1cab1a7d98db28873ed7a2b7a034d58eb309ed61de8df26b785853e62ee04ab6

Sharing

Copy URL Twitter E-mail

General

Target
Merluis - Original PROTECTED.7z
Size 145.9MB
Sample260407-s8dpgahs5l
SHA256 1cab1a7d98db28873ed7a2b7a034d58eb309ed61de8df26b785853e62ee04ab6
MD5 6b48e06ee824fdc3b89e852e898b62ca
SHA1 62548f30ba9887a734d49c3cb1af2c7b471631cd
SHA512 60102ea006caa5ed1d87c0705103b56713d678087f7f14dcc23aeed8c0d15ae75d0a72b846cc5de09a6b4b0d7e650c7922d32645a700f15c484d38633d051bc0
SSDEEP 3145728:ug4BcbTljE06dfAMJ9QGoA6hC9Q7arVdeapeI:ug4BclIrfAw9QGRiw1pn
TLSH
T15178338C054F7634F88901A5F9C892D2838BD4D4760B71FC7F2F2D1A99D4AE3E58B896
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Merluis Setup 2.0.0.exe
- Size 146.0MB
- SHA256 bd3997c44f1820eccc6574ee003bf5319b6a27d28e782937271c6ae190af024d
- MD5 6cda615633eadf8cb0529efc6c722973
- SHA1 5574dee4b8874c2175c852c1dbfec272db48778e
- SHA512 9f89acc6703a25b8a34af6cd1dd1f164156db479507fae93663f81ee02a79b055ba30e07c2675b691698f7fd4893e3207c36a4593a8f716923cccde7853e9a69
- SSDEEP 3145728:/72DhEj3FrORmO2uPL8i3VKIbN3kiG9nw6ZHVxa5aLh+ju8vdUq:DMY3KLAiFD30RZHVw5Oh+juK
- TLSH
  T1937833C291A9D47AE6EB7533D5797EB560352FAE3E22AAC35409B081EE33DD02C41D07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 145.1MB
- SHA256 7ce28826c1994c785b86b6655fc67841559be28aa8fa3825efc22599346a9671
- MD5 e877d16b69ebdab23faf5050637bfe01
- SHA1 b92580bd772e739b014e067fbd2a9a7561a35ddd
- SHA512 8138a524580c304e9e042ce2af5f0c453ffd829a6b915ac1bc60d1219281c8c9a73bbb74cef9a6abf4cf0c8c259bb9a52cf7efeefd3e8ff8230ce255cd8f9817
- SSDEEP 3145728:x2DhEj3FrORmO2uPL8i3VKIbN3kiG9nw6ZHVxa5aLh+ju8vdUP:xMY3KLAiFD30RZHVw5Oh+juv
- TLSH
  T1D17833C291ADE47AE6FAB663D17961B56439276E3E22AEC3140DE0C1DE32DD03C41D1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSES.chromium.html
- Size 14.5MB
- SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
- MD5 b5e57572cfb5efa08f55f46772a42ded
- SHA1 51db84dada057af72e2fb8acca3ee4436e4bd3ed
- SHA512 288bcbf48f928866a0d2910fe57cfbc040f23b533bbdf4ef6fa43631edf6035d689ea41643b3afe833cb7476ecb2fbb932f137f3734df8462898c4837f6096eb
- SSDEEP 24576:6eBHJjZ6vobjZ6Mt3jK6DCHwR2auHxKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61J:6er8aeUSn8mMRx5
- TLSH
  T184E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  Merluis.exe
- Size 200.4MB
- SHA256 6f6ee4710884d7b9a6fe498ffe66d0833ccdaddc2a99dff529a42fce2ed32d50
- MD5 39055af3485c58631341edae17938ad2
- SHA1 a39d652c686c6a0ba4b27533676c5ae68ed19e8a
- SHA512 8ff4b3b885b713d82ead543adfc409b6ae2dbcaf935317edaf8c45bc71a03089c1b012ea6cc940a049a7865a30e27bb2c8c0d732dce6ad1df653b1b28c39d46a
- SSDEEP 1572864:FqaVl3T8N+NCd7+PthILD+LM7ug9a/QqTxcqJf1WWJbYUZZv4I9ihgLrAwqi9mLy:MaVlD8Np7+VsITcrMJLg
- TLSH
  T1A9A88C03E29641D9E05DD175974A9633FE72B8094B28A3DF2B5407922FB7EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
behavioral15
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 e5269bf9b9b9451a2031cb36cac2a349d8237bc603763f9bbd87aa2ea26a9d5b
- MD5 d956e81791d9896d939b65c44f811c3b
- SHA1 321c7b5806ed816db37d003c081ab13c878a21d0
- SHA512 da922b0dd6f2958b35ab5cb5e97a670df2685b2fad256fa42feeb54cb29ca191d1c9702156a8abf86401427fb728f6aef2c6aa071fad02dab4efa3da39bf3a57
- SSDEEP 49152:ElO590zl4MCz6FfoiZ8gk7ACKVmQbs4vdxmB+LsrRfOUkrm3chsEmirNX0Nv5ChD:ErjCiZ8l7VJELsrRfOUkrm3chsEmirNb
- TLSH
  T122E59E03F6D650D9D029D57097AB9313F631340A8F215AEF26804A253FA7FD86E3E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libEGL.dll
- Size 490KB
- SHA256 43c99316b238e294bbe0341bf99887bc64a3a576df058182030166613d272bfc
- MD5 6eb5623a52101945a3f5dc3c5f0f5d66
- SHA1 b787f0468b89e850ca659192fe4be8d873bc530b
