7413920cd9f7e7f5c8028325e10da81c1ca917c8ae3b39608f87cbd8908e922b

Sharing

Copy URL Twitter E-mail

General

Target
Drakonix.zip
Size 118.2MB
Sample260418-vrvb1adt8l
SHA256 7413920cd9f7e7f5c8028325e10da81c1ca917c8ae3b39608f87cbd8908e922b
MD5 96e7960e5d7c8643d161a0f50403ff18
SHA1 5bd3dbea182e893ad797556fd9ad7fbcc01137f7
SHA512 60d4d50701035681b58cf489a846b1c15196a084ce6384194e448bc540704801d28513e5bb4e6c62eebd7c56ef64d533984687b74f2dc868265b02a2ee73e09d
SSDEEP 3145728:9MyvDWdLKmxjb+W8oDGnCV7mZG6cF+5ewBMmJik:9hW4mx6CV7mZG6cFKRBMRk
TLSH
T1F34833C2CC53AF18166FE7B05EE8DF7B7B152E2F5187B72162255B83145A847B8C0A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Drakonix.zip
- Size 118.2MB
- SHA256 7413920cd9f7e7f5c8028325e10da81c1ca917c8ae3b39608f87cbd8908e922b
- MD5 96e7960e5d7c8643d161a0f50403ff18
- SHA1 5bd3dbea182e893ad797556fd9ad7fbcc01137f7
- SHA512 60d4d50701035681b58cf489a846b1c15196a084ce6384194e448bc540704801d28513e5bb4e6c62eebd7c56ef64d533984687b74f2dc868265b02a2ee73e09d
- SSDEEP 3145728:9MyvDWdLKmxjb+W8oDGnCV7mZG6cF+5ewBMmJik:9hW4mx6CV7mZG6cFKRBMRk
- TLSH
  T1F34833C2CC53AF18166FE7B05EE8DF7B7B152E2F5187B72162255B83145A847B8C0A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery persistence privilege_escalation
behavioral1
- Target
  AdobeOwl.dll
- Size 2.4MB
- SHA256 8c6807a69636a7d1bec37349ed33d08fed0fdfd7f5be5c1dc020323e7543ef5d
- MD5 91ba5d0e7895a389248c9052f9fe7b0f
- SHA1 6d20ab20a1fb3a7080efce2b949f48de3649ee0f
- SHA512 484b180d260eb9bfa0e8462438904e885ea2ebd21fd7cea65523a69e4cbb0bfc768f1ea3526de658b63e46099f717aaf06a7b19d9a435dbb6175a712cce75b4b
- SSDEEP 49152:P9gypkP/B9jhhQmecV4MCODxC/2L1wHvrHbiQFmF/vaZpEm7I4x1IjQgR7S0WlVI:KP//jV6J/QrVsRVpO
- TLSH
  T14AB55B5F77788464C1279134D453AF47F3B2F4980F34A74B5AA602AE5FF73A209E9222
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  AdobePDFL.dll
- Size 11.0MB
- SHA256 f23fe1130cd71b65577551b6bd09ae4327caa25b924494e03ed91c62234343c7
- MD5 29f079cdfc76a4343354d8fa01fd58e4
- SHA1 755842f3d1097fb59341ea10b85e14eaf9b18be5
- SHA512 d101ae9b40b031bc83830f69c94d4f0733767ee77547358e55e7b0666cf1d87b3a8471b0266d6ecb949a2b55a2bb6f3871c879d172c4f82cdd8c5a5ae497ab60
- SSDEEP 98304:TDdJBvzXIABe2czuy/cfO59Q+JJrsQSZkBLEJ5MZhAly70wo2ZGfNrZ:TDdJBr5Be2wuzm5zsQSZkBLSHDGgrZ
- TLSH
  T19AC67C16A77580E5C06BC138C9579A07FAF17C994B31A7CB46A1761E2F337E06A3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Aquathor.dll
- Size 75.0MB
- SHA256 de5abd89cb585454e6ffcae71132c71ba52f3e3340526e7aa210664329f40462
- MD5 0a7ba6b905ea036a8826fd4b0bbff003
- SHA1 d4d1742f1d3cb4fc511639f8b047bac594ed56e5
