0a0b8365c18695898667c339de1aef305e48355c00df7cbc3df2fdf879522428

Sharing

Copy URL Twitter E-mail

General

Target
Cryptex1.4.exe
Size 73.9MB
Sample260531-mcflasew2z
SHA256 0a0b8365c18695898667c339de1aef305e48355c00df7cbc3df2fdf879522428
MD5 fc28cf7cb55f80f578862e84b1f760f4
SHA1 edb8c39dea721c38a69420836a6275284ddaa11a
SHA512 18bf537ac50646a03d47275d80ec42cb39d186d07e61489d41d5a13d6415e48bf0fcb8ffe4415842e54f5505fd47d117cb4745b7a742b93ff1911c96c549544d
SSDEEP 1572864:mt9IKPg7yH6RWYcgpTo/TB7f7RjEMZRhC0VhqkzKwSsQO+MS7:mUKQyH6RWvz/TB7fV1ZRo0VIncS7
TLSH
T19C083384847AFA29E92F05FF0B123BB1E3949B5AAD01205F8E5C9F5C771058950BCB7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Cryptex1.4.exe
- Size 73.9MB
- SHA256 0a0b8365c18695898667c339de1aef305e48355c00df7cbc3df2fdf879522428
- MD5 fc28cf7cb55f80f578862e84b1f760f4
- SHA1 edb8c39dea721c38a69420836a6275284ddaa11a
- SHA512 18bf537ac50646a03d47275d80ec42cb39d186d07e61489d41d5a13d6415e48bf0fcb8ffe4415842e54f5505fd47d117cb4745b7a742b93ff1911c96c549544d
- SSDEEP 1572864:mt9IKPg7yH6RWYcgpTo/TB7f7RjEMZRhC0VhqkzKwSsQO+MS7:mUKQyH6RWvz/TB7fV1ZRo0VIncS7
- TLSH
  T19C083384847AFA29E92F05FF0B123BB1E3949B5AAD01205F8E5C9F5C771058950BCB7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 73.4MB
- SHA256 643638883dd96df5ba6d5f6f7605d67dbaaf6747e8b53d42ab48267804b46038
- MD5 191813ae4459a12c5eb6eb585f687041
- SHA1 43fa5ea0e62c1b469a75dcabe5d037cf8d1e1836
- SHA512 13bfa38392a3920f7a5f5face90fc8d2e1c9ad16e5ea7108cefb6044b85a6fdbcfaf369aede4cf97db95b55b825e9c4341f612fa6599bc8be47a4ec445270428
- SSDEEP 1572864:Nt9IKPg7yH6RWYcgpTo/TB7f7RjEMZRhC0VhqkzKwSsQO+MU:NUKQyH6RWvz/TB7fV1ZRo0VIncU
- TLSH
  T1BBF73384847AFE29E92F05DF0B023BB1E394DB5AAE01205F8E5C9F58771458950BCA7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH
  T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  VudehView.exe
- Size 180.1MB
- SHA256 2770bdecf042ff071b3e7e1e036e6c78ff4de3842ed50c3c09cf68967fbd6ed0
- MD5 2170cfe5f6ca3f26929e82f764b7d4b9
- SHA1 18313e3a71fe154fd3c125d2d70d2075b8d73992
- SHA512 aaa25665bda7b86309612874469db6b671e94a20206cc6ead2b959144ea877febc46f88359a717ae6aff081bf4eba40bb50f6e1f374d64078706e49c46542220
- SSDEEP 1572864:fH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:8sok+hK7
- TLSH
  T174988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13
- Target
  chrome_100_percent.pak
- Size 148KB
- SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
- MD5 83ec43f2af9fc52025f3f807b185d424
- SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
- SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86
- SSDEEP 3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
- TLSH
  T179E3E1D3B3F4ED3DCB9716B7A2260072ECB3466D0692124B168AD4752A66B8CCCC47D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14 behavioral15
- Target
  chrome_200_percent.pak
- Size 223KB
- SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
- MD5 dc48a33bd20bfc7cacfc925a84b015b6
- SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
- SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a
- SSDEEP 6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
- TLSH
  T11E24F1C7B3F8DD3DD9630AB3522A01F1EDB2113905B6560F57CB9C347999AC988C9283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral16 behavioral17
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
- MD5 e3bdb59b37b730647d4a1e44756a730d
- SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
- SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
- SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
- TLSH
  T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  icudtl.dat
- Size 10.0MB
- SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
- MD5 ffd67c1e24cb35dc109a24024b1ba7ec
- SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
- SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
- SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
- TLSH
  T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral20 behavioral21
- Target
  libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
- MD5 c13e55ae6200e74c0b121cbd5c1d323d
- SHA1 098675729109e19a0b6cbedbbf45398265ab6644
- SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
- SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
- TLSH
  T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
- MD5 a3bf08772053b66ec34701037f120736
- SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
- SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
- SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
- TLSH
  T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  locales/en-GB.pak
- Size 474KB
- SHA256 3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39
- MD5 7b278baf4598e7ffeba15180c017311b
- SHA1 2a8f2a9138c700f607441647833ee5a8d2ba2b85
- SHA512 654b69d06eb9de0b187dfdf5249f88cf9c73031034e0620703db88910737c22f3dcef75f05993237bbda657703fa2b152c467f33b6f3c48cfdc8c35291049db5
- SSDEEP 6144:Ll+NdwHNYrwSiKdFkIV/MP9ezQSKrfaYdrcLlY5IPxGBcvRJeG:Ll+nVrcC/MuQSK3Z5Mx8G
- TLSH
  T11CA43C1FF784126A069312627B0AA562FF26D06CB35112663CBD802C33B7766C3777E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24 behavioral25
- Target
  locales/en-US.pak
- Size 478KB
- SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
- MD5 a99b6152bdeac44148f94394c4149622
- SHA1 df7371533e92aa24f48469116d9a8ac73249315e
- SHA512 3160b58d10ca147594ff4aca004007d4e6823421be349cfad945c681e220eec7266d88434a4d31c719a346650ac0ed31f1f13fca3e824d81bb65ebb4d21cc2c1
- SSDEEP 6144:1kdXRDCEmszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUEmGeM1QcDq+5UxOLwB
- TLSH
  T175A43C1FF7441229069352627F09A5A2FF36D06CA39112563CBD812C33B7B6AC3776E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26 behavioral27
- Target
  locales/es-419.pak
- Size 575KB
- SHA256 4dedec1ac933c73773b1e54caab1c4d606d12f3788cbeef4d6a2a382138cc907
- MD5 cdbcdaed721e027cdd6c76de0c166f6e
- SHA1 105dc222d858bc32c3a5acef310d08a821ec7cfc
- SHA512 0afc3970922ea3efebf595bdaf27228eab79da2545d63a85d94d6f319353907a5fe265a139a1563eca653d06dc8f3de7dd9f8de4bd9ee0094f6873f521f58429
- SSDEEP 6144:CXIiSSLPaWqEJvslpbYl7GuoZOZ5zaOaQ+NK891:EzSSLP3DOpmGw5za0+x1
- TLSH
  T136C40922BAC81F5310E3A388B743D753E4989545B408D29BE8EB876562CCF8CC977ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral28 behavioral29
- Target
  locales/es.pak
- Size 575KB
- SHA256 a32221be9b65aead3fa779dc54e5ca483a7d73c4815e5c7c3b53711f560bd301
- MD5 d1dcb55680b8e6d28099e8c90473b73f
- SHA1 633a049a5bbb84ee50d4586aac3563d4fa4c11db
- SHA512 3b4eff67094776ff04f634a8533d6986749c8c7d6c0cbfa2ee4f42ed66e0cbd8a3435922ea0bac9b6cf7c6e63d79d96a3f7d09f1e806c8b2c23baaec3b318e42
- SSDEEP 6144:F2IPflvErbD70A13XVslgkVXpT+ZoBQihXFijm5JEf2u/Sz/B6PZOkx:MIHlsrbPFVMNphBQiXijm5q2CSLTk
- TLSH
  T1C3C40722AACC1F631093A389F743D753E8949585B508D29BD8EF876612CCF8CC967ED1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral30 behavioral31
- Target
  locales/et.pak
- Size 523KB
- SHA256 a4d1fe9903641540b11e0d00e574a6665a1602ad81f6aae9a083ebd04bc768c7
- MD5 c6557b5d9083aacdca9c09af5f8e30cc
- SHA1 a64ea081b5c73e07f87885f19ad26d7918720dfc
- SHA512 7200823594da9dd6724631531c1d60494d3206192c8cad7fae655e1ad9fea42c36869812fbaf9cfa17ff85c27db365b7f9d640c0db14059512db2c7d5aa19545
- SSDEEP 6144:HeaFiPGOrs99Z0+I+eL40pmFZxEYTHbtiPSia6OSt75H50MHFjiCKM2aD/APQOW:HhFeGe6Z8++mFZq0SfH50MsW
- TLSH
  T132B43B42A27D731B282411F9E737A923DC9EE7D9B4000D966C974A1970FEF8C38B6B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

Network Share Discovery

Obfuscated Files or Information: Command Obfuscation

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Executes dropped EXE

Themida packer

Checks whether UAC is enabled

Network Share Discovery

Obfuscated Files or Information: Command Obfuscation

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32