55453f794fbc569bf4afdf593aa27ff863bf1e1c67c7ccb5eb7bf48f29ff0de4

Sharing

Copy URL Twitter E-mail

General

Target
HSBC_UKToolv1.0.0.6.exe
Size 3.5MB
Sample240603-n8lmvsfa72
SHA256 55453f794fbc569bf4afdf593aa27ff863bf1e1c67c7ccb5eb7bf48f29ff0de4
MD5 7b7702067e951bd5efd6930025432c64
SHA1 dc9130c769472eeadeac380c0fc40029d2e8e295
SHA512 7c107885607c73121f1dfc6ab3f7f6c3e2c21264229eb9b3551fc9bb5e6bf830d4fd072ba900ab039715e99afc50d79ce6812c646ca4531f88fdbfe07e3930f7
SSDEEP 98304:8XBnHfsvIWrreL4Zld+oyjgCCPMBHyiciqK8DWoYoA2e:SnEbe0MjgCCPMBSictGQe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  HSBC_UKToolv1.0.0.6.exe
- Size 3.5MB
- SHA256 55453f794fbc569bf4afdf593aa27ff863bf1e1c67c7ccb5eb7bf48f29ff0de4
- MD5 7b7702067e951bd5efd6930025432c64
- SHA1 dc9130c769472eeadeac380c0fc40029d2e8e295
- SHA512 7c107885607c73121f1dfc6ab3f7f6c3e2c21264229eb9b3551fc9bb5e6bf830d4fd072ba900ab039715e99afc50d79ce6812c646ca4531f88fdbfe07e3930f7
- SSDEEP 98304:8XBnHfsvIWrreL4Zld+oyjgCCPMBHyiciqK8DWoYoA2e:SnEbe0MjgCCPMBSictGQe
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95
- MD5 09d8971beefefffd710030dd167a99e0
- SHA1 a0117786ad77213f3eb48cfdc3819786cb796b7d
- SHA512 3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0
- SSDEEP 384:EhC43tPegZ3eBaRwCPOYY7nNYXC8/Yosa:EoTgZ3eBTCmrnNAI
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral2
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 4KB
- SHA256 e594544cc4b4a0a5439a2b9a79db14e580d815c87e353781c47d4eab5e313b8e
- MD5 c1e153f9fa1001eb9fb34bbc4a3f3927
- SHA1 dfca2dcce9b0486114692a23776191627b0c9839
- SHA512 d2a7c2853b56f60f710dcea27c346dbd22593c98e5c000c22650613851f26e505b12260bcfc050473e97c2796a91c94a3c201785dad4d95de0b4e2de35c3a41f
- SSDEEP 48:C4ojqpOxUcbslAR1k5eKv8rbvHMgiqCmZuwJQ7TLSMXaIYatzbgAa4l5YAZ:SEeFslARoeK8rDHMgTCmj/MqoRb+4l
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral4
- Target
  $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- MD5 SHA1 SHA512
Score

