daf849962f9c583e526cfdf6fc6efd57abb97df281bcaa6e651899c8cb5a3437

Sharing

Copy URL Twitter E-mail

General

Target
e-core.exe
Size 73.8MB
Sample260508-1tk41aey4t
SHA256 daf849962f9c583e526cfdf6fc6efd57abb97df281bcaa6e651899c8cb5a3437
MD5 db0357c9a9270543eac71d24fd959212
SHA1 db19efa10704085ced32301cdeffa926907b1334
SHA512 995b643e358b51a85d445a0d080d3de9da6463cab388f77f9ba6f0a2bb7433be02c38546b1980f857ca6dee28963dac5909d9aca7276a2940629442eb6ea495e
SSDEEP 1572864:bt9IKPN+SXrERWYt5sjfUIm6CSxU0OndQ5VIr2K4BgdaRhSd7:bUKp7ERWFHvVA2jgvd7
TLSH
T14608332E4976C6E9C773C5B850F20E11F314CA17FEB2099FBB19A95CB111B8908B8776
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  e-core.exe
- Size 73.8MB
- SHA256 daf849962f9c583e526cfdf6fc6efd57abb97df281bcaa6e651899c8cb5a3437
- MD5 db0357c9a9270543eac71d24fd959212
- SHA1 db19efa10704085ced32301cdeffa926907b1334
- SHA512 995b643e358b51a85d445a0d080d3de9da6463cab388f77f9ba6f0a2bb7433be02c38546b1980f857ca6dee28963dac5909d9aca7276a2940629442eb6ea495e
- SSDEEP 1572864:bt9IKPN+SXrERWYt5sjfUIm6CSxU0OndQ5VIr2K4BgdaRhSd7:bUKp7ERWFHvVA2jgvd7
- TLSH
  T14608332E4976C6E9C773C5B850F20E11F314CA17FEB2099FBB19A95CB111B8908B8776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/app-64.7z
- Size 73.5MB
- SHA256 c177851c10f0bc37ff7330a10a95b88a952b1cdf66c32432586a158635782b76
- MD5 baba30ef3b8d6fdfac41ca6087f58352
- SHA1 d4d1a9f11d261893b4fc4b30ba1a0b2ea51e8a65
- SHA512 54d267dcaa53f12e604e204a2e1c5a38be859850b40054e21fff9d28053955c6d73ace6ac05b089cebf24338e5bb7fb5683dbdab91d43940a6794420b6866a3e
- SSDEEP 1572864:2t9IKPN+SXrERWYt5sjfUIm6CSxU0OndQ5VIr2K4BgdaRhSb:2UKp7ERWFHvVA2jgvb
- TLSH
  T1F7F7332E4866C7F98777C59860F20E11F314CE17FEB2099FB719A95CB211B8908B8776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5
- Target
  chrome_100_percent.pak
- Size 148KB
- SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
- MD5 83ec43f2af9fc52025f3f807b185d424
- SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
- SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86
- SSDEEP 3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
- TLSH
  T179E3E1D3B3F4ED3DCB9716B7A2260072ECB3466D0692124B168AD4752A66B8CCCC47D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral6
- Target
  chrome_200_percent.pak
- Size 223KB
- SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
- MD5 dc48a33bd20bfc7cacfc925a84b015b6
- SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
- SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a
- SSDEEP 6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
- TLSH
  T11E24F1C7B3F8DD3DD9630AB3522A01F1EDB2113905B6560F57CB9C347999AC988C9283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7
- Target
  icudtl.dat
- Size 10.0MB
- SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
- MD5 ffd67c1e24cb35dc109a24024b1ba7ec
- SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
- SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
- SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
- TLSH
  T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral8
- Target
  locales/af.pak
- Size 520KB
- SHA256 c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7
- MD5 fc32a6b72fc91e1be9c2c9d2ea586ec3
- SHA1 5d439600cff26476d8715b778881f5735356d723
- SHA512 b34c7390d4a15936b1f74f42fa91ccd0ca0587f0dd630096c9a16ec77756e2137d9e49ab1ebbf703c8ce6f56f110d5bb3333b1ebed51779d1bb2460b203a7250
- SSDEEP 12288:WEG8+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:WC+ozrc86VZBaja+H2Jyngae5Ig1eo0N
- TLSH
  T1C5B41C0AEB80173D09A076D6BA0846F7FB9CA26CD770B2B6DD9D823105A6EFC117D1D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral9
- Target
  locales/am.pak
- Size 840KB
- SHA256 49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c
- MD5 e0c0a175875fe04c01c7606efc083d24
- SHA1 15cea393a6cc1cbd619303d78eef6948f05710f6
- SHA512 3fe18007d138b39707007a98b95781619f892aa5163f74c600c930c6284f4219c2a6714d25a104eabb98f763fdc481ab26ddddd1bd4010ca1630b5d8fc4e2994
- SSDEEP 24576:odRToH2hTCNRysrxQH9hjN3fpzvh51muMXqVFq+XG/6WxLP5Y:M5z
- TLSH
  T15D05BA547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  locales/ar.pak
- Size 921KB
- SHA256 817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc
- MD5 480baf1a6d7fdb28a105180bd5791388
- SHA1 9556fabb0744eaa5eb17c93a5375f31b5315d7a5
- SHA512 24853a554509eb069b04dea588ac154d5dfb2601cff8f1575d9f83e8b1fc787fc723c65d952028e1ecd2eecf406226ed8b5eb07a1bec58efce4673e5d97d4e18
- SSDEEP 12288:NSi92W+BUC/+/RxNEhugvPUzumJkOCSn5KNp5QpnSEqt:7wWYK5aQi
- TLSH
  T163158AE21B2984720B96DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11
- Target
  locales/bg.pak
- Size 959KB
- SHA256 f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83
- MD5 d9d3b4d420be9277d69584a3c0b5080a
- SHA1 285a094979b739c4455e3790968d33ca4d466146
- SHA512 388ca1cc11485fd3d31a7fbf710145cbd480cb386d96cf6dfd83e1ef2f5376df76db5c2cb051c5a045452875f8362890cbc6df547200bec624c9f13636655803
- SSDEEP 24576:MhrgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:+gWoOYLYfYUPVbKDks373ZN3ApmVDLpw
- TLSH
  T1722524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral12
- Target
  locales/bn.pak
- Size 1.2MB
- SHA256 5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d
- MD5 f22d531de1ef474d9839c96e22a06277
- SHA1 9b12fcf37966444273451d9859e20a3c4a4be1f1
- SHA512 86f9958450e6d4fddca876c7bbc87d154d17fd6e8c002cef98a97c5d265f215c2d8e32c9cbcdad5a28361419877367cd959cbcc24eb77229cd982df0a8a2c8af
- SSDEEP 3072:LEcoGqGB2le1abaCb6Ew/0WySZISox22f/MHDrYfHBpxspSPrCXqB+iBbHRI8T5F:LjJfa56/0zDgpCOXqB+iBbD5YqNP
- TLSH
  T18F45DE209C6E81B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A25938ADC3C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13
- Target
  locales/ca.pak
- Size 584KB
- SHA256 bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89
- MD5 d042acc4d9f540c737480d25488ad68b
- SHA1 a3a59a5baab008eb1d24693bcaf551fe1248c4fd
- SHA512 0e11225f2362770d10a387c56ffacba75c2bf1607da7df576e0a09ff0254736f825e5e4f5b055171d62c46d6a7f7e33548e9147d26bdf8113576cae9a5e0849c
- SSDEEP 12288:Ogqbr7D1MeCi24V3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOwjcXR2lxQE8v:OjRVoiL6qhgMNxgQh5vfScs
