66861b9d7adb0dcd7022b3c484c1e0927f40598abe941a3a04a4ed26c61f7a55

Sharing

Copy URL Twitter E-mail

General

Target
betamagicfantasy-Installer-Wizard-1.4.2.exe
Size 73.4MB
Sample260602-b5t4lsct6m
SHA256 66861b9d7adb0dcd7022b3c484c1e0927f40598abe941a3a04a4ed26c61f7a55
MD5 aa87b8a12661dce2632ef7c27b082f8a
SHA1 4de0bddb3ab102abc091eaaee42359e3d4a1c0b8
SHA512 8c34b7c193f8f26f5f9ee7b1fe65b663c99625b6c7f8f94a041239db5635b4ed601555e66a8a9238edcbea9ecca8e4c07631bb390352524007aed511c9668b2e
SSDEEP 1572864:wOejOYfvolb+gP/Gs7JMgizAWvdAERHsEJ53a1VtyfToDx:wO4XCV3AxA2AOHbBa1ufTMx
TLSH
T1C5F733789E6BB8E7D10061FA744108B03D2F694762BD6AFE59BEC4DAFD91050364C0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  betamagicfantasy-Installer-Wizard-1.4.2.exe
- Size 73.4MB
- SHA256 66861b9d7adb0dcd7022b3c484c1e0927f40598abe941a3a04a4ed26c61f7a55
- MD5 aa87b8a12661dce2632ef7c27b082f8a
- SHA1 4de0bddb3ab102abc091eaaee42359e3d4a1c0b8
- SHA512 8c34b7c193f8f26f5f9ee7b1fe65b663c99625b6c7f8f94a041239db5635b4ed601555e66a8a9238edcbea9ecca8e4c07631bb390352524007aed511c9668b2e
- SSDEEP 1572864:wOejOYfvolb+gP/Gs7JMgizAWvdAERHsEJ53a1VtyfToDx:wO4XCV3AxA2AOHbBa1ufTMx
- TLSH
  T1C5F733789E6BB8E7D10061FA744108B03D2F694762BD6AFE59BEC4DAFD91050364C0BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/semver/ranges/to-comparators.js
- Size 282B
- SHA256 6c5e966210cff270fa2850668aaf8460fac7759f8d99f282521ef7a78f4564e9
- MD5 ffa280f5f852dbfbd8063d30c20314ae
- SHA1 938d6720d58117335d9d06352e644251274a030b
- SHA512 0c506ce7f95070e944e96231238990a0daf8e148b497c7da13bd1714079d8ec7845c40688b16148acc91992775cf1bec0753680d90525fd46cb382eeac3dbb71
- TLSH
  T189D0C256129632198B5E61E0B39014274CEACA91F0088546122CAA812B03D60ABF68A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/semver/ranges/valid.js
- Size 326B
- SHA256 5ef6f995af801868925940cf8df5735d565ebabb090b068695cae65218bcd3ac
- MD5 eca8d7d4225aaa805dc75cf92f0ff117
- SHA1 80d218f17a4d38030178c3d94dcb098b7b1e7251
- SHA512 fa8edd562f29875374751446c79365501a036f9bd534a84a94e30619d552643fe071ed84b2d0814350ee886c6b22ba9c7c735d6f8b7cbebdaa970036db766b41
- TLSH
  T1B8E0209515F651060FC750E45288500B79CEC2D1B20C4565A34003557F46CB080BA0D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/socks-proxy-agent/dist/index.js
- Size 7KB
- SHA256 733d7d4622ffb11a3212da7fa43236e36fa1fad0fe3efb23d2c3890cb9312bb7
- MD5 f29c78808230c73797bc9836365425f3
- SHA1 a54aa07ec961e7563065d52b18d580f30648d1e7
- SHA512 9eda381de78109ce039d246648f9ad34ffcd6e3fb1d685f893b976a04cc2dd5c4256f83f4ccf918ce273de853d53c747241fc3323d2fa7dc35b8d6337c3f788c
- SSDEEP 192:ZnUQgdyNS8TUtWiDW6b/H8Tiuq5ci0zYWxWQv2dffQjOHbhB7f0OLB2eWcIkiba+:mRtP8IbLf0sIG0T
- TLSH
  T12FF1A80C99F35021D2FBB2AD875B60547735C40B6209CD6A3A5DC3A0BF1366896E3BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/ssri/index.js
- Size 13KB
- SHA256 d027d53b84a5abb1926c1b3ff7f3c8164f697c27bb20af6dca79c16669a2ff82
- MD5 88900b6107ab6c08da3c827c847868ae
- SHA1 984fa47b4ade65632dc029fde405643c4902b707
- SHA512 c502bf0496fb76b64d8ab771b0af895c046d901acbbc3f1e7fc169260bfc7698bbc2d97c4372bcb07318e7f7ccd1545a50f62304bf306d5193f42e9483c6b0d6
- SSDEEP 192:oMbnWTED1K6Ie+7jMzdoWjSErisEmebQCeUUzeR2EsPgRSR2RlsRPvQETl4fTO/Y:oMbnjTjYsPCY8mTeOfVzNAFMI
- TLSH
  T1A15242663DF1719003C3B6B68E8EC012B221602732795A69BD9DCFD45F86838D1B7BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/unique-filename/coverage/__root__/index.html
- Size 3KB
- SHA256 3f0a2d6d3e8d2a8f8fcef547507b60045d4354b98392b6d640a6fc30fa6877ab
