1b82576d3240f7a22a1f863a4bb51e06192d65b740edfc4afe457f85a3bf8e30

Sharing

Copy URL Twitter E-mail

General

Target
assistance-informatique.exe
Size 9.5MB
Sample260422-als7jaev9p
SHA256 1b82576d3240f7a22a1f863a4bb51e06192d65b740edfc4afe457f85a3bf8e30
MD5 724e1266835113707511fa2a7086dc05
SHA1 4c0d7b30adf3a5c0e4f7c6b532094b77b8a7d601
SHA512 6820a8c253dddd9b4be05b4d4d4446dcff4a435e45f022cea20924b965ec6eb369048a3d95cde52718cd349800d81d41628c8b93a60c937f22116b6bd3677980
SSDEEP 196608:u5Y3e2KVJ8//UC22xQxKJ0uLB4pPsJONVo/HugxRfJI8q0Wxx:FHgC/sCpkKJ0uN4nNVo/ugrfJiDx
TLSH
T1F8A6332B3468C544D81F08B2CC99E1F0307F6D59EDA6978BA5973F49B2327A7107E90B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  assistance-informatique.exe
- Size 9.5MB
- SHA256 1b82576d3240f7a22a1f863a4bb51e06192d65b740edfc4afe457f85a3bf8e30
- MD5 724e1266835113707511fa2a7086dc05
- SHA1 4c0d7b30adf3a5c0e4f7c6b532094b77b8a7d601
- SHA512 6820a8c253dddd9b4be05b4d4d4446dcff4a435e45f022cea20924b965ec6eb369048a3d95cde52718cd349800d81d41628c8b93a60c937f22116b6bd3677980
- SSDEEP 196608:u5Y3e2KVJ8//UC22xQxKJ0uLB4pPsJONVo/HugxRfJI8q0Wxx:FHgC/sCpkKJ0uN4nNVo/ugrfJiDx
- TLSH
  T1F8A6332B3468C544D81F08B2CC99E1F0307F6D59EDA6978BA5973F49B2327A7107E90B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Base64.dll
- Size 3KB
- SHA256 015f30080a8a8ef5c9ee8751400100e3c8abb48d5c8ab5208a48daae39d22e9f
- MD5 20dc0e30cc3a715e100f8662d09b71a9
- SHA1 c40b9158a8c8e28d4ce7ba73a6f2e69368afc389
- SHA512 2e455dfa373f91b563dedd2e043f8730e686bb1a6ae45c488e5ea5b9cbb0c7658b767b2e751008757c62537f8b70396aae79721dcbf13e493daaf6cebc5500bd
- TLSH
  T1A271EB9E8F1B4423E1058B3486C725D53FFD9A5735C3693FCF900806A9811FCA092EB1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 27KB
- SHA256 6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9
- MD5 6f73b00aef6c49eac62128ef3eca677e
- SHA1 1b6aff67d570e5ee61af2376247590eb49b728a1
- SHA512 678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938
- SSDEEP 384:DZoRF0XXUuJReQg0Tw67ADWBTgmldIogUD3GLgFmyaX/fVYcWJQCDmrinogRdBl:DZaF0HtTwuz9yu3KgwRX1nWJ1q+noI
- TLSH
  T12DC26C107C9042B7D28E5671A1E50F075B3F6E512AE65883CF256ADA2D612F0FA3F31B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 d239e6ca779f822e2f28ef9a86bdbbd7a5ea9c7641b7a62a37c9b45b15dc5c8a
- MD5 44a147533d1439c7b6ef37e2153e3c00
- SHA1 1f7c3bce46180b1e791b8fc27f576c8c39881e18
- SHA512 85380b45fcc3803c38b9092ed5f310c80390bb40502f2d09599922f0db03b4ea44c7a8c9ddb5ce9d0b6a95c54ae3d79cb58609b197f64f383dacb931c38fd482
- SSDEEP 384:ECC43tPegZ3eBaRwCPOYY7nNYXCm/Yosa:ELTgZ3eBTCmrnNAC
- TLSH
  T127624D1137D558B3E2D62A797EE2B7138FA5FB2264438E0BC7332E06381A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/InvokeShellVerb.dll
- Size 4KB
- SHA256 2fddc8b8ab4bf4838ea374d25e4cb9e83362c3f1cb24f380137d14c814d56169
- MD5 1a6e1ea7e90e50d9a18e034e7cde41a6
- SHA1 93148d67fc2cee4537f749a8c98a0735065241a8
