3b48e8860bf29ef6191cbe0620d0e60b9014857306b955276f04703feee17300

Sharing

Copy URL

Twitter E-mail

General

Target

upscayl-2.11.5-win.exe
Size

215.8MB
Sample

240907-t6k67swane
MD5

cfd86efc1bddfd3653913fd1c1daeac3
SHA1

753cfc762eb2e0382c4a7e6308b019848c32649e
SHA256

3b48e8860bf29ef6191cbe0620d0e60b9014857306b955276f04703feee17300
SHA512

94695a5e7b916cabdb22726987bbf6168d0ff116b5faa8ec6d6d07b4fa6748137573d209a1e53074bf6fe7e34f2645e48c3ffe5898be917b8c33cea9f0f60352
SSDEEP

6291456:g4NqwhdQJ+qQTyN8O+dTUOB6BF31qCQ3puwVisQThWtgjC:g4QwQJ+52eTUfqCDSi1hWtgjC

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  upscayl-2.11.5-win.exe
- Size
  
  215.8MB
- MD5
  
  cfd86efc1bddfd3653913fd1c1daeac3
- SHA1
  
  753cfc762eb2e0382c4a7e6308b019848c32649e
- SHA256
  
  3b48e8860bf29ef6191cbe0620d0e60b9014857306b955276f04703feee17300
- SHA512
  
  94695a5e7b916cabdb22726987bbf6168d0ff116b5faa8ec6d6d07b4fa6748137573d209a1e53074bf6fe7e34f2645e48c3ffe5898be917b8c33cea9f0f60352
- SSDEEP
  
  6291456:g4NqwhdQJ+qQTyN8O+dTUOB6BF31qCQ3puwVisQThWtgjC:g4QwQJ+52eTUfqCDSi1hWtgjC
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  14KB
- MD5
  
  adb29e6b186daa765dc750128649b63d
- SHA1
  
  160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA256
  
  2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- SHA512
  
  b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP
  
  192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  8.8MB
- MD5
  
  2675b30d524b6c79b6cee41af86fc619
- SHA1
  
  407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA256
  
  6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- SHA512
  
  3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP
  
  24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Upscayl.exe
- Size
  
  164.7MB
- MD5
  
  f82edae8701c295c1c3a1e921957df5b
- SHA1
  
  1987582f5c2536d615425b9b7b6fc98b14702e99
- SHA256
  
  659cf17865e0fcbfb781f0352c9a79206d4acd4cb0dd4bd41d97bfdc22fa5f8a
- SHA512
  
  9425c30e8902f25d7341d4439c5c0afbe64999ed853beec732630b8eb1ec07eaeca6e8445618828f7b967efe814d2ae2bfa32ac774435d0b794b354bfa4525d8
- SSDEEP
  
  1572864:kL2Lvk/bNV+SYwfyyOka0sVPyfWbQcYjV6n5TUJlHMgrH61ZrpFQ0K0ulCanlio5:etQVl5WvEYNK15w
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.8MB
- MD5
  
  7b41ea1ab9f79949d22eec263eab088a
- SHA1
  
  b3023ce6fdaf84cfd04e72f192e6346317d1fac6
- SHA256
  
  711d06d78161f86246ef8551fcfb9133a20cbe74e5c2ca4d3b1e0cc197e92142
- SHA512
  
  f26716f793ca9d48574e9841b65d9b7207fa2080857417a2d987052c6746962910c20ffdee34b05045c30205d7bcdec8ccaee16bccb906c86c082fa29849bbe6
- SSDEEP
  
  49152:/F5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQ9SCu:/FvSkJXv+tiLAD0+D9S5
Score

1^/10
behavioral16 behavioral17
- Target
  
  libEGL.dll
- Size
  
  477KB
- MD5
  
  8d347862e31c290c359f7adb6b0ece4d
- SHA1
  
  80c47ac373cc080931f1cfbbdd86c60d150b43af
- SHA256
  
  87c48f62bf01baf4286270bb5fb941367427483bc237bf269a916ed1e71a128e
- SHA512
  
  9d0c8df6b69719e01150d7c545c391ef8af7982f8d9bfba390c3c2d73e497ab8110962e7d21e992c48beb8218a52a13f0175136bf4e7dc3c675107990a37cceb
- SSDEEP
  
  6144:J8hd1BSjuMmof2SEXVVfgV8hxN7h2NQIEOg51f0FticyQ:J8DXSjZmof2SEsmN12NQIE7f0FticyQ
Score

