5ffa615137c62de9fb4ba74baffb4c8b20e091be9530fc1b5f579bd26c4a0d80

Sharing

Copy URL Twitter E-mail

General

Target
Installer2.0.rar
Size 94.4MB
Sample260424-ejezcaet4y
SHA256 5ffa615137c62de9fb4ba74baffb4c8b20e091be9530fc1b5f579bd26c4a0d80
MD5 89d7b8d16e77c0ed288b73c8ef57ad04
SHA1 31445392936e6ea52fd70f3045af370b0c037c2a
SHA512 9cbe069069375cbc7c5aa2768b7fa42d886e8e9865dd68b2c988496309362f60a04c5763da16e564f3a00388d5bba9f6b377aa32992a01d23adc7edf6bcb17c8
SSDEEP 1572864:/0RwnCUaoWp/ziXDYLcV3XRqYpqipH7kNLiAVOVoiin:8RwnCUC1ezYLU5qiRaLiJon
TLSH
T10A2833EA21A43A9D1BA143B4F662849DD6FCDDE3BA073558707AC021893C06FD37C65E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Locales/libcef.dll
- Size 139.0MB
- SHA256 6b5f537885e7917f554ee73024d08728396ca71d7aa2a5cad760358feeb60a4a
- MD5 57c329d856f32a9ef873cc84dfc4e6e5
- SHA1 b1b2865f933e0c11b67ec25986e877ac82f87307
- SHA512 c914e67e66613ddd731e8693dc812461324f367ae2978ae9b62f4e06e6cf8d6eb19a2d1064e6d7f31d5dd84f988178a4363b358b60df0a03c14762a007d85754
- SSDEEP 1572864:4xLCIedOvL1RjnZrz+GzCFrkKLukZg0A3nNETALSjonU3aLKA6ADgQvEOGNVgd4Y:4vpJhKZotNDOpbYA
- TLSH
  T159689E01A523507DD89331B2346DFB2EAD3042168B2D7DD7EB985CD5BFE12D2263A287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- System Binary Proxy Execution: wuauclt
  Abuse Wuauclt to proxy execution of malicious code.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Locales/settings.dll
- Size 27.8MB
- SHA256 e6fa39becfb3ec790226e501dc2acfd180ed74eadeadb6250bfdff57a9ee9adc
- MD5 1a625b19f3347153176b758c07b7183c
- SHA1 71d58c6aeb3c941a06af1726005d43f6a9c8e7ce
- SHA512 34846b48afa5fadd96046906a24a258268b50a0b6248fae908773b263df8c8d19809387745b9cc507f1f565a96938aefd6ff74b0b3f24054629f6d32f4deaee5
- SSDEEP 786432:tbNf/sRr7WlUL8rkziGhilStfPq3trCE4t+mShBU97ICoh:BNf/sRrqi8rkziGhilStfQCE3mShBU9u
- TLSH
  T158577C22B412C031EAD201F3A5BD7FB9559C8630237E94DBA6C43E2999606E33B35F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Resources/.github/builds/azure-pipelines-release.yml
- Size 9KB
- SHA256 dced84211413edb5962e4c3d81ed52d4241e2ed3ce885ac3d1c83dbfa682c274
- MD5 4b0406244836377c1ca20ade6c0d2aef
- SHA1 bd86748aa11c6c9c1176123d4d7b64c352509616
- SHA512 dcb8bde717bda1486db0301d2e92b81196eeef432f5d37be58576a1fca3c6aea7e2f812c142dfddb68fe0dc6523ed76a5cd28fd47498b28966f9d9faa5fb018e
- SSDEEP 192:hdHUm/5FL89HtQ5mU0pe+Srq5WUud21mu5Jafk7+ri7G45FLjXJ2fvtQ5mU7yeNp://oQc/i21mgJafk6r4G4XXJ2yyii2RZV
- TLSH
  T16512A3F2659455A060824A67B8F7E3065034A063E3451B7CBCDDC2846F27739D3BAEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Resources/.github/builds/azure-pipelines.yml
- Size 3KB
- SHA256 6bff4caa930982fa5d34316944415356aca0807baa31d85bd234b7b0520da2e1
- MD5 91e45f4fbd7014e2bfa0611392a1e65c
- SHA1 eb7a986e42164ae19d1951238e86f858915fdad4
- SHA512 992a4a2ffabc393d8538ffbc38b4b7554c3df87f52a6f40c1de843d8f81dd0a900a091154dc22e993cea35da5ff8449db202d35f2a1bb945fa93bf7f497334d0