- SHA512 80aa7f7ba3b584dde0179d1299cdcd3b7b6dc7812cad0497a1890ae7781151967c1b5c30c113c195e4f3df2e530490325cf5a6ceb94915fc527d9c1e6f1df138
- SSDEEP 6144:QAfj62hlMiUnnvfoJnd645CcTah1K9y56jPSc6080IeKrrKx/+:NjTlMikfq64/aay56jPSc6080IeKro
- TLSH
  T176B48E15F3E845A8E07AC1748A434642DB76B8560B65FAEF03E092793F37BE45B39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 102e14130bc86237811e72d79f4c8ab4500d523ffe5d7e2cc4fb47c8ca281cd5
- MD5 5262ace5699ae7d79e6b8220e539bcda
- SHA1 da07cc7bb9236099e40b7340da58b925402e78e7
- SHA512 b83e777fa8328fea705726fe7a7f338b32a0794dbcb25963729e082b6487b6f1cb3153809f76c7249b4dd445cdb155593e0837515168b3a038d361429610b355
- SSDEEP 98304:BtcBg/mDJXckcdcCtu/wIKiIMvbCiu7NXY/:rYXckAltezGike
- TLSH
  T172868C03F29640DDD05DE2B897579227FA34B8450734B2CF2A9457252F67BE0AB3EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/app.asar
- Size 549KB
- SHA256 e7749ab8079fcb941486bcbf8da9f9511fc89ea35e6189cb40259b29f8cfcbbb
- MD5 253e13960022083b4523b2b267916272
- SHA1 052ad2eac91aa02d2f2f4a1a1bcfdbd25509cec6
- SHA512 1308b227dfb8c917e29e8d4e4f4fcd9441cf89001f13dbd70e0e28daa475b8cc8e106e67ad1384fa2b12bbfc0a96da3ad2b61dabb9f471fd1c11dc27d5fdfbe8
- SSDEEP 12288:GwS/x0uwCi5TrIK5ysEgi20MySDL20lI440C4I:Gr0uwprIwylhMySDa0P8
- TLSH
  T150C48CCE5AF20015DA13753C5EBB7F5951609F932905CA00FE2DB304BF17A5AA8E2AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/update.jar
- Size 24.6MB
- SHA256 b4a7989bbe6d62951b93a33515f6690dab161e226aaae820ee6d9b086836d433
- MD5 71d8a02cb6d6f3f5cb071395572aa0b4
- SHA1 6e247911839419f46f1a3a56f76a819305738fdd
- SHA512 c180e850de921890dca7dc8b2bf9119a6c1c6b2d86fd959690f245d126767dd5c85431f7ca4c159088c17d5f16f933dbc2c2a170003ff0d76948373fcf49371b
- SSDEEP 786432:KxH2T6eobChbL5VJSIGEjXYZaa7NUoPN4jP:UHh7bCNMIdOR+oqP
- TLSH
  T16B471212D856883FE583E27678829FE6F83953D5E14B912B07F00993F6829CE4B3275D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
behavioral22 behavioral23
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  snapshot_blob.bin
- Size 329KB
- SHA256 fac1244b22c24bcf7113231faa60ee7effeada447abf21e516078e46c180d367
- MD5 8e75c2abe972babc8942fa2b8d27e1c8
- SHA1 41365174362c59b1f4fcf141236616b358bcebff
- SHA512 75827f52715645b750dbc47ac0f38ab6fcd974072875e04359b0d78e8e67eb06110276e0a23dad992dc257f5c8be3b38d70c91eb4d393a330b511b2a5993b412
- SSDEEP 3072:CtjRKkOt+xeReIyhOwvNDZOYQ8eZwDKUX/xjsIlkx/LnVmr4FIGvqT:OR4t+OU8tzZ1CjsTxDVmMFU
- TLSH
  T14974CB06F319C72AC459267E4CF993893234B2CE9F86A21B759943FD38B153D4D22B8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26 behavioral27
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 f2b284e5ef86a9d5aeb27ee816cb59a3eb479b01c1434639d5ed51f8b4ee893a
- MD5 5ebff4f82fa7556a48a5c9bfefbf1d83
- SHA1 237cb075294c59ed59a14499a4a29837053395a9
- SHA512 238a8a7d9c4dd9fe42573dbcbfb5add23e995af7067bcbb7bdbf4c61eb3425612ef6e7506db2abe1368a7873b51d8db2be90bae66683d0547ddb2b8954f2eed5
- SSDEEP 49152:h5oVsEAAmn1hi/mqbDP9U7rBoVXWqIyPuQDcJwc8f7mFojWRT70yX+JNOFPnLgmD:DZEAAIyUF0LZRnbEORS3
- TLSH
  T13B463803F28681E9F05DD579875FA622F632F8814B2276DF16A01F192E77BE06739B04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  vulkan-1.dll
- Size 915KB
- SHA256 b8a032e514dde1133e61dd2cfa4800299643ea33ecaf26598cf25ac74024200d
- MD5 c8eba3c923f031ea25b44cdb0ee8fd1d
- SHA1 4d3ee3ade8e4581afde2039cd264ea9a2515524d
- SHA512 cfe228b56d6d9801932179ddfcc2e980fcb7301179b1b5c56d9512bd880ec5e882199dabf543edd63c80a8c0a61f9791ddffcda06e94360f3e5f48be471df6a0
- SSDEEP 24576:rxxFhL0KIeZ/GJLoqQ1xJ0A8p6Z5WGcSDYsHQDi6g3P0zAk79oOHnSA:jFl06Z/GJLorJP8p6Z5WGcSDYsHQDi62
- TLSH
  T1F7155B23A6948569D57AD034DDD2870389B178822316B9CF42A817087F6FFF47B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32