Extracted

• • Target

    Valid8Proxy/Data/Jint.dll

  • Size

    244KB

  • MD5

    734c5ce8f9b104d8ad3c7b494e96f9b9

  • SHA1

    184cd4152b1b65d9531867b06c2e1c215fb872f1

  • SHA256

    ed618668ae9e7c02c7c2b7332dd09079168cca96432a051044683c996337001c

  • SHA512

    1e3ac0649e3b7bf9e97681aa7b1346aa44afe96d8c86fc77a6e002b8cf5b14b1a57f19f669ed0d4ae9a94d3f65d4eefa99dcffcf5d74afc8731f913c9c9f79d6

  • SSDEEP

    3072:hE1DupDOGfyKkpsZa27k5t0f5jjBWV239UDjRFAkqYL36ZmvYYGUaKTUCRaikNrJ:hjyQlGunmvjPa2vRQrXPHNQHsq5+L

  Score

  1^/10
  behavioral1behavioral2

• • Target

    Valid8Proxy/Data/Leaf.xNet.dll

  • Size

    142KB

  • MD5

    2c607159e31c1e091697e74efa5cfebe

  • SHA1

    874d28447e5c1d7583f413db85049bf17de830b5

  • SHA256

    056900c587b7e574ccd154a83fe299bada653347c3862076b0ef6035039c0bec

  • SHA512

    bfe7b463db8f0ef5981b4cdf22d2815ec10a941fb7cdeff4a861626f1fa9a29f913c5e971b257a5d206965e1300328b7530c40692889d9065ab95d63a63fe55c

  • SSDEEP

    3072:iKpUZ/x+t38Q4I2T4EFWX66sU9/dfYJd:vUZ/x+tMnI2T4/XN

  Score

  1^/10
  behavioral3behavioral4

• • Target

    Valid8Proxy/Data/Modules/Checker.exe

  • Size

    9.9MB

  • MD5

    a609164d1658cf3bdd653a05865f5eae

  • SHA1

    487232488b7d1c4af50c19e2c641989fe6f98911

  • SHA256

    f63016e0eb409846aced10ccc9a632cd6ff567a76eafb659b3a23e48a79dbacc

  • SHA512

    49d50a708596bd8823a3e203669a4369dd81545d8416122284d7b26d26502d3c7627ef150a76d8224507e77ec0e8ca1e8306acd411f07ebb6902d367b3129cfa

  • SSDEEP

    98304:uglet6sFODTir3/pi9Arhsmu+bPBEOWGgbZm9Fzl:ugxsFODGrschsmumPCxUz

  Score

  6^/10

  persistence

  • Adds Run key to start application

    persistence
  behavioral5behavioral6

• • Target

    Valid8Proxy/Data/Modules/Checker1.exe

  • Size

    12.1MB

  • MD5

    c80d62ea9392b55404d34513ea87aac8

  • SHA1

    47fbed6b45f7ec59f64f2328cb5c2397102fcbf2

  • SHA256

    0ec753374174c21ad50f39c68611bab1fc687c8359c2fe8d5cdb24c9c859fa77

  • SHA512

    3f9a47489b66e8f9a093b69bbd7a4d3a4793fcab24a48a86233244b4a7204a7eaa4b0e93078632b4131f7275970189b7aeb41bc395a9798ce989b63f949c6511

  • SSDEEP

    196608:99EaY7HakrIK63UtauZijIXMCHGLLc54i1wN+gPIcu9KYK39shSEo3PPyIkMeKOO:IPae63hucsXMCHWUjvcuId9/PyjrF

  Score

  7^/10

  • Loads dropped DLL

  behavioral7behavioral8

• • Target

    Valid8Proxy.pyc

  • Size

    11KB

  • MD5

    430e5da13005a3086397b5935ba25fbf

  • SHA1

    ec1ee42e9ad3196edb2afe9ee73080c7d1cbc5be

  • SHA256

    bd7f72d6e89b5dd538f5b6b9483971d4c5d004f197efbc305ea73625f173acb3

  • SHA512

    a332f0c63a8c93da26c4af99a6fd5bf92e05eec6eb41fa5bc03b29d18da85dea33e2885dc76a6dbb97f2f91a711e5362dffc468b5d3e550bb7c4854be9a80cc0

  • SSDEEP

    192:daQa99LRLnTXXXAXBXuX1JeKx+QtO8kRX4bjrlVPGNMaS54EVfuNhimXNVQEEFkE:daQaHxZkxqjTNQxZ2e0259y

  Score

  3^/10
  behavioral10behavioral9

• • Target

    Valid8Proxy/Data/Modules/Jint.dll

  • Size

    244KB

  • MD5

    734c5ce8f9b104d8ad3c7b494e96f9b9

  • SHA1

    184cd4152b1b65d9531867b06c2e1c215fb872f1

  • SHA256

    ed618668ae9e7c02c7c2b7332dd09079168cca96432a051044683c996337001c

  • SHA512

    1e3ac0649e3b7bf9e97681aa7b1346aa44afe96d8c86fc77a6e002b8cf5b14b1a57f19f669ed0d4ae9a94d3f65d4eefa99dcffcf5d74afc8731f913c9c9f79d6

  • SSDEEP

    3072:hE1DupDOGfyKkpsZa27k5t0f5jjBWV239UDjRFAkqYL36ZmvYYGUaKTUCRaikNrJ:hjyQlGunmvjPa2vRQrXPHNQHsq5+L

  Score

  1^/10
  behavioral11behavioral12

• • Target

    Valid8Proxy/Data/Modules/Leaf.xNet.dll

  • Size

    142KB

  • MD5

    2c607159e31c1e091697e74efa5cfebe

  • SHA1

    874d28447e5c1d7583f413db85049bf17de830b5

  • SHA256

    056900c587b7e574ccd154a83fe299bada653347c3862076b0ef6035039c0bec

  • SHA512

    bfe7b463db8f0ef5981b4cdf22d2815ec10a941fb7cdeff4a861626f1fa9a29f913c5e971b257a5d206965e1300328b7530c40692889d9065ab95d63a63fe55c

  • SSDEEP

    3072:iKpUZ/x+t38Q4I2T4EFWX66sU9/dfYJd:vUZ/x+tMnI2T4/XN

  Score

  1^/10
  behavioral13behavioral14

• • Target

    Valid8Proxy/Data/Modules/Newtonsoft.Json.dll

  • Size

    695KB

  • MD5

    715a1fbee4665e99e859eda667fe8034

  • SHA1

    e13c6e4210043c4976dcdc447ea2b32854f70cc6

  • SHA256

    c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

  • SHA512

    bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

  • SSDEEP

    12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7

  Score

  1^/10
  behavioral15behavioral16

• • Target

    Valid8Proxy/Data/Newtonsoft.Json.dll

  • Size

    695KB

  • MD5

    715a1fbee4665e99e859eda667fe8034

  • SHA1

    e13c6e4210043c4976dcdc447ea2b32854f70cc6

  • SHA256

    c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

  • SHA512

    bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

  • SSDEEP

    12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7

  Score

  1^/10
  behavioral17behavioral18

• • Target

    Valid8Proxy/ProxyChecker.exe

  • Size

    582KB

  • MD5

    82c493c58ad0ed2255d1500840d1d75c

  • SHA1

    24b2997983add8d90e896af2dbdc32cf19895389

  • SHA256

    325a912d9f9f4878cfc13a45a2da2494b4c4080c39d8a40166eb39c6ef3d24a0

  • SHA512

    68f91fe3693dffdaadf28ad5dd3719cdfddff6e4729f48774ae336aef97908d8bc2c419aff65a7d4cbe24e2b85ea2f311dfec2de1136ed7fd7374d2d3ead8c88

  • SSDEEP

    6144:oOaTmuaJ0GFRabVg8O1lFrRawLmKx85EJXlkc3rNPWyXJJy1LDR6qwYelXN1C4q1:oOSmvFobVgZtCKZX97NPWyXgteYILQ

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral19behavioral20