Overview

overview

7

Static

static

3

PolyMC-Win....1.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows10-2004-x64

7

$PLUGINSDI...gs.dll

windows10-2004-x64

1

$PLUGINSDI...ec.dll

windows10-2004-x64

1

iconengine...on.dll

windows10-2004-x64

1

imageformats/qgif.dll

windows10-2004-x64

1

imageforma...ns.dll

windows10-2004-x64

1

imageformats/qico.dll

windows10-2004-x64

1

imageformats/qjp2.dll

windows10-2004-x64

1

imageforma...eg.dll

windows10-2004-x64

1

imageformats/qsvg.dll

windows10-2004-x64

1

imageforma...mp.dll

windows10-2004-x64

1

imageforma...bp.dll

windows10-2004-x64

1

jars/JavaCheck.jar

windows10-2004-x64

1

jars/NewLaunch.jar

windows10-2004-x64

1

libb2-1.dll

windows10-2004-x64

1

libbrotlicommon.dll

windows10-2004-x64

1

libbrotlidec.dll

windows10-2004-x64

1

libbz2-1.dll

windows10-2004-x64

1

libdouble-...on.dll

windows10-2004-x64

1

libgraphite2.dll

windows10-2004-x64

1

libharfbuzz-0.dll

windows10-2004-x64

1

libjasper.dll

windows10-2004-x64

1

libstdc++-6.dll

windows10-2004-x64

1

libwebp-7.dll

windows10-2004-x64

1

platforms/...ws.dll

windows10-2004-x64

1

polymc.exe

windows10-2004-x64

7

qt.conf

windows10-2004-x64

3

tls/qcerto...nd.dll

windows10-2004-x64

1

tls/qopens...nd.dll

windows10-2004-x64

1

tls/qschan...nd.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PolyMC-Windows-Setup-6.1.exe

  • Size

    35.7MB

  • Sample

    240728-29bqyazhqp

  • MD5

    5bb2a28bb44d9033b2faa48f32da0808

  • SHA1

    30b5f1936b77874ec3cf698e0427164d67da48bc

  • SHA256

    a24c03e63449db0f994c715115c7648e88182888305be3554ef8f9a9215a0501

  • SHA512

    3f05d74741a5fc69f58ab33499ded5760c9af3ebd6d8b531259b5c45b51c9273e3a09c6a1fa12a3b0d8caa54476d212aa7bdda3f8a41bc987beef5255747bab5

  • SSDEEP

    786432:rO6WYUESAnXNJrFIwY/p/bMVrRYdi3UsGYBniW890Ker:rlWYIAn9AwYR/wVrRYM33G2ni9iX

Score
7/10
discovery

Malware Config

Targets

    • Target

      PolyMC-Windows-Setup-6.1.exe

    • Size

      35.7MB

    • MD5

      5bb2a28bb44d9033b2faa48f32da0808

    • SHA1

      30b5f1936b77874ec3cf698e0427164d67da48bc

    • SHA256

      a24c03e63449db0f994c715115c7648e88182888305be3554ef8f9a9215a0501

    • SHA512

      3f05d74741a5fc69f58ab33499ded5760c9af3ebd6d8b531259b5c45b51c9273e3a09c6a1fa12a3b0d8caa54476d212aa7bdda3f8a41bc987beef5255747bab5

    • SSDEEP

      786432:rO6WYUESAnXNJrFIwY/p/bMVrRYdi3UsGYBniW890Ker:rlWYIAn9AwYR/wVrRYM33G2ni9iX

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

    • Target

      $PLUGINSDIR/System.dll

    • Size

      25KB

    • MD5

      853d33d653fb8622e5fd1aa862d07aa0

    • SHA1

      310561cc0f30657974ab627a2341adfcec84ab92

    • SHA256

      dbeb911118606a36e430e8d8be39e944b80167fb81ccd11c56afafb25747e633

    • SHA512

      6d944929b0a4350aba32b28ef9f26d6c8f1a7c44aade158587829101a110ac7d892a9c5ca4ce60945c8cbd63eb0df63c3e8785c871e85ad22635f0ac80dba70a

