80f0bed717cec18b62ab72b55472c3df97177bc9e698dad712db053004c73844

Sharing

Copy URL

Twitter E-mail

General

Target

Iy0xqmfv6DsNdAB.exe.zip
Size

69.9MB
Sample

250124-1k3bxs1paj
MD5

f3a2be7eae32eb58a0635d79775675a0
SHA1

9a40897cdfa6db173f169f95600025d6a0399c3c
SHA256

80f0bed717cec18b62ab72b55472c3df97177bc9e698dad712db053004c73844
SHA512

da9f67aa8e24db1decb535dbb5eccb687fe23be76efe807355a78ac7db314f1a8e9af4074e5d8d5d45617a7360451cc5690c3e5cf1e09d712d502117e6278c92
SSDEEP

1572864:NHNWq5yRvv6VRhIlN1evrM2HnKDU+aBsgIe8LWpFaW4nrB4ewpCr9:TWq0RvJT1eI+gxaqgIe8+FaBt4l6

Score

8^/10

Malware Config

Targets

- Target
  
  Iy0xqmfv6DsNdAB.exe.bin
- Size
  
  69.9MB
- MD5
  
  6d99c86ea889c64bd93096e46f4ff001
- SHA1
  
  24d4ce27f0c18718c1bd2c0e88929a23a2b687d6
- SHA256
  
  2cc2c009340d8c77f3e645ccbffa9194961637e1a11ec75af0557d4a3eb7aaa5
- SHA512
  
  546a1f4240224b4f0b5b1b263963a217834d2c5f41cc54409f7ec64ac985c867bfa474b2dbd06600568cb46e7dd8007e05d016b9d374f51ebbf41b75313fe49f
- SSDEEP
  
  1572864:7zFnFZA3ffM7zCw1suxfW444XH/CTri00+Hd75No7:7zHK3ffqzCUsuo444XH67PQ7
Score

8^/10

discovery credential_access execution spyware stealer
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  1z.exe
- Size
  
  155.8MB
- MD5
  
  70a34191dc95920a76e2a753e6745891
- SHA1
  
  3eec8a392ea7862ab98ba9cee175a83335f8a3bd
- SHA256
  
  6a36e2616c7a3136d1ab925b75972a526493470f1513a35575e24c68a5e592a9
- SHA512
  
  f06f81d31d15a3c3a7cbc9b50a3888e3c3465926bd6935c996c4367fc137a529ac1748fca04be22f3f2f76de1c5b1fa2cb5053c8ed1adca6af2f6a7e348c171d
- SSDEEP
  
  1572864:QVU4t/Ct6JMgabao+nh+bw4FlWMZBZHuoM2t52kOUeEbaVO7GJbdHDexdypGT+LY:GYUJkH0sEQ
Score

8^/10

credential_access discovery execution spyware stealer
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Enumerates processes with tasklist
  discovery
behavioral7 behavioral8
- Target
  
  LICENSES.chromium.html
- Size
  
  7.9MB
- MD5
  
  0e3e4362f785aff0b9e1852b1064c0f1
- SHA1
  
  a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA256
  
  bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- SHA512
  
  193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP
  
  24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral11
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  d5e1f1e9d0ccfe7f21b5c3750b202b4d
- SHA1
  
  74144ac93c0c58a9b9288bce5d06814c9a1b1dc2
- SHA256
  
  e1ab367644f72ebcdc8eb3fcfe829ff51719559ac2a43a1600e712b16871ad65
- SHA512
  
  dcf70d43f1a83c424be99c38e33e520c72115c3d30945980e5e394d460462251bde309e543213b2b08dcbe9769d11d46792e1cc99aa42777fcc34d6f3361a3d2
- SSDEEP
  
  49152:EZ2KxYmwFfgQQs0ShPrF0/zO6R0gRhPj3hTUctrRhuwSnKxqgI5IN8N3lzl3hqzb:Aofp1Pyi54wnKxqg4INhhd
Score

1^/10
behavioral12 behavioral13
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  dd78b86b3c92d61c37b44ef5b157cfe0
- SHA1
  
