052fb8eca00bad93b8d1fbf7dcc7f51441da48d2bdb807b031ac837da58314c8

Sharing

Copy URL Twitter E-mail

General

Target
SMPVerse.exe
Size 91.8MB
Sample260522-pegx9ac15v
SHA256 052fb8eca00bad93b8d1fbf7dcc7f51441da48d2bdb807b031ac837da58314c8
MD5 cd717247d1cf8169558c4f499e432d49
SHA1 c3ede1ff9e4dcde93f3bbb629ff4622a5e15aa9f
SHA512 2d6577754173c96b668e876bf7eb237321df15512f8e190b5719c58c1699837b30a4ed6bcb09335d34584990bb26440b5330ed71dad4fb3a0fa7d38ebf55a981
SSDEEP 1572864:bkUg8evsj3Z44gV1PrEkqcd1Wa15Ms85wDnXnV8ZDozIwPcKHHSLloSqpLIF7:jT6sjW71WRs+YXVxNZHHSiSQQ7
TLSH
T1AB2833B92719D8AFCB05AC3BB8028E2855B23DC7509991E766CC6A401EEC4F4A55F4F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SMPVerse.exe
- Size 91.8MB
- SHA256 052fb8eca00bad93b8d1fbf7dcc7f51441da48d2bdb807b031ac837da58314c8
- MD5 cd717247d1cf8169558c4f499e432d49
- SHA1 c3ede1ff9e4dcde93f3bbb629ff4622a5e15aa9f
- SHA512 2d6577754173c96b668e876bf7eb237321df15512f8e190b5719c58c1699837b30a4ed6bcb09335d34584990bb26440b5330ed71dad4fb3a0fa7d38ebf55a981
- SSDEEP 1572864:bkUg8evsj3Z44gV1PrEkqcd1Wa15Ms85wDnXnV8ZDozIwPcKHHSLloSqpLIF7:jT6sjW71WRs+YXVxNZHHSiSQQ7
- TLSH
  T1AB2833B92719D8AFCB05AC3BB8028E2855B23DC7509991E766CC6A401EEC4F4A55F4F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 15.2MB
- SHA256 850f3ba4ecf28b8710e3b0a5255b2660df7b635302dfefbab02111eb88f9c4db
- MD5 ebf5480f681977d018fd188c9da2bdeb
- SHA1 7bdbbf1386f4741556c5a96ec3f53a63050b68fb
- SHA512 822b6e12d4c0d96409dc14d26e104e9e0ecdeca4d78e15f004a7cfd0190009ec21ab143edda037b1660b316b4f61bfd699a9fa38e64fcbba9c032cfe8597ed7e
- SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+U3r8xd2zJQf8xF6DNgQdGxw:w
- TLSH
  T1D9F6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  Windows System Management Provider Service.exe
- Size 204.0MB
- SHA256 af8f9c8a49b656e3ac0eae88da7501b1c00944d606140d3477c83dcf63093678
- MD5 157c2342514e4c152849ef5a2bd0ad46
- SHA1 d7477d42141655db824ca10fdadea1cb0d868056
- SHA512 e4ff807daccb537826aaabd5c7c88bb2c77bea390c251ff6c7e328009251d05efe0aba36c4ab937f13e8d6f2655153e71c2c9f96bdf3f15381a3045c57112b50
- SSDEEP 1572864:6lO7U+UY69e9lYKEIkcs585/pXIboQCHGOXhjXFPb5kUpbYxr1gtSZ/3p8tgU41F:62YXImgdeESMS
- TLSH
  T125A88C03E29A41D9C01DD175575AA633FEB1B80A4B24B3DF2B5447522F76EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Enumerates processes with tasklist
  discovery
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 53fbd10fb87c20cc0b85942768cf76561109cc71b612ff600a7a0e857051c143
- MD5 5b9b8ec39e5efa78c49f15ce45e6eb96
- SHA1 e507ea3ec56592d3ebf522e7f9e3848b9a795224
- SHA512 1bdafb016c4adf2de6b6918aa0a98185f5bd05933003e1f8ac84bd2c73a79b3586350ee4378892b07e2dfdb9dc75c0a37414e7b2720b6d080eeb27d35477eaf4
- SSDEEP 393216:VDo0qtOp5zxtGlyWOLynvTWcRedqlQ6P2RJ:KOPxBQvlf2
- TLSH
  T190473A122646D49CC059C879C7678B268A6C30E73FA7B9EBC0F451252B79EFC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 3f8800714615ee0be74e88cf80b605f912d3d142fc829344c7b7c3b646f7a5d8
- MD5 61c1ac8a13dbd35ee671ab14d84fac81
- SHA1 0687a3a70c46d6f50a5cfd156e15df32662a42ce
- SHA512 d7bfe6273fc16691e3c53ca04292a7df0a9f47415321aebb597bcaf08040a7a6c66612ad36c90923e51fc7d55e316d35c8bdff898c94d93db98aeadf18839ba7
- SSDEEP 49152:fWP28bu0s6grWFv/iGOjeaGgQbalS199aJLKIbk7k64aoijQrNoJdxljA6iPyfI:f028bu0CKiGWeL1bal9ZrNoJaL
- TLSH