    • SSDEEP

      384:YQi8KP2WPZVVAfsjFMOpIVKGdDWG0OkuK3TZupbm:Y+KP2zEjFMTxWG3kbu

    Score
    1/10
    behavioral2

    • Target

      $PLUGINSDIR/modern-wizard.bmp

    • Size

      25KB

    • MD5

      cbe40fd2b1ec96daedc65da172d90022

    • SHA1

      366c216220aa4329dff6c485fd0e9b0f4f0a7944

    • SHA256

      3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

    • SHA512

      62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

    • SSDEEP

      24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      14KB

    • MD5

      cf1d851a552068aaa0515ecbff6f40d2

    • SHA1

      e2cb25ac6cee0712486c8c2a7e00250a89554ca5

    • SHA256

      38192df38514cabdd22e08cba2b3d27aac774ac8090a0f326d441718f47a82c6

    • SHA512

      b76b86b8866c5b5556c361878b128e1ff5010585c79b733df4548ee7344cdde409d647afb1e50cdf8d33d74595bc2b8fa971ba4b80e78d00670d085a1871d832

    • SSDEEP

      384:BepxuRgZvixzDILPx7EWKGKVlDJfU/HpYpym:BhRgZvcUxEzUvi

    Score
    1/10
    behavioral4

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      11KB

    • MD5

      d9624f8a2014d31c4f114b78e20ad6b3

    • SHA1

      0c1b5761bc42372778ab5af27165cc52666924c4

    • SHA256

      1822b4b0c0111e82361ddf3d603d14392d80908c17d51d187bd2aa8d48e104e9

    • SHA512

      db2015d2f2783b1734a8b92154d9fe454d212ff586b66fb235986872b0ee5dc6c6e7d8498fe000097b3fa11aff2f6136dd28b618408d85995602e2664b941c01

    • SSDEEP

      192:JFArL9YKCLmpfHcQOliHERKXWRChDuatU4atUCvqx9:LcFCuZO4kRKG0ptUntUCyx9

    Score
    1/10
    behavioral5

    • Target

      iconengines/qsvgicon.dll

    • Size

      60KB

    • MD5

      2e3245b65686ec3c286c3eb0d949ab41

    • SHA1

      d41b17b7c7deddb801509c237592b1abc550420f

    • SHA256

      c16f3c3645a8dfad08335917d48bd4c3946004c80177941c52d4af9b994cb722

    • SHA512

      29b8e3637dba3f96571a25e8bcdd50db1d4372b03324a0b01a24394d29312000b66154b95190b01abefd763a9e281d7b21fbc46eae9749ef5a13eb88b65ba23e

    • SSDEEP

      1536:fkyqdXZpC+MRXORgkRQ1QSBGj9kiRKFkCAh2oqQl8zGh:fkyqdJVqQF5TRKFkCAolQl8ih

    Score
    1/10
    behavioral6

    • Target

      imageformats/qgif.dll

    • Size

      39KB

    • MD5

      4ede5a553daa717719869bd463718db7

    • SHA1

      0a30edd7475ba0476750d321b63e6c135e21f0d1

    • SHA256

      50ee1d8b11ac731185b364f217f6d5736909e4864f93d14c91a0af07a6748d9c

    • SHA512

      a197da345aa7bb50d148c1c519042aa20887a3e99bc629ba21ad7eac4dd1b74ee8cb299969b10754ade3a5600290b3e98d21548b20b8c2f2ea3f04a1d7826229

    • SSDEEP

      768:eWCpBLhvEnXWy8cKayHk/6W5FJCeoKWAtF3ckEh:7CpBLhvyWy8cHyHk/PJC/LAtF3c3h

    Score
    1/10
    behavioral7

    • Target

      imageformats/qicns.dll

    • Size

      49KB

    • MD5

      459da5f48b865427454bb1a5def89237

    • SHA1

      03bc5300812308a729ee1295b07ade790583b9d2

    • SHA256

      d9e21478a211fe31d0d70e1b9ecfa2045fda14712901f2dcfd7f1a435580a99c

    • SHA512

      4a47dced210ead447d5a578e91935e55f9dc640156c523471d9b8ff112d3245ca33feadb3389a3cddf1a7774b7eb71bd02daf61d7ac2bf558a6b8898750c8dfe

    • SSDEEP

      768:el4zI0aH6XN6ldAb4TjCgM9k58KXyZCfJoiHbX9c9gC7jQVdfsh35uNh:WqIdLm9kFJG6C7jQVdfsh35Ih

    Score
    1/10
    behavioral8

    • Target

      imageformats/qico.dll

    • Size

      41KB

    • MD5

      c0b67ef5ed2b5be6270644c32a37d2aa

    • SHA1

      fefaf44142f6290499494c26320ebf2608765613

    • SHA256

      8ec4240fbf9d6a3cb78a749099139e6cfcf0b65c463577bec6bf301225130628

    • SHA512

      2cc07e6859d5997624b3fec512ddbd4f8e750de3255beeda1d80342e556ee05ca7649a61823e7b59df09a25d8a2b9cf26edf1eb9e5f13564f6b295f08aeff9e3

    • SSDEEP

      384:LI0XTL64QIHJQ/t8h8kuE3TJownU7dbjWe8em8ywerqDTELnOFY8SCLXe0U1o19Q:LITeykVxUtVknrAToOeCjU1y9hOTh

    Score
    1/10
    behavioral9

    • Target

      imageformats/qjp2.dll

    • Size

      41KB

    • MD5

      21a10bbfc68443624bd5cbf60694ddae

    • SHA1

      93397cdbbedd7276cce782d279d714356aafea8a

    • SHA256

      adf8bc6107a68d8ad7759e2889cc562a9ea8b2faafe8330dade6c63c14011c5b

    • SHA512

      7ce2adf38736d7f0db7fdd1690a4fca5d4ae09c5b0e83415707d5ff9311016a23454d3605c91fb2a0a47351ad6ee5c289501566389a67ec95d354191cd281c52

    • SSDEEP

      768:V3Z6Rj28x1KHhx88kwchKtCj1WHjnvggfh:OazM8kHkCIDnvLfh

    Score
    1/10
    behavioral10

    • Target

      imageformats/qjpeg.dll

    • Size

      52KB

    • MD5

      1cc13bfc374732073a67593e2ff05f03

    • SHA1

      d658abea5707c95d89cc52b76be46b4e3192a319

    • SHA256

      85e53a7afa86a6199e84536b4de12a9888618ac9febefce9047d17a9a11436d9

    • SHA512

      baaf73a3d861085c26dca7303afbbf635a39a3b4fc23b8e9e8674df15fdf81159765e771930f27502e06e1f07b32a09ae3fa0c3d2a3659f1b3bacf62c954a6ff

    • SSDEEP

      768:GAZ0m2SlGxt/3ZnfPahfObrGhlakxdWOXifiNC1W9DECCIBL4h:0rSk3ZnX2fdlakGfqNCU1CIBL4h

    Score
    1/10
    behavioral11

    • Target

      imageformats/qsvg.dll

    • Size

      33KB

    • MD5

      009e5108152300e88f96e9444d49dacd

    • SHA1

      d1f1bca2a2fcdbe0464862c9cd92021b4ea532d5

    • SHA256

      eb102d75994745f35b080b36821b01f2f7c7ce325bcd2d9d83fb9b62e1c3f641

    • SHA512

      988b1107d3231244fc2350af032a765ad8d6f8872d0e46223a6b480123db4c11c70a854b6289e526c168f7ccaa8a96599cbe4745fe41d4ae98d338e367463d5d

    • SSDEEP

      384:DGFsv44AmCJyUHPv/kuU3TEY9DPasV19V1qRSCNUy/sc/vfh62ONCAkrs2QAO7:DIsAZmC80PHkH9DSs9zCRfh6jNSIf7

