0ccf9d46633ad337dd31852311e9c4e7906c579af584a9eb77725360a6028ba5

Sharing

Copy URL

Twitter E-mail

General

Target

MyGov.exe
Size

68.8MB
Sample

240528-x74aysac38
MD5

57ae702f9ccbe017404f9aa1eeb5b93a
SHA1

6e0a9c83ce659571d62fe21053915d8c74dd7634
SHA256

0ccf9d46633ad337dd31852311e9c4e7906c579af584a9eb77725360a6028ba5
SHA512

befea9277259a64527f6c96fd907b9ebdff86f3387a2a7350c83c45ecdf227b8b594816209797eb1662224fcf1a7feb8b82edc6843a579580967236e1297caaf
SSDEEP

1572864:7xsVMr+U67ndLM8D0XTCCvx96XG7q9Q+GhNVQRHXs+OyMdUR:7xs0mnCneCv7q9XVRMdUR

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  MyGov.exe
- Size
  
  68.8MB
- MD5
  
  57ae702f9ccbe017404f9aa1eeb5b93a
- SHA1
  
  6e0a9c83ce659571d62fe21053915d8c74dd7634
- SHA256
  
  0ccf9d46633ad337dd31852311e9c4e7906c579af584a9eb77725360a6028ba5
- SHA512
  
  befea9277259a64527f6c96fd907b9ebdff86f3387a2a7350c83c45ecdf227b8b594816209797eb1662224fcf1a7feb8b82edc6843a579580967236e1297caaf
- SSDEEP
  
  1572864:7xsVMr+U67ndLM8D0XTCCvx96XG7q9Q+GhNVQRHXs+OyMdUR:7xs0mnCneCv7q9XVRMdUR
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/app-32.7z
- Size
  
  68.0MB
- MD5
  
  6ed3089f8654d2eefeac398419a12880
- SHA1
  
  578d75426eafd9be00a6b3532898617c1b4b98a7
- SHA256
  
  abbb62ea121a139683a1cb735b4022492dff40eeac22e0f2183d3c329c6809f0
- SHA512
  
  b19c314c6de57f1817b20048bdc749ed6f129c725ad42f89b14841a4ea44ce84edae48f440cfd0a7b5674f32ea92740cde90f3960eaa8f3330d141d44b3f4e93
- SSDEEP
  
  1572864:rsVMr+U67ndLM8D0XTCCvx96XG7q9Q+GhNVQRHXs+OyMdUM:rs0mnCneCv7q9XVRMdUM
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  
  LICENSE.electron.txt
- Size
  
  1KB
- MD5
  
  4d42118d35941e0f664dddbd83f633c5
- SHA1
  
  2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA256
  
  5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- SHA512
  
  3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
Score

1^/10
behavioral13 behavioral14
- Target
  
  chrome_100_percent.pak
- Size
  
  163KB
- MD5
  
  4fc6564b727baa5fecf6bf3f6116cc64
- SHA1
  
  6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
- SHA256
  
  b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
- SHA512
  
  fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
- SSDEEP
  
  3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
Score

3^/10
behavioral15 behavioral16
- Target
  
  chrome_200_percent.pak
- Size
  
  222KB
- MD5
  
  47668ac5038e68a565e0a9243df3c9e5
- SHA1
  
  38408f73501162d96757a72c63e41e78541c8e8e
- SHA256
  
  fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
- SHA512
  
  5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
- SSDEEP
  
  6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
Score

3^/10
behavioral17 behavioral18
- Target
  
  icudtl.dat
- Size
  
  10.2MB
- MD5
  
  e0f1ad85c0933ecce2e003a2c59ae726
- SHA1
  
  a8539fc5a233558edfa264a34f7af6187c3f0d4f
- SHA256
  
  f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
- SHA512
  
  714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
- SSDEEP
  
  196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
Score

3^/10
behavioral19 behavioral20
- Target
  
  locales/af.pak
- Size
  
  464KB
- MD5
  
  862a2262d0e36414abbae1d9df0c7335
- SHA1
  
  605438a96645b9771a6550a649cddbb216a3a5b1
- SHA256
  
  57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a
- SHA512
  
  a789a4cad72106a5c64d27709b129c4ae6284076f147b7c3fcb808b557a3468b4efe3ede28033f981335d5eab986532c0497ddd6ed24b76189fe49366692ee73
- SSDEEP
  
  12288:KYHoLheVm/Wnzo+E+VOSMKlNu+d2ZH2Jynua2VIzfXo0vIFNgRU2Sw+2Ss37xzOZ:LoL0Vm/Wnzob+wSMag+d2ZH2Jynua2V5
Score