- MD5 a869cf359fe08b845a5aa253ad825edb
- SHA1 e8067d215b69c30a2920f8086425aeff8b4c7946
- SHA512 c16bd4e2c80902f6f4845f6634140c094e9349c0e4e34f112fed4ad0981a7a484be224610382e6cf1a5f02c250de851578036848257c01b8a5c2d4488e366118
- TLSH
  T10A610F9CB0EA6272101B84C06E9C1F9B34F4F396C204555875FC9A729FD6EB8B04399D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/unique-filename/coverage/__root__/index.js.html
- Size 2KB
- SHA256 68aa19427432d257fcffd76f9b763cdefcb0868e71abb14ff5a91bd2391f2d00
- MD5 c49c4ef80940ddc50c80587e1efd1490
- SHA1 76f8d96578fd41cf7aa10296b506580943623354
- SHA512 d76a064d6e3d1e226fc72d7f24683c0bdaf3624484969015f7f2a5f633d8cf14edb47615a5c80f06d327c16b1148f3f2d0e55eb4ec4ce6aff28bd3595727cab6
- TLSH
  T15541AD69C5E16523006381C0BB9A2BAA3CE100DBC9545521F7AD7BE5CBC8E8EB457A0E
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/unique-filename/coverage/index.html
- Size 3KB
- SHA256 2d92563975adf69d86293ddd0ce4d66ec9723d9c360357b98fd5b933f1182865
- MD5 d0181cfb6e68156b3a21c044eef9c2f5
- SHA1 4d4f89d07d9394f1e3adbcad10a0b263da223209
- SHA512 c6b864e6c18c36be9a7bcc89ca2f4a0b0a11dfe9f9157666425dad1542618c623de3e45a77b78c5de84994a10fc3949775b5ed5a99fffdf0250dd42e8db6ce9b
- TLSH
  T1D251ED8C70EA7232101B94C16E9C0F9B34F4F39AC204455975FC9A729FE6EB8B04399C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/unique-filename/coverage/prettify.js
- Size 17KB
- SHA256 67126b6cd4d1b2305f8c8fa5974971ebe90ab2b0f6e209ba2f1c6e4af05f0207
- MD5 fdaf2510a4125a409882ed554f89c039
- SHA1 43f2560c12ab3c378b4e8ef24ce54df255974b32
- SHA512 8ceb3bd1a0fefbf1ab5b0db73ed8d8d37ad758c90635d9428d2340e3e164c0d3f92d1cc2a8b03ad1bcd783e833785c6ead2c80247079a41ef1f57706926f1e27
- SSDEEP 384:a2U+Ljq4/Cnc3SKTWJYM3l3bSK4H8jegKrx68/Qhke:vU+Ljq4/CnVK6J53l3bWgKrxb/k
- TLSH
  T1E2822BDD87601B79759521F009BF701268D56A369A1CFCB8F3E6EC2029E0F46406AFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/unique-filename/coverage/sorter.js
- Size 4KB
- SHA256 f36b3bbab81ff43151b2e5f45dea4770e6e3f2436ed41060792402015c26944d
- MD5 6cd2f517cd50c640eead359218c9035c
- SHA1 22e214a23aa976891fa6bfc1ba7c3ed79c289960
- SHA512 df34f348f286012577c01db8b6d249df4924ca6343c57293e8537bd2651259d2754e5d8293d864e7a6a2111d978977740ed4b0da1a79be070c469c6465284160
- SSDEEP 96:j8xbUjyslE1Sm17i8ixPCPiIEECyibECV:gxbUjyslEsm17i8ixPCPilECyib5V
- TLSH
  T197A1015836E23236A51370B987DF14A17074A9131848EE207E6C97514F61CAD8BFEFCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/unique-filename/index.js
- Size 215B
- SHA256 3a3218f3b64cb4b585a712fe58c9ca0ee4b1d861a4c53b42867143c209a41d78
- MD5 33a86a11985cca792daf027ce2bff089
- SHA1 44c3a94742a61d981cf91ebcb8b1aff52c5a5345
- SHA512 25a87510f88cc3bf31345863ab140dae656c582340d150b77e7df1e3ce862c5fbb1296093f500905d9161e868adf750c175f134839ebfdb2b9b50d67aa33b04f
- TLSH
  T1FBD0A79E13D4B109E9968190C5FD9A43308FE4E032796400DF147B914194B454EA3BAE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/unique-slug/index.js
- Size 287B
- SHA256 2bfbe1f3de1620c5da3080b036f2a5a8d6d7586ba24870d54ff919c993f0dc32
- MD5 16cefab3a8f28a11c6d852e9d67ab741
- SHA1 e7c79fff8e33c94c274ea5c8a2044e904b07e5b0
- SHA512 14813428a43b7bafb680d912e47054368cbf4e28846e7c3f37cdd16f02f5c8e49df46a3838cdf0f4c9c6e68f60ba4c861ac937c9e4624d9495f59d3b390c60d5
- TLSH
  T1D6D0C2DC3BF0B1A5F20520E1C0ADB54AA48CF5A311EC4962818058206B6995C6BFFDE1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Contacts third-party web service commonly abused for C2

An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32