- SHA512 53d35e9e4a0d45a5b37da7952f7bf8c26666fa57748c3d292fd154e40a602f08ad55735cefe9bdf043e03e3eff3e58d603bd9980ef291b3c5f409228dd5ba872
- TLSH
  T118813F3343F444B2D4D79A376F6B09E96A22AB1137B5654C4A83182A6822BEFDD38711
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 36KB
- SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
- MD5 1cc87d2b5a79b18f133b4f944e2f2f74
- SHA1 98e0ddb727c76e06be1668434d754e5b80a0c154
- SHA512 d8fee1c09fef9af4e1f38baaffa3a6d059713b14ecad900815c086cc22855644fcdeacd6bba31ea6e6925831e650f7b0d34e6dea4c57a978fb4f5bf0cd6d72a9
- SSDEEP 384:JLmJwO50x66T9JOpOUT38YZvml7xoKdyuwlx8xSiorppugBwUdJopS:JW50hJwwUTsXdPwxvtpDtdJo
- TLSH
  T1DFF26C507C8144F7C28E4235A5A9AB179FBF692036E55983CF269EDA1C311F0E93B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 01773690efda3c1fa609287f4bf2277f3d366fe4a1ddc099d2949fab54f0fbd4
- MD5 be828e6e1885cc5a25e18f123e2a76a0
- SHA1 96432bf2da4e1c454f49f76e20855f27c2fce2f9
- SHA512 983e9a9e941b162031b8acf372c3ec12180b54f8e5f7172a6e87599e127170240841889d6e346a730f4970c9079f5f9cededc2730f910eb4e0bb897f68cfca70
- SSDEEP 48:S46+/ITKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8m/ofjLl:zKuPbOBtWZBV8jAWiAJCdv2CmCL
- TLSH
  T135C19574B3C248B9C491553778EB37D36612EE746784600F9B6711AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 6dd790a014a55ddd7df741a6e6afe0c9df936e7b463cd203563c991b4ea1e5ee
- MD5 51937c5c11d9a2c3261dc976e48003d8
- SHA1 33bac426167a88d6afc269a09865f950dfbaaac4
- SHA512 a95828c5317b318752aec0c91bf1453a814ab8e1ef39e04face90952ec53e1523f26fea1c91e4fac97e311f6b3460e20e2fa9dca596eabfcf4b7ba920af7b910
- SSDEEP 96:p8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/A3lkCTcaqHCI:aZIKXgk+cx6QYFkAIlncviI
- TLSH
  T10DF1C7B5F3D10673F9AB427438232F221B2AF521576581A7450316CE7661CA3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
- MD5 ee260c45e97b62a5e42f17460d406068
- SHA1 df35f6300a03c4d3d3bd69752574426296b78695
- SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
- SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
- TLSH
  T10C325C02135081F3E4918138986B3A276B6A15029BF98E57DFD39646BE20BE3BD3D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 153KB
- SHA256 01abf435f6dcc89560a068a9af0c2e6f067d7d4b1a6a0b848b40ecb907885d11
- MD5 d2c761a29981f8469a4c3071db73cd02
- SHA1 7e3fa24665b4ddd615dbc2e9b07dd73595836930
- SHA512 420e33d24da8392037a3afd413df96cc650b5c5a25de1e10d0859cf926b149a77197bbcd59313b0a96e115add4c7ad7fe712a6d14bb072cb46eb6bd62a1d369c
- SSDEEP 3072:Tyht+x43dp/t1/kZfj1SvXTmj0OslQaG5Ewyi:eExEXt1Cb1SEslQavw
- TLSH
  T1C9E31A1137F08039F5F72A786CF5C6604E7ABD32AA30D25EE750C96A2970B85DA35327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/UAC.dll
- Size 18KB
- SHA256 0d21041a1b5cd9f9968fc1d457c78a802c9c5a23f375327e833501b65bcd095d
- MD5 113c5f02686d865bc9e8332350274fd1
- SHA1 4fa4414666f8091e327adb4d81a98a0d6e2e254a