  4dcf9ebc3ff5ca552c0e83469b921153b29aea1f
- SHA256
  
  e142752e073c0051a0beb963981af70263ed673959515545521a7941d3230838
- SHA512
  
  9d071568dc56db2ab93d034d07a11a477aab8ac50d9ea3c4db3ac4866fcd3c2f3002ba7a3f2c55589a9d68463181fc7a03327dc164310d7e80e30cc6f6bf2423
- SSDEEP
  
  6144:s4itlpEJVqKqK5Z5UibKsBHI0Sfnx+lXGpeOQHA93GT3sm:s4itlpAqKqK5Z5U+jBolfnjIyG
Score

1^/10
behavioral14 behavioral15
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  af3792b63af63408a40604184ea6ef7f
- SHA1
  
  b4d577e1c7ca0d4d3a34e2edb919cf58e6b62952
- SHA256
  
  b0ff1bad8e2f34b12dfcc4b5387bdc042f9bc2f963e11dea1758397ca0e907ea
- SHA512
  
  d413c52f7c82dd17f06002f3ca6bc3efcf4e11e88379d989d982b2f9f47b71643971c4988abee2dc1212027b2cea148a8849bcb442dd4dbcd8e26ea892dd7a58
- SSDEEP
  
  49152:x2b3imtb1uWsvZRUCXQNMBbGUa/XFfOpvQnDwX+xjA7LAIgRg37QiI+id3pFJs7w:x7RWft4NV+sduHox6gWE5lHaFX
Score

1^/10
behavioral16 behavioral17
- Target
  
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size
  
  412B
- MD5
  
  0b33e83d33b01a51625a0fdcbef42ce3
- SHA1
  
  1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA256
  
  a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- SHA512
  
  1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
Score

3^/10

execution
behavioral18 behavioral19
- Target
  
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
- Size
  
  137KB
- MD5
  
  04bfbfec8db966420fe4c7b85ebb506a
- SHA1
  
  939bb742a354a92e1dcd3661a62d69e48030a335
- SHA256
  
  da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- SHA512
  
  4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP
  
  3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
Score

1^/10
behavioral20 behavioral21
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
- Size
  
  1.8MB
- MD5
  
  66a65322c9d362a23cf3d3f7735d5430
- SHA1
  
  ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA256
  
  f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- SHA512
  
  0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP
  
  49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
Score

1^/10
behavioral22 behavioral23
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size
  
  224B
- MD5
  
  f0a82a6a6043bf87899114337c67df6c
- SHA1
  
  a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA256
  
  5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- SHA512
  
  d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
Score

3^/10

execution
behavioral24 behavioral25
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
- Size
  
  59B
- MD5
  
  8582b2dcaed9c5a6f3b7cfe150545254
- SHA1
  
  14667874e0bfbe4ffc951f3e4bec7c5cf44e5a81
- SHA256
  
  762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- SHA512
  
  22ec4df7697322b23ae2e73c692ed5c925d50fde2b7e72bfc2d5dd873e2da51834b920dea7c67cca5733e8a3f5e603805762e8be238c651aa40290452843411d
Score

3^/10

execution
behavioral26 behavioral27
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
- Size
  
  6KB
- MD5
  
  275019a4199a84cfd18abd0f1ae497aa
- SHA1
  
  8601683f9b6206e525e4a087a7cca40d07828fd8
- SHA256
  
  8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- SHA512
  
  6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
- SSDEEP
  
  192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
Score

3^/10

execution
behavioral28 behavioral29
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
- Size
  
  1KB
- MD5
  
  e5c2de3c74bc66d4906bb34591859a5f
- SHA1
  
  37ec527d9798d43898108080506126b4146334e7
- SHA256
  
  d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- SHA512
  
  e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
Score

3^/10

execution
behavioral30 behavioral31
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/src/backup.h
- Size
  
  6KB
- MD5
  
  29dd2fca11a4e0776c49140ecac95ce9
- SHA1
  
  837cfbc391c7faad304e745fc48ae9693afaf433
- SHA256
  
  556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
- SHA512
  
  5785667b9c49d4f4320022c98e0567a412b48a790c99569261c12b8738bde0b4949d3998e2b375540ede2ff1d861cad859780ade796b71d4d1d692e1ed449021
- SSDEEP
  
  192:jXmQS7rRLcxPsPVHXmIXYIyx15kPhw0Io:j2QS7rRLOPs5e0
Score

3^/10

execution
behavioral32