General

  • Target

    c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8

  • Size

    126.3MB

  • Sample

    240918-jlyaxszhkr

  • MD5

    d00b33ffec18ea912241a7f687a64d8c

  • SHA1

    2f3d534916f1a5f1e59d6c861d5e41bff065ec13

  • SHA256

    c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8

  • SHA512

    14dd54ad55bd0b7e8c7b9181204587c6ba0b1b9e9cd748ee8669b1120b17ff63647cc124950c536408fb38958d41d2a3d4b4c9fe9e1bba55db6f282d7e9278f6

  • SSDEEP

    3145728:OVbtEpBMufRS4HITiNPO4nsa7jegaqidl:qbtYMujH5N24ntegBidl

Malware Config

Targets

    • Target

      c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8

    • Size

      126.3MB

    • MD5

      d00b33ffec18ea912241a7f687a64d8c

    • SHA1

      2f3d534916f1a5f1e59d6c861d5e41bff065ec13

    • SHA256

      c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8

    • SHA512

      14dd54ad55bd0b7e8c7b9181204587c6ba0b1b9e9cd748ee8669b1120b17ff63647cc124950c536408fb38958d41d2a3d4b4c9fe9e1bba55db6f282d7e9278f6

    • SSDEEP

      3145728:OVbtEpBMufRS4HITiNPO4nsa7jegaqidl:qbtYMujH5N24ntegBidl

    • Adds Run key to start application

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates processes with tasklist

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    3/10
    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    • Target

      LICENSES.chromium.html

    • Size

      9.0MB

    • MD5

      f017c462d59fd22271a2c5e7f38327f9

    • SHA1

      7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9

    • SHA256

      40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37

    • SHA512

      72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07

    • SSDEEP

      24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd

    Score
    3/10
    • Target

      Signal.exe

    • Size

      177.7MB

    • MD5

      60395fa951d43300e09d76c7b1b876d1

    • SHA1

      94f5757c2bba2f918cec19f1832e058c2558e5e7

    • SHA256

      7261c1766bfbddf94b14e3b266b210df18e1e94500770c849dd7841d1a206d2c

    • SHA512

      d8811a23f5de57b9b6e61cb03e5fd57e390538df38966e08f5a2839ae8b4d39998888bbabf19276836b28d7a3281ff5046573c62e0b27e399c8cd1ce6bc54f85

    • SSDEEP

      1572864:v+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnaX:vA5kyGScBQT/

    Score
    6/10
    • Adds Run key to start application

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      1e0098b10c27e88026a57f4ada4d4730

    • SHA1

      42b091f0d812002ff35a5411d84b9c314d47f3ef

    • SHA256

      2ee0f50892b73d06b9466f880e26b1e874ac85974e0dd31118cd874dcde9bb42

    • SHA512

      3ee139a2e20af64b51b38e609cce50c0e88ac4fff2350f48413a4acc8f56d79a369af9b4c2e10f107802357010f736f7c28c791cd2997e0d830de75eae3fb98a

    • SSDEEP

      49152:ICZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNa:vG2QCwmHjnog/pzHAo/Ayb

    Score
    1/10
    • Target

      ffmpeg.dll

    • Size

      2.8MB

    • MD5

      0c637e52377adfae60a11e1656c03606

    • SHA1

      10f08cc6af71c772a045674fdc3f6c5bed882f7f

    • SHA256

      5194b6ff6ca8d57129fcd9685e495d1748d3933a3a962e00d53f046c344d1259

    • SHA512

      e8d6d854486a4fd5c643c65fea2f5518d6ef27f426c77983a31aead0e64f869dd375a7c84326c33a759681e110fffb2a42d60756aa21c561346faeb52af99147