- SHA512 f56dac99a875076af0df8a74545e2bbe9710fc310ffb598adfcd8544b0ff8aebae779df371ff2bd53202d116cb1e4c0156405bb512055b7b13c8280f1d317ae0
- SSDEEP 1572864:Dn1Skx3DANF1UtV84GjWBA5dFaSiAQ+TPA9pzG6h9KHxfh6iqjWSM:DPzAn1+evnFEAQ2P8TM5h4O
- TLSH
  T13D0833C1D5538F282A53D7D81EAD8FAFB7247F3B0899A374A51B1CA3446C8AF645090F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  BIBUtils.dll
- Size 184KB
- SHA256 972a65982f71d18478ab932ae4337dcb6133f8c07d5c64c5c6ed9ee551743341
- MD5 37e8f692c2037bb711cf7366f9ba1828
- SHA1 23cb2214375ded5183b9197fd4b7b8a77703a58b
- SHA512 4d10abdb9dbd384c6c304bd75058455ae423d6aca66cd472bc10518aa9034ebde7a068b132538aa8f74e042853bc7647c7c8a0bc6134a0ba72b4c49010b86099
- SSDEEP 3072:lHKEHgepFk2HWcvrUUKjJKBqi7NrOFZ7qAYTZlb5GwVAuIFw/gbXl5tfGKw0rHWq:lqYFk2H2lVKonAKw0r2+j
- TLSH
  T1F304D72A765880B2E0A6D23989D39A06F7B370529F315BCF5481433E1F37AE5FC39661
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Launcher.exe
- Size 2.9MB
- SHA256 a0657b6cc937534d9dda18de95e41a108f6030d63ff3aa105b2fa78c8aac6af3
- MD5 e614ae2c3840113f11833a1db00650ad
- SHA1 04278b488970fc874cd96efb802e787a9652de83
- SHA512 f761ba90e08e3e8e94d0485bdb3a5290b792de2532a2c01c646a007b819a1ea46437cc221259f1627d0c1766b526376c12a494cf9fa47d7a4cd70e1d33feb592
- SSDEEP 49152:2mIU6iLVwASOZGtlqIALX3H6IA5xkflxxV80C5K6BjIUoMpxBmK/imxQQ8P1Wz3:w+Y9IA+4h7/T4cA
- TLSH
  T16FE59E6AB69800D8D46AC13CC5565123E3B1FC1517B297CB1AB4AABA0F73BE55F3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery execution persistence spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral6
- Target
  data1.bin
- Size 29.8MB
- SHA256 8330cf4397db0598deecc728c9fa4fb9a05d63f9d4c7eb6009a53b2a364a6790
- MD5 17d83522be4a236d4174a8a2d08ffc80
- SHA1 601220e077ecbe5572bc2c4228d2dcfbeba93e02
- SHA512 fc6887ba4e2e82c0c455646cf573c0520740f08fa10531a003e5c8593c523d97745f0760795ec45bc4fecfa9ecc4ccb25647170881d8fba46852c4a83fcc73ec
- SSDEEP 786432:99ugPa7oZ1ZcKZBgQ7pWuJ0A1P59+Dtz+0jBepYj4l55Q:rdPlZyQdWu/1hB0Nxj4l5m
- TLSH
  T19D67336CFC66ADC7DFA9B07DD9A4A3919EA20CA6C5000B011D38F35C3D726CAD785297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery execution persistence privilege_escalation ransomware spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral7
- Target
  dvametadataui.dll
- Size 1.6MB
- SHA256 debb707236756f810cd41367c4187d8f94e17da64f25e686a22d9302ffa190c8
- MD5 86ced251b2a21e750a07ec08eb120abc
- SHA1 93844bc1af04ef5b686c69c1b14623fa0ad03fb5
- SHA512 c204f78e1973658413eb3a70c9c1c9ddf8ac5ae1fa063e335dd6456bd83661c1d6c542eb30dbea0986cf8776b998e108f03edb6d243d20dca4ab3e84777c6362
- SSDEEP 24576:qHZUe69DV4fH6K1fmhjdcv4BDPpkFOMo5:2aJ4fH6K1+hjmeDPpkFOR5
- TLSH