1^/10
behavioral5
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral6
- Target
  $SYSDIR/CFCA_HSBC_CSP.dll
- Size 186KB
- SHA256 d9ecbdc7e2e31764549f5b7a5e8dce46cdfd6dd0664d491ec7203ba5253f610c
- MD5 3381efa4d0deaf0722439c0abd15f35f
- SHA1 46bbc73777b4954749055c6c7a534cf8f0422556
- SHA512 eb560a40f589aec56cf2acb8229ba12c4a41dd5b835b0f79c5b583d28e6939751d544cb99bf7aa733cca269097123f05072a6eadadee0e490e4cb98de0a486d5
- SSDEEP 3072:1rWstMq2tqGBM2I24tZGFruup43qWWbuPcRvYwgUBF+0:lWstN2S2p4tIFrmqWWbbRv3k0
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7
- Target
  $SYSDIR/CFCA_HSBC_GMAPI.dll
- Size 157KB
- SHA256 5ba4585be6c8c895d9a66f21693682dd3b58279ef0cdf1479b841a12f96114f3
- MD5 c29ac30451c9ebfdd175db086c8d82e2
- SHA1 cbb269459f244425fd6ec1db8088a267446433af
- SHA512 9c5ed13dacfea957bdbe7473af071394d0c98daec0012027ba5c779f4577923ed76a0b3b0a57432be4e8102cf9d344a03cc4bd933d04bd281a4f22e4d0014406
- SSDEEP 3072:dViHRlJrLeFRKMdHtpBVwMKeyIQXYMAqHROUPUYYEFuUCiWiHxzi:eHRlJriFHdHtpBVwMKeyIQXYKHROM3RW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  $SYSDIR/CFCA_HSBC_LIB.dll
- Size 257KB
- SHA256 58fa342fb8aa5b4dd6c70e7ac6be69fd892fbfb6dff7dc499fec9b0fad8fe00e
- MD5 562ec71ced3842116f7addb2d78cdc4e
- SHA1 e34b01795e025d6e83a82a805e5d2ab6d0022c2d
- SHA512 354ab59d0eda6fbbc05989f4eb114f2877a3f27ac7f72a614ae3d2a06b2368d244528e71f376862e6ecf6f0b272a454cc9228c74c81dd2108a30ba993c144508
- SSDEEP 6144:91mvTKTVTFHqt0XsjSeSt9wYlFvDeKW1FdI5MZ:91YGxJ7cBSvDejFdr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral9
- Target
  $SYSDIR/CFCA_HSBC_P11.dll
- Size 184KB
- SHA256 61c93b350f48896aca966524a7196db119fd188a107796221a4f54f723df7a22
- MD5 7cda3a6e91e46cf2b04e60a72590b452
- SHA1 ee82fb11e5c1b2c6df2e03452e699188175c0af1
- SHA512 828b321b86dd42e5e96279c0418ed78b59f7405e26600fb0b1ef4cad2cbce1efea185e004de724e6f21b24ee98c0e79e0978987f9c048e28dd29fab3678a0030
- SSDEEP 3072:6n2X+D4hYEyWf+e+kd8jPW/imWrb0fVJVRDHJUvUldz:3YEyvyAPW/ArCVRdfz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  $SYSDIR/CFCA_HSBC_SRV.exe
- Size 69KB
- SHA256 07d989855f4dd8bfd5e4e1d2a3cdea3696957fbe0f202ab699c9ea7294cffbfc
- MD5 eb168e545f4f09125c9b2537141b2131
- SHA1 224a30956a26b35395f238d7c3692032d00e023e
- SHA512 a10bc667b69f0dde67da8cc2277688cd36cc659b0ceeb26c9c24934a8cc5454044ba0a2c07b593ce4428b6ce1fafe5b37e20c6577451f657810e6372f7dbc530
- SSDEEP 1536:h6vawbAZwTqawgKCMw4XeXgLmquIT2lCHoR4M70V3hFw:hxwcGT18LeYuITACH+oxw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  $SYSDIR/CFCA_HSBC_scsp.dll
- Size 45KB
- SHA256 011523f383fe08bcd5a07307fc76cb644d6d7e955a88fdea02473a7591858386
- MD5 59671bf95699f5fd4ad23e6da2bd6284
- SHA1 d50f9d1cdbaacabb86fb6106e98fff084e9ca9f5
- SHA512 b7abb03eb4c2b395fc48679421668cf9ddd164c3b23d641b8631a97df0031133b5d8ea2102efdc0e07b881ebfe1668c0c4a3102ab6897e56ba734306ab01ecbc
- SSDEEP 768:3Ai/JwobqOtAHbhgSFmXEI1iogdq0S01/2o+6JKKFx:wK+mLBJ1iDduaJp
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  $SYSDIR/CFCA_HSBC_scsp.sig
- Size 136B
- SHA256 81994e5295f30965a669078a3ff371e848f3d51eb788d7ede8c0d0db10051d19
- MD5 4f9b21ed006ad3eb4963bdaf16fee87f
- SHA1 a38a0ab75845a1fcef9692d3a8e746613bdca9c9
- SHA512 2d37303d0fbb80962f5e62924d8460ed6c2c13ad753b119653734ddcf4d130f6946acce64ae2de5f812f4e1e91d71d60b0b051ba0d02c6c215ee9583a6bb7ed9
- MD5 SHA1 SHA512
Score

