zloader | 55309a4905c0c074bb9b488a58314dc58d89dea1a8f6963a367c3a62110592c6

Sharing

Copy URL

Twitter E-mail

General

Target

RetracPatcher.exe
Size

83.2MB
Sample

240921-ynjymszfqh
MD5

d8b516ccd538b7fb0b43887437955737
SHA1

80682e6da24c2f43efea4a7c122c8622a083e901
SHA256

55309a4905c0c074bb9b488a58314dc58d89dea1a8f6963a367c3a62110592c6
SHA512

12c017f28753e859ae13127edb9a859c299d6567d5529d72c01293d7fc949d16f2c2c32edcc720765aea66457807757973ef1d4ecf2a3b74b2108dfed668a42d
SSDEEP

1572864:DC/xlZ1DRUH32qZ0QaTY5pONinTIXK7hqsAyUhEvpPLjjW:DYTAPO4nsayyUmxPLW

Score

10^/10

Malware Config

Targets

- Target
  
  RetracPatcher.exe
- Size
  
  83.2MB
- MD5
  
  d8b516ccd538b7fb0b43887437955737
- SHA1
  
  80682e6da24c2f43efea4a7c122c8622a083e901
- SHA256
  
  55309a4905c0c074bb9b488a58314dc58d89dea1a8f6963a367c3a62110592c6
- SHA512
  
  12c017f28753e859ae13127edb9a859c299d6567d5529d72c01293d7fc949d16f2c2c32edcc720765aea66457807757973ef1d4ecf2a3b74b2108dfed668a42d
- SSDEEP
  
  1572864:DC/xlZ1DRUH32qZ0QaTY5pONinTIXK7hqsAyUhEvpPLjjW:DYTAPO4nsayyUmxPLW
Score

9^/10

discovery credential_access persistence spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  9.0MB
- MD5
  
  f017c462d59fd22271a2c5e7f38327f9
- SHA1
  
  7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
- SHA256
  
  40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
- SHA512
  
  72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
- SSDEEP
  
  24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  OGFnPatcher.exe
- Size
  
  177.3MB
- MD5
  
  82db6baf5501b11cf7582d68cb173689
- SHA1
  
  ff40fcae2ecfb00eb3f1a36521afbdc93db1e6e6
- SHA256
  
  17f48d532943a1160b9c171e183599d28b3a03b4943df8d1b5f8af2aaed142fc
- SHA512
  
  9d47fc31fec0379b7ec6461401e5cda54f7b64d6ff0a30136e5ad58bb94446cfa6f1e511380eb5bf99f59174e56fdc7a7cd06cf7cf46898c672bf37c36ec4d82
- SSDEEP
  
  1572864:s+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnau:sA5kyGScXQT
Score

9^/10

credential_access discovery persistence spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Enumerates processes with tasklist
  discovery
behavioral13
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  a7b7470c347f84365ffe1b2072b4f95c
- SHA1
  
  57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA256
  
  af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- SHA512
  
  83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP
  
  49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
Score

1^/10
behavioral14
- Target
  
  ffmpeg.dll
- Size
  
  2.8MB
- MD5
  
  ed10fd2777a030b2895d2f555207f1b3
- SHA1
  
  81448e7a72e49eff746abbedea503139b7eadbdd
- SHA256
  
  996aed5bb751d70e215bcc3e5be2ed28fb54412af05031c592df101b51232e0c
- SHA512
  
  435f33fd11fc25a495726401211ed87771c831eab8916b8bb9520bf0f799646f911b22716f090849bfc85e2372cd28aa1c9de46f9d613929993ef009955173e9
- SSDEEP
  
  49152:nFjQnjfFEokq/eG+xqIiyxU6b+rq+X6CfUBXY/JBY6:nFjE/CxqnyKk+r1/H
Score

1^/10
behavioral15
- Target
  
  libEGL.dll
- Size
  
  473KB
- MD5
  
  e3f6c7b1316f7ca06ee178377ce16ff7
- SHA1
  
  f546da89ec0d3ef238892be8f2dd697d411518bb
- SHA256
  
  ff6d4f18492a704b4b9d853abdcc73a4fa561b0c685619508e25afaf4e4800b9
- SHA512
  
  cad4026efc48192c4904a4b0ec583d2e24b94f8a5f91824716eddb32477512799b10a4f9cc7a2976a25ca0d333bb1c68bb98b1d0f9bd7020e0e31be7d950720b
- SSDEEP
  
  6144:7TQILNFetxbb8J6AGrIKLD0Rf8KRWAwi+u7fS41stlu9:4IDq58JFGrIKLDWNW2+u7fS41f
Score

1^/10
behavioral16
- Target
  
  libGLESv2.dll
- Size
  
  8.0MB
- MD5
  
  ac216b22cb7ca21d9803ae6b111792e5
- SHA1
  
  f6678626aa522628110315889ca744572549bb73
- SHA256
  
  3cd10952ba73ba4a36f5ec92dcbb0893092bfc8d77a381f6f9f3090b0ecfbb50
- SHA512
  
  df344f79ff5d4e38b451bea948c234b63af0402565097082a082b44a4efb9e0ed367884875cbc817237b7ae7ac126fc7de0e8615504923b8db553c1a3a985a90
- SSDEEP
  