  T1F675F723EB44986DC037D63DA669C6C1EBF274A40F304ADB5845851F6E735F88EBA318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  dvaplayer.dll
- Size 1.1MB
- SHA256 10aa33a68eff517acbe301cf6a7d9c39a7439b1c40ac7eef8382f5303f6ea152
- MD5 6c6b8b9d94153cfcf939be932e14e2cd
- SHA1 7c0bf19856390916961b50e30e78b055d8b2649c
- SHA512 4beb5769504090e73446293c12e79fa153aab3419790349b3dc865cbfa32f5102a3c56829e414cd31b37f0e5a7fa52e9875fdeed7f86f60cf76391f5dcd401c9
- SSDEEP 12288:N8OaOn5io2bDnbAIft6nEoH9cjDELOuUviyowQWai:FSDxsJdBU
- TLSH
  T116352A1ABA388195D037C17E89A1C685F7B2B8920F3197CBB195A71F6E3B5F805BD310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  ipcclientcerts.dll
- Size 203KB
- SHA256 557905481764bbfb09e2c6610411dc65233fd5ad33c6d7a06e5b9c0843e722fb
- MD5 3a37090222bce3a31a78c88e9e7200cd
- SHA1 a992afdf0315b792db4a49344d026442a40c7f91
- SHA512 e571c237442351caa47c9b6cbec68872098518a40bee1d929b12e80b10a668b352d6eb586b9ff22c6b47de8409324347aa7efd52e3e58c0638bd3b473796d9d6
- SSDEEP 3072:yD6wUHryNo+6giQ0fJFu1cNGpUb8zIpFtIN:oZ6gGKccUbzi
- TLSH
  T18C144A23F68A15EDC85AC170C36BA633B93270C94B316AEB13A446356E7DFD0A63C754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  libhogweed-5.dll
- Size 208KB
- SHA256 bb8e68b8f4a89a2d15ee64e3917cc9527d1af6084283cfd05ecc32cfd9acb668
- MD5 73f438c0dd6a241076fb9488aba93e32
- SHA1 9e30d5bbb2f1b6b6eeb623958da8659888ca03a3
- SHA512 51d0f2467468f8aacb2d1fa947ba5c2d25f7ff21bbf1d3cd501daaa3e45ab373e11eaad973417e1243796e23b93892f137484956054c9270367807d77bd30256
- SSDEEP 3072:M7tMBs+rd4EBZAU/Ihrqyp+Px5xGgeHurSN0rb0xkgM2RoPp656Pj:M7y+2rIhGyp+p5YgeHurSSMbZtmj
- TLSH
  T1D7249E1383565CBEFA3796784761937365B0B9840F70D71B1324EB743D61EE0A72A3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  msvcp140.dll
- Size 544KB
- SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
- MD5 bc88b387cafa556068b5c5d6ff3ccc8f
- SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
- SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
- SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
- TLSH
  T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  sqlite.dll
- Size 1.6MB
- SHA256 993e27dcc6db761a81d6afb66a8cc8ecf258741b2d12952e9d3e5e2eb7fac566
- MD5 15cf92318d1a31de965fc193fd0a4a7f
- SHA1 7a0b8cd756e8620a3efa0ade44d16ece3bb9cb07
- SHA512 e0e6f773c2ef85e77b21819e4988b8b4cc5a391ebf74edb3b95e3072ec623247dc13ec0c4495e99f97d215a06e04dc5be5494a70919e01c85c5b17ed55de5eac
- SSDEEP 49152:/mE88dVaVfMc/2yrgjy7uqUAyMEeNAm4xZzfH:aY
- TLSH
  T16B85BF8572B9DC39D9D983FE563D20BB5E953E5BCCE00F6171BCA2242C90B90AD85723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  styles/dvaaccelerate.dll
- Size 12.4MB