    • SSDEEP

      49152:bFjQnjfFEokq/eG+xqIiyxU6b+rq+X6CfUBXY/JBY6r:bFjE/CxqnyKk+r1/Hr

    Score
    1/10
    • Target

      libEGL.dll

    • Size

      485KB

    • MD5

      1a0757e9814eeeaf9d6e3802d206ab94

    • SHA1

      394fdd80b8a4bf1b2263c67775b891024df673dc

    • SHA256

      8a0bcb2e1e5a9db53923a4b4a28e9d3556e143f602af5fe91354e5a06ce949e3

    • SHA512

      c4d032a9b9157aab8887abed1f434dfc8a0689a8f5a17e5340004f2df87f8422a033924eba97436ef7ad7298934e85a97f14417784b47b78e57b38c0d1c9aae4

    • SSDEEP

      6144:kTQILNFetxbb8J6AGrIKLD0Rf8KRWAwi+u7fS41stlu99N:dIDq58JFGrIKLDWNW2+u7fS41f7N

    Score
    1/10
    • Target

      libGLESv2.dll

    • Size

      8.0MB

    • MD5

      d1ff2ac8dfe49b8846208ec710c28426

    • SHA1

      d2f1d2c0805ba91c4b0963087745d0da9f85bca8

    • SHA256

      3a70592d4b77abe4005040d70647fa7db0851def813f59430418be011d1c5f3a

    • SHA512

      1e1ecd36db0a0c5dc589e29831c432773b5c001d4b9b4b3bd28ae1c0f5222b2433b5ac6099965b476fc0748531b2badbd555e3d2d9e26438b3e880eac6b1396f

    • SSDEEP

      98304:oAb24VjbjUkC/f5031ZIXytRt1lK6XC3aB:oAb24VjbIk2sEol/maB

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/@indutny/simple-windows-notifications/build/Release/simple-windows-notifications.node

    • Size

      191KB

    • MD5

      5b0aed1a4ea1055682c09e5cc97e92a0

    • SHA1

      e8040ca28bee0acb18dab7865d9778a7b596343a

    • SHA256

      c192835cf15d1cc41cea39678b9fab2e633343d559b0a705115bf35192890f43

    • SHA512

      dbedb15b9c22d6f6d51360fb5cf5583f9a07849ac0e87e6bb2847a270c324bd9296b6499c1db94a9dfe5a9ca74e5c57931c8a6f402da18fc3436c953111aa501

    • SSDEEP

      3072:yQ8+SWF2u365XvW+AuGpZIoJk/uJfc5zBPyvbomm/ThK+r:lS2cvW20I3uJ6avA/g+r

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/@signalapp/better-sqlite3/build/Release/better_sqlite3.node

    • Size

      4.7MB

    • MD5

      ca94cda7e4116a2f8a19d58b04325972

    • SHA1

      f624a90d91f54821d702ba500229b2c2f937a1b9

    • SHA256

      570b02dbcd2976dcdf21c07269551f60837d590541a8ed6e1442d917b67fe887

    • SHA512

      153d77e42675abf14b3a73401e87a41e559b2e2fab1c33194e525e1d8be33f471283def51470143bdfb496f857c7397310ebbb5a370ac82e34b11a107731010d

    • SSDEEP

      98304:G9+WpwYWzBhWr2ShZQnBFVwLW14lOAQpWcSCH:avCXWr2SX6BFVwLyUO3H

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/@signalapp/libsignal-client/prebuilds/win32-x64/@signalapp+libsignal-client.node

    • Size

      14.0MB

    • MD5

      dabdf1031ed47e231b19e88e6c1b5f84

    • SHA1

      c6940f7ba64e968a32fea4a96bcdb5219689f834

    • SHA256

      4c2943c8b7a120b4576c554ba3bd0b5fc6baaca30408b6f5167a9955c59e5168

    • SHA512

      921913acb90aa1820b041fbba6dbc60df6f46122d4e71a44ae37aa805c0270a0bed9823a3a606169a9af24e18c5cd66049c4a94d4872b6d0ed0c266cbc1f3b37

    • SSDEEP

      98304:GDGd1j/Eyh0gNfE/Xy72zXp533nAc0XTSTC7tUIaKa4CLhmdU+m0ZWi/ZRmVSK4G:515pBUIaKwhmdU67aUK4XW