    Score
    1/10
    behavioral12

    • Target

      imageformats/qwbmp.dll

    • Size

      29KB

    • MD5

      f46d3de28effaac3dfbdd1e981e02062

    • SHA1

      b6ac2a2d202dad6196d3ff74ebddc55e6864b605

    • SHA256

      b01a5b1d0d2ef350c11237db2c0833a25ad9c4a156e0ae9372cfcc4c80766ad9

    • SHA512

      be0675bdf65062f129bb480f97bd49a88812b556679531f03a2cb3b0c1bc3f8e6eadd84a61d884115fb1f535fb6af124e083b382b09ab81eb4f5e85383ad5ff9

    • SSDEEP

      384:ZnV81r0/w/bkuU3TfU8ZuAz4i4RSCPUhc5kyvV2k8XTh:ZKh0YTk59bCac5TvVx8jh

    Score
    1/10
    behavioral13

    • Target

      imageformats/qwebp.dll

    • Size

      37KB

    • MD5

      1d451e9490f04ebf9ddeebc6d4defed9

    • SHA1

      9c45fe4c7c51110b6caa825934bde3be635d52b8

    • SHA256

      ac519464b426b167622c89c270239e249a6191414340f6e8837d84684fd7eb67

    • SHA512

      790d43c5814a1e37fd4b2f570c1d4acbe8e648e47e714079b19a1148d708eb12afcc34f6867e2231a81e52bbeeae455076cfc5ca2358b1cd104e2010e82e0bf0

    • SSDEEP

      384:mwywyOT4J+AEwGickuU3T8GHa5jveq1b000GRSCxU0s4HqTOSHrGh2:mwkzJ+WGfk4n9N0ClrHqTvHKh2

    Score
    1/10
    behavioral14

    • Target

      jars/JavaCheck.jar

    • Size

      1KB

    • MD5

      25cfd80bad948ffe4d80096c959e60fd

    • SHA1

      362dec97a15b8ebe182dbff0d0e444010f9431fd

    • SHA256

      c123f4f4d4d0fe0c97f07e6a042494c6ca247a8252a01a63a81fe7eff4ec8aea

    • SHA512

      f8ac2b2b514368a016236fbc641791e15f571e2a96387043c5082cb02e52c5a1adde55acfebba7b560d5973d740511952301b79d7c32959f33d06e140c8e14d9

    Score
    1/10
    behavioral15

    • Target

      jars/NewLaunch.jar

    • Size

      16KB

    • MD5

      a1bfb7daebe8f4882539853471746793

    • SHA1

      a959ff0f886ed374b6c59d87390dfa94f7e34a1f

    • SHA256

      1049bdc59f4e64ec960b4ba4e512f92539df4394e19434b2d09f7be13b19b5c1

    • SHA512

      3e69615de6a2a697b40f59b53fbb3f8c04d9b98d4eee0a1a88270d87ac0510bf6f3bea2e8fee0851735c40b2e80e89d28cdca209d550c278a82049d11a2492fe

    • SSDEEP

      384:ispRkY475KC/4xA9EMkZqODDqkwETZsJlX0g1ftRPof:iQkaC/F9EdZ9wkWJx0gq

    Score
    1/10
    behavioral16

    • Target

      libb2-1.dll

    • Size

      33KB

    • MD5

      db2059841e2b7be00607dd20b3eabc7f

    • SHA1

      b5853cc3716a55ce69faaf8b84365ddbcc1c85ea

    • SHA256

      7fb8418a1172042dab5227fcd466b1bf293737f5b5cf35359e851516227f109c

    • SHA512

      ac582b3d5ecb891892fcfe5e0647233058312be04b16f46cd2e4bd0b2c72cb341f48aeda83998688ae1804ba2e6fa10cdfd1db83c072238b6dcfcf5014c3f401

    • SSDEEP

      384:3nz9mELQAZEFhf2bSN3s5sO6yY5ifPaFJdNdsG3ZeS9dJO4XQ6M/0KSer98TFx:3z9pLB0hf2ac5sO6HHFJdNxdJ81SnFx

    Score
    1/10
    behavioral17

    • Target

      libbrotlicommon.dll

    • Size

      140KB

    • MD5

      d8663f9a347755f11f2c67cddcfb37b3

    • SHA1

      56cd42ca876a2601b5f488daffa78357239c6a52

    • SHA256

      62f363f6aac0d54ce7b115c0412b19e0fe5480f4e6fc1254f663b0ab6868e46f

    • SHA512

      c3c92ca4d3ca0dac0c0d125e7b9a358bd2a9a45d1e779a7ae7b014a20e07540142f9a16c6231e744bb5c3da4db688ccebf79185a3ed2caa55ecb367e53cce71f

    • SSDEEP

      3072:U1O4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBGx:94AhdNorGvHdbi09GJ+

    Score
    1/10
    behavioral18

    • Target

      libbrotlidec.dll

    • Size

      58KB

    • MD5

      8616fe7148a27752d73b7f8c72c6fb3d

    • SHA1

      090a9ec3b201a3c80ee77fd2e0569e41f52d0b5a

    • SHA256

      7d6c0f954b6f2db1c1c5fd5904886ae055859a02ca31b6dde5f96f6b0259d23f

    • SHA512

      ced8f709d2372341153c1571eeb93d4146325be6bb7f23eb5a65258ba4925c0957f01ad89d004416c5390fb234aa687cae774c68f19cc919eab9e40384768931

    • SSDEEP

      768:Cw8HPnLzL3GtzrzLbLL6LnLuWvzTP5erXErJHDblONd7IxhzTkLgck2dhjFDCkBp:+LqzrLuvfQr0rZa7qzTkLE2jxCkbgF3Q

    Score
    1/10
    behavioral19

    • Target

      libbz2-1.dll

    • Size

      98KB

    • MD5

      981dac0b4d9eb1da0be9f51024d5649a

    • SHA1

      bd47b357caeaf24bed207b379da8f961f901dea9

    • SHA256

      b79cd3a7102e359ef6324e98966a67939e58ec2b651ae2847cae84a4dfa453f7

    • SHA512

      89be623acfae7ce840509462d8c142626c7b3a3c2fad90f2d8fc0d5b5465d5203bbb2423a781c5e7004c55ec2d52e5239c709a85d64767fb0df811423911d8e1

    • SSDEEP

      3072:L2bM6qvTwjW7Ofiw6zd+srIBMnw6DewF35:O7qvTwjW7bdzce7F35

    Score
    1/10
    behavioral20

    • Target

      libdouble-conversion.dll

    • Size

      70KB

    • MD5

      39fba801753d680cefa21b7f1dff4582

    • SHA1

      831c0ef18e969a03a478975eda217c52d779a49a

    • SHA256

      e7f82f105503d961d2f83b92c05fff29e6e788c185f8acf7cdbdda20fc14247b

    • SHA512

      f5fa92aa58c8776891f4a62666a4af68546d881a5610d6df745fea4286ca1a5eeb35e835aefc4e6e8b9d1a52d00fdec4c632e435e1f865f06d6f14228400eb93

    • SSDEEP

      1536:UvOBkYKcJGxx4KYaGEkBY5eF3kAjE2m/EZ7vAGF33:JBkTxmKYxBYMPjE2m/67vJF33

    Score
    1/10
    behavioral21

    • Target

      libgraphite2.dll

    • Size

      148KB

    • MD5

      69fc721cb2ef268148e430bac038d459

    • SHA1

      47d566f9bf60661d6e8fc049e38267530ef9ce06

    • SHA256

      f927efecd958f0e54a24ae297f86cd6aed05e7fc20e5da0882050ab9ec464395

    • SHA512

      e832017cd8b6c8ac360acc63226ceb0356b2a37d33ec32f4be92018d1ccc47f665de633d06ee80653d9bbc16f7595135b68cc140b34db4b86948169d5c6a33a6

    • SSDEEP

      3072:0c0rljrMd1AP6mEzmU5fi5NGE428JXtgX5u+CRjFUF3ICh:05fIAjOa5NGEAOX8+CxFUF3ICh

    Score
    1/10
    behavioral22

    • Target

      libharfbuzz-0.dll

    • Size

      1.2MB

    • MD5

      e85d252253944114f440fdbc67d4ae67

    • SHA1

      da478c55e256307b26a813222608a955335b1a4c

    • SHA256

      52ad06f04d6a3c190199b454f48d5e993dd7c2cf93f331a6bf87a19eed0bf511

    • SHA512

      b74dcd3327762373a27a144cc5ec09e58db9b348df2d6f5ee481c8970ec89c3c238ad232f11849ff917a0a278e590652b137c21186b4e5162cf48576efd73778

    • SSDEEP

      24576:pHQrRo4m2fAKjo35ctyYmlPm95atZzUPO11F20n:pwrG4miAKU351fZzvjF20n

    Score
    1/10
    behavioral23

    • Target

      libjasper.dll

    • Size

      423KB

    • MD5

      b0ba526108345cba92c7e750fda62b8f

    • SHA1

      7b5cc4309cbb9f117228677ed149dedafd095e26

    • SHA256

      628118c2d3a7fcebbbb88d0c6a30f03db49c696b1145dee1b9bcc1fe60d78a13

    • SHA512

      4cc87147ea822dd1dfa6ff980b7c9d3ed437b7095e564470ec4171a02afa104a560b72041a4b69dfd901cd1a375f77d90b762922e8527ebb3af43cdca811d07e

    • SSDEEP

      12288:WmNuwLvWgFpCaDl08ng8HSjRngzfLebGaMkLqY8tJH+zFvZ:zNjFpnDl02pHSjlmfCbdMrj+zFvZ

    Score
    1/10
    behavioral24

    • Target

      libstdc++-6.dll

    • Size

      2.2MB

    • MD5

      8a1130a942fbf7b4e56245e680ebefa1

    • SHA1

      454ad827bc26e9c974652ac0cc8b16ec551eefad

    • SHA256

      afef4db985a0a6f9ac7f55eb339c3de62166334043b53bd25d0bbb0b73a95deb

    • SHA512

      75723732dc26a9f4ac74afd61f507b781b640d70faa2a946801621b28eaed103e0d3828d2ccaae4dd7e10d9ec3a6b2423e07cf0d43cd7fa53e46619bac6ea2ab

    • SSDEEP

      49152:/s8qlibqj48M+cHL8/TxeNFyizfUTBiYOwccr0D:/7qluqOHL8/TxePgiEccr0D

    Score
    1/10
    behavioral25

    • Target

      libwebp-7.dll

    • Size

      733KB

    • MD5

      14c79212164f13744fc8f52c99d253b6

    • SHA1

      c99d7f644f455794d427cc66569a098ec8fbf5f1

    • SHA256

      d5a256f452f07c15bfc735a6294d8df5445c3a07b372e8731cda1575a280892a

    • SHA512

      cd05f62966fbfa393e2f31892108cc81c83738a9d694e18e5ac7fe1d650853a11adfd71e7136395aaa2e7de75598473b47835ef3901fe81808c74c183078130b

    • SSDEEP

      12288:tme5DP7A3cc0r2KssJ7MBvW83pPVGNsFGUIjMlSnK18837:t9+3chr20JYBvn/lES8837

    Score
    1/10
    behavioral26

    • Target

      platforms/qwindows.dll

    • Size

      1.1MB

    • MD5

      079a790da98627ad48797555e5ae213e

    • SHA1

      b7d46d8db42af073ec727faf45d5476b1f3801c8

    • SHA256

      92c3427fd901689591b955eac396f68ab65890a5ac161b6861567b60fe30840a

    • SHA512

      98c4f9524f74054a19eb9bf1df3e6c6d1da6eb8ac2bb6e95925d0ac4bf93512aa472f876f6ce03424ee5d6b3c79e7542bf05847bf95bb7e4d294b7bcf668e923

    • SSDEEP

      24576:qQnSZwNyhGekFt5Y6giylmvX1EQMBXoBg8:XScCGhFPY6giQKX1EQMBXoBg8

    Score
    1/10
    behavioral27

    • Target

      polymc.exe

    • Size

      10.8MB

    • MD5

      341d7ac79625c3ab885d90ed5ce9ab2b

    • SHA1

      11139fcba6c8124dbe03a90058a2241dc7a70118

    • SHA256

      7b8f33c02ba9e3fd92ae5df31088c47cef1afb0acd2c2eef1ecd309b465c84a4

    • SHA512

      9adf7da50ac181d418e26f5feb22f6cc93e9b11299159ca58cfd8fd0e2c5d9a6376737a08dd8aab79f1a1d12d269ed77c23c779f1de8b91fa97dc42e622a6b31

    • SSDEEP

      98304:dIzA2C+GqLsi9u7mSs6/VxJxm56rdYNU47WSMg2ENuKlJe5V3L:R64s6lx0GdHrpENXo

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral28

    • Target

      qt.conf

    • Size

      1B

    • MD5

      7215ee9c7d9dc229d2921a40e899ec5f

    • SHA1

      b858cb282617fb0956d960215c8e84d1ccf909c6

    • SHA256

      36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

    • SHA512

      f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

    Score
    3/10
    behavioral29

    • Target

      tls/qcertonlybackend.dll

    • Size

      92KB

    • MD5

      69fbf25e80645785e5644aa8abdec2bc

    • SHA1

      23af8efa7a781deb1a9baf3575c889e00998aefb

    • SHA256

      c45da596e584f2eb1a0ba229e35444bd86115697b954583d16ae8e37b0c311ad

    • SHA512

      5a75cba1bb47161e47aa98d67171cd3d356419493071f4b10359624069b4d309df966039fd041fde76666078176a787defde75eba86aadcd781422ec2c6a0563

    • SSDEEP

      1536:89IKilFfSqZJfQRFPdBCuvRjonroLcfNU2T6HoU80lycXwfLjGMkwcLJuMy5D4Na:0WFamGZDVRjonroLcfNU2T6HoU80lyci

    Score
    1/10
    behavioral30

    • Target

      tls/qopensslbackend.dll

    • Size

      344KB

    • MD5

      15e184e002844b1d087e4f7d28615f0f

    • SHA1

      c9793245635e572a6128701d4a3121c74da28ca8

    • SHA256

      e0216f08dc96a37cbd651755f4536c127f7988b720ee09b779d9d2011aa8b670

    • SHA512

      332d429b0f4faf8e7cbad23fdcbe0075bd4afb4e083ce848d8ca604d3cce314b09525bf2757aafaad80098ad3e7a18f7e59e60e1ca5e6deb2d6f78a0c08bed85

    • SSDEEP

      6144:GJ9KSmipWYqbvhdo7h/SuHTcRCCEouamssdwIGkki:GLIiAYq7hdo7tHTcxzgd/r

    Score
    1/10
    behavioral31

    • Target

      tls/qschannelbackend.dll

    • Size

      229KB

    • MD5

      1de4437a527b30d27328c2044e9718d1

    • SHA1

      366cba4dfa3afc8f01c5486b6b80d545389a7b66

    • SHA256

      863f8e6bb77c6c36553af6cd62da5442254a889da81bcdc3033e2f12ff1578e3

    • SHA512

      27dada25c2a8ad8c52e7c5f40bb9a3f32a595e14994087eac276ec16fcdfa1eb406f797d954d5f50e66ff99b25be2facf61c2d5b4b7faa359940bfb1c1a9dd71

    • SSDEEP

      3072:nH98mbJYzEaMnKhEjhs/4bMCjSzCzXowJsAf9P2/ntRgtDFhHYEzjvW38Al70LWE:nH9xaQKXbmDFrW38FWEC5OlvA8qgvo2

    Score
    1/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

6
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks