cc0f8deaa62669cf6362dff8f89b496c6609483cc127423a0df95642249c8a6d

Sharing

Copy URL Twitter E-mail

General

Target
SETUP_FILE_(PASS_KEY=2117)).zip
Size 26.9MB
Sample260530-vd57caas21
SHA256 cc0f8deaa62669cf6362dff8f89b496c6609483cc127423a0df95642249c8a6d
MD5 59928703a4fc96c07d88802554d21073
SHA1 97e0586e67e0624aaf58b8bc3d68cb622a1a1877
SHA512 1ea02d9fa17078727b358f1e2d9c1c097008dc8bfad532c4acac0a337718a461510b3d588d2fee63cb6bbe23bdf0b0093cfe0f99bc0e334d5f8285ad9be8c66e
SSDEEP 393216:9pzBucFr3P7V9KaTdPA7Fi4Kept/Xbbylq3gmkC0xuGu4Ac6g1E+/bP6Uv4SI3Bx:0yzLP644KepRftz2kJimaIahnhQ
TLSH
T1D35733D80B5A5482B23DCF191836FE97113A4B62F6C0ED91763E7AE8F731440A927D27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  CoreSyncPlugins/LiveType/customhook/uninstall.exe
- Size 1.4MB
- SHA256 fff4a6570cbb4abef93e86b7513a2cdec776e86c6fb2bb15e5cb54e34d8e8f74
- MD5 89fd3c039ac80195f5c03f84cf13e40a
- SHA1 1cbbb7a44063a1f6c317356b83aa72aac87d596c
- SHA512 de43953a496f4f19532c980fdc9a11574020deb8a4f52ffc45058d8fbd1dbc3cd3bb97ddfc433536c24b21407a58be3aafe5a707adbe3227d7e86bb0d6c7b8cc
- SSDEEP 12288:7MRO0EOI9vSpTD4DQbKZVbFnRGiKvlUL/XUii5uuR3HGe18tb1AJzACEsYu22Vn:7MIpspTD4DHjile/Xde18tRyACBHq
- TLSH
  T153654B11B7915018FDF312FA5AFE606C9A2DBDE00728A0D752C42ADE8675AF07D31B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  CoreSyncPlugins/LiveType/livetype.dll
- Size 1.8MB
- SHA256 3e9aa71316d5815502c1ca9352c9fd5823443b50bc43044c78fbf27468eeffcc
- MD5 0de2befccbf4f1cf6ee5e3a918f688a9
- SHA1 c7bbd490df6b2b5170e7c00f733970aaf2df10c2
- SHA512 645f7ebbcb479112f0627ba86693524c25fcaaa1f70cf29bd28896fb6cafcf3c8b4055271cf2d487979f531fe4daadc65e53b750b175d2412d7ad3b283138fa5
- SSDEEP 24576:TUHUZ29ehafybjKrWmS1YsGB7liUiflT2N70FzmIbSc:gUVEKmS1rGB7liUb0xbl
- TLSH
  T1CA858C317B45C135DADD02B24ABCBF69426DD8A44F7502C796D8ABFDCA241D22B32D23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  Download Navigator/CoreSync/CRClient.dll
- Size 1.2MB
- SHA256 79db93b9777271e0eb2c369d94f76d5eb22bddde48389aad20d672c1aaa5bcf7
- MD5 e11264a135c0d5a41e50f4f039fd00a5
- SHA1 e6901801edd4f97ef6297cc4966b499f314d3421
- SHA512 bdf9597dbf9b374ed78571f9c1f1d25ac00e1fd3303ddef08c80a53fa11657d9cb6c323a6aae5469796f44c1840dc41b88c5a721c3a3cfc38451d91ac6b665f9
- SSDEEP 24576:6o9kbjL52+HxRd+GYAx59TmZyyKXkbtolUDKOFcVkFVmCAdWRc+6bKdqhe:lSbZ2+RrBxHm1Z4Kc+F1kWRVqhe
- TLSH
  T15D557C22BBA58021F4DD12F152BA3FF65F6E7924373A44D792C06CA999305D33239B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Download Navigator/CoreSync/CRLogTransport.exe
- Size 136KB
- SHA256 49d3f75b82ec3fedba94baea550f7ac9828d757f19d7d6eccc9f0aa0cb6213a9
- MD5 971530998a2ccd236e3a4d1946b34edd
- SHA1 e6ab5165475c9f095d6b6d65eab59e6ff46b8978
- SHA512 0556a6ee40ad026bf1ba3d0ccc0cbc56a8733e7b362967072350db3007bd6cb4bc383af2f182a751d370f0ee6d64b73fa75cd8ba919bcbaf632be2de6bf95def
- SSDEEP 3072:FLQsM1VK7T7l9XUw8Gpm7W9ifTdaVX/smhoD9:FYXKH/Ew8T7W9ifTEXsD
- TLSH
  T17CD36C22769BC071D17123F118A56FBB97BCED344BA645DB73C4AF3E48102C13972A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Download Navigator/CoreSync/CRWindowsClientService.exe
- Size 327KB
- SHA256 d6c13c106f8842b3d0ffaf25627e3210cfac8becc85da45f627634e3d88a334d
- MD5 4114f30e4bc7c2bb5ff87927dfff5728
- SHA1 3aed76756bf8b9d6a622d215b556e97121003870
- SHA512 129b30840916da9a2f134fc7ec57e1b197e37d7865923513f666a81ce38e0d450a431c4f0f02adca70d328c23a3b88ef07a3d775ea010c964c0bb05ce0450085
- SSDEEP 6144:wvGO78e7aPBI213XzsJ0zghiyZoybMNcfxABT9:gz2R81bMWfYp
- TLSH
  T117647E2326DE7CE6D03152B037BB9BE6D75CDC2417A1C0DFA2C09AA9982D5C33531B96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  Download Navigator/CoreSync/LogCollectorTool/LogCollectorTool.exe
- Size 283KB
- SHA256 4edde0e620bf5ddae3866617007bbcb1033e4f3ad89890494fe0b88dc9e45a21
- MD5 e4c25b5d5e7345e94eacba83cc9a7791
- SHA1 13fc6018ec0147e32ff5abba9a351120637adc0c
- SHA512 9b87e56d0dd2b625e356e01a89cbf397951ddf10021901b0241b54de6cbbcb9e51c94085bc1864f303746b05fcd72c04a92b03a346876d366ddc178646eee3ff
- SSDEEP 3072:3F8LC2BSSUDLbYCccyJI9ieUBjdReeQ6IIs7NUvas6MyC/I1rc6MyC/ILoeqpOVq:aLC2QSU/b/IRee0jsByPcByFZBybbT
- TLSH
  T13B542982B6DA6F52D07AC77510720A419AB7BD3F2736C14E3CC5289F36326654373BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Download Navigator/CoreSync/LogCollectorTool/Resources/LCTLogTransport.dll
- Size 509KB
- SHA256 9e29814cafcbda8925fd280aad76bc683b6bae3df9fd955d09059f1e985ca47f
- MD5 f800d4db393cfe98d119f28b898952ca
- SHA1 0b49ed5dfa73248bbd4d4a34ea953b9ccbed60f6
- SHA512 b96221c69f21cdf34721231cffd36f6262f54ecc182daba1e73c8753c00d2b8593c0134f85918e57ac13e92cef47b2dfd5666b3f333a1ea9a8616128175c5c6d
- SSDEEP 12288:tGHQu9ZBjaYs029KHL1uIDnhP+HHDXbWBvoDqdY7fX:tGHQu9ZBjvsFKAIDhPaPWd5dg
- TLSH
  T137B48D227691D432D63F12310D689B9F46BDBBA1097CE81BA788163F5F71482DB3361B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Download Navigator/CoreSync/VulcanMessage5.dll
- Size 642KB
- SHA256 f93ea84881ba80c51df747ec6d77284162d1b6d052b6445c57cda848d798ee56
- MD5 0a48445a75beae74e5887bbc5323812b
- SHA1 f88a5a7c0608c0c6d782e423b3727b644ceb050e
- SHA512 de1b2d0478d69013cac09369b2e0240c63b59609a92307084d0fa68b6507a14c76de4dddf1b8faab4147e4407947e59f1a3de17c6b7e6907387bc38b0e17f5b3
- SSDEEP 12288:e9+0LONo4VrTnj++CY6T5Z7SatPuUdIOGiu3CNu/jCQX7g5oap6uEppu6S+R4cll:e40LONo4VrTnj++CY6T5Z7SXg5oap6TH
- TLSH
  T148E48D22B601C1B9D55E01B25A38BEFE667DA5714FA005CBB3D85A3DCE340C2AB36717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  Download Navigator/CoreSync/customhook/CoreSyncCustomHook.exe
- Size 1.9MB
- SHA256 cb4cc8e79de46c0e85b0a6d8c6348383bc875c4a38db73aeb2de3248ab7f1a5c
- MD5 03ed2a2d9ee91fda999c7ae9473695a5
- SHA1 63d02a8fdd9480bb385d916d67a7b5fc7c2e1960
- SHA512 7533384f82c3d3d1618d53325b70c9bb5929616cb4c72a5bfc70d78a5e831c1e3e3d8148c0faf9edaba31ae130fd5f510b4ae9942c0eeffc95beeee0db4bf59f
- SSDEEP 49152:5pewoqwfwKky95h5x+hgbi8MU3T/66f5kPCOZG:neeE5HTO6f5
- TLSH
  T1C9959DA1FBC380B1E9E71AF251BA6FFB5C386A11472444C7E2D01E6859701D3B63F64A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral9
- Target
  Download Navigator/EP106KIK.EXE
- Size 295KB
- SHA256 759404d45d0ecc833a783adfc5552b53fde066ab47fd739a6b48fe840422c96f
- MD5 6b39c5f83eb225d2cf8222f7a8db1f2b
- SHA1 185d5a097bb6a4fe7dc429fe99b081f6c7034bfd
- SHA512 aeb65b60acba27b50e563c52fd5f5d31d6b09374a2dabd2a1f95ef0bc97d9420893166089c03a7d551185a40d567d35a9d5ad25807d15a0fa5afef82af247551
- SSDEEP 3072:hA8A4X4X49X4X4yxolKljiTt81T5qFTrMzbGfDNqg2qIFnoquC8Lf6qU1cxLN/r9:+8molSjiTW69Ew8akSXlSlqJrTM
- TLSH
  T12554E953E96AD1ECDD18883463F26D712DBA3A7FEC681A68B0D9360ED4D2113512EC1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  Download Navigator/EPSDNAVI.EXE
- Size 2.6MB
- SHA256 fbcb3a8e699701a451c3afcb70c8ab0384ac230d0def270d04db06cf4d2197c8
- MD5 dbb4079b89d419177657723663087f2e
- SHA1 0a268a9a2e6d23188c2ce5dd9e67d09515ee46f4
- SHA512 3e2688f22f5689348b3613c6602fc0063b8ace5fdb780178d15499916a7042f5c6a030bc64bbb4ca8cb9980e319946d97ea9c85d4deb679fdc030768efeacb44
- SSDEEP 49152:upmhOhWUinGpoXypsYL7nQWYQB9uCxFjnLbYZOlVBXy2dW8YZmnNm0PHK5oPqrrO:pMs3nGpoKfQWYQB9/JnPdy2UZB0PHUoj
- TLSH
  T12FC59F213FA5C036C2623531957EA37AF169BE711B3446C766902E3E6E305C3A93D72B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11
- Target
  Download Navigator/EPSDNEUL.EXE
- Size 3.6MB
- SHA256 c49319e41568854c66a82955263ca092b767e8803a64dc306c3a4580230aea7d
- MD5 949fe001449f583c8e8ecf70e8aaf347
- SHA1 7a544d22a286524ebbda3bd1e8c9217b27214b77
- SHA512 f6ee5cb2c8d6c61245e050f93439096e9c9321a36374285467b912afaeb08eb215e26011bc29d546a066ec42dc12391e683c7f7619f6d34eb4267c205edc17ba
- SSDEEP 49152:FXXsvGxkD/ID87+hf3bFOshy9ECwwDpo5luG2H2d5yFP1ixAUF50u/zvs+8d7K6x:uvGxe
- TLSH
  T1CB067CA263C6606AC11690B7D9507A347FDA583CB706DEF210992A3F34F3E60B339759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  Download Navigator/EPSDNLMW32.EXE
- Size 1.9MB
- SHA256 1e5cfedd174fa668af989e48bef2ed832012afedba928a45acc6f643938a5eb4
- MD5 fabfd31d030ecf36865d9a382ccca3e2
- SHA1 ca57f2b9940a80da3c187ef907d6c92e9a1c97b0
- SHA512 d6d962b8df55e872a0145d0c0e7abb35479ea559c62def8cd3ed673eec46a60e4ad8a2de2f0831292342926a7f130f30b156bf1c149fe5191be8ebeb2840c073
- SSDEEP 49152:FZt2NOkNxiFGYA64FXE5XP22I3yYUJr9be8qZOSOBsFS7t7o:FmNOkNxHP6IXEkT+E
- TLSH
  T1CA957D32B7A1C836C35259718BACA75693E5BD707F3D81433588CE3C4EA51E28A52F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  Download Navigator/EPSDNLMW64.EXE
- Size 567KB
- SHA256 e217bb03c732629eefdf64edce9ddf95a83a49b50c2211b7a88e2edcf1ac64bc
- MD5 d2e2bf9a8dfeac99fb1371d9a0e6548d
- SHA1 f1f4dfd9ecd0d44569f06383ef300b95a75f13ed
- SHA512 c95c2e3f6902bb7a42a4d03eecdb60ec11cc1d76f3cdacfa53d7ea04104dc8522d7cb4ea9a6d1e682560fe1eb1a04a6b3ed1db4d05e961757e1f6c755d70267c
- SSDEEP 12288:EeTCtO8xlmTmIB32dJVzoSq4ItzR7whPRzsHvp7A7R:EY6ywVz3qvDmRgPp7A7R
- TLSH
  T1B5C45B4AB7B444F5E0629139C9538A8AE7B17C514B70C38F02A5F77A2F337A15E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Download Navigator/EPSDNMON.EXE
- Size 409KB
- SHA256 df05a75f0511287170128195278a57792aa9cdd04539d494cba332f30d681139
- MD5 6386d8706b1889537d84598bfaaae825
- SHA1 aee5d0c947bd2a831008fa145fb29c6188b5e707
- SHA512 5f4c2669eb3641f25107ca3ff8165e80c02c9b7bb923d9c5f22a8a6b28e49386dbb4267ff3b91bb70084957041e8813a84fd58879e3002605410764b810d817a
- SSDEEP 12288:bhlcHJRF4bvSW/0+9XR8mL9mxWrrMMDMMM6fU7N7Uk:bhggR8mL99rrMMDMMM6fU7N7z
- TLSH
  T1DC948D203F85C036C29111329AAAD77AA5BDBD315F3181C777D43A7C9E70AD2AA38717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  Download Navigator/EPSDNRUD.EXE
- Size 388KB
- SHA256 f8816c487f6bd0d6124e8a47fe860b9f8926775b600a186b0e28839d04357a22
- MD5 0b15b35251982de613b9124370b33220
- SHA1 5fffc72832c2ead4c59af038ed9a60d6934d2e89
- SHA512 70cfff875b1c4463c59ecc4851a8fb1afc8b9858e0451114a81960cb7d8c2c8fff72984f1d7fa8c66b9c7c73bd0dd3e0c72342111baa5781229d727eac98d0b9
- SSDEEP 12288:8kzj8h5gbbr/FxJrrMMDMMM6Xg18hC7j7x:tbr/VrrMMDMMM65hC7j7x
- TLSH
  T106847C2131D2C037E2A7207105F5C374A5BABC215B384B4B37A17B6DAE71E91AE7C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  Download Navigator/E_DGE321.DLL
- Size 246KB
- SHA256 462bf23a010e135071ebdc6424006fcc1d20e20d07d670b450501ca8f91c26c3
- MD5 48e4dc143682b970f4a818e8ac49cd74
- SHA1 1fdfa3fc20795bd83a0105c201b684843d454dcd
- SHA512 3f2c4de695b89b8becefea557d4cf7800bede906b65c5700c1c439a4c66f9c4f72ce8a8ce624546bcf18387224b6887a69659b8e4b2385cea0873a405a076e7d
- SSDEEP 3072:zIjFWKYxas/xNzAgEUTuJNX4J2AU8z4aYQl0GMo1YjE+zu60tldoV7k3vy:upYxasDAgEU6JNXAdU8sanCGMbu60e7j
- TLSH
  T17A348D1175D0C437D3BB2535896BD3356AADB8304BA1C2CB7FC08EB96F206D29A3535A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  Download Navigator/E_DTSKSD.EXE
- Size 664KB
- SHA256 963684da1cdbd58f4be38407d131d314372713c56fffeb0506edd4763a5cff69
- MD5 9a227f1c28ad32b4617e099ad278d8ca
- SHA1 543cbcad8c9bcfc2a56628f3d60ed02c55ce0be0
- SHA512 0cd8ee31eae9d02263cba0f5f21cf2d3f5e15bde6fd03a93e2b3e381eb42f4eb11e042c20ec5d881b06984d7fee756a7970b0f1eeb0dcd78db9b668d6d77345f
- SSDEEP 12288:H7fpQzjCYYpVid9co5Sor7BvXqAWMYole6wSIlqnMN:Qj+i8o9vXq9ole6wmnMN
- TLSH
  T1F7E46B13BB95C0BCD92418345BE2AA7129BE3A3FDC341A9B71C8361DA9B1193513DF1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  Download Navigator/E_PRLGR7.dll
- Size 110KB
- SHA256 f80c138c1a5f7abf943c0920682fef1df354eb3fb41278c7e79306ab65bc18d9
- MD5 61edec071a2449f18dbeea1de7def39d
- SHA1 9119cae892c713c78a40fc6da5d53633ea8916c0
- SHA512 b9ff692a63d4b55b5386da7703ca1289dcbe64144bfb73ea6318df7be99c1e9db86cc45c247f0564c706984f3a0627b06c8dec97b7459779772c624aaba7b16f
- SSDEEP 1536:N36t3wZBy373C6x8qVkXdVDPmbsfc0ahz/s26YmJsG/ymchQr7B7tfvx:N34Mm8YkHDPmoUo/ymch4V7Nvx
- TLSH
  T1BCB37D223690C135C8D674BC56DCA73167BEA4B00BE485CB7BA907EDD9607C0AB3539B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  Download Navigator/E_UPWJ01.dll
- Size 1.1MB
- SHA256 cba63e53602ed356cf72aad0ab2bccfaf0139fc1c8b9b9fd68f916e148b25772
- MD5 90a7ec371c8301a4574ea6714dba77d6
- SHA1 4e18c083a1911faa0f3cd72705fe7c306dc73c02
- SHA512 945911633a894ac2d0c93e761c2f3a355b00fd7c85646d43fac940809e9c68fed10b860d60e623f900998125ed932088baeff638afa62b725b7cd63d134e3032
- SSDEEP 24576:BFWV1mixaRcYoayhalrlmL8LyXOpNsWlTXm0yH7y7Y7F:BFg12yhalroL8+XncTXm0yH7y7Y7F
- TLSH
  T110458D213B84C136D66E2177D1BAE37A326976311B3181CBB6901DBCAE705C3E939B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  Download Navigator/Osasoi.dll
- Size 455KB
- SHA256 ba4d2982775c59fa3813e78c4c692a09f97ccc06fab1bd95d7e5dedc93816b24
- MD5 f53cd3583c38807e7f0d4cf275039c90
- SHA1 b09deac2273f33e124b5594b3ebeabcf211dd0f9
- SHA512 e35d4bc96b44bd0c10ffbf40fd771bc9aed1f4036fcb2508ede773db2e975dd611319f1a297cabfed91de12d5bfe3eee5d0c0d4e11c5eea8fc62ef62c3e87877
- SSDEEP 12288:i0DKzK6MWpVQJ/lU+jau2pE7mWfxIEF47G:KMWpq1+E2pE7dxTF47G
- TLSH
  T1A3A47D53BBD0C03DC26A2530656AE37525AEBC315F3482C7A7846E6E1E306C19AFB717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  Download Navigator/_html/AR.htm
- Size 440B
- SHA256 e4bc7f46b9f87b44cdfa4342dbc50b401e4547dca7e93a44978dabe696773ca0
- MD5 0eac194a7da9402f253e760a34554c05
- SHA1 69dd23acf852df2d00b521c0848149c0d0dd6ffa
- SHA512 40b362b561211e32c3aaac30b37204d1a6be79e2d123bed3572dfc0d36b941ab2098b92745a5199114922afd83baa128c798763b18a0c733e84e5a04329b3cb5
- TLSH
  T1A3F0E5F910171C26A5A3DA36F0E8BA74D9B50C03A287BE105C2562A7B1C5558C6A7AB1
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral22
- Target
  Examples/COM/Scriptomatic.au3
- Size 20KB
- SHA256 22b1e3dbc9f6fa593a87765c186f4befd0d6041cdd8f3adefc828b952e08c49b
- MD5 a1b729edaa6b51a5972c426082c19737
- SHA1 d78d0dccfe195c7fefe6033aded4fdcd7823976e
- SHA512 fad8774e961763e3be2d5078d40979a4f959aa171515e5cda361818e782bc1a049c324a0a84829116b144d1d04ac5f9e22165baa0e63c732abfaba07f646fcf6
- SSDEEP 192:HdvhxMXrf8jwDl1p6PngSUF1qU41ukjLzNK7ZN8NrRRQiER/MOV+WQNuyPudF+rU:HHsD6gSUwukANN8NnOxFWPkI9E5L
- TLSH
  T1F49286D57C2BFD3D292BA1522933E8DCE90F4A0DD10AB65AF87CFD88518C42CC5A156E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  Examples/COM/Worksheet.xls
- Size 13KB
- SHA256 ad62ace472f8d341fe65ea4dd633d9f1ca3b04a82a66cf33a2d17794711ae241
- MD5 48ea6822ca50d0ed031947b9d8d329c1
- SHA1 f5548bcbd70ea31e567251317fdd2d34f001c160
- SHA512 62700cd2657d7a551e2cfee5c90fbd5dc65b837734119f6bbac5d4e0545ececb9ba8beacdf7427790845e0b02b3d4f1ea7ade8c11c6b4fda6ceb3213750a3f62
- SSDEEP 96:UqLyl2JLIqgchloB8MQj4dWb/ec/Oc/Oc/5CDch7+:Uqs2dhlFjl/D/D/56
- TLSH
  T1EF526C9AE6678941FA0A537047E3D716A3332D75CF670A81B70E732D4FBD6908903A62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Examples/GUI/Advanced/msgboxwizard.au3
- Size 16KB
- SHA256 9cfc59c702259f4e35312f2d27416fb7fe5e21472dc4a88efdaf08d9a067a684
- MD5 de83becfe933ccce312c3e716636eebb
- SHA1 03642051e21ded64734df7340cae63151709585a
- SHA512 b77be9667ae48822cc3eb04253cc0de8047ba51db7b262644828fbc95256ba81913e460680f5a47336d947bcaa4a390cde8b17ed6752b754efc5a7539aeab8f5
- SSDEEP 192:9SXpXTn38NDXlJikGM5Iqr+7PS7B87zc70x7eI7vtAtbVRRx:9A389rriPmBUz00ReAFCbbP
- TLSH
  T1C3724449F69D9E65E311924258B99CCA8F2ECB3AD00831BBFC374E8C514079CE46579F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  Examples/Helpfile/ForInNext.au3
- Size 853B
- SHA256 31cb5ecd9137b35daeff1cbd3c0cd8b46b57662a6a18b6dbed43503023c0f7c4
- MD5 758c074a0d0780cdba8e9d047d3c2581
- SHA1 0a05f4078177795018c50f8610ab07b09825d265
- SHA512 059b4b68129e7733f3e502245a3dcbe7f722b7b85e3e707adc7ca862548430c39f5bac3895c66aba7f25bf83b52a64ab57d9b6209c7ac5ea2a103a3cb278c686
- TLSH
  T1D101120AF9FB7F42496A61A205335988E234D08853765D2CB86CCAC5D89430F91FB2CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26
- Target
  Examples/Helpfile/GUICtrlCreateContextMenu[2].au3
- Size 2KB
- SHA256 6f54f9ab154b4f65a0d6d53ec7a34b76c5432f4f0065816a84cb717e654f4980
- MD5 0df91f74ee61c131fc6f45eef166f855
- SHA1 150c387d786a8db5f525862058cde487427b7c8a
- SHA512 326371a818b9c268e7b5c52dbb0b5c73f080252f7429e5d792e44e7398024929cd5bb86072e48c79ee5d8b6bf45af498db355bf1a80d107d6cf0d5b42a8d89ba
- TLSH
  T1315130219EAB9151320A28508BB3CC4EE39C8958D16965377D6BCAED10E403DEBEA3D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27
- Target
  Examples/Helpfile/StringRegExpGUI.au3
- Size 15KB
- SHA256 75c1b181b40044108bd8b69768ede674252bb0448b6c3d0bc909e80639183b08
- MD5 0dc14c39212ed99dbea76675a59c2f09
- SHA1 0742f5fc6e9d3ad6b0610d559a5dda3271d6fe3d
- SHA512 27f06bc44348f741249e08b23e11c557c27efa9d450dc9fb52ba9a8730d53a9dd32864b3b472947bcacfb519a229ad79db62e9b81bc7378ce6004d2a75613db5
- SSDEEP 192:9JPcleR6EdUW2eudng061uPAE1F5gVgUFrhd3zZvHN6GT4h3fuT4O3FB:9lb2eudgxsAERgpdj1Bz
- TLSH
  T147628162F61E194969422084663BCC4ADB4FDC1CAABC3496FC3DCDAD2050779D2F8ED9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  LcMgr.dll
- Size 389.8MB
- SHA256 4b281cef91d0ecc090fe9a8d8f0954cd8d7fb5298722a9edb628b95a2ca708bd
- MD5 6e19e2115cb886ff086e19b1c32c1219
- SHA1 550f13df5aa3f1c72fab1045f496f1c8f455cf04
- SHA512 12d07827f1ce5ce093ccae0b171ebdad3712bcdffa816be62682fb52d9825e1afe140f8762f79d8d2495a4db1e8d4e0358edf06d77d0ecd46a5683b83ace0f13
- SSDEEP 196608:3YdcQWS5v+kLMolGmidx0MbYQ5B8tvjgtVPgAutAI:2cQrV+kNlobP5B8tvjgtVPgdAI
- TLSH
  T13619297437D013D4DB12D5BA8E0AD7E5D828BD047321099E225E361A9B339ED077BE2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral29
- Target
  Setup.exe
- Size 2.6MB
- SHA256 0508be5a7f0817b109a0a18143a6917a6edc3b8e3983d25b8501e2a23c3ae0ac
- MD5 94e6353833711e1de4de2ed265718d21
- SHA1 059f5bf1c682430930e9b80879ce8b6cad672d12
- SHA512 112704c35735212514ed36fd0dd7d11a5cdc027c02d0e4dbd90fd77c976c34914e67cbf07a6855463b90132e4a2f61b102e9b88cea8c4bb44d5e77b079abe720
- SSDEEP 49152:tkgz5iIBH3uE18IdLkljZmB5mJm3H+3OuZyBIOxSol1a90HeNb4rCYTkScRW/KME:tfyIKjZm2Jm3H+3OuZyBIOY90HOb4rC5
- TLSH
  T131D59E217761C076D5632530565AD3B8E2F9AD304D39423762D1BF3D6AF0A42EA3CA3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence spyware stealer trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral30
- Target
  libvlc.dll
- Size 179KB
- SHA256 a27fcf98acdaa19cc3363846b6d66a3183fcf1cae778aca1dcc10552f738afb7
- MD5 06f7b41d5cb75a23b74b1783d91953dd
- SHA1 607223e27545d58a6f6554979816d300b9ccdf88
- SHA512 840a01fca1c5ace25d134027cbffc7b67ef29c9195b79f0c1587c4345deeabfb721b08df351c5ca37ce0bb0d46d6667726747a0eb92b1576063fedee52eb10ec
- SSDEEP 3072:rnsSO3fxJT5Xg4sgIxhpcRu9+FmTJA1UMBHx7/JSAyAChd9s6dLEs6d8:jsSO3fxJT5aFpcY++JA1U8HxtSAyrVd1
- TLSH
  T165045A85EA8794F1ED9709B09293FB7F8A329601CB34DEF1DF18F85CDA63A42244951C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  vcruntime140.dll
- Size 81KB
- SHA256 6823b98c3e922490a2f97f54862d32193900077e49f0360522b19e06e6da24b4
- MD5 a2523ea6950e248cbdf18c9ea1a844f6
- SHA1 549c8c2a96605f90d79a872be73efb5d40965444
- SHA512 2141c041b6bdbee9ec10088b9d47df02bf72143eb3619e8652296d617efd77697f4dc8727d11998695768843b4e94a47b1aed2c6fb9f097ffc8a42ca7aaaf66a
- SSDEEP 1536:tBYGvQ2+Ub54AE6ZkJrIriwx0AKGsu0g1kq1ecbRMKlB66M5iEBiA:tB7vQ2+a54AE0sAKxQ1ecbRMKlQoE0A
- TLSH
  T17E836C11B4A84072D176597452AAEAB3B63DAA508FC54FCF6FED4CDC0AB82C17336217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Loads dropped DLL

Suspicious use of NtCreateUserProcessOtherParentProcess

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateUserProcessOtherParentProcess

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Reads user/profile data of local email clients

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32