- SHA512 e190d1ee50c0b2446b14f0d9994a0ce58f5dbd2aa5d579f11b3a342da1d4abf0f833a0415d3817636b237930f314be54e4c85b4db4a9b4a3e532980ea9c91284
- SSDEEP 192:5cdcpry0igQ1Ii1rzn6U4gbfW6irWP+vOg7XRSEi+OPLjte86jugnincl0Nr90Og:WqVibvTh4qnFP+OPEzinclP+
- TLSH
  T19A821A5537E543BFE57229313AE766120BBEB8301A32542F4D63AAC93870987AD3D707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 2071ad3c37ddc62c9fdbca7e2551d16bee11b0ef0f510cd16ddc098cd368fbc1
- MD5 352495269f7d223991247cd2f2eec4db
- SHA1 22a4aae719ba575c7b90524595a1eac500c2209f
- SHA512 07005457d0f76fbb412dbbf094460020b486ebd073446265f252226f52e4705d95a0d05a1f32a39c6f3bd3a9853be837e9425360341581ebf36493939c629608
- TLSH
  T1708160BBA3F40CB2C0854BBB40A71CA793B2DD702716401E498B568A2084A6FED1E705
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/nsArray.dll
- Size 6KB
- SHA256 8bc5e75bbfa5a8f10526aec2af441153b2883d6d288726ed8f7c9af12a1ee02b
- MD5 82d49c227928741f6f09c5cea3bde9f1
- SHA1 b0904368a5e94026d0ca5760d4577236f796051d
- SHA512 d4f588e3613886e3dab58330cd69ce7f24c39be2c4854cc8edfcef98e1324926fcde0d79df1a8fdf5e2bf9327b17f22a9fa1396568c0ace4e46d4f548fdc7530
- SSDEEP 192:mUODeqedh6EHFRA5sX7d7KnnpOKxX22v:2qqedh6EHFRksp7KpFX
- TLSH
  T192D13B52F7E85DA9D5B703B95A69571D912A7E30D6BE92881B84303D2861300AA18FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 13ebc725f3f236e1914fe5288ad6413798ad99bef38bfe9c8c898181238e8a10
- MD5 1b0e41f60564cccccd71347d01a7c397
- SHA1 b1bddd97765e9c249ba239e9c95ab32368098e02
- SHA512 b6d7925cdff358992b2682cf1485227204ce3868c981c47778dd6da32057a595caa933d8242c8d7090b0c54110d45fa8f935a1b4eec1e318d89cc0e44b115785
- SSDEEP 96:s7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN838:UbGgGPzxeX6D8ZyGgmkN
- TLSH
  T140D1E7B832C20DF7D44D86743F22381717BDD47617B542A1CB932AD61EA2AE2FE21B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 175KB
- SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
- MD5 87853c0f20f065793bdc707ece66190b
- SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
- SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
- SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
- TLSH
  T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  TeamViewer.exe
- Size 19.6MB
- SHA256 3f2b9f9ae4378bdc7e34095f38cfd9fb3cfbd304eb52f43eaf95da74ec3abd86
- MD5 f3d04ca25d21295fc9865619bb2dfea3
- SHA1 d4cf6f10f9032095708977fe0e00b9d7f8a49792
- SHA512 9cb38148115a0967ff2ab561e4d41ebdfbceaec10074efedd24b8122fa709fbc6f68a589cf04c3ca7a435486ba017c86f619c6f1e9c763b58dfbfe9db8859979
- SSDEEP 393216:qztMz1tVeJ+5VF0lZ1pJHVxBxH03jxCBCpvP:qztMz1tVeJ+mzlVx7eCBcH
- TLSH
  T18E279E12F7DAC0FAEAA306B10839F23D43757E610C34876B6798AF1E5D30542AD36766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware stealer trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

Badlisted process makes network request

Checks computer location settings

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32