  T1DBE59E02F6D651EDD019C034979B9313F631780A4F209AEB16905A223F6BFD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  libEGL.dll
- Size 500KB
- SHA256 89cf2599519430c43d61a294823227bb15fa82e1655f8f55fc7c366316c51fe4
- MD5 a67667f1f6954c50a9ce1e75f24a8fa3
- SHA1 cbdeaa4620cdcd5a3fac8e2773ba8674a9ab3a46
- SHA512 da847d4bf7a498270718f5c4523d5bc2138a73ea5ba58dcf24625154df184a628ac809d43fc07ebf25ce8e9a061e2e443906c40ad7e94063e660a997ed8cc728
- SSDEEP 6144:5wKVOb8lys73EbAi3uYDbW1XJ5aihN5Iio64haxiVNcPPmWF3PdPNNkygV:5BKA3Z5XSiAaxiVNcPPmW1JNm
- TLSH
  T14BB48E15F3E947A8D07AC0348A538646EB7578960B65F9DF02E052392F3BBF45A3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 92fbce221070939730a2a09c4e0e3cff5e6478a858e463e5e6bca365562479ad
- MD5 1107c9de14654874316510d52bfec064
- SHA1 3494e4adb6fdc177cfca9217521650bd10b1f116
- SHA512 c9273cac3208e03015e18421a2f1837f66f252467a13a2d2221b2e8c339aab9fa0d351a80cd92d7531accc3fee01fb81d2345ee05f1a26336c7d865ec35ea2bc
- SSDEEP 98304:mHm3j3XoOkLxIpo4WddKJT8Yt5d4o5we5MMWRv:Sgj3/0xIbZdO
- TLSH
  T131866A03F69641D9C01DE274975BA223FA34B8550724B7CF2AA453262F66FE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/datavault-win/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- TLSH
  T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/datavault-win/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- TLSH
  T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/datavault-win/prebuilds/win32-x64/node.napi.node.bak
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- TLSH
  T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- TLSH
  T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node.bak
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- TLSH
  T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size 224B
- SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- MD5 f0a82a6a6043bf87899114337c67df6c
- SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
- TLSH
  T13FD0A71002D514F489B0BF80E49F0B163DC781E33B026450DC8888512BD72A3608AD9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  sqlite-autoconf-3440200/Makefile.fallback
- Size 547B
- SHA256 67d473327dd92f5cad68fddb78b8bb3e8745aba851147945893e4db5a2b59892
- MD5 8ff4cdbeec29d794549a0aa48da06bc3
- SHA1 7fd897fc720b6c9c6f760867c97a95431fa4693e
- SHA512 9871a654d8b140ad5d6768d385b86ba7f32927f8ed6374e62c93db99be4a40841f6900d648f33d07dc118b6ea93f00c45f53e4b675643b2b487c9c0df1ea1474
- TLSH
  T16FF0C976A3551EFF26C804A990F411C5390192A28C3C222A0CA7ECF41E214E0CA08CBA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral28 behavioral29 behavioral30 behavioral31
- Target
  sqlite-autoconf-3440200/Makefile.in
- Size 37KB
- SHA256 fb106f5b536ebff14b7e0a5aa11818ad6bbb0098690e6628ef2b789f941be58b
- MD5 24d5ce4709d8310d4bdc202c714f2dec
- SHA1 20c63f327a25b183a64a1df0a09bea2498e2c1e4
- SHA512 7ba280f06c1a7d6fcfa0ebfd09f55c4234330c101ebe42053676d2ec3333785fe740025a1109c993941e76560eb909a123a46d7bb7f0ae6b7b50caa59a748f83
- SSDEEP 768:DSpDBTSKW8hI98wi+ZnWUqaVUfm4gpzKCR5mB6rP9cpJx3H5tDOQT2WWoDSWmAL/:DSpD5SKW8h+i+5WUBV3pzKaf94JXtDOm
- TLSH
  T11103E82FE89C5D3BB8C4C1E6BE6641D79883421696152D237BCF6E0C360E14B517B63B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

Enumerates processes with tasklist

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32