b3107d0c06bc8bf9c652b753a3f47f22bfdef5e1a84dba8ae4e7990a53077133

Sharing

Copy URL Twitter E-mail

General

Target
build 1.0.0.exe
Size 87.6MB
Sample260523-e1zp3sfw2w
SHA256 b3107d0c06bc8bf9c652b753a3f47f22bfdef5e1a84dba8ae4e7990a53077133
MD5 399852b5af0368144a18407a0f51c779
SHA1 c06a97b7a7accce34e3874df63aa1f4414f62382
SHA512 6652177593a5bc2ce4041a2ace130e01b1c2be93a64657e10a901c573b1c6273616fdd521bc015b3434738f81f7ef2c3199f66bd4078d7204af50457c5cfc67e
SSDEEP 1572864:/mUSLHpfo4hUY06V7k6YA6SpQMkIJd/y78yqUWeYy9U3QsLnC16WEYm7j7e7:/mDLJw+0mPYHo4+By786JY0zsLnC1wYV
TLSH
T17E1833E13CCB1F53CA4C6D388B352F78966C99A91E44648359C4A337BA78FC91D2D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  build 1.0.0.exe
- Size 87.6MB
- SHA256 b3107d0c06bc8bf9c652b753a3f47f22bfdef5e1a84dba8ae4e7990a53077133
- MD5 399852b5af0368144a18407a0f51c779
- SHA1 c06a97b7a7accce34e3874df63aa1f4414f62382
- SHA512 6652177593a5bc2ce4041a2ace130e01b1c2be93a64657e10a901c573b1c6273616fdd521bc015b3434738f81f7ef2c3199f66bd4078d7204af50457c5cfc67e
- SSDEEP 1572864:/mUSLHpfo4hUY06V7k6YA6SpQMkIJd/y78yqUWeYy9U3QsLnC16WEYm7j7e7:/mDLJw+0mPYHo4+By786JY0zsLnC1wYV
- TLSH
  T17E1833E13CCB1F53CA4C6D388B352F78966C99A91E44648359C4A337BA78FC91D2D1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  build.exe
- Size 216.0MB
- SHA256 b485dd320d7eaf9d100030ca5b6d1e5d1f29647cf93ba49605fe6f3a26bf89e6
- MD5 070812cd4790743ee5b24fbb28ec41b4
- SHA1 bfb08840d1cdcff24d93538edca56bd4e3d2a802
- SHA512 7cce604ebd7304922e0ffc432b52205f723929271547dcb8d49c1dab9ecc6df893005453de14571be91d12a680e73259af78494321a47949b791ffe2c3fed681
- SSDEEP 1572864:1XuGYpqqn71DjiJKfgwVsLc2mHpCavVnbJ81bmHG3ZFsr0Wqbg6WpknAbIZfwWl5:IG6eLjPBI
- TLSH
  T1EDB88B03E29A02D9C05DD1B59B5A9633FEB1B8454B24B3DF2B5407522F66EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 b4befc2b9acf8b9f0fee8c437166d5c6e22f77530de157e27008dbc571c12ab2
- MD5 d32e6fbd9599f9fa63069fcd1effd6c0
- SHA1 d75f370d1bfcb8c69abe82f3be4669a0171224b9
- SHA512 bdd8b151aa450ab689cfdb5345bba3514db90d4b80352660b35649758e4e7ff148e048317efdc3ae879af96784f0332d43fd1ee48ad95bbed90e893fdff5ebf5
- SSDEEP 196608:UWxkDUHlgJWwgvYtoexSGkJ+ccXP2BPUNkiAqAN+nN3bR:UEkDUHl4Wwg2xSFJ6XP2BPUNpQN+hR
- TLSH
  T1974729122646D49DC099C879C7678B268A6C30E73FA7B9DFC0F451252B79EBC4B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 25c2906d4bc8f1135149123b9ddbb7a1347fa8e6a4b7199e968c30e4047ed5ba
- MD5 06aa695f302360c757b139e4a7cea4e4
- SHA1 dca9bb7b6b88f78cb6e84b2c166fd612c462f82f
- SHA512 ded9f9e641b16ff79eb1c76dcf4f25bbd242509f81dcf7d662256cbb4da58c43a5724e81cd52662ea023fe635eafe501c344c841a4dd370844a55fa3c994a7ee
- SSDEEP 49152:1D4JOs9bUAtjcqOEYcvDb199aPLKIbH7k6Q4gNoJqFfwYd7f:1D9+UAdcqbvDdRNoJ23
- TLSH
  T11BE59E02F6D651DDD029C03497AF9213F631380A4F205AEB1A905A263F67FD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libEGL.dll
- Size 496KB
- SHA256 72842b1dd36591f14cf328dec4ce6ac84081fff30d674691e38e9a05d669eb0d
- MD5 942d87a9df1e99dc1cd8f9aad5b85dba
- SHA1 984766b04ecb64da717843226c13336cc9afaa8d
- SHA512 95a52270e8f66a5ba09523a04e299920e9523ed474fe53d7576aec384e5494f8c9ca65357d3b6f3151f4eb2ec67569d14c8ed7f860ea89a63855ad8d76bd78b8
- SSDEEP 6144:eVjuHfNwVk2IcwksKrkL6xIdjZwL5/Q5Tmcql3JeLBo6IXtOqoQ29OSM:e1WFj22k86x+U/Q5TmcqveL+6Na1S
- TLSH
  T1CEB49D15F3E946A9E07AC1348A538643EB75B4820F65FAEF03E052752F37BE45A3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 ac17cb6686ec501476afcef06f0af356b8c2c99fa99911634d8d61e7bac5c27e
- MD5 eadccb7f82896999fdffc17924f0e34d
- SHA1 17438c34bd6731e6b064e3cfed710cef4dd40b30
- SHA512 29068cc19e304220aacdff00b956158dfc6efe70cef9f8294c88f792aba22d583c452019e5b7930da0b431ed4b1c3f5b926334fa7533079a1590d9985cb71309
- SSDEEP 98304:krJ/ioHTS9xMZWw2J8Iu1aaIxcj5SLto:q/pOuRBaycxo
- TLSH
  T162867B03F69641D9C05DE2784757A223FB34B8450724B7DF2BA453152F6ABE0AB3EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/app.asar
- Size 63KB
- SHA256 9d8002ac8400a3c33fd69c150c4e324d1cbcd371868c94de20711441438ab5ea
- MD5 54aca67254dcf9140bfcd8e0762a5cd2
- SHA1 577555a45221a7d6576d35c27aa351c61f27ea48
- SHA512 c712f6e16cd8ae29fbd41d0d57c91ade7c7b667bf117599524681b4a5f4bf2b34fc81dd543371d393360099ddc997f11c4704df4ed37cb4d40b57e469eee6ebd
- SSDEEP 1536:74Mj7fVbRr3sJcpN+iedpcd8W3zpbEpoQ6p+9aoYy5ruTy5KBmzuKmzJPi+5zujH:740mcpN+iedpcd8W3zpbEpoQ6p+9aoYg
- TLSH
  T1B253B869257700B84FDA707A1B36944DEA177BA3CE04C307BAAED8913F932C525B076D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 89e96a26aded3c8b849ad7fef9b2cc228f6fe3c0591fd34731d5d0dd758ef58f
- MD5 05128b26cb110206be709e565c927420
- SHA1 004681a54388b79e5ad5b3e9116bf2da8b71ca46
- SHA512 2bced69259107b3f45b7ecd8b35337dfaaddfad596fd99cbf949b838a68075b18741df10b5b79fe6306e4d7bdeaed2b38c313f0e6465781374807367dc737428
- SSDEEP 49152:NixHPC/InMj5kgotyssEw/Ga8irpnhQMjQbw9mhBljAAV+afo81gP8XCEQdtXDx:0xHPdNPnyFslWgr+DXu/J
- TLSH
  T1F6463803F28681E9C06DE579875FA623F631F8850B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  vulkan-1.dll
- Size 932KB
- SHA256 5e4f54907236b4732f0fc2f62c5ec422118c1ca3098c01712384dfefc7dd7465
- MD5 dc0390a1d3a547bbfff704ba29e19044
- SHA1 b266890f3eca66f8b856a7c82ecbdd5c68d6fe75
- SHA512 203931ba17abdd765f64e1f34aac5dd2e31abd52ca0fcb690525690959be3dbac771bf5956692cd013ef5355c0ec24dd785afeb23dfbae8157057eaa0f5722bc
- SSDEEP 24576:6g7xfpW1F35jjly/ux7te3MDSozK6Z5WzcxDYsHkDE6g3P0zAk76oOHbRl:rFCh5jjU36SozK6Z5WzcxDYsHkDE6g3r
- TLSH
  T1B2157E22DA948A69D676C074D8D18A038AB074811712B9CF07B81714BF6FFF47B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Checks computer location settings

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24