- SHA256 1164952add16666920be10f8a91364700ce965d237e85ca72fc63397b8e68de5
- MD5 71ec18ba5b3578bc2e88f64d60ca0797
- SHA1 23fc447c1f77a0167dccb5cbb5deec32014cac31
- SHA512 f9deea04df889fc493e5d12471451aa1590e15afb4019337fb1a296ca2286dd93f883b255ecf7e1bd84c35b887d425d837ef68ef9cce7ebe58df36ae77ac827a
- SSDEEP 98304:B8jd6lrLddIRBGprPmt/gP2XwIrlw168rk3PFHU:UiVd5PQ/gPawklw19k3Py
- TLSH
  T14ED69E86F0D665ADD617407421BFBB127D213E64425C0DF742E2E9B81FBA7403F2AE26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  styles/icuuc64.dll
- Size 2.3MB
- SHA256 65eb04cfa9ed2f5e4296234bdf2c9fd3b90dd335475bb2c336d769c228940559
- MD5 49aeef3e2a29c062765a747e8e227ee6
- SHA1 69498e9a4431390b6172aecc656590b4ad761265
- SHA512 4745e1c5d19ab3276cb7c832af544a412e242801b5d7d09976390ce39a41aa30f72c2e63eadb27005297e66de8ad9424f8af97ee707c072370999fa4a4dc2501
- SSDEEP 49152:+gtKs7mHw0MQL9MLiEGr0AuJZPHIJXBU8jQJ3:Os7mQZkK+sZPHCm
- TLSH
  T136B58C57F76A80A3D47BC13CC5A60BA6F6B27C014F21DADB069B83592F236D045BE391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  styles/libEGL.dll
- Size 470KB
- SHA256 0c26fdf2c41eef7a3b747f33d6fe1ceda5376be062b0eeb7f2a17547fd9d3bb5
- MD5 9c8d80369399871b1c997a443277d1c0
- SHA1 5c5eb382d9c074c5e62c66b30a130564cb34bac2
- SHA512 3b944a6317c1118225e34a71b5911082a967a02f53d01796533852620f8eaacb811b27af55d2d4f8cd109609b16a19c56ec7162aed1f28715d777e182603e615
- SSDEEP 6144:aVfIbqlkym0DsRNEzLsl8OSsENhmIaZKkYZOueu:aVwbqCym0DeMs6sENhmXKkYKu
- TLSH
  T14AA48E15B7D444A8E06BD134CA534642EA76B4920F65FBDF02A493392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  vcruntime140.dll
- Size 124KB
- SHA256 b1b933beee9a06842e29f0005bc7fa8b82626fb0922863f61eea9ca0491fbe40
- MD5 5c8a44742138e87cdff02ce38e83c33f
- SHA1 c3c005bbc39b0556299ab793b447d85f2be623cc
- SHA512 251bca3a4194b151267e496aa53ffe283408e84c3b55a3adadb5f4c1105526c53407adf83268fe8552d3430ffd3ca12c8be0fd1eef9736b489956bdbb49b1601
- SSDEEP 3072:1tkenID0f6aifkHWBXjG/IuecbfmgTFFUi/:oWSIHWBXjGlecbfzL3
- TLSH
  T1C7C36B42B2F801FBC16AD174C2A6AE23FB76B84547609BDF07A58A640F537E06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  vcruntime140_1.dll
- Size 51KB
- SHA256 ae1dd66cf1345491f13d460b0580d2fb5c6b8e7a24bed440c7cee6318cc389ea
- MD5 f877e4e147b59e870f37cae33de0493c
- SHA1 a3ccc4e27250adbcf533a7fa8c69c19005ff5463
- SHA512 0c9022e70b16d169471861faf80ab00599dcfe5c9042c7ee3217a65859d837fb548a94ba9de2d364d4e01e41dff6232408fdede8df82070e6293ba1d86aac93a
- SSDEEP 768:z3oZYctpzcx0pdESASv83qw4DYIOfg9zhBRjFOQNONRds9zB:Lc6wk3qgIfzhBNF9N6RdkzB
- TLSH
  T1B3336CE4977C5482D86B9870C1E6EE17BE38B7D21B50978B07A5D14C0E933C1AB3D36A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18