- TLSH
  T14ED4F8239FC93B6744D3320AFB46C257F48CA9847B06D254F4AE1B1622CCA9CC677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14
- Target
  locales/cs.pak
- Size 602KB
- SHA256 db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1
- MD5 319f34edd53fd08e79e5f443aec8e098
- SHA1 c98bdb5c6c1cc1b1581648ab8498b8079aac85ad
- SHA512 619b4365a4c7c620f09d472a5a5c1d984095ff6b03627333e8a0688b2f21e138ff50b6a3d5efbee67beeddd377ee47202b4607c69a6b76aeaa5fdddf28aaf0ca
- SSDEEP 6144:6KHOO0BmicuIsgyha94N85AKh6mARAO52C+TH/NOnbJSBXq8QS:fOEA1glC85AK0P52C+TH/NObJS9
- TLSH
  T166D4491EEEA26435588002487FBE4228BD5E83540B2EB9BB6CCF9C91217577E8FF4D54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15
- Target
  locales/da.pak
- Size 545KB
- SHA256 e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04
- MD5 7db5f17d66731b076727181f7f66d867
- SHA1 82ab8e705a0eaa73c20bad139467d193379f82a0
- SHA512 fc1809fb53ea2f5e57b3814a8a7323b96cca724de2528ec39544c51525b5a4df611701712242f910f23628e68cd45fe3bc9ddf519d4b908965cc56f6f9450a3f
- SSDEEP 6144:IEBnngPFn32fJMoRzVsh5OsmZE1seDrcwlQJWJwgKobwmPaHLV5bpkUdRi3jd45k:IEBn4tGfKmArYbp5bpfdNm
- TLSH
  T17FC46B4BCC9C732F89AA0764F3118EA7EB5D543CC684264FA5D8943A09CFD6097BE1C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral16
- Target
  locales/de.pak
- Size 582KB
- SHA256 4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd
- MD5 f13adcc145f23f6f263c50318da302b0
- SHA1 1f9b92e5f0ac9a0579cf511a7ceb8c00a40d564c
- SHA512 04557b6ccc5caff3d3ce15bdfa9a1b7415ddc8a67963f58931ebe5678b149c6d771928ea785f07b5ca0e86370e2130f8084d1586de15521fc11a435b11c168b7
- SSDEEP 12288:5apU1C760Ps3K7UpugEaL9Xtt5PPMkUt1CTz:5D1Cm0Ps3K7UpugEaLRf5HMvCTz
- TLSH
  T1A5C40703ADDF625EC78273607701CDB77B19E36BC342312A88EDD12B654B5B283AD526
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17
- Target
  locales/el.pak
- Size 1.0MB
- SHA256 b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d
- MD5 2f0639ad04c3c16a216d4789dbbc12d7
- SHA1 b0ed4b4387545015b4cf73b50fc473b5c35d3548
- SHA512 c5a5332c67c8aa38deec7254bac15a73c6d432b705fac8c4d6feeffff1a095ba4766443a03c1e4f17a4f09c1fa29d6d1c8740d6e455be2c0973869ccf8dd0122
- SSDEEP 24576:qvHcaFbu4FDYX9QnMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQu3:cHcaFbu4FDYX9QnMDhWJXDsS7miHcD23
- TLSH
  T1B735CFEFB4582DED8086950785D8F07C2BC62D6CE749CBD86629CB60BDF80719622D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral18
- Target
  locales/en-GB.pak
- Size 474KB
- SHA256 3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39
- MD5 7b278baf4598e7ffeba15180c017311b
- SHA1 2a8f2a9138c700f607441647833ee5a8d2ba2b85
- SHA512 654b69d06eb9de0b187dfdf5249f88cf9c73031034e0620703db88910737c22f3dcef75f05993237bbda657703fa2b152c467f33b6f3c48cfdc8c35291049db5
- SSDEEP 6144:Ll+NdwHNYrwSiKdFkIV/MP9ezQSKrfaYdrcLlY5IPxGBcvRJeG:Ll+nVrcC/MuQSK3Z5Mx8G
- TLSH
  T11CA43C1FF784126A069312627B0AA562FF26D06CB35112663CBD802C33B7766C3777E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19
- Target
  locales/en-US.pak
- Size 478KB
- SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