1^/10
behavioral18 behavioral19
- Target
  
  libGLESv2.dll
- Size
  
  7.3MB
- MD5
  
  6c16e7bdb6955ef198e66f7f690f8fc7
- SHA1
  
  cf1c0cf4ee1d1f245cdb34230f04356713493a84
- SHA256
  
  5750b05729ff3f47eef645cbccc9a61db49577965cd264dd242d1e6181f9006b
- SHA512
  
  a91240460d72207dfd513a36e02c3f2abf228725a263fd11199d4504f08604723a0e9721f20a3a28655aa19e1e23a44c31e135c9fb14cb7796219aef67caae42
- SSDEEP
  
  98304:2DRTxwF+JsIp05zu0uDqqvE9xLHvKMZ3RTtf:2DJlJsYQAqj/1p
Score

1^/10
behavioral20 behavioral21
- Target
  
  resources/bin/upscayl-bin.exe
- Size
  
  6.2MB
- MD5
  
  df8890daf06272767aadaee4a8a4f25e
- SHA1
  
  d38104e86ec7bd6478cdd81b1e58eab4104ccab2
- SHA256
  
  704fd622984220c8c646a8dff4c7eba1cc62fbb8c47383996f38571f76b73fbf
- SHA512
  
  c6d7cb0cbaf7ab61bfd776cf5a180a8f0a7d076da737009840dea59f7d2b96ccebd9a37b34e1294bc309c3e23e91cb70a290c993d87fb6e31fd1a7eb482c4c2b
- SSDEEP
  
  196608:68UmfGvd38iIIB9gUJi0Emw2W/R+XB89y:FUmkd38iIwR89y
Score

1^/10
behavioral22 behavioral23
- Target
  
  resources/bin/vcomp140.dll
- Size
  
  192KB
- MD5
  
  ef76327ff132a48f3bac24598c99b373
- SHA1
  
  71d2bca744724aa55c16e74b1ed22b61ccfd8920
- SHA256
  
  d49b394de1154176b39611c37c669ebff50aa5a818dbd5ff3d2214a299368ddd
- SHA512
  
  b3aa61ec77ce171b6a7910f0d973e8393dfc457db0d5e6035e18eb4cf9d75ca9e4a9fe012e91c2acf4e9b944535b15cc99ad15a1273e1fdd651ff5406a26ccfa
- SSDEEP
  
  3072:OFxwRpcDSgiN1hHxRB+s5zgexVahxUE+30/eRyjyTIZV1YakAU1Bvwp/lC5:K+R5giNjxRhHxV4EseRyjyQIv8/l
Score

1^/10
behavioral24 behavioral25
- Target
  
  resources/bin/vcomp140d.dll
- Size
  
  218KB
- MD5
  
  cc99e9c91ac21ec10d3ec0c4c69fc893
- SHA1
  
  143b5006fc08e91639c3233a64c81f17c0b434e0
- SHA256
  
  879ff638ac1c12a436ad794fb4bbbaf06ac4b43a980ebe5509f56acde2f3e5ab
- SHA512
  
  0e27b1b10b0f36d82a6533c5905996fb41840f33ae5bc7fe9d5f96bbb32e18c72877e0043a4b45e4e8b643bd127be9a3ba65e06a1a3490fb6118cb94902f0e19
- SSDEEP
  
  6144:6MsOAUrG07h85u2Y/xx46QX1qRrQIL9/F:6MfAUrGEhiu2Y/xx46QU9Jb
Score

1^/10
behavioral26 behavioral27
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  b81fc81f1a68dbf5111e354cded2e27b
- SHA1
  
  04381a966723f49a4d9f01e62fca9844dfa81f6e
- SHA256
  
  8fe67773a0c11c610115a36b9c101bb4200c9444cec742d134125052bbe929e4
- SHA512
  
  1cb6e05a197bebe6dd2bd613ea461b00d067ae57d7b6cd27a1cf09b919e91644764a4145d9d8fe2ff8e1cb7f5af9a39e706ea711412bd8439155c50cec86cfd3
- SSDEEP
  
  49152:36h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzc:Kh3aMXoSHfPwksHldLiuNr
Score

1^/10
behavioral30 behavioral31
- Target
  
  vulkan-1.dll
- Size
  
  931KB
- MD5
  
  c05164b53f9508650eff2fadf0df02ef
- SHA1
  
  8be89a10846d35a86a573800dc83f3f2646add7f
- SHA256
  
  1422520163e4fdd1e575633aeee72530bec59ccc4236a76a98db2720a6b1461a
- SHA512
  
  04feeec1e88f330d17b1bef9134565ea3a0cb0d2f8934a77455fa9e5134ce4001ce9752b6d258fcb85ef6fc36b9cc435d41d9801aa8f8d6dbd0905b3b0f7819d
- SSDEEP
  
  24576:TYWOq/4Kt/Ku8n387ecbFb6Z5WoDYsHY6g3P0zAk7sL:TY65/M387R56Z5WoDYsHY6g3P0zAk7s
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32