6cc67bb7fd39d9a9ece9f18faa93e9c4a0e7efe00af25b773769cec6bcb59a6d

Sharing

Copy URL Twitter E-mail

General

Target
loaderV1.4.zip
Size 27.8MB
Sample260601-3sg23ahs3w
SHA256 6cc67bb7fd39d9a9ece9f18faa93e9c4a0e7efe00af25b773769cec6bcb59a6d
MD5 96d62add652ba2ae83140bc231c93b45
SHA1 233f1e65cf9eae598d1b1ef62c77105068b514db
SHA512 62e90712ff9e9011c4a3668c5b8ae5777884ad6fe73264994064e05ca4cf03f838440b73a09ee6cc64434e7407f17c3e4f09a7b17a78baaf28e031021e0892f0
SSDEEP 786432:FvX1kkda1L7TnncjsLOJafsHeF5LV6JW5dwBx:913durnncV4kULwJW5+H
TLSH
T19F5733E67B419C560030648D81BF79E015834ED1B18A7E12AFE9C3AF6DDAD61BD00F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  loaderV1.4.zip
- Size 27.8MB
- SHA256 6cc67bb7fd39d9a9ece9f18faa93e9c4a0e7efe00af25b773769cec6bcb59a6d
- MD5 96d62add652ba2ae83140bc231c93b45
- SHA1 233f1e65cf9eae598d1b1ef62c77105068b514db
- SHA512 62e90712ff9e9011c4a3668c5b8ae5777884ad6fe73264994064e05ca4cf03f838440b73a09ee6cc64434e7407f17c3e4f09a7b17a78baaf28e031021e0892f0
- SSDEEP 786432:FvX1kkda1L7TnncjsLOJafsHeF5LV6JW5dwBx:913durnncV4kULwJW5+H
- TLSH
  T19F5733E67B419C560030648D81BF79E015834ED1B18A7E12AFE9C3AF6DDAD61BD00F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  cfg/Qt5QmlModels.dll
- Size 409KB
- SHA256 db769c3b34bf9775543d939e574d920237d1ebd00f9e1cbd909affda2b46c252
- MD5 25f45cb9dceda77d1ba7195231e3d26b
- SHA1 f20ca5c5cfd14ac89d12c5a742c6ad22062ee012
- SHA512 13be1a19e6fcf614441bf21ffa1891d61b6bb8a7a1f7b9cc321ce0b5dc35e7cbd4dfdf10741f5b13b8f571f164c3b5b1a205e92572f592b57ba6d24cc6ddfc9b
- SSDEEP 6144:Vrr8NnFa/slyxm751WPuN07tfAgVDMl7vEZ88pUovns2I2jonYixlTEqx3zddn/H:VH8CocMl7v4UcnsQ9wECnvfKNZvd0R
- TLSH
  T174946DA2F28381B1D48557BBD5ED5727D536F1008F1292C3E369FA4271663E22D3E28E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  cfg/Qt5QmlWorkerScript.dll
- Size 47KB
- SHA256 c3809f3b9bdaff1d4e30eade92381c9eacf90b5a5c2f620558eff7672131e1b5
- MD5 0d8b8a2dc7358b327459638976e61d93
- SHA1 23092825d96613ec3debe00984a075bea688e825
- SHA512 06de2bc20ea2ac7b1c6f735a0f53086525ac93ca2f7d1a6dce67df912cc057030ebff79d48957330e831f973d73c2d84f2688065209b8f102b14d3fe1a5e5ef8
- SSDEEP 768:SsXZnI8IbXb7aDgkiT0iAMFTk4fp0zvOAj+Q5NdYZCwg8hgZJBc3umz7bF:TZnI8IbnaDgkiT0nMovOAj7NaZhg3ZJ2
- TLSH
  T18E237E90F24205FBF147827019569BBB863EF51047D1E2D7DB7FE96229A23F3293A109
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  cfg/Qt5Quick.dll
- Size 3.5MB
- SHA256 ceee311e5bce28242cc604158576d503a2d577479ac7aa89c2ca3c8af6bc6f63
- MD5 7326e1eedbc7578fe74281dafe854a99
- SHA1 b5a907f2dd8d637e31794a16c9451a933343fff2
- SHA512 2f0cc9b22bd4d8afab11f9c84fc55be3b89db49969bc4476a900697472084e8cd17e820fe9bbfeeea270e2995fc46f10ac9f380bc97907f8a72f908803532aa1
- SSDEEP 49152:+dpiskZaWmhprp+olJsnkTOjspJ7I0QQcs+mCNtHoWGdkZR:TZaWmhpxzsnkCjspJ7I0xcbXWkH
- TLSH
  T1F4F57C53F58240B1D885B27C054E5E6FA13DB3804B2C4ADFB768AE5611B13F21EBB399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  cfg/Qt5QuickControls2.dll
- Size 145KB
- SHA256 ede39c2fa36cf1dfd9c9b6035c4dc6eb5a3c6c4e5496f7e16e20a53040fe7ef4
- MD5 7fee0175267ff4e1080df80b7e4a9903
- SHA1 b0697cadc45ea062c45d0ead881034e73ec37267
- SHA512 02986c4af5b5c99aac577acfec237b98d88965042f58f378ff9cfef99da6b5d60f66474c3a44818eb2f418a8eb59a5eba4c88afbca20570071d8a02ed68bc92f
- SSDEEP 3072:rCkBZ9OqBuPgFPxiijuuCFxd8N5XbjiiFZglT8e0DdsKviFEs:rN9OqBcgau9bj5FZglT8eQsKq5
- TLSH
  T11BE3191976CA4161C0CAE2BC1ED99721E23BF0F06BE647D7AA358E5514703F21DF62CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  cfg/Qt5QuickTemplates2.dll
- Size 903KB
- SHA256 87a23d56e53807be951160af98d35ae3f92d51c139e7daf4bbe36f26c1dd02d4
- MD5 739815c9d2dd584d5239603ba28f1fe9
- SHA1 344d445e743266e3c3300753633a26bdee176b0b
- SHA512 940c1f5986a858605c4ea3c1575ca632483223a9bcae606c40656d9bfdda9d59a0a5743c9211ff3702c7c2d494a20422e9732d2c67388316331ab01bb3c6f6dc
- SSDEEP 12288:zXoJg/OtZOpBOb0+SY6D4WjsxFhs79GKxTZd2KlTTVXFOoqF:9/OtcBOb+4WghsbxTZddTV1OoqF
- TLSH
  T103153C5376C951A2C889F33A18875663A474B0F05B159EC7B330AE8929B17F22EFF1C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  cfg/Qt5Svg.dll
- Size 265KB
- SHA256 d099dbdefff005ff9b3338914b7c0dbba4aa1ddd6cd46749100b8b4da5e3ac5f
- MD5 a90572a270f154280b7a6f6bfeb8793f
- SHA1 4d292ced5552deef2a4454313c5379c948f4e70e
- SHA512 27e8b06f335ffe0fb63fd3826dce0b9a349a4c18bcae9795728e2178719e03a1515e576090fd0023686b3d5ae775cb3860e2690a87b3d2447ad9adccf4360d63
- SSDEEP 6144:bKjOkkWRDXWs5zF6StLYglQ8y8DvWgvNqW4UebzLgVA2T2LGyruaDkT:bsH5Z6MYgsgYFDkT
- TLSH
  T1B5443C52B2520DA2D58AD378785F2A27DB3AA08303798FEBC3599C6174643F05DFB385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  cfg/Qt5Widgets.dll
- Size 4.4MB
- SHA256 a8a34fa960cd1dfb3500b5d2b486d9ad60125e2b78fa7dbb08141f3861092330
- MD5 e0be43fee11c1a9ba5c1f28b2b3dc875
- SHA1 2fbfd08c39fbefa4c855f1fd6f8c75748796a9cf
- SHA512 3a150ab899569afb4c7cd29c269ff03f966217f459a03bbc4e626ca2ae772398eacf053f21dbafc74a5c48426f9bc6f4782ae039c894484f98cf786cfd3498ee
- SSDEEP 98304:C2RXG0VkCA6SBJt++5MIQOQhQe2UmJMKxRIG9ZBsWhnkz+uy8S9LCdS4GnUZCgaJ:SC9xI
- TLSH
  T1BD267B53B28642F1C886D17849EF6B63C935B1054FAD52D7D38CEE4669E03E02E7E2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  cfg/RenderSystem_Direct3D11_x64.dll
- Size 742KB
- SHA256 5f224882ded5b6d3f68f14d6bb4e1762267bbb602b7b9733bd153663d1541bb9
- MD5 e158315d6efdb61d92d96231bb708e4a
- SHA1 9cadc19e97872dcd7e9b47b5c350ad243e3be280
- SHA512 69b558683bc190c927bc58bf4dee32e213c4b86b4e484f7988adf6086c76374cd3b785d3aeacf8b11a315092793e3ba4f489d7323d8af0a76f6502ff21746a80
- SSDEEP 12288:752qhMkFplZIdDRIPvd3ol3xZVDpR1R+xOwU0KUu4BsjFt9OnxxY:752qhMknlZIdDRIPp2fXReOwuUdBuFt
- TLSH
  T1B1F4E72BBA698151D136917F8AC38792F6B274000B22DFDB4155932E1F37BDC4EBA760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  cfg/SQLite.Interop.dll
- Size 1.2MB
- SHA256 1a6845e27761e5c26c1cfa128d2d2360d24e05d229008bc2f0b4215a03366dc9
- MD5 6112b48951eddb62e78ba86d239fb2a3
- SHA1 3219cc358a61073823294fb6cbea081a9ec2fc01
- SHA512 71022aa649c5751a2abb7b9b618747009c22c45518dafd7df307193e873308eccdf7303b7f8554a541c9f02006e488bfe3567ab61e6fde3806415b810ca6612e
- SSDEEP 24576:6KE4r0RaYdKYR7KtLqUmZRDiJC7Z2CQiQYZh5YAIQLsV5:phr0RZ5RGtA0KpcYZ8tEs/
- TLSH
  T165458C52FA8381A1E9E111F5A2FE2FB7097C1609432888E7D3A46CD49E600D3767F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  cfg/resources.cfg
- Size 6KB
- SHA256 6c3cc59fabb0f86d84333eb1ebd4c500cb50f1fc2977dab0cb3162b59df072e7
- MD5 5f74f313f3060c0e2441853ce99bb737
- SHA1 287c2d1defd0a2906e7864fc2e5b435b02ae76d9
- SHA512 5f7335176e8c8f09b636035807d46599b3ef824a1ee84cdcec96101456ecbe612419999688ed39d4599c2fb21123c574caa6f34a023f747dce3c25b2dae6f63a
- SSDEEP 192:5ODAGCSckzajCa/X1AK8nBmsdwvc3Nw29zn2M3Qa1yZ/CpzpnsnVG4cnXP76kcJb:5ODAGC1kzajCa/X1AK8nB3dwvc3Nw29S
- TLSH
  T149D1C03162B281DA1DB5A3349C63C131977B38EB69CEF68AB895250CE48B3C4F335D91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11
- Target
  cfg/ucrtbased.dll
- Size 1.6MB
- SHA256 c522ee6a049b3d0db1d75f65300ad65a7ded1bbd68aada02a7017764776f8d55
- MD5 98e1f9b7ac0cdd62177792e2f125c782
- SHA1 27b07545233216d06f1d4a3a7c35336dbd09745d
- SHA512 5e158a7d8b14df72c50d8f90ecda2459ff1f818eb14aa9caa973e03e0dc7ba254150d3f2dee7e9e032f84a8b864c60b13f554728f15aec555d64dabbd25181c0
- SSDEEP 24576:oWgfZWtdB3mYL9ElH1WvhmY7KwT4DkfyRL61KcOwR2TwONNpcMlZmvvIZPByzLp:offZ8zClH1WJj7KqfyRL617LANMp
- TLSH
  T1EB853A01B7918038F9FB15F9157E7178A83D79E01B2484CB53C46AED9B2DAE4AC3172B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  cfg/wintun.dll
- Size 538KB
- SHA256 d694fa46ab4cfebcb2632d094c7aa97278eef2f8052438621766d863ae98a931
- MD5 fa0391a861b949de22e0a59c6faeaed5
- SHA1 d451ef2224b27938eeaa97ad26f75b686d86082e
- SHA512 e44889d0f3044f90962181d7d8787076f70b6e1d7974150f16f83d33a97f1fc4bdd0c7a38eee7a1ea8e8dc4f66ed37dab004f2855dd361de8fdd4ae6e08fa048
- SSDEEP 6144:w89wYsjDrSwf2IHHVVsWhC2njQtIu1MlXwiMnnyDQhWmnU4Dm:jjsjDrSOFaWFnjQtIzlXwiW/U46
- TLSH
  T1F1C4AE43A7D84467E5F79A3445738A526B3EB9300B30CACF53528A698E637C0DE34B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  loader.exe
- Size 2.7MB
- SHA256 53c219925662716776816a3e32718daac43c09591e3d38ed9ba28bc5f0966ff7
- MD5 390834c290cfd25fd0280f7c1cb5c2ec
- SHA1 c98b174d314f0291d756501cdd4eac44b779baf0
- SHA512 c2beb43154c89b15f2e9cd8bf4c78995f047ad74cd746c2eb795ae0ee8e11cf243ee53db92992ff79fb6f8d660bc593a14baaf6e3ae21724b07174ae008896aa
- SSDEEP 49152:bHGhZEfYCTNg6enMjx5BlXAdl54X2GaxWyCExqF:bYlGGdMl5zAb54XbsWyC04
- TLSH
  T1B1D55887A862E4E1C819B2F368A381757B68BC253B75A3F729DC21351F312C449F6F94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral14
- Target
  x64/Bypass.dll
- Size 8.1MB
- SHA256 dec01fbb6941fd9a4856f38682a6ed7d90d04e66731e9589a80001b99ea7a6c2
- MD5 113387f3925dfd0cbdd616d55d4b6967
- SHA1 b7da7a3dbfbc5be4ab41affa6c1c5bbb8c2f091a
- SHA512 6ad0288448d7f07f01296ac64d9ed9d248566c0fc875a3a0ecdbaadcd7e8ace0d923f0d2b2ed7ccf69c765a1ec77b58ba3df8a9ec34e91b644fb93c2ad6142a0
- SSDEEP 196608:lSl9ZqKWwVOuqaPg/Kei/v27WKb5+cXuDL+:Ul9ZqKWwVOuq2g/K27WKb5+bL+
- TLSH
  T141869D1776A600F8E57BC07CC6579A27EB71744A0330ABDB06E082662F67BE05A7F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  x64/ExtraBypass.dll
- Size 133KB
- SHA256 daa3e138c21b572cb7955ee35f2fb1398b47313837c73f5999a385e1957bc392
- MD5 f808357eb75ce997e02ed7c936f33b81
- SHA1 94eb0afd7193de15f94d5788a8b56e65933b2683
- SHA512 ee3b8a35183a29edf1f699bcb00463fae1d6ce0227616b90ef13979f18025ed26f4441055e872b625e87fcedfd35951467d104fab97856190a77c62d5178f280
- SSDEEP 3072:y/Mc90jGyW2CAqrC3Q8S+vEyBUB+5vnA8wvsl:yUO0jGE9qrwQ2NVpevsl
- TLSH
  T151D36C47B7B410BFE4778274C8D30A12D7B6B8251B609B9F07A046592F237E19D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  x64/Qt5Core.dll
- Size 5.0MB
- SHA256 cf8e93aaa512d06c33eeda299f9a9e2f03ce2579cc3019cc700c14dc712c044e
- MD5 a8aadbf8569b2666ed428cac867ab3a8
- SHA1 1bb02bd74b5389d81c55db271d3193ab53231a03
- SHA512 75cf1b1257beebcaaf6e012ee79c1349bc7610fb309d07979f7d22744a14368f472db5230c18f64a2341fc8810b99417a547ae341ec39fdbcec62a7f2ec2cac0
- SSDEEP 98304:8Mh6WxtebHCfjJsv6tWKFdu9C+IvZRnZy0Z/r7:8Mh1fJsv6tWKFdu9C+Ir5
- TLSH
  T150368D91BB978276E596C270C87F775F0429E8014B1245CB93EC360A9A756E23F3B34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  x64/Qt5Gui.dll
- Size 5.7MB
- SHA256 c4f002232626cb9acecd55eb83f4ffbe48a9143327ee6c80e98d3609454e2ac2
- MD5 806e5fdf1b7f8bf1ff3b5b2932a9cc51
- SHA1 97f72fb4962d8f4c34eee2f31c1d463dd8809a3b
- SHA512 3c7d81c87b3d2dc8765839fa3e537e87b4519ce1f303f5baed2f48e09273fb11d9b1ccc9c61613b560462de1702bcaf70157e3279bf1b9a07daca128138c8902
- SSDEEP 49152:U6SX6DQsWn9/Wp2DUivYrMbNo2iw5MUzLzYc4Lm4TCMHr/wOn3aiChtNNmgnmzLJ:U6DQypsnvuMba24rRt/wOqme5A
- TLSH
  T1DD563B91B1827173CDA2D2BE270F66BF91B7A952C30493C386999F9455303FA0F7B906
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  x64/Qt5Network.dll
- Size 1.1MB
- SHA256 836ac6225b472b803c37ff2cee850be512007c0c4533fd01d4f3d68f901dc011
- MD5 461ebc61de9df636ebedff159ee29a11
- SHA1 d23a55c4497aa981f6e88a192776fa8651fc7189
- SHA512 3ed4f61fd0a05b7dc9b78b9e88f91c5cb4efd993f786f10e2c167a199802771d26e9a5cdd512520eb1924991628e4199a299d46418aadf8935a0062d75eb52e9
- SSDEEP 24576:GwgJGEvsd22GiH63KTs9tYZQiJHQvy+Sh3sZDp8D0DX87:9d22GfGvwvmc18D6Q
- TLSH
  T1B6355B62F38304F2F88951B5891EBF7BCA3BB218471656C7EA1C6EC6D9917C1193B0C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  x64/libGLESv2.dll
- Size 2.7MB
- SHA256 35d3d00e8efa92fd0a572a93e12e4c5a1085208d44e78833c689cff5152768bb
- MD5 be16d09c90aee6f5ae105c4ed154fb66
- SHA1 08739488eeb5df47f0e09515330b96e10068db80
- SHA512 5206a536272a7b3523b22c135762097ebe055885a04a741d7d995c8291e05a25b52157df902651bcbcce66fe6b7568539b4615e2eff9fd05103a702a72769322
- SSDEEP 49152:POdBHA+8YIQe/dC0sycRJxV/NVlL7O0drSj/SGLWz:+VVI3djuxV/NbTf
- TLSH
  T1D1D59E21B759C13AE68F11B01C346B6F811D9B654BA5C5C3B2DC4A6F79B26C30B3A70B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  x64/libssl-3.dll
- Size 656KB
- SHA256 646df07af6cf02feaf275e059af65ef773d155537b3263f441c690ea389919cb
- MD5 f686b8e737e5c63cf10e1d62bfda82da
- SHA1 f95126546d7da2ca78eb47e629520acc58901fcd
- SHA512 fd4eeec981bc68f5b160143729fc460f09e4f08c54262eae94b2926fd0ccf8c010d8676842374ec6501ce861c325899edc31a9b9b291af016cf574c2f80a4ad2
- SSDEEP 12288:i/5vMcyLqhv9URGIcJ+umLjON8XVf1a89ghPIpK3yYiFuOPrinOwAORCQr8WIbUJ:4xyaFrqjONPKQiIbIbUuXzRN8
- TLSH
  T187E48D92FBC24CD2E2C6457D19BB17BA1A3EA2006724C9D38E52A8748D617D11B7F3DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  x64/msvcp140.dll
- Size 436KB
- SHA256 5b858fe4a054adb9461cfd12a5f3b8a9622a2eae88bca8dbd7d84a9f972a20b3
- MD5 0d3e750f8b8882470a74db90de94f814
- SHA1 cb07462263379d3f5dd89e2b62ac31a2f7538821
- SHA512 b5ac0039428d844db36327ce6637d207ab02ad4cd89e0eac361d61393d396d6e2fff76d1007985889ec88d20e9c62ad29363b984b77d791feba588c1ec64f084
- SSDEEP 12288:BStyWf0sTWRzbpT/tD5YpsGx30A7whUgiW6QR7t5s03Ooc8dHkC2es9Y8:k0HsTWRzbp5D5YpsM3t7v03Ooc8dHkCI
- TLSH
  T1C99429327B464DF1E48A13B971C6472293F9FC650361E3C3A3EEE0192F666C5A673681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  x64/msvcp140d.dll
- Size 716KB
- SHA256 9d78115b92a83f53481158fc865a998d213df39d13e2d8a444a599c586e73963
- MD5 e93722ea1f3026b37006cab1efa49e06
- SHA1 6411bf1be6387395e48e1a815dfb4922ef36f3a2
- SHA512 2e1addbe1d19886bb591a318a79e57fff3825e3c34a2eaf28cbabd27d5125ab2a6151b8d16b3d9bc53061f71949d90e6a185fda316e28a3c07b9345e52a774cc
- SSDEEP 12288:1HGJFwCP3zaIongGVOOdya2thUgiW6QR7t5s03Ooc8dHkC2esnRrH:1+LP3zaPngGVZDl03Ooc8dHkC2eC5
- TLSH
  T11FF43B316A029739F8EB03F69AFE076E92B8AD11033561D392CDF45A1F695E13B33542
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  x86/Bypass.dll
- Size 6.4MB
- SHA256 2a29d2d9378a44e6ce051f072bbc79aa0ec6cfc6d4594499c3f60dce007f1382
- MD5 12139240c449d58185295311b9ca1bd3
- SHA1 233a49c4e8080d114df0a8eff6c61027fb2999b5
- SHA512 b1622be018f89ba35db49625ae3c9570fb4840b35c326c519e1b08624f40c368247eec8fff12afb4c116aa940ad398690e57de66ce9ed5616e53b7639805043a
- SSDEEP 98304:ldjcdo1enJIVtecCJn+6z3WC4JySwChtBW6oG+wh1+5bUY7:Wije1Jn+6zGBJyQhUGHQF
- TLSH
  T1A466AE12B903C032E4DB01B1E1AEEBBE4A6C4630132594D797D05D7AEA719D33A35F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  x86/ExtraBypass.dll
- Size 97KB
- SHA256 f96f8b66f2fb99077a4eff2cf55c1500f334d71ba425c3989453ab5dae190c6e
- MD5 18c9f48b88bd2241a265919a4cd4a794
- SHA1 d1823f9e5fa97b4bd2196b791710e56c93e4d99f
- SHA512 54f391618df12bb996589a3bafc4e4431b9f99051818630918c406a14a6332e133070bcf804a7349c2b2a0dad3bb9138db11ab699e5ad23b03dcde85bc081b4f
- SSDEEP 1536:MMFBplMH3yTvs+w9sDPOgeFIMKMcbNYUGsWKlcd714KktdVmAz92deM8wvU:MMvfMiTE3IOgQcbc71PEVmAp2dP8wvU
- TLSH
  T1E8A37B11B690D075EDBE1D305868CA729B3EB820EEE0DD9B3759066E4F303D1DE2492B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  x86/OIS64.dll
- Size 129KB
- SHA256 1ad7ecae2d5de32eaac6bd2e2e2944afc774ec13f19f317144eaa48d2a8b4b78
- MD5 03be170f2d50850b08443108de0ea4bd
- SHA1 cd54809658ffd853f07c8bd8b4ed75ff56d7e512
- SHA512 a9c35404bcbec3396385e11993ada3b8c1ab521bdb8793722268a126761d311e9972ef9608c475eefc5d58d2f9e08c2c610a0d2838988dd81a99cf3585c23e6b
- SSDEEP 1536:1Uss/dVyUYJoqzhkHIqztThJLmAoEhR1oDXY+qaGQLFty4hSkV2FZyeapo7NNHXo:1zOAULzWcjapoZNHX3VOlKXQRSjNm
- TLSH
  T1F9D306673B298692C163937CCA9BCA52EBB274500F1297DF9354435E2F23BEC5C3A560
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  x86/OgreMain_x64.dll
- Size 9.7MB
- SHA256 7d3888d21398647519f10a89b1f300d8606f761ad159e6021a797b1b9b3df5f6
- MD5 b9d337cc32b96bdf5739f3a71b43376b
- SHA1 b31d196d5a411bd41c965961bea1a25a271bb2a2
- SHA512 3c6f98d1206494f2deb6e63ae939d8e69b77aa79a35a055f2db2d015a5fc0997ec9360a915a2ac5be4d86eb97800d87133f9e07292425de45d16aea82432f7a9
- SSDEEP 98304:gsgM9mDoQN/JH2hr0HedcE5/xG8XofqhMjLVfebaSRmnjWy:gsgM9mDoQVJ2hr0HedcE3WflUIjWy
- TLSH
  T19CA65B1B73A89181E532A1BD8AD78747E2B17C000B629BDB1194771F5F33FD84DBAA60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  x86/OgreMeshLodGenerator_x64.dll
- Size 782KB
- SHA256 0a12de855b922ea8562e83eed9eab45a7325091937f2c71b676f241fe1129eb7
- MD5 91c480f9d8050a04c0154bdd6d3f4254
- SHA1 afcf837ead8ba294dde12c3b2868fb3ec082f746
- SHA512 e24e1bc3a21b9c1f3df335b3cf2317e5e2de0a54542f0c5f455c34adb861d785bff473f871b98c202226b5684d31704860b4793b930848a60017a7fff7430ce5
- SSDEEP 6144:VkuuYpxE8RodSyLnrwgoavFF/MWRNmnK4kXOU6QedEKuLXASGOsIbXHLlh0CXwCm:VhhqqdExsrNWquHCeqckKLHrxJTnH7
- TLSH
  T15405821AFA75C2D0C17AD07E9693A72AFD71385A8B2427D35385931E1F72BE4993E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  x86/OgreOverlay_x64.dll
- Size 1.3MB
- SHA256 bf29d36958198cd577f6634b4d268045e981f1ded6bc3a43eac4d8f4bee7aa24
- MD5 e266999327bcf948e2d4b37b663927ef
- SHA1 6acc0badaa27d0c02d2e6d11f6d8c8b3901b00c4
- SHA512 eb003ee4b807f0e472a13887de6e3781f2be5cda0e61e8c440c1a21c50c5637aad18062ab7a5f52a5a1fbe610d45d4a5ed7b32c986001671f8d36f2fc569d1f1
- SSDEEP 12288:nybQt+tlhVvXOUTINs4fDoh7jli97omkZr7uqqzGWoLAi6r2LgAN4vVYe3K:n0lhVvXOUTIlfK7Pvr73qztoLACcjv8
- TLSH
  T1AA552907FB3982A1D17AD1BED683AB1AFA71341947245BC742859B1E2F337D8993E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  x86/PhysXCooking64.dll
- Size 454KB
- SHA256 4e91e4859be23c127d1aba38cc7e94a9ad32b563ecee96f22e9616c118a54c87
- MD5 1c96729a13507add0b7e9c3df96103c0
- SHA1 c6dde3c9b3817967e3b93fbe61e9f60a5b1d5d44
- SHA512 de6c447f5578408053a32ed86138bc70fb8e3389476fe6f2124fd4bcfc0f04d64cb1f852a751ae12e5b5e5ec6e9968a34e3cfb4f346f421eb2dea5af522cca4e
- SSDEEP 12288:mjT0mkNu4HcE+PzztRqAqo5RpOiw4EnHW1+:mkHNu48E+PzztRqAqo5RpOiw4EnHW1+
- TLSH
  T159A47C42F27680E8E02BD13C9956F51BE63139590B1486DF53E0D72AAF63BE4297B313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  x86/PhysXCore64.dll
- Size 4.2MB
- SHA256 0e88edff1575793a1d13a35f6439cf083be230801fcaf8f0c6e059b67a20830a
- MD5 878c0051fb37fcd5e22c57d4d1515d5a
- SHA1 1b0160b849d9dead7733c65787e91b275893bd6e
- SHA512 61755a5b8c71072d8d2bdb34a0877ddbea39d64741108c9452458d5a9d37a47987531bd063175c1ad31dc5815a8c42e9b4628c7c841f2302cbc802d82a565c3d
- SSDEEP 49152:OpedZvym3nBatgt+vpAeiTaRS6gIJCOckY6ocBPY82EvlTCZnxkqYeHLwR7:Sa1B73Oc2XJAGeHLi
- TLSH
  T11F264881A1F680D5E47BF039B567F21BF62234044F6496C753A086195FB3BE09AFB326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  x86/PhysXDevice64.dll
- Size 66KB
- SHA256 8d8ef32baa325d8e963114e65e0c09d51b05584839b9e907da954c1d8b3bf62e
- MD5 a6f63720fba64686f19148b5a46fbff3
- SHA1 74acc018b07a6231d1ee141d0922758429d0b7ce
- SHA512 fe2988cde34f51e5e5581703d78c38e8e2608477648396f44be21a5f8ec4ad9c0fee78e793a364f433b0ee6bf0168956560209c61c7c4ddc3cfc240c1e3657ae
- SSDEEP 768:Qv+ZeaUcLUkl224JFR3FnWXyjs5xj9DyRLu0EZ8nGQHoHL1ARfz1NOt+q51vRi9:Voz4vD6FlFWijqyRLulCGLyfPAo9
- TLSH
  T1C463F585E25240BDE0AEC27888930E45F675F4261B2613CF0764869F1E6F3C5BA3B76D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32