- MD5 a99b6152bdeac44148f94394c4149622
- SHA1 df7371533e92aa24f48469116d9a8ac73249315e
- SHA512 3160b58d10ca147594ff4aca004007d4e6823421be349cfad945c681e220eec7266d88434a4d31c719a346650ac0ed31f1f13fca3e824d81bb65ebb4d21cc2c1
- SSDEEP 6144:1kdXRDCEmszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUEmGeM1QcDq+5UxOLwB
- TLSH
  T175A43C1FF7441229069352627F09A5A2FF36D06CA39112563CBD812C33B7B6AC3776E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral20
- Target
  locales/es-419.pak
- Size 575KB
- SHA256 4dedec1ac933c73773b1e54caab1c4d606d12f3788cbeef4d6a2a382138cc907
- MD5 cdbcdaed721e027cdd6c76de0c166f6e
- SHA1 105dc222d858bc32c3a5acef310d08a821ec7cfc
- SHA512 0afc3970922ea3efebf595bdaf27228eab79da2545d63a85d94d6f319353907a5fe265a139a1563eca653d06dc8f3de7dd9f8de4bd9ee0094f6873f521f58429
- SSDEEP 6144:CXIiSSLPaWqEJvslpbYl7GuoZOZ5zaOaQ+NK891:EzSSLP3DOpmGw5za0+x1
- TLSH
  T136C40922BAC81F5310E3A388B743D753E4989545B408D29BE8EB876562CCF8CC977ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21
- Target
  locales/es.pak
- Size 575KB
- SHA256 a32221be9b65aead3fa779dc54e5ca483a7d73c4815e5c7c3b53711f560bd301
- MD5 d1dcb55680b8e6d28099e8c90473b73f
- SHA1 633a049a5bbb84ee50d4586aac3563d4fa4c11db
- SHA512 3b4eff67094776ff04f634a8533d6986749c8c7d6c0cbfa2ee4f42ed66e0cbd8a3435922ea0bac9b6cf7c6e63d79d96a3f7d09f1e806c8b2c23baaec3b318e42
- SSDEEP 6144:F2IPflvErbD70A13XVslgkVXpT+ZoBQihXFijm5JEf2u/Sz/B6PZOkx:MIHlsrbPFVMNphBQiXijm5q2CSLTk
- TLSH
  T1C3C40722AACC1F631093A389F743D753E8949585B508D29BD8EF876612CCF8CC967ED1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22
- Target
  locales/et.pak
- Size 523KB
- SHA256 a4d1fe9903641540b11e0d00e574a6665a1602ad81f6aae9a083ebd04bc768c7
- MD5 c6557b5d9083aacdca9c09af5f8e30cc
- SHA1 a64ea081b5c73e07f87885f19ad26d7918720dfc
- SHA512 7200823594da9dd6724631531c1d60494d3206192c8cad7fae655e1ad9fea42c36869812fbaf9cfa17ff85c27db365b7f9d640c0db14059512db2c7d5aa19545
- SSDEEP 6144:HeaFiPGOrs99Z0+I+eL40pmFZxEYTHbtiPSia6OSt75H50MHFjiCKM2aD/APQOW:HhFeGe6Z8++mFZq0SfH50MsW
- TLSH
  T132B43B42A27D731B282411F9E737A923DC9EE7D9B4000D966C974A1970FEF8C38B6B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23
- Target
  locales/fa.pak
- Size 855KB
- SHA256 ef9e5b71063c26b1a5d512f5e14c3f7fe5a1925ff25ca799c51f8073c33bb90a
- MD5 c4210a562cfe294967c268bf51adb62a
- SHA1 bc46733d1be4d423628e72c0ae2f516a5f9731fc
- SHA512 add8aed91965a55c0f6114f1ebef65cccaad968e866e20ad63277e1a707bd8b0ccbaacf4d8112895d186912c376be389cafb6040935bcab720a1f2da9b168a54
- SSDEEP 24576:g14mFf8u313uyqoT+seqHRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUD:gY5/3
- TLSH
  T15715C3956AAC5AB16746CA0341E33834C773EF12D34DFE40ACA1076609A5B139F5FA3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24
- Target
  locales/fi.pak
- Size 534KB
- SHA256 93c49ec40accea8e1f4f9b7db68b9b818f8db0b7591cea67ae9bf663c1c57728
- MD5 050870ad4d70ff6c4cdcf7207b048929
- SHA1 98d0e2c063b1586b821528bc14246d6f2e279e64
- SHA512 76f6e716a48eece399bacfe9781a6c13f7c7c139af11453b7491bae80f578e539af36d6e88cc2bf33d63f67f6b66d0cee4439816101fe4d11c8e8728737b02f3
