cc872b27423bca59f1
- SHA256
  
  766a2563eed1854fc2910ea334d5adef0389c544ad9bf992d3f5695b59cdf560
- SHA512
  
  ead0464026987c90ef1aa6abe0d36af78a2041600b00e51d07fde2048f0e021d59557ea1615dd45f72470e23c6ab260285c20ceefd23e7fe060acb6450396fc5
- SSDEEP
  
  98304:KCmUB1hCTOi8sQrZwwpxTbG9tIagImnkiold7GfbJLljZF+3J0gWuXYRM84ab:KCmUBMB91gImMMxlY3Cg51K
Score

3^/10
behavioral25
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral26
- Target
  
  snapshot_blob.bin
- Size
  
  158KB
- MD5
  
  8fef5a96dbcc46887c3ff392cbdb1b48
- SHA1
  
  ed592d75222b7828b7b7aab97b83516f60772351
- SHA256
  
  4de0f720c416776423add7ada621da95d0d188d574f08e36e822ad10d85c3ece
- SHA512
  
  e52c7820c69863ecc1e3b552b7f20da2ad5492b52cac97502152ebff45e7a45b00e6925679fd7477cdc79c68b081d6572eeed7aed773416d42c9200accc7230e
- SSDEEP
  
  1536:uebVb91USSzM+uCPNgswpzHD41OzB965pUB8/DR9BgyLMRPoq/rX4JHj/kMKE0YC:uTgsED41OV965LXMj4zF2Xl9B
Score

3^/10
behavioral27
- Target
  
  v8_context_snapshot.bin
- Size
  
  465KB
- MD5
  
  a373d83d4c43ba957693ad57172a251b
- SHA1
  
  8e0fdb714df2f4cb058beb46c06aa78f77e5ff86
- SHA256
  
  43b58ca4057cf75063d3b4a8e67aa9780d9a81d3a21f13c64b498be8b3ba6e0c
- SHA512
  
  07fbd84dc3e0ec1536ccb54d5799d5ed61b962251ece0d48e18b20b0fc9dd92de06e93957f3efc7d9bed88db7794fe4f2bec1e9b081825e41c6ac3b4f41eab18
- SSDEEP
  
  3072:qqgtKzy7vqUSMd+5ZTR4ymbsLIniZiYIU+gTh3WOdvmttow2LyZDvooPmdZwmNgi:lgEzy2NTROsLftIU+gTQ4E2ro+dOmp
Score

3^/10
behavioral28
- Target
  
  vk_swiftshader.dll
- Size
  
  5.0MB
- MD5
  
  a0845e0774702da9550222ab1b4fded7
- SHA1
  
  65d5bd6c64090f0774fd0a4c9b215a868b48e19b
- SHA256
  
  6150a413ebe00f92f38737bdccf493d19921ef6329fcd48e53de9dbde4780810
- SHA512
  
  4be0cb1e3c942a1695bae7b45d21c5f70e407132ecc65efb5b085a50cdab3c33c26e90bd7c86198ec40fb2b18d026474b6c649776a3ca2ca5bff6f922de2319b
- SSDEEP
  
  49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4
Score

1^/10
behavioral29
- Target
  
  vk_swiftshader_icd.json
- Size
  
  106B
- MD5
  
  8642dd3a87e2de6e991fae08458e302b
- SHA1
  
  9c06735c31cec00600fd763a92f8112d085bd12a
- SHA256
  
  32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- SHA512
  
  f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
Score

3^/10
behavioral30
- Target
  
  vulkan-1.dll
- Size
  
  899KB
- MD5
  
  0e4e0f481b261ea59f196e5076025f77
- SHA1
  
  c73c1f33b5b42e9d67d819226db69e60d2262d7b
- SHA256
  
  f681844896c084d2140ac210a974d8db099138fe75edb4df80e233d4b287196a
- SHA512
  
  e6127d778ec73acbeb182d42e5cf36c8da76448fbdab49971de88ec4eb13ce63140a2a83fc3a1b116e41f87508ff546c0d7c042b8f4cdd9e07963801f3156ba2
- SSDEEP
  
  24576:PR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:PR1l1culw6Z5WUDYsH56g3P0zAk7
Score

1^/10
behavioral31
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

An obfuscated cmd.exe command-line is typically used to evade detection.

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32