- TLSH
  T1BC8184F224E42421A19B4B07B0F7A30A5034B473D5461ABC749CD384AF6376593BAAF7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Resources/.github/gradle/wrapper/gradle-wrapper.jar
- Size 52KB
- SHA256 198159fcd7d29533c0d37423d66c44729982d5280c9e2c7c5f4b7bc6a9317f6b
- MD5 339746b848a78b370095eaffe15df105
- SHA1 d5f2cff8bfce6bd848ee3dceb06393502f78ca7c
- SHA512 fa5200a814b8a5fe94b58a8448ed233645c28b28c0d95fd3d2cadecc48fb6bc04a46f00796ab5c9d15df116e9dab4516807988051bb04e77608e020be590e5c6
- SSDEEP 1536:TxEAJ6wvQqbX/LbQ4eh5AOkv01ttK1IXesHd6+3NS:mAJQaP3jeh5Av0fqHss2I
- TLSH
  T14E33BF709AE6E525F633637F68930992647A576FD0CF027B2E78275EB77044E8A23301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Resources/.github/tests/Files.InteractionTests/Helper/AxeHelper.cs
- Size 1KB
- SHA256 8f8f0ae71faf05cab81a10d2650085d79c7886907a194d8c6cd83be5fa766e2c
- MD5 4e8a5a5e217f7211e3cf40418dacfdb8
- SHA1 d931e856b75d1421d06e50e8c0746d7963558d5d
- SHA512 031be20038b16ef5d40f09f6d4cbf1fa1efc0bfc2eb1037d90c893b14c003c03b0a948c4fa62e89259c5326698500fc2adb34bda2ba7b8216ee45f02dc3ef3cb
- TLSH
  T1F411FC41FF0D903108E9110EAC0822DA1E143FB8827C85319D5EE708DEB19272AEE9BF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Resources/.github/tests/Files.InteractionTests/SessionManager.cs
- Size 3KB
- SHA256 ef71d89ef1d3fea4577da6db9d9432ce86aaf6e9044c60d71b2346a71f00edc1
- MD5 9af1b383ed2ba3b59f52a41c04a5c439
- SHA1 f5456396e577133666183ea9058b9925a4a202b9
- SHA512 b82899dbb4a6ec5fe9e7a013d9e28be9829505589b154dfb32a2a235c3bb7849b828ed5fe9017447de8e837b186fac605a0b17d341e28bd64b71f3a63290e746
- TLSH
  T1AC613345EB4D46BA54B3C00EA23E15D60B3E87753A7805F3BCA98625EC5445E033ED9E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Resources/.github/tests/Files.InteractionTests/Tests/FolderTests.cs
- Size 3KB
- SHA256 9b5ab51e55fff8d268b0451d1ba75025c436c957d12dbc12b01ce849e9a630d1
- MD5 67440346eada629378edbd70d43d2fd8
- SHA1 214bcb95eecaf7bd57348e5fd06ef13e98d10992
- SHA512 3f5cce3f5100d1f54233bebfb3c082a5884410a603547639408a5bd5096a4023b3201801cf526091b4fd4e18c433b0466121c9ce1f4dd51e63bc97be4d18af77
- TLSH
  T14A712F62F62D0A7C0163D037404B65E05F7CD92CB2722D0B2E49087ED5EB2E94B6F567
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Resources/.github/tests/Files.InteractionTests/Tests/GeneralAppTests.cs
- Size 393B
- SHA256 ba7274835742724c114da2085bd02502e7bc8654a812a89bf6280679a06a1079
- MD5 9ab0518eaa0e02142621c56e35661c20
- SHA1 586bfccba2df1218f6b0823421f68b406a78e505
- SHA512 d354049f50b397416caa853281efc06dda678c76f029490ce101de30a7a015b6c15b567efb0d58304c34df2941559471532dc28e4531e07110b912604778dfbd
- TLSH
  T127E0619BDB4FCC770061F051092074E5231E0B76EB780D67489F077B85B632D8462D17
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Resources/.github/tests/Files.InteractionTests/Tests/SettingsTests.cs
- Size 1KB
- SHA256 6dde25fc31c8d0e66480488ba79cbe89038f5a975f56f5fe1175566ed69df830
- MD5 8c6a531ff910bcf0135a110532c359c2
- SHA1 9f6fedf5a2947637949d859f757fc9c6429bc96c
- SHA512 cbc42dfbb6e72edc93fabda62ad93b866a96044763043887cd4e6db2543946cfe06e8491ccb7a072a89e4de8e84c24869baa03a751aa6c2033b6b59aa7ed4042
- TLSH
  T1A821E072DF0E8EEE00A8601649D052C5222D0A30A6741CB77C5F4276D9E33AD43FAA3B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  SoftWare.exe
- Size 111.9MB
- SHA256 c9e9d9249cb8c708320a3292768dab0c1e61ef2e5437c45a795fd7b651058b3c
- MD5 fb0e38ad9e0cf7ff8e3ef856b95c10ef
- SHA1 954a73a679beb7d033224ac4a9e378e53fd01140
- SHA512 d9f165fea3fc41a629b73ec1c4b1decbe4477001ed83340b70fbc384b07801bae6be62bcb9ecd999b70543e76240b8c310ce741a40f2492b58870b5219b1f39a
- SSDEEP 1572864:bAXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYBjqwb:W3iXdqwb
- TLSH
  T15B486C43B2A75098E4BBC97582D65323E9337C8A1F3069EF15845B312F73AE09B39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral21 behavioral22
- Target
  codex64.dll
- Size 130KB
- SHA256 056156ab1da26259bc6075e18db532dc1ca6477e3a64342c2d172930c4d45b71
- MD5 ec40d1921c5381cfbca8c2d3fc0378b1
- SHA1 0b667915ac26491f1df3181df76ee21559557c29
- SHA512 a5f662dfebda8608be875a7aa0fdb2cf41247eb21e6fce3326ad315b99ed48703b063bc6f12797ff81ef14d3e8a7169756e77f8ed5d0ea10bb5cb52407dc61bf
- SSDEEP 1536:/1LAXfTNoMzsoliY8jB2a8PV1+JRRZbcoO+XPTXg0HNZN3s9uPSVF0TzqGUrKGZO:9Ar11O2K5IozfM0q9uPS4/BUzZn04YG4
- TLSH
  T177D3123AAA316014E5D9DEB7D293F3E4D63DB1A0AA5DF7C228B00CE132A95ACC541D13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  core.dll
- Size 27.8MB
- SHA256 e6fa39becfb3ec790226e501dc2acfd180ed74eadeadb6250bfdff57a9ee9adc
- MD5 1a625b19f3347153176b758c07b7183c
- SHA1 71d58c6aeb3c941a06af1726005d43f6a9c8e7ce
- SHA512 34846b48afa5fadd96046906a24a258268b50a0b6248fae908773b263df8c8d19809387745b9cc507f1f565a96938aefd6ff74b0b3f24054629f6d32f4deaee5
- SSDEEP 786432:tbNf/sRr7WlUL8rkziGhilStfPq3trCE4t+mShBU97ICoh:BNf/sRrqi8rkziGhilStfQCE3mShBU9u
- TLSH
  T158577C22B412C031EAD201F3A5BD7FB9559C8630237E94DBA6C43E2999606E33B35F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  dxil.dll
- Size 1.1MB
- SHA256 0be52198c8b2bf84324bd46aeeca7faa4174c37a404f0fea2710f16182ff70ac
- MD5 9b644863ad685be03fae4592b1b27aca
- SHA1 312650de117775f250dd66cf8313ee30ec4d6673
- SHA512 40ebc4323fc6977c2a04c8ea4aa2e6993421906844179ade7d94dec3fb76f8d77ff853a9f2e5f249c558c3bd079d6372f5cd7fe98808adce72bfcb64ac97058b
- SSDEEP 24576:FicAJr4b/VVrhmnduoc4Ae8RYFfl4fiHeBBUJF++zG/TnT:3AJ4/7Fmncoc4e4f+AmrT
- TLSH
  T1C4358E696B984075C06BD079CA97CA87F7B2B4110B70EBCB05B1129A3F376F15A3E316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

System Binary Proxy Execution: wuauclt

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27