f7f2335afde689822c6e070e4920871d204f86a1977dadcb5fb89aae8a18f9c9

Sharing

Copy URL

Twitter E-mail

General

Target

kmax Setup 1.0.0.exe
Size

90.6MB
Sample

250328-l4869awpt6
MD5

f65ec6d28990c6219bcdc223af914505
SHA1

688cf51c68a97da1fe7e169b3a99e9406c17e9d4
SHA256

f7f2335afde689822c6e070e4920871d204f86a1977dadcb5fb89aae8a18f9c9
SHA512

ff3a653075c1ede51372413d4abae42a7b4ec31e0f756e4f5c6a3f1f79523385b5dbbdc253fa890db401ef2ac891e9434a4885528a7d6db87dcf858e6f2a4764
SSDEEP

1572864:U++BWqL9BHOKcHAPaG9wL7uwbzMwESLBsGPC7V6OcUcZyxmVBH43iWsfyAK5Roq0:UPB1+KG69wLSwbBES1s4C7H6MxmVBY3Y

Score

8^/10

Malware Config

Targets

- Target
  
  kmax Setup 1.0.0.exe
- Size
  
  90.6MB
- MD5
  
  f65ec6d28990c6219bcdc223af914505
- SHA1
  
  688cf51c68a97da1fe7e169b3a99e9406c17e9d4
- SHA256
  
  f7f2335afde689822c6e070e4920871d204f86a1977dadcb5fb89aae8a18f9c9
- SHA512
  
  ff3a653075c1ede51372413d4abae42a7b4ec31e0f756e4f5c6a3f1f79523385b5dbbdc253fa890db401ef2ac891e9434a4885528a7d6db87dcf858e6f2a4764
- SSDEEP
  
  1572864:U++BWqL9BHOKcHAPaG9wL7uwbzMwESLBsGPC7V6OcUcZyxmVBH43iWsfyAK5Roq0:UPB1+KG69wLSwbBES1s4C7H6MxmVBY3Y
Score

8^/10

discovery credential_access spyware stealer
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  resources/app.asar.unpacked/node_modules/ilovingcats/dist/index.js
- Size
  
  412B
- MD5
  
  0b33e83d33b01a51625a0fdcbef42ce3
- SHA1
  
  1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA256
  
  a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- SHA512
  
  1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
Score

3^/10

execution
behavioral11 behavioral12
- Target
  
  resources/app.asar.unpacked/node_modules/ilovingcats/prebuilds/win32-x64/node.napi.node
- Size
  
  137KB
- MD5
  
  04bfbfec8db966420fe4c7b85ebb506a
- SHA1
  
  939bb742a354a92e1dcd3661a62d69e48030a335
- SHA256
  
  da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- SHA512
  
  4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP
  
  3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
Score

1^/10
behavioral13 behavioral14
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
- Size
  
  1.8MB
- MD5
  
  66a65322c9d362a23cf3d3f7735d5430
- SHA1
  
  ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA256
  
  f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- SHA512
  
  0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP
  
  49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
Score

1^/10
behavioral15 behavioral16
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size
  
  224B
- MD5
  
  f0a82a6a6043bf87899114337c67df6c
- SHA1
  
  a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA256
  
  5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- SHA512
  
  d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
Score

3^/10

execution
behavioral17 behavioral18
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
- Size
  
  59B
- MD5
  
  8582b2dcaed9c5a6f3b7cfe150545254
- SHA1
  
  14667874e0bfbe4ffc951f3e4bec7c5cf44e5a81
- SHA256
  
  762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- SHA512
  
  22ec4df7697322b23ae2e73c692ed5c925d50fde2b7e72bfc2d5dd873e2da51834b920dea7c67cca5733e8a3f5e603805762e8be238c651aa40290452843411d
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
- Size
  
  6KB
- MD5
  
  275019a4199a84cfd18abd0f1ae497aa
- SHA1
  
  8601683f9b6206e525e4a087a7cca40d07828fd8
- SHA256
  
  8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- SHA512
  
  6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
- SSDEEP
  
  192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
- Size
  
  1KB
- MD5
  
  e5c2de3c74bc66d4906bb34591859a5f
- SHA1
  
  37ec527d9798d43898108080506126b4146334e7
- SHA256
  
  d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- SHA512
  
  e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/src/backup.h
- Size
  
  6KB
- MD5
  
  29dd2fca11a4e0776c49140ecac95ce9
- SHA1
  
  837cfbc391c7faad304e745fc48ae9693afaf433
- SHA256
  
  556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
- SHA512
  
  5785667b9c49d4f4320022c98e0567a412b48a790c99569261c12b8738bde0b4949d3998e2b375540ede2ff1d861cad859780ade796b71d4d1d692e1ed449021
- SSDEEP
  
  192:jXmQS7rRLcxPsPVHXmIXYIyx15kPhw0Io:j2QS7rRLOPs5e0
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  resources/node_modules/axios/README.md
- Size
  
  63KB
- MD5
  
  7904f8d7d78d730e4a6b95d0eeab177d
- SHA1
  
  249b236d609aa9ef726a4dc4599fb7c676db119a
- SHA256
  
  a888519b313372de0867d68b98cfd2e82f42d890db0992a78fc57df860245364
- SHA512
  
  9ac48b7eff6bfed2e9f8299fe276aec1893e9c1ee708fd29a04861ce6d3328ef414fb3cc856c58276cd36cb4ca2426298743edef745752d606c1b76ae3d0f478
- SSDEEP
  
  768:vo+T+q+qAXNGvNtJXDvBTZXRgBPMVraLRYpO3rzSPpSuvmDfyTGED07NIp9WQh50:vo+TB+VaNSBSVpmU9t0
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  resources/node_modules/axios/dist/axios.js
- Size
  
  140KB
- MD5
  
  7894529ad1a8ea15d3c032969ca9895a
- SHA1
  
  98e179d567c3304ad4873b68fb32b765e7aaffa8
- SHA256
  
  13f2d407139e344942f2aa0df330113125d9c3f45c9c545031297d793dc5cdb2
- SHA512
  
  199ded09383f7e6b816dc73736515e123cf6528cf0d9d1f7f5e3e7b732d43cc4fe63eeb2bc7e94d9263b4a82e115195e6ee3d69b077e99a7c04a46a5512346a0
- SSDEEP
  
  3072:bU+3ihQwj6scu1jx70wBI+Pxqh0DqS6wJ0rmri6oA:AvhQwkwFpc0GJwJ0r3fA
Score

3^/10

execution
behavioral31 behavioral32