207fa692624885fcb2a3fb9730d9ad56966caee49d2ea9c409e8a58e05e8127a

Sharing

Copy URL Twitter E-mail

General

Target
_207fa692624885fcb2a3fb9730d9ad56966caee49d2ea9c409e8a58e05e8127a
Size 89.3MB
Sample260519-y6a4fsey3m
SHA256 207fa692624885fcb2a3fb9730d9ad56966caee49d2ea9c409e8a58e05e8127a
MD5 9afd9eb4460b301174e2a5f7d5f9c707
SHA1 cb48470ab07b50b2bdda3868d1fec9b8b1b8d96f
SHA512 48dd9421165a1f05ef5776f2214815af58f3748bf8053821f1ad033420cdb3acdcaecba728b5b0c28ea414febf99753792799f92c1e2eb929fc6db20f3da7c66
SSDEEP 1572864:ZejOYf03PwDdsoMxscxOXCY5gVePQz4/I29s8eZZnZCqJlEjGL11rPZ7:Z4xDd91QkRO/vgqJiS1xB7
TLSH
T1EB2833C0651EBD38C3A3C53A7196597D9B5FCCC944E681BDAC92D030BADC922A709F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  _207fa692624885fcb2a3fb9730d9ad56966caee49d2ea9c409e8a58e05e8127a
- Size 89.3MB
- SHA256 207fa692624885fcb2a3fb9730d9ad56966caee49d2ea9c409e8a58e05e8127a
- MD5 9afd9eb4460b301174e2a5f7d5f9c707
- SHA1 cb48470ab07b50b2bdda3868d1fec9b8b1b8d96f
- SHA512 48dd9421165a1f05ef5776f2214815af58f3748bf8053821f1ad033420cdb3acdcaecba728b5b0c28ea414febf99753792799f92c1e2eb929fc6db20f3da7c66
- SSDEEP 1572864:ZejOYf03PwDdsoMxscxOXCY5gVePQz4/I29s8eZZnZCqJlEjGL11rPZ7:Z4xDd91QkRO/vgqJiS1xB7
- TLSH
  T1EB2833C0651EBD38C3A3C53A7196597D9B5FCCC944E681BDAC92D030BADC922A709F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
- MD5 1ca87d8ee3ce9e9682547c4d9c9cb581
- SHA1 d25b5b82c0b225719cc4ee318f776169b7f9af7a
- SHA512 ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810
- SSDEEP 24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ
- TLSH
  T1D296A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
- MD5 fa145097e0274da929aacd68c31338ab
- SHA1 a999806ef0c15593100e21bc8632d7b1806bac47
- SHA512 d4898eed2ea09cb9b1810d783558ee7bf284701734437fbd9e1035138216e1ddbddd77d588a0b722adc5c5fd4a245871537bfb9b168910fc2bffbd6cb78c3c9f
- SSDEEP 49152:pPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU9n7xN:9SOONYbQG7m8bdazl9n7r
- TLSH
  T1D7D5AE06F6D640D9D01DC074869F9223F631354A8B24A7EF1B909A252FBBFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  javaws.exe
- Size 168.6MB
- SHA256 38a51ea74ea5d8db1adbfa4036601708c1291f243209a2c30a46abb25305bfc4
- MD5 a8fb6737c90526a9bdfa2c46495ba61e
- SHA1 cf0364202cb116b8dc3430dcab084ce6770304d6
- SHA512 98310ecac80081a1e42fa40635a863c658b0151bc88c8f3beca8d3bbd79c936a0080336128cb483ebd4647fb2353a52670d548b5c1d796b059c43d3245077423
- SSDEEP 1572864:XOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:LgmeNxNNZxqV
- TLSH
  T135887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 467KB
- SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
- MD5 5db499ae909083620e47eeea1623b2af
- SHA1 bc23303d6885b8f5c3fb84b3fecdf1a678e94a25
- SHA512 d656bfa6d59c495d85eee872b372f7fba24f89101c38de1de904ece0d9ffa6eb93de81fdf674efa5ef724ea73188b908b8ad32cfee03c656accb835683929311
- SSDEEP 6144:ZuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+gehJp/Ej4:w0iKbbTfDVJ2dWQo+genp/EU
- TLSH
  T1A2A48D15779444A9E06BC174CA534642EE72B8960F25FBDF03A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.4MB
- SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