  98304:dAb24VjbjUkC/f5031ZIXytRt1lK6XC3a:dAb24VjbIk2sEol/ma
Score

1^/10
behavioral17
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
- Size
  
  1.8MB
- MD5
  
  66a65322c9d362a23cf3d3f7735d5430
- SHA1
  
  ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA256
  
  f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- SHA512
  
  0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP
  
  49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
Score

1^/10
behavioral18 behavioral19
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size
  
  224B
- MD5
  
  f0a82a6a6043bf87899114337c67df6c
- SHA1
  
  a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA256
  
  5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- SHA512
  
  d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
Score

3^/10

execution
behavioral20 behavioral21
- Target
  
  sqlite-autoconf-3440200/Makefile.fallback
- Size
  
  547B
- MD5
  
  8ff4cdbeec29d794549a0aa48da06bc3
- SHA1
  
  7fd897fc720b6c9c6f760867c97a95431fa4693e
- SHA256
  
  67d473327dd92f5cad68fddb78b8bb3e8745aba851147945893e4db5a2b59892
- SHA512
  
  9871a654d8b140ad5d6768d385b86ba7f32927f8ed6374e62c93db99be4a40841f6900d648f33d07dc118b6ea93f00c45f53e4b675643b2b487c9c0df1ea1474
Score

1^/10
behavioral22 behavioral23 behavioral24 behavioral25
- Target
  
  sqlite-autoconf-3440200/Replace.cs
- Size
  
  7KB
- MD5
  
  335ee30449b5d0d52ab314dbff93d52f
- SHA1
  
  02c67258801c2fb5f63231e0ac0f220b4b36ba91
- SHA256
  
  74ba0687a84c328df2836f73d7d36368099a5f5c1c360a84211e51fa71f1dfc0
- SHA512
  
  02f40bc955c833105811f78471e29f062c1cebfe4bd96ffba941670c0026ad5bbc81f336b7c2c6b9f804c67ed46c9dabab927ec0fb4c709bd7a049454f27073a
- SSDEEP
  
  96:lJC/3zjNPMMQIQBmajlyM3px6D3t1KO4vNoHyJ:l0iAM3vlO4vNcyJ
Score

3^/10

execution
behavioral26 behavioral27
- Target
  
  sqlite-autoconf-3440200/aclocal.m4
- Size
  
  364KB
- MD5
  
  6f9e7a7b0ab591c27b3cbf01a3c1036a
- SHA1
  
  1f464e1017c18769c630a1d4fbfe9acd57a303ec
- SHA256
  
  a459cf9e72aa3bf51c748226e37c2e192144047e3b1a5173119b92fa62f2bf82
- SHA512
  
  aa0aec1a3442ecf4bbcdb908f32d72803e0988ca0b3d6ebaf32a49a2a898328c3bb71cf77ca3b062d55ccec9d86953fa52ddf02460d7724de09a4efb38d8ef7d
- SSDEEP
  
  6144:tdAwSQSqrgHFnOvwYAU9FWgi/2WDg5+YaNk56cHrYw+Zg+XrZsGEREYRGAFU25tt:rAtM7E0LQNnc
Score

3^/10

execution
behavioral28 behavioral29
- Target
  
  sqlite-autoconf-3440200/configure
- Size
  
  485KB
- MD5
  
  a3cfbb77ff42001bb363783c3b2dd261
- SHA1
  
  9b222ed32dd27dc2b2bba00e7c2fbd1a0ac5974d
- SHA256
  
  e4fd1a4c97d06f37d55eadf277cbcc62f01bf505c743ae50db90117457042c20
- SHA512
  
  6e6a70a449d52ebe05b74124ba47476764bc3c0d640b3f32d6f9b46fe31b1842fb469792705215627398c88e0f0a0f64f1590e438f0bce92bedca1c68ebb0cd5
- SSDEEP
  
  6144:X0hKTRerWD0QrR482PTxJToVL6APIudUVQUszNr3+5c+D+hmCk7XDSy+va++XYK4:ChKIJ3C1IJ4p5Z7H1eAvySpjxhH
Score

1^/10
behavioral30 behavioral31
- Target
  
  sqlite-autoconf-3440200/install-sh
- Size
  
  14KB
- MD5
  
  b090c5891571c820e91d345a9551af44
- SHA1
  
  894e0a9de7976233743575c6b84dedc1b37025b6
- SHA256
  
  3d7488bebd0cfc9b5c440c55d5b44f1c6e2e3d3e19894821bae4a27f9307f1d2
- SHA512
  
  e9ed1ec4b9903ccca1d2d7c224200aaa194f22e6ccbcc2a3a595f38f5e3bf04177bcfac4ae12310bb91262ad8aa3f63420d795a42fb08d95296e0836f4c6a5e9
- SSDEEP
  
  384:9dj/jriL5B5hZgfViYUnMRLMRfur6vTUk9J3kX/sddHswFhTmrVxPD:9l7e1B5hZgfViYeE+ur6bUk9J3kvsddg
Score

1^/10
behavioral32