- SSDEEP 12288:slKO6419l5Mteuah5EinUtWnSp0WahHNYM:6B5E8nRl
- TLSH
  T1AFC45D915219C22237C8D29E7DB0903EF6E5E3DCCC284D96E843C7D849E99887D7276E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25
- Target
  locales/fil.pak
- Size 604KB
- SHA256 9b69d82f50c159d1ec5603ef45dc139143b4f05761f38f263a66fffedd28ff5e
- MD5 1f9d4a873c12948379cee5092476a12a
- SHA1 016b780d49470603b2e8bf1c4953036f0e30c125
- SHA512 a6477b04f21ee5f1c15002adfdb44a2c81759a1d8e0b2af2d705be6572afa6e0037d1944b4e0e7ccde8d2bfb2d97e739fbee0d11ecf7199c229d5a6db4aaad81
- SSDEEP 6144:fGs4IsSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzGK:fCilx5G7M
- TLSH
  T1DBD4B515B7401748DBC352E51360A82FA6E560B83F82386E4FBF269B7BE7CD5D270192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26
- Target
  qejiwinView.exe
- Size 180.0MB
- SHA256 7d31804da906d57b751abf8b4edca484c4e7197454ac980c59a15d46b3ec03f1
- MD5 b24b79f49fe9ec3c9ff566b6b53a5032
- SHA1 1b334cdfed8d07a3eedc672ada2d67aa024b0743
- SHA512 1da6edce82638c1f7762fde9e091041e01e88126a03a0be3f71c5a047a7014de1a94f0b912dbe71ef4b97e8878000f1b36e8f7ec85c1680ce0d5caa1472e3b79
- SSDEEP 1572864:TH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:wsok+hK7
- TLSH
  T16D988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral27
- Target
  resources/app.asar
- Size 3.0MB
- SHA256 9bfce6bad74eb724a9b854bb81cb5bf23ad2a80173260887f83da405858bfaf5
- MD5 63b7b452e2759546403ebcf2f6949079
- SHA1 e1202dbd27864b965e1dfa6fd7a33dd3b0f1d3cc
- SHA512 de2dbfdad8fbc227d2b094ea08a41b80e4f9192462125f696685dff5f86ce0ffb62dffb0c778ce54c434708bc8ab2642194bd814b79c4598393c7f359691d7b6
- SSDEEP 49152:88XXTC7sRhVJpLgPmQtL9q3/J/f89q/ay/qD/DI+fV7ZPmv2abwOSqdSUkFHvv5/:O7oxfQ63/J89GaKsLpmv2OwpUYHvvdXz
- TLSH
  T122E533865E9081E2DE33CA2B1B3095A5D4078D83C348D96CBAC53D9EF609B08D63B7F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 409a0fa76f055a87ae70434414586d144502beb25fa3004866ee70abd9a8547e
- MD5 5633d5211bfbbbd2b0493fcbd492f5fa
- SHA1 9ad2466751880fa0acc1dc6af2693d975dd9e307
- SHA512 8eb5ab1ddb1dc42eb323a163af6b4521acea5194909ed39933710bf3fecec5f50f070c20df57a89f4528076fbddb0fa0c27de3faa7b4a249637be00ec3bf396d
- SSDEEP 49152:YaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+B:762naMskwtEMaQPJnymh
- TLSH
  T1AB463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  vulkan-1.dll
- Size 874KB
- SHA256 f6c99137c3d6af45bc2262815867d6d37f5dcb0552caffc90cd77fb6561b7491
- MD5 a6e115dcfb063d0c06f8bef721166b37
- SHA1 8a548affa209f561e7eb8f51d5515aaec8c7bc59
- SHA512 ec5715c005cd2bec8ef2ed5af16c041d56d5e1175342c285e4c2d693a88cc86bebe83ec7d59ba3c37b91f1b5e99879532aae9a7fe68fe7ab2c758d649e034062
- SSDEEP 24576:l4cMT4Bv88wonwyHp9zDp6Z5WjDYsHy6g3P0zAk7TKr:l4bo3/nwyPzDp6Z5WjDYsHy6g3P0zAkP
- TLSH
  T1E8157C23E6648669E4768034C9D24A03C9F274921725B9CF02A84718BF6FFF47B7DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Network Share Discovery

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Network Share Discovery

Obfuscated Files or Information: Command Obfuscation

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32