- MD5 57c23aa2c39f11528e56a48ea1824036
- SHA1 d4fbf180266eb210f8d83360cbbd3804249c60b8
- SHA512 77487060b824cc70b30b30b144b8f174fd08ca6a298fd8c8f45d8417b90b7914a0d135edab39d6a5b2b883d49e9386da382a9ce5c52dc07ecd147f49118efa63
- SSDEEP 98304:Ceo+zGD6g/ZXxUhH2jsS5Tgg+uPGOja21pcwXm3zq:C1u0MhHUmkjFCzq
- TLSH
  T1C6768C03F29641D9C05DD2B98B5B9123FA30B8944B34B6DF2A5847253F77BE06B3AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- TLSH
  T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- TLSH
  T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/bin/win32-x64-119/better-sqlite3.node
- Size 1.8MB
- SHA256 23d3cf71d5a77e3f44e4b7247fbe67b0d47c2d3de4954ca2e090761ddb285fee
- MD5 4c36cd5480ddbba385093e2f040f829a
- SHA1 33b7d1439a103fd14f093af214ebbde520e74659
- SHA512 9167418c79b9fb7ea5b76cde999aeae8486b93845836f6fab4d6583728eea7146fc5bd7aef7d29b70303fb8729bbc00f1f134d4a5c99f34899f7faf056513523
- SSDEEP 24576:AnJqg+oTBWGdor1XoXAf5Ym+FwMdXE+RuUIjH2sH9uJ1P59LWhlIMhGqq4viG7yZ:4JqZ5YbwCR9IT2sH92h8EMh4bo0P
- TLSH
  T1BC958C4BF7B400BDC1A7C079851B560BE7B6B4051770ABDB0594CAA96F23FE217BA324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.8MB
- SHA256 23d3cf71d5a77e3f44e4b7247fbe67b0d47c2d3de4954ca2e090761ddb285fee
- MD5 4c36cd5480ddbba385093e2f040f829a
- SHA1 33b7d1439a103fd14f093af214ebbde520e74659
- SHA512 9167418c79b9fb7ea5b76cde999aeae8486b93845836f6fab4d6583728eea7146fc5bd7aef7d29b70303fb8729bbc00f1f134d4a5c99f34899f7faf056513523
- SSDEEP 24576:AnJqg+oTBWGdor1XoXAf5Ym+FwMdXE+RuUIjH2sH9uJ1P59LWhlIMhGqq4viG7yZ:4JqZ5YbwCR9IT2sH92h8EMh4bo0P
- TLSH
  T1BC958C4BF7B400BDC1A7C079851B560BE7B6B4051770ABDB0594CAA96F23FE217BA324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/test_extension.node
- Size 101KB
- SHA256 e529475961b67572ff0c0f2338f4789458f200821f1c5d90b275e7aee184f909
- MD5 c3f8b9d4cb553d6fe02a44eb9d8b071c
- SHA1 2d3e52ec64ae995629966ab592d258be7870bf77
- SHA512 bfba716b8be68c64e8939c890cb92dc4446da5afa6d7f34af884815eb00d90661dc5b9330bf9d0f7e9f4c1586daff1574c071c8055f42379af062ef35c8a748c
- SSDEEP 3072:Gm1XvZ+CiNs0hufIkLCaTJNFVNJxVNVNDdW8HbPCj:GQjUslHLNTNH2
- TLSH
  T165A3395772E500BBE1B78679C8630E45D772F82107619BEF03A4429E2F277E18D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
- MD5 722c2b2dbeee143a14c7ba04edf8e3f7
- SHA1 88321c5c15ed00c72570b28e8183b2440bbf6419
- SHA512 0537a881c397d0bb0836ff74a881d650d59fc151f0e4ccb1c4f5a9fe84549dc9753b886b3e14534c551c167ff702fae71b58fe4fe90c78b43ef05a4cb2761855
- TLSH
  T11C115CCF4B4A2678E3F2B7C1EE21E94E046442E47A5A0824C0CC1DC139AB15A78C6DB6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
- Size 3KB
- SHA256 dbf82d838a58ea5164815779ae0eee5c9de8000cb1596b3fd5bae90ec70e02b2
- MD5 384a5594464d61d108767fd21c35085d
- SHA1 93ac2fa3248cd2aa6c69b51a86cbea38cd8a2008
- SHA512 1cc9d276dd328f2ed316ce42878c38c5f54832592f3680c5117d432f8f205f28179529d4f092ed8cbcbf0d3cc5aead01be36260994519ef1c4583494ac1474c8
- TLSH
  T1F58161F76789067D24C70029A12D61CABA23C32F8B7478484089566C0530AE45FBACFF
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution antivm
- Executes dropped EXE
behavioral30 behavioral31 behavioral32