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/win32/libringrtc-x64.node

    • Size

      11.5MB

    • MD5

      149dc213cf36222b0b437b45a6f2967e

    • SHA1

      9644ea5476e79718f3e99235a3c71c01eee981c4

    • SHA256

      fdb8c084ac5bc02a16ec15998acbb2bd98ab34802d870658f2604e95b25a573f

    • SHA512

      d5668205fcc2ee3d89e31a69ce486d60edebaf29095f6042b6037256dd18c8f8f3f66df8c17b16159e0a12099b9199a34b7571cbcef35b40a1d8b559b2418238

    • SSDEEP

      196608:pZd1SJZpuv3KrRCmOLALaDCbe9ji/m+5uH9qfTVpuFG:pZdM7puPKrRCmOLALaDCbe9ji/m+sH9W

    Score
    1/10
    • Target

      resources/elevate.exe

    • Size

      117KB

    • MD5

      691263b6b2e1ae67805cff0ee6c798da

    • SHA1

      8f560d7bd945dec40fdd4e971795bfe97e505995

    • SHA256

      75d197dc68e409f45c6b5820256a8073089f558a3745a3eda4f961ffa0994d08

    • SHA512

      7bcea0ae2cbd36a6da447e544e9f3244fcf6509bb011d26d700e3d31cda0a149e0f226ae7b653561e9d87fe8e44cbc34ca176f9f529f656195a18928bae52f9e

    • SSDEEP

      3072:wtbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlqKqgn:QPrwRhte1XsE1lzFn

    Score
    3/10
    • Target

      vk_swiftshader.dll

    • Size

      5.2MB

    • MD5

      bc61f9ce1ec9900d1afddc8d1937e267

    • SHA1

      3d5db748c46a4d4b23bf7b2172a82e86f51e2264

    • SHA256

      49b749416441f09a6e01d95aba7ea11b3291fb295d19692fc8d4940814cd1eaa

    • SHA512

      cf30ed57dfdfddbed90b5105ef9a47fa03b551bd1f1f182dde97e485e6b53a39ead4bd983d665091dc18685a83b33790de15c4f8905c3e5e8ddcfb635d401edc

    • SSDEEP

      49152:kCGM4oeoplNc2pKVnr3AvCCLOySISecKTBMqIxDu99Frv/TJgcs10ZxkWidfOvkc:M7oeop/7ZjrXtxsZBVK2c

    Score
    1/10
    • Target

      vulkan-1.dll

    • Size

      886KB

    • MD5

      0483a12dca5f2bce7d5ebe78841fdedf

    • SHA1

      7137cfafe75c3750ef0cee7467a32ea08e8d7326

    • SHA256

      ac4f4abf36cb935bd84728b2efa4f027053b13a4707da1639049290366399cf9

    • SHA512

      ed4a777dde64b5f07870805184a0b58db313eb0adf7c39f439649a030f083fc90fc319f9379ce347b17bbee53263bef100b36f8917364646ac90b8f71b56a803

    • SSDEEP

      24576:avBtBPI5xicAl7igP7O6Z5W1DYsHq6g3P0zAk7/BoxMKqzN0:aZQ3Adn7O6Z5W1DYsHq6g3P0zAk7+b

    Score
    1/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ec0504e6b8a11d5aad43b296beeb84b2

    • SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

    • SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    • SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • SSDEEP

      96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr

    Score
    3/10
    • Target

      $PLUGINSDIR/nsis7z.dll

    • Size

      424KB

    • MD5

      80e44ce4895304c6a3a831310fbf8cd0

    • SHA1

      36bd49ae21c460be5753a904b4501f1abca53508

    • SHA256

      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

    • SHA512

      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

    • SSDEEP

      6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

zloader
Score
10/10

behavioral1

discovery
Score
4/10

behavioral2

discoverypersistence
Score
6/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

persistence
Score
6/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.