3^/10
behavioral21 behavioral22
- Target
  
  locales/am.pak
- Size
  
  756KB
- MD5
  
  4eaa15771058480f5c574730c6bf4090
- SHA1
  
  2b0322aae5a0927935062ea89bd8bd129fa77961
- SHA256
  
  b05dcb8136751aee5eced680a5bad935e386bfce657dd283d3ec00ee722fd740
- SHA512
  
  b67e7dd24eadc91d4cd920f8864cfb23a9c67b2cecd54ec97e01705636604ce504dc417d6af1c53f374b58eddf71a12bb82248bd8fd68307161d4833342681a9
- SSDEEP
  
  12288:sjsuGn8MVs2TZIuHzLzxBT2qE36jpECuzA+5P9LlVrClOwPQVx30jH8+F:HnG2TZVLzxwqEqjpECuzA+5P9LlVrClj
Score

3^/10
behavioral23 behavioral24
- Target
  
  locales/ar.pak
- Size
  
  829KB
- MD5
  
  f529e644ac3f062283d68e65241a54bb
- SHA1
  
  b36ff7369cf2c68fcc93dbfb4b36e6c90748323b
- SHA256
  
  7b6d035dcf6cf17ed7dbf055eaa6d1b2cf39c1d18743a540622602c3462bc919
- SHA512
  
  dc7f609b9061617fb425dd3000c54c5e52be8bf49df6c64df6384ef54232244418cbb78f3f9bb7764de95199cfa1c84908a6bbc65df1ece1de7e626dc99c6f4c
- SSDEEP
  
  12288:nDP/7q4BukM/T/RJUX4Yxwv4UPCNakEN5KNN1++QINIpT:DL6vrt58+h
Score

3^/10
behavioral25 behavioral26
- Target
  
  locales/bg.pak
- Size
  
  861KB
- MD5
  
  0e8005b17ac49f50fb60f116f822840d
- SHA1
  
  f2486da277de22e5741356f8e73e60b7a7492510
- SHA256
  
  50e4f6b9c387adf4baba3377c61d99326cc3987928d8d60b88d1ac29352820ea
- SHA512
  
  5df18bbeabd56e70d4c5a80dee5b7ce48259000665941634937e556e3b3a1c6403aa45c410f6f755607549c9dd35d722987b447c50efca51228ffeca4628756d
- SSDEEP
  
  24576:9MCo3qBsklYOdAs1axUYVbOAHi373Z5+3aAK5kVDV5uRumpod2JK5ITOuORx6QKq:9MCo3qBsklY/UYVbOAHi373Z83a1kVDj
Score

3^/10
behavioral27 behavioral28
- Target
  
  locales/bn.pak
- Size
  
  1.1MB
- MD5
  
  c8173f0cc63ca9e02c07abec94892b53
- SHA1
  
  2688b199cc40bb2082247fa451eac1304608e48b
- SHA256
  
  e6adcfb4f3b3bccd4a27edadc168b503c36551cd6b27fb24043efeb21f691ce5
- SHA512
  
  3d2317430722dc15c5d938fa55235af1caa03dcff7a574b44d37d89e7cf2c94dd2e84518b3eeca4a5a8dbec1b99d94aed97429aaf55c63998002d50ce9cb5019
- SSDEEP
  
  3072:HPvKTlIymMTAKhwg8KgMokBw20kzhY0/ukfe0/Q8hhar6j7dkjBbJrlD+B5rwDlo:HPvtMTAKhwlFpKAShhG6j7wBb85mlo
Score

3^/10
behavioral29 behavioral30
- Target
  
  locales/ca.pak
- Size
  
  524KB
- MD5
  
  9e3ea2baf7e6c6101fb6b5b92c797bdb
- SHA1
  
  c181dcd37141d955d85be56e3e08d37c17feaacc
- SHA256
  
  b4efc6026115b7fac9f6b9cd360dfdd570cb5a16faf38d549fcad2b80e5f1fd2
- SHA512
  
  90e9609764847285d82894b3c4d98496fb9002c0cecae092e71b7d43d8871bd1463898d82b6a65a530ba76ecf403a30a01485f2f16e376a773f6fdf8f302e402
- SSDEEP
  
  12288:PUKf2nke7kREeopxA3n5PqF4N3Mw2juwHzejm0t3lvq8+x92fR+IsjcmlLEYjCJw:PimY6RR6QZIMN7vsyL5jGjiu
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32