d4d1dad4a0548d1c9be3045b8d11c0f182176df47b1903190037fbf8b4751b60

Sharing

Copy URL

Twitter E-mail

General

Target

Obsidian_6.0.0-beta.2_x64-setup.exe
Size

4.0MB
Sample

240811-dvyedswhqd
MD5

de7c56083ce0a54a7ad6a53a46ce93ee
SHA1

efbb97f90b0f0b1846b04daaa0bf4f1b28a5ee13
SHA256

d4d1dad4a0548d1c9be3045b8d11c0f182176df47b1903190037fbf8b4751b60
SHA512

47ea58f5f95d45a314d5a2b8b4202357025a5392a210b78e4e515c55d66ac2258e1090d3cca644df77cfb322007722fd77f52cdb7f9277834e065242a4986004
SSDEEP

98304:xOCre4JpFFcq6I1b2poOHFmIW9wdpZBACIeB1npiV40UuKZ:x/DFC/16OMUXx1EeH

Score

8^/10

Malware Config

Targets

- Target
  
  Obsidian_6.0.0-beta.2_x64-setup.exe
- Size
  
  4.0MB
- MD5
  
  de7c56083ce0a54a7ad6a53a46ce93ee
- SHA1
  
  efbb97f90b0f0b1846b04daaa0bf4f1b28a5ee13
- SHA256
  
  d4d1dad4a0548d1c9be3045b8d11c0f182176df47b1903190037fbf8b4751b60
- SHA512
  
  47ea58f5f95d45a314d5a2b8b4202357025a5392a210b78e4e515c55d66ac2258e1090d3cca644df77cfb322007722fd77f52cdb7f9277834e065242a4986004
- SSDEEP
  
  98304:xOCre4JpFFcq6I1b2poOHFmIW9wdpZBACIeB1npiV40UuKZ:x/DFC/16OMUXx1EeH
Score

8^/10

discovery persistence privilege_escalation
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1
- Target
  
  $PLUGINSDIR/ApplicationID.dll
- Size
  
  198KB
- MD5
  
  91c2e2f34b5bba068e9a6178e13a4e5c
- SHA1
  
  affcac00894c9afd152e55d0bff7899349edcd6c
- SHA256
  
  f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
- SHA512
  
  ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
- SSDEEP
  
  3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
Score

3^/10

discovery
behavioral2
- Target
  
  $PLUGINSDIR/StartMenu.dll
- Size
  
  7KB
- MD5
  
  d070f3275df715bf3708beff2c6c307d
- SHA1
  
  93d3725801e07303e9727c4369e19fd139e69023
- SHA256
  
  42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- SHA512
  
  fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP
  
  96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
Score

3^/10

discovery
behavioral3
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral4
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  6c3f8c94d0727894d706940a8a980543
- SHA1
  
  0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA256
  
  56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- SHA512
  
  2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP
  
  96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
Score

3^/10

discovery
behavioral5
- Target
  
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size
  
  968KB
- MD5
  
  0ba06473cec3f0e72fc6865d870b6bd9
- SHA1
  
  16df1d1a5b4d5df3859447279c55be36d4109dfb
- SHA256
  
  2b454443f12806d9e531e18bf19933c0aad1cd8ae397c71b99e814566e6bb5fd
- SHA512
  
  42b3c4ce685afb43b8ba235b29919f7fdbc1997618b74d189817d14d1d80e52ea67f6e614d4097bce6ca53b90d46a6d6a54882cd2ea176134a308b64a2b882cc
- SSDEEP
  
  24576:v2zSi+70fdjsUD5Y/CjsS5NpIMDcuHeoPffPJT1Qn652hOfuvNwRnkYkN2IO:ivm0TYKw8DnVbTwbBInkYkN2F
Score

3^/10

discovery
behavioral6
- Target
  
  Obsidian.exe
- Size
  
  10.6MB
- MD5
  
  fbb36a01bc9d71015a842eb4573a8107
- SHA1
  
  7938cdea3f5cbe50f4e95fb2faf4985ccb344dab
- SHA256
  
  b5062a0d25860ebeb99f3b2b2fc53e982cadbb2247725bb0c72e9fd06a55f9ac
- SHA512
  
  a2baa42010b74a09b633dcfbe81f7cc9c76033603462cbd2344d1d291be30e20132a25a07f08d18c15706388410fdd13a75ef3ec9938209220b71c881071e113
- SSDEEP
  
  98304:zjC4uKgzCXTVwjwCrCGpISMqYDq7b5NxXYxYqQbchwQ6qxb6FOeVgEtGbxYz+V:MCXJ4xWzSM47tYxY12wigFbZ8++
Score

1^/10
behavioral7
- Target
  
  uninstall.exe
- Size
  
  496KB
- MD5
  
  9f53fae750d5d64bd759ed22803e73df
- SHA1
  
  a985242dba3e9b67bcdf26c85decb635e9ffa000
- SHA256
  
  e94ff5f5adfd4ea8b2ba07debfb2ca8fc6c8101477691e3b70fce2e5e284fddd
- SHA512
  
  c976f3254002648fb1461d7cb34f8156fe4844fea8f4041fed7021576969cdee0871665c1f223466d408de89a51370769caecd4d44d71bed1234039b95697789
- SSDEEP
  
  12288:wYmMCEELGHIPAgZOtaK/4+nv7F4KOaqUqL:wYmhIIBc0Kg+B4KOLn
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral8
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  68b287f4067ba013e34a1339afdb1ea8
- SHA1
  
  45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA256
  
  18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- SHA512
  
  06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP
  
  48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
Score

3^/10

discovery
behavioral9
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral10
- Target
  
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size
  
  968KB
- MD5
  
  0ba06473cec3f0e72fc6865d870b6bd9
- SHA1
  
  16df1d1a5b4d5df3859447279c55be36d4109dfb
- SHA256
  
  2b454443f12806d9e531e18bf19933c0aad1cd8ae397c71b99e814566e6bb5fd
- SHA512
  
  42b3c4ce685afb43b8ba235b29919f7fdbc1997618b74d189817d14d1d80e52ea67f6e614d4097bce6ca53b90d46a6d6a54882cd2ea176134a308b64a2b882cc
- SSDEEP
  
  24576:v2zSi+70fdjsUD5Y/CjsS5NpIMDcuHeoPffPJT1Qn652hOfuvNwRnkYkN2IO:ivm0TYKw8DnVbTwbBInkYkN2F
Score

3^/10

discovery
behavioral11