3^/10
behavioral13
- Target
  $SYSDIR/CryptoKit.HSBC.exe
- Size 4.5MB
- SHA256 ab6068524bed05e25cfb24987d3c29f833ebe684e3072458ea25a0c826441314
- MD5 88b6ed048456d41f4f9bdcebc69fdc04
- SHA1 05a0347a4abc84ec871932d6e9f8c59c4e206cc3
- SHA512 9cd9e45f73427da24297a19aa4a4d5e4b7b928868879babd1e3b9a424ce0ff4cb23201e777b142d651c5a044364bb625badd546c55973ecc7c7a4538a0cabe08
- SSDEEP 98304:2Kr0mQVOjfSxgHtQBFZdG/Cgem9fy2vUIBjSj3btptYSSxIaGN:2Kr0mqHgHD7eYfy2vUcE3bt0InN
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15
- Target
  $SYSDIR/CryptoKit.HSBC.x64.dll
- Size 1.3MB
- SHA256 e00eba22c4ca5e9fadcd2ddd561b0cf9f9eb8ae7bac619777fc527354b10e016
- MD5 510f6561ce51936a460d7ccc2c04010c
- SHA1 a1078a52039a14dbe476f67dfcae77c09f9339b4
- SHA512 e700651aa50a9b00ef38ad2c5f74e220aa39f91708163844f94a109d0d4a7194ef7c093da416412c1b54fa7d22a3cf0cb97dd41f0002ca29005945a55d5d0bfc
- SSDEEP 24576:IcdjuFD3DgfGCNSi4Q/HFFlCzqpD2iUl6ZBXi:Ic1uFbDgfGCN5V5VUl6Di
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Registers COM server for autorun
  persistence
behavioral16
- Target
  $SYSDIR/CryptoKit.HSBC.x86.dll
- Size 1.0MB
- SHA256 fa69867c017873a36f500ff84dddde62439e3960dfae7d30b4038a4b56e834b2
- MD5 d6093ec468e383c616154ec1c92e3f53
- SHA1 9dd2406105c67f86085c9a82475c1e903690dc81
- SHA512 10ab0650d7e8e294cb6d4b7a7ff3e6e2ea4f1893be32eb00bd5db4bee0b2e6b51dab50e0f66500bf5602f1eec3abc236b3492cec97afa67470928d6260676e89
- SSDEEP 24576:59imEEBDlFxRvhxB3srzAzj2ByAEmXsa+:59ijgfHBGzs2oAEosj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  $SYSDIR/npCryptoKit.HSBC.x86.dll
- Size 1.1MB
- SHA256 5a52680b20a7b2ca26383f83ad4285b9f236f765cfcdcdb0f11a8ee14696d3a9
- MD5 48eb627ddb83642dd4848e2c08d68d80
- SHA1 1f9ec3811f68f65c17719cf5ccb2a81a38672fc1
- SHA512 a1a8fc58c7633f7d868863827e34d1d15bf04e62cd166f91c89e23db463b90c3264474d57cac28b387113505c1925e8d5d3ed51bada307bedb4b3a107790d07e
- SSDEEP 24576:ggIUf+v7BrAPaOLnc5xaVlanYJofo2XLk:UISO4mlRJmoYLk
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral18
- Target
  CryptoKitHost.HSBC.x86.exe
- Size 1.0MB
- SHA256 5c7b30e459b57ed325a35fd23389d1086390efe7dbc5cd7b009d6ce287f9f2c5
- MD5 9df83d1d074bcc9461f8d59d906a4e1e
- SHA1 d539a8831218654d5cf409d04954d3add6bd029b
- SHA512 8e276526d7be9ec13a0445a5ef4a30ad66c687664eaf9265d0ccfa1f7b28550530c2c5e6b604a7e00356c0adda575131890bcf21c7dc150b952783204369ece8
- SSDEEP 24576:OgctMhz7gC5nbgVaMhxWbPXqh0iL5XTLbvtO:+t0EugfHWTXqnLxLbI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19
- Target
  com.cfca.CryptoKitHost.HSBC-firefox.json
- Size 208B
- SHA256 bb97f8e717d4d93e179c21e95adfe4246961484b278b306bba39552857027c80
- MD5 23717c4721cfbb1eea7bf90f4e6d6e8d
- SHA1 24d950a53f38324491ebb2af8ed6e154120f97c4
- SHA512 7da2dbe9cc35968e7aed16a7efcd4bf6b7a7ecdd7af2af8c0c4a9951bb4caeada6646096178d29f22eaf3ff5fa0ae442e15b5a05930dadd3c178de943d3b51ac
- MD5 SHA1 SHA512
Score

3^/10
behavioral20
- Target
  com.cfca.CryptoKitHost.HSBC-win.json
- Size 473B
- SHA256 fb33588577ea06e32629840caa9af95cc281856a16e585c1cc4b7b6a14b978a2
- MD5 54a783d9904e7f3ddfd20d694df0f59e
- SHA1 f50e8217d7e1b5929d0be9340485292de965b1f6
- SHA512 a4ffa8a56c0e1e6be27d259370e1e9dcc012ea0443fcdfda57986e918c729f7b97863eb8d8e1069b59270d8464bc09adf55637ae56d2cc690dd30d75f641b90e
- MD5 SHA1 SHA512
Score

3^/10
behavioral21
- Target
  uninst.exe.nsis
- Size 2.2MB
- SHA256 964e23a72da9c5f2ad32fb6e31517e7bb5ceab4b2e7ea711d98362aecec306e0
- MD5 cffa0d5e57c4dfb318c75df221a2a0d8
- SHA1 753e6952ee9022316b0ef34e8e9cb8ae930a8501
- SHA512 c4ec1acf8702ddf02fc8c4925e2fc46788419ee3d22f2039d17e5003e3532b322879b9334134ac592bee12281d0d87a0aa17311d2b6e74413f0d519f2225604d
- SSDEEP 49152:MQEtu40mQVZEbhqqFXF5SxgH/FQBFKedvOVFCgeT6QXkS:Wr0mQVOjfSxgHtQBFZdG/Cgem9S
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral22
- Target
  HSBC_UKeyTool.exe
- Size 223KB
- SHA256 24f2211816c726dec4a5b8809b7455bd34a00f4391746f7b3b7b55d13452a043
- MD5 ba8cca1bb7a11644bd700452e4a92ddd
- SHA1 b8cd8668bafd14eff7abfea72a8f32dd85c8259b
- SHA512 768e24bdcf90c4f7118154c823a1cd680a822c2fabb7b978747fedb4805f24bef46a3576b7b64d63b60c5167e9adfc4adede216d25ad64ee92e3696750412d98
- SSDEEP 6144:g1vHJZpDQ3hXEy8ER8B6yvlYGkO/eHa6BR:gjD86O8B683/36b
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Loads dropped DLL

Registers COM server for autorun

Checks installed software on the system

Drops file in System32 directory

Registers COM server for autorun

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23