feb12f8484ca9b848e178da360b6434b1af9fab48a47a2e42b193e6d9fa46433

Sharing

Copy URL Twitter E-mail

General

Target
Decache_v1.1.1.zip
Size 11.8MB
Sample260602-ejmn7adv4v
SHA256 feb12f8484ca9b848e178da360b6434b1af9fab48a47a2e42b193e6d9fa46433
MD5 a9bc7ed01138633872895a3a4479a69e
SHA1 5d044976535763a766538942811f5e851feddd3b
SHA512 256e5b944d518c2751a62d88f7e6e090a27018f3a8f3c3070e614f2cc5d27bd98e956dc4bd87542c5364e694d5b66ff39df8de104c0e6a8cdf17fcc10b62a23b
SSDEEP 196608:Oa3PxZBwvfvvn6GPoAFUG7Tjc5IrhC4RTrammj5F1qpDm2w5j77TXCFVFrkqNm11:Oa3RsPo0HjLI4xBmL1qpDm2cj77TXCFm
TLSH
T1EAC633A673F8B36ADEDFE6F61237EA87463329444DD2360941B436A860F3355924C32D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Decache Exporter/bin/7z/7z.dll
- Size 1.3MB
- SHA256 a575175338706d1473e2bebe1cd811283c63c697a17c0865de85ede345898af6
- MD5 b418b54dc8da84500c7070e160d500b4
- SHA1 e355240da7851f619168a830ef1eede3aef2383b
- SHA512 52a7454716cf165d2e6e65edabbe4b507bcf8199288d44de40bbce488a43dc45261d32b63bb0e547c4b3bdadfd29d98d4eaaaebefb1a0b15e3a734a809a10d20
- SSDEEP 24576:Yhzoc/XupYDLimyUBKGm2MWYe3swtF7Qv/jVq1hgaZVgpoKODpT9e6isdC:YhzocvupYDLcGm2Oe3sMaXegaik9zVdC
- TLSH
  T174558D11F7F1C0B4D58D5630862DBBBA50F8E729CA10A8D777C0BE6E6F319D2C225A49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Decache Exporter/bin/7z/7z.exe
- Size 349KB
- SHA256 2f17553a71ad019d64ad83b79c82c3f824491281c9ef514dad8006918319e6ff
- MD5 6137cb5ea86c03a20131a98be533c1f5
- SHA1 f221c9390e2b5c077b49cf33e50b144ecc8fca96
- SHA512 b4bea20e23a20c8ce6a0ffdd91c27a992a6376ae3d3922ee0349a7e7e4908cada2fa85049341818fa01b6e8b0b41a8415f736a417683e8447d6accd5771e7378
- SSDEEP 6144:NWqF8itGhnIVsIqEV8CfqW2WJRckYeaPKjy2nGzLGd7ByF6L69r4YpYrrV:NgkWGqqxqYRxYe5jvq2YpSrV
- TLSH
  T166747C127BE8E43AD2420131CB5AABA5E4F9D3684E71484337C4196C2B75DD6E33AF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Decache Exporter/bin/7z/7z.sfx
- Size 424KB
- SHA256 353a3f6d7cbd06c6f25589df00b40f363e9f597c4edc4ad782f6d6b21f297f09
- MD5 cd076ef23ef776a8212aa42f28beb6ed
- SHA1 ad230c2c18852a1dae5abb68fbe5d630bc951d66
- SHA512 a8dc29bb9454a82fa62f4dda4b5deb1631cbde108a4060605320eb88bbc45a4b6f2046c0a7ea01daa203c7d11c94c819d1792c1fa135d79bd3f148ba9531d802
- SSDEEP 6144:9n8/VEOuUg4ziefIZSn08IPOXlFP7ZmrBBWQkPUrbFEkNXI5iixcJhXZtu6:9n8/6OxgZeIrLclFzWrkPALNrTJ06
- TLSH
  T130946C6BF27840F8E0B7D178C5629A07F775785A0370EB8F02A8867A2F136E55D2D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Decache Exporter/bin/7z/7zCon.linux.sfx
- Size 478KB
- SHA256 c29701887677adc82aaf3f2c55432007b3228f5d05ec3b932e08bfc3ed1a7159
- MD5 db3535a4081f88de6ba7de17906b8f8c
- SHA1 726f77a8ad4624835d01b5106873c160c191b1b3
- SHA512 88474b1e27b6dd72eeb7b7252ffdc24ec4fb3ce38ce9a124a78d268dd7ae93e862b318ea935898e90ef8a