94f04077a18564eb9b1f88a21ec5856e22269bba88ef3024823cad9a2b81b816

Sharing

Copy URL Twitter E-mail

General

Target
Exploit Launcher Setup.zip
Size 107.0MB
Sample260522-wf55sscs4j
SHA256 94f04077a18564eb9b1f88a21ec5856e22269bba88ef3024823cad9a2b81b816
MD5 ccf9e99db37aab3b6d6eab0467636e87
SHA1 e608efe217be3e3d607cf9ea83c03d7f4127f25d
SHA512 4071d93b6f40bfc7ab8068b9eb2f6f6c7344178915df6e9c01f56490464bc324da9d9e34827e1343c93b60abc5f34f3a9bf12d95080570db445243ff7cfb7bba
SSDEEP 1572864:6BlH6RAsmxxoOdmEY1Snj3Of7LqFdzLcBdyNyB13jSQDOqIWA1S:6BN6SzxxPdms6PqFdncBdyNsSmAg
TLSH
T1E63833ACD5B65D7DE4BAF83CE142ADB0014635B66B327B83D7AD2CAD32B14611B3160C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Exploit Launcher Setup.zip
- Size 107.0MB
- SHA256 94f04077a18564eb9b1f88a21ec5856e22269bba88ef3024823cad9a2b81b816
- MD5 ccf9e99db37aab3b6d6eab0467636e87
- SHA1 e608efe217be3e3d607cf9ea83c03d7f4127f25d
- SHA512 4071d93b6f40bfc7ab8068b9eb2f6f6c7344178915df6e9c01f56490464bc324da9d9e34827e1343c93b60abc5f34f3a9bf12d95080570db445243ff7cfb7bba
- SSDEEP 1572864:6BlH6RAsmxxoOdmEY1Snj3Of7LqFdzLcBdyNyB13jSQDOqIWA1S:6BN6SzxxPdms6PqFdncBdyNsSmAg
- TLSH
  T1E63833ACD5B65D7DE4BAF83CE142ADB0014635B66B327B83D7AD2CAD32B14611B3160C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Exploit Launcher Setup.exe
- Size 107.0MB
- SHA256 8a4f9d4a57a42d0c0daf83926b3b58cdfd4cd760a93df5932417f966f5314678
- MD5 3acf97ad4519726f59eef5705c35134a
- SHA1 a24866b8d0972e8667999c2abb1da33825059256
- SHA512 822b62cfc6694ca3738fcb5139825023be13aa1ac8b1174057de6ac65bbb6c30022417eaeb61302f40e6dff1e9ae49247b34efba892ea481cffe3e659bbfd22c
- SSDEEP 1572864:1BlH6RAsmxxoOdmEY1Snj3Of7LqFdzLcBdyNyB13jSQDOqIWA1M:1BN6SzxxPdms6PqFdncBdyNsSmAK
- TLSH
  T1983833ACD5B65D7DE4BAF83CE142ADB0014635B66B327B83D7AD2CAD32B14611B3160C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution spyware stealer trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/app-64.7z
- Size 106.5MB
- SHA256 226f7adfc95481b1cc06a13c2bd448e5239568ecf28f91fb82cf27c3f1d44164
- MD5 da202472de8754586bb88e9ecf8be49f
- SHA1 c0ce575b81444264247ef0906f88b912154c6001
- SHA512 10e8fff4e5be60723d2ef9128d355a673577fbad30bd504477b78e115dc070da3e141d7c31a10971d59df2face3f822d19e7fd3165e2b3b24af3a27fd0576c35
- SSDEEP 1572864:7lH6RAsmxxoOdmEY1Snj3Of7LqFdzLcBdyNyB13jSQDOqIWA1c:7N6SzxxPdms6PqFdncBdyNsSmAW
- TLSH
  T1343833ACD5A65E7CE4FAF87CE142ADB0014635F66B317B83C6AD2CAD32B14651B3160C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  locales/mr.pak
- Size 1.2MB
- SHA256 0eae188c9a81bd3257a21dc28448b5e9e5c3f4f4de4dc8e178e7f13cab06d6f7
- MD5 b7fd0eb57e0a1266990bdd0b405675b2
- SHA1 74becbfb683508912e703f31c650cb29057f1f74
- SHA512 e6fb9760d62051f1185b060e8288c56b95e3e8d701767d8645ee9cd464993b76c78aff365f401a56e391d63857307827d716ba026bb5e4712444b09b0ddeea4b
- SSDEEP 3072:rMfCBVYlp+n/4xasCPLmFZfr1iuJvm89/njU6TkeInVEwFEyGRg3R5QodgEPYyla:Q6DYL+CZTYgKZOa3Vq9X5km/Iwp
- TLSH
  T10345C24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/datavault-win/src/dpapi_addon.h
- Size 99B
- SHA256 bf9639dd953de6f4ab47d68943f11f99907ff31ea4d05549150e89a21a6efb51
- MD5 e1d8371e28e361e1c2186543cb7c5c15
- SHA1 61a289e4b6357d6124e0673ad99fe3ed37780989
- SHA512 46fd5fa577482b2d0a3800019bb70f1d7f48c36881830d2b1e68de5ba84ce5aca2ee0e7b11b5eb5ac1eee9640a69bd67e30ecde1290a075d92dba86ce26d5e87
- TLSH
  T1CBB01211C275394F54D4C1D72616ED003C89130C2F94E0142904524779055C5710B685
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/datavault-win/src/dpapi_not_supported.cpp
- Size 218B
- SHA256 0c1d1737d698c15cacdfe963b8a84cffad1422fc0be1fd6995f0572b70492a1c
- MD5 9b3c19681f02ac440971abbd69ed4b41
- SHA1 4e76b0c252d900a68c76e1662442d998e71b5545
- SHA512 d4a8ca44d3b30386fc499c920d57cb70453c6efc68583a6e3a3c41a0cca30dc2e113dbdfbd0cfffa8ee3e6d397f4140b9c9bcb4d9e6979c7b5c375ad1a126a0e
- TLSH
  T107D0A7969315321B56A1C18AA213D8106D4811095EACF6041219844EB6563D6314299D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- TLSH
  T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size 224B
- SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- MD5 f0a82a6a6043bf87899114337c67df6c
- SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
- TLSH
  T13FD0A71002D514F489B0BF80E49F0B163DC781E33B026450DC8888512BD72A3608AD9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
- Size 59B
- SHA256 762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- MD5 8582b2dcaed9c5a6f3b7cfe150545254
- SHA1 14667874e0bfbe4ffc951f3e4bec7c5cf44e5a81
- SHA512 22ec4df7697322b23ae2e73c692ed5c925d50fde2b7e72bfc2d5dd873e2da51834b920dea7c67cca5733e8a3f5e603805762e8be238c651aa40290452843411d
- TLSH
  T1D1A002D1B590B39576E44054E5D486821C91C1E1A5535AA0C14986A51C4888055159A0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
- Size 6KB
- SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- MD5 275019a4199a84cfd18abd0f1ae497aa
- SHA1 8601683f9b6206e525e4a087a7cca40d07828fd8
- SHA512 6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
- SSDEEP 192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
- TLSH
  T1A3D1514DEAE36434962F76E9861FA65930398547347C8A417D8EC3901FB5C2036ABFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
- Size 1KB
- SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- MD5 e5c2de3c74bc66d4906bb34591859a5f
- SHA1 37ec527d9798d43898108080506126b4146334e7
- SHA512 e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
- TLSH
  T14421C18C5CD370A59B63F0AC636BA00C7579191330A4C590758CC350DFD1D6A87A3E9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/src/backup.h
- Size 6KB
- SHA256 556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
- MD5 29dd2fca11a4e0776c49140ecac95ce9
- SHA1 837cfbc391c7faad304e745fc48ae9693afaf433
- SHA512 5785667b9c49d4f4320022c98e0567a412b48a790c99569261c12b8738bde0b4949d3998e2b375540ede2ff1d861cad859780ade796b71d4d1d692e1ed449021
- SSDEEP 192:jXmQS7rRLcxPsPVHXmIXYIyx15kPhw0Io:j2QS7rRLOPs5e0
- TLSH
  T1E9E1A46EE77301AA193351A2976313B05F2D540B2E3CD163BADF43E16F826CA1764DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32