5d6b8d84ce058fb94f45d3560e3b49d2f6263d489787ac799bb72ea1406a74f4

Sharing

Copy URL Twitter E-mail

General

Target
SoulCod.exe
Size 73.5MB
Sample260511-e1by1sbs6y
SHA256 5d6b8d84ce058fb94f45d3560e3b49d2f6263d489787ac799bb72ea1406a74f4
MD5 27920c79278637cfbff66a5e93d8f22f
SHA1 4e521b7c50106d8576fc64da2700f1e0829c7204
SHA512 ad7829667cf123ed113e4c4cc811d7b5651ed317abec03984c9e0f95e9d88bf38b5d288765a9aca6735c8b024d37166dc88b7608a050e2ec1c1bfadfd80211c1
SSDEEP 1572864:nQejOYfpJO6is7Z8mn6yaZqrO+i+Tsx7Iucyk5uiyHRatqmogda:nQ4R2sT2ZqS+i+TcI4k5ui0atJk
TLSH
T11DF733D6A3EFD859C4F0C5FE5B00B8029B5DCC6352E9A1CA097B01DBD07D8A85B09BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SoulCod.exe
- Size 73.5MB
- SHA256 5d6b8d84ce058fb94f45d3560e3b49d2f6263d489787ac799bb72ea1406a74f4
- MD5 27920c79278637cfbff66a5e93d8f22f
- SHA1 4e521b7c50106d8576fc64da2700f1e0829c7204
- SHA512 ad7829667cf123ed113e4c4cc811d7b5651ed317abec03984c9e0f95e9d88bf38b5d288765a9aca6735c8b024d37166dc88b7608a050e2ec1c1bfadfd80211c1
- SSDEEP 1572864:nQejOYfpJO6is7Z8mn6yaZqrO+i+Tsx7Iucyk5uiyHRatqmogda:nQ4R2sT2ZqS+i+TcI4k5ui0atJk
- TLSH
  T11DF733D6A3EFD859C4F0C5FE5B00B8029B5DCC6352E9A1CA097B01DBD07D8A85B09BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- TLSH
  T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- TLSH
  T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- TLSH
  T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size 224B
- SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- MD5 f0a82a6a6043bf87899114337c67df6c
- SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
- TLSH
  T13FD0A71002D514F489B0BF80E49F0B163DC781E33B026450DC8888512BD72A3608AD9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
- Size 59B
- SHA256 762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- MD5 8582b2dcaed9c5a6f3b7cfe150545254
- SHA1 14667874e0bfbe4ffc951f3e4bec7c5cf44e5a81
- SHA512 22ec4df7697322b23ae2e73c692ed5c925d50fde2b7e72bfc2d5dd873e2da51834b920dea7c67cca5733e8a3f5e603805762e8be238c651aa40290452843411d
- TLSH
  T1D1A002D1B590B39576E44054E5D486821C91C1E1A5535AA0C14986A51C4888055159A0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
- Size 6KB
- SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- MD5 275019a4199a84cfd18abd0f1ae497aa
- SHA1 8601683f9b6206e525e4a087a7cca40d07828fd8
- SHA512 6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
- SSDEEP 192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
- TLSH
  T1A3D1514DEAE36434962F76E9861FA65930398547347C8A417D8EC3901FB5C2036ABFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
- Size 1KB
- SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- MD5 e5c2de3c74bc66d4906bb34591859a5f
- SHA1 37ec527d9798d43898108080506126b4146334e7
- SHA512 e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
- TLSH
  T14421C18C5CD370A59B63F0AC636BA00C7579191330A4C590758CC350DFD1D6A87A3E9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/@npmcli/fs/lib/common/file-url-to-path/index.js
- Size 450B
- SHA256 f92520525c626ab49eeef5ba8663906187fc90790419e1d0aa9298d709faf682
- MD5 66410a0413ae63125e2724a1935f263e
- SHA1 62959907de4776baee6961527d94617355a15685
- SHA512 116095a677f9724579a5a014ee56c295c6325c9bef5995be5b1df5c4c0f1bf710bc00e6f8125e0c36a27a34150dc12d15e10be190df0fcb79e4b5bd3d4124f22
- TLSH
  T161F05C818FE7F2F12EC801DEDA19E813776FC8E932A4C061901E4586578A9D447890E6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/@npmcli/fs/lib/common/file-url-to-path/polyfill.js
- Size 3KB
- SHA256 214657f823570cf213b451ba04d6d87aab9fd3ce823b50529c04e45f58b1de87
- MD5 1dc6eacd20854eed4b60fe6327117ed2
- SHA1 61949d4e95c7e8fbd3c6eeb07fe1986b4ba55aa0
- SHA512 b42acbc5efb083695c189ea445cf60b82c5e51e457360f0459cabadd98355f12e07086372cb8b79086ce42609eae9624a60579edb7117df52ceeb6086f9658ef
- TLSH
  T1D5511341A5F64064469A332318CDE02EB118B097258C8D5BBEEC7760FFB61398EB5F6C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/@npmcli/fs/lib/common/get-options.js
- Size 528B
- SHA256 9effc9eb07753c26041c78a42338687c9dbc3a2fe7580256277d1e6f9b6ce4e1
- MD5 b4354f6b8f8e2f5d7f695eec9131753f
- SHA1 f715742a9eca366ee9f876155a4ff2247ec9439a
- SHA512 ad1a535f946e56f26b0d0b8e299e15085f2e9f11f7f0ae69816466f1e93565cc641e7600a659f8c6c48c35e7c02899918aefd61fa8e40efe715b5826835dd005
- TLSH
  T150F024473D91B11012A6587025CD2009F21ED477359C9B9476ACA1E9BB81820ABB8AEB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/@npmcli/fs/lib/common/node.js
- Size 181B
- SHA256 3682e75ccd114a154ec490db83cb92e4e81a7001f98551305ce8e1f78cef3cbd
- MD5 fa6921f91a421d1681df1b09eed61db4
- SHA1 093d6e28561e89a93b28ef446c6cb26254f3e021
- SHA512 755f746f64a33503e8e5023055cfcfb973e3fa0c5a6c92cf75fabbc1ce164097b3af7b486cf3882d7ca63b36077611291c5a6e799603d36f5f93b790663b0152
- TLSH
  T14AC01213E8B9E65E02C56470A4C0C8032B5F825075484160CA64945F27458A812D3888
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Contacts third-party web service commonly abused for C2

An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32