86214e8900832cc0d41c58adbfdb4139e1142d9e0f02f55ca429016e26a0412b

Sharing

Copy URL Twitter E-mail

General

Target
SiriusQT.7z
Size 13.7MB
Sample260504-nqplssh12t
SHA256 86214e8900832cc0d41c58adbfdb4139e1142d9e0f02f55ca429016e26a0412b
MD5 032bb42dfed7d385616c30a642b801d0
SHA1 e018c11104e87342d2c35edd3a3095f4f34ca992
SHA512 71d4755c54af1c9b21086145232d19ac6569f85d75b75747103ae4b46238f7fada65b851a343b8013e7b0431d0d779e0a9186a44e78a46217405ba653201953a
SSDEEP 393216:OZoBKMlcjK24fOKw0Rg3fkz22usLWalDh4:XxBOygczyUD+
TLSH
T1DFE633D96E0D73231B67C817870E57C08D6371C5D336A2CC66F97BDAA81C6A6109A3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SiriusQT/#RunAsDate_x64.exe
- Size 73KB
- SHA256 6d3c2b31fc940843e61e7c7be156f3987a99893491e63bdbd299da241770973b
- MD5 a591b0ca3fe24ff46759b8752108fb5a
- SHA1 1665ed72049950f980794b36e956db7e65e1fb79
- SHA512 a1b63a72ee98f3f0ad00128af3e81d49f72669b8909241ed1ed195ad302ad380c4cbf89a99bf9ab5b78779fa19dd4cda8945cb66ca61d26ff7de868ac8925bea
- SSDEEP 1536:A3MAFzmXHXx/cIjTPj7YGG0GJYcBUBSlVbit:A3MAF2dVEbYuUB0y
- TLSH
  T1BB738E86A3B801D9D866CB70CAB68713DFB07D115972C31F27B4E1999FA33306E24726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  SiriusQT/Qt5Core.dll
- Size 5.7MB
- SHA256 ffe7dd4f3edbf6b87d1855c16b9f9c245cc3bbefb4d032537c5686699f91790c
- MD5 f598f1151f894dacdea21a47a214c209
- SHA1 b1ea19d9f361e1d4596abefb51df82601fa09b64
- SHA512 3c0ad8156248d25a1194c2c21e21886973855f9c681ef231129f5fce73012a2787ba3161cdd3559991d86894bbbed11449bac56d5e676346802bcd03c69decd1
- SSDEEP 98304:fys+BX0av+ePwBluJsv6tWKFdu9CtuS74iYRrqfC:fys+X0g+dBkJsv6tWKFdu9Ctv7irqfC
- TLSH
  T124567B57BBA60161D0B6C23CC9EB9252F6B2B8014B328ADF1259574A5F377F1293F312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  SiriusQT/Qt5Gui.dll
- Size 6.2MB
- SHA256 90b1a7c47965eafcc896b99e9520198c097f60975b74884f1c2bc91a5ce88160
- MD5 1273c387e80db82ee6a96ac4788da8f7
- SHA1 d0ba5c2c54e535254fb1ac5866c32b4c1398e045
- SHA512 3356e4da246a05aaa959002463835afc4154077e112acde6531b78bcaf32272f1d81d8b8aa8407d31bee48b1f439b57427874660386147729749efe790a2ada2
- SSDEEP 49152:5kWYsqgxdm7x1Kbjjivl7TlsXufGRobtYdbbjEanzdmt96UUJHRorIeof9oWnx1n:5kWYsqgxDT/EUmt9godWmqS5W19
- TLSH
  T1D2661786725A6252C977E27E874F052EE1F3B85283428BC758158B580F737EA1B7FE01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SiriusQT/Qt5Network.dll
- Size 1.3MB
- SHA256 f7c7a1ea2570d1238287470b479e384f87c39357d1a4b2eeedbf90901d9c3cbc
- MD5 20dc922278cd948ce6dbdcb74580f910
- SHA1 1a34d4738955f99c17083fec22945b0d6af76f40
- SHA512 90afc14985b51744e2f3ea11a0f6f0edc3c7306bf6e9539c9526adbed0caf47e2b19fa90b38a3269424f109adb80f2bd7394620a35360d5aeb0b3641eb92fb79
- SSDEEP 24576:ogyc2+p+8TtzmgyzcVOrZYKqaewBp7OoakX+UtBEO1ORIV:ekMzKOrZlqaewB1OoakuU31OCV
- TLSH
  T118556B63B3654291D16AC138CA578A07E6B27000A3A69BEF5269CF5C2F337E3673D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  SiriusQT/Qt5Widgets.dll
- Size 5.3MB
- SHA256 9e38324e796eb66200498dbfdcda8ac92f92155a9accdc6c97f92f475ea4c8c2
- MD5 91439f0387898388cb1a3150c5848d73
- SHA1 d57b3c8bb6ae88f98add39890c9a8c3fdc2a0f55
- SHA512 8a282440d5b2ba67ef4d9f490c0ef93946b60351b4019cb247eac67da92398b55745f6325fe6ab7f62088132614cc9f6332726e532e692f0b709bdcaa3999bac
- SSDEEP 49152:oBk7r12r8CgPfdo+553iwKF0d+IUXzj6S8SdnDpme3wfv2IBXGexos0UGDrGGSJj:X7r12lUKiChSZ0UGDrGGSDO97y
- TLSH
  T149465A97B3A50185C16BC23CCE8B8A17D6B270044B628BDF156ACF592F737E12A7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  SiriusQT/SiriusQT.exe
- Size 11.8MB
- SHA256 4fbbb632e08fde2aed8401ffcae9e45627d87084335ac88eb4c25088f0708b79
- MD5 af44f98de9bb7c555e4daeed241985ed
- SHA1 7c4886a7d558822bc9384e22b42980c4790e4734
- SHA512 4dff043ddbccec1ef35afb5c910d2f3f3b92f2fa9714323f0ab20426347bc62d1f83e79db45dbab6ceb0426ccc3b2bcc7ee5b7c62f9e4fa423fc5cc282d3d843
- SSDEEP 196608:NGFc1wXWczJzCSFzsjReoZwRNGmJmapD:ZaDdpFzsj4oZwRN3JmGD
- TLSH
  T1D3C6E01F769643F5E572C4BCC95A5643E632700E532069F379AC8DB92F336E91B38A02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  SiriusQT/SiriusQT_Cracked_Launcher.bat
- Size 117B
- SHA256 f2c0c5bbd1d08aacef612bbbf6bfcf81367389b07bc0464a750b28f4c86e7154
- MD5 0a8c06539748c16007cda7707ec009c1
- SHA1 dfa7a34b2c6becdf6d345a5fa4bd9723f69f0ea4
- SHA512 96a2f25b510fef229723cb800acdf908e32b945cd966e151803226cdc687f28b725d8867c8db16fd81c54c97f41c51fac954961c5674c71e0e21c1b66a24beaa
- TLSH
  T146B0929A5022981C9822B58409A2AAB7B08BC07B30C167807683B135A987815A94E7BA
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion privilege_escalation
- Loads dropped DLL
behavioral13 behavioral14
- Target
  SiriusQT/connection.key
- Size 32B
- SHA256 3e6143b0444dfe9c91955dbcfbe43b3fce9dc94d133e7738d5e067c025e87235
- MD5 11c43f8090f770470ce3677e09dea1ce
- SHA1 4cd1eb738aeb403c5de055ec1245bec274ea4a52
- SHA512 66eb117f4fe5eda40e9a3dd003a0047826fe3a499b68874172b0ad067bb131e9d9989dbe246f4905447570a6fd7558dbe86299146fbc0befdb9c75aa561cf471
- MD5 SHA1 SHA512
Score

1^/10
behavioral15
- Target
  SiriusQT/imageformats/qjpeg.dll
- Size 447KB
- SHA256 b6f871cb7e0c859af7004ded62764362e91acc536c8b37cce16ebe3502761e81
- MD5 90564a7bbd984f6072cff8a5938138af
- SHA1 898ff55492067256e70d24f6694aa9bc1abbaa94
- SHA512 2e84eda9fa79fd1795719323e9959007812f140621f9e4aa06649632364c5d3b1759480053de1335669e1c0ffe50a84048daf45ff59b01a6b2b909741ec607cb
- SSDEEP 12288:dylxbV7tJvOcagCcnl7Hpk+Y6cTPtrBn20vxrYOc6WbNv5zhCE2As1jZ7VWCMi+M:d0YGnykxA3
- TLSH
  T1B2A4B443B2705C47C7E54475EE6AC1A6E798BC1CC7FB4AF734C5ABD93A226B0B429600
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  SiriusQT/platforms/qwindows.dll
- Size 1.4MB
- SHA256 1fa4d2f13d22d9a859503d7b7c87ba39d379d9a14afcea7299d572eabb2bdf57
- MD5 ac584cbeb327e9d2364873f451e074be
- SHA1 eb2d7b7f38c880ae4bc4f32c50e10e73ee15c816
- SHA512 4fca1fa9494799f382318d329a3040bc067d55e7cd99be6d768e975fb585f61f8c1360908284bb04c055dcf21a164464305e9255d52b1c57a0cfc49eea003203
- SSDEEP 24576:X/JCM63NAI9HwxZ3tVuItJKLOlxrbzxTbhE3Yd3ZAX2NyX:XxlAL9Hw73aItqOPDxPUY4X
- TLSH
  T10B658D57A3B54294C1ABC23DC65B8B17E6B2700503619BCF11A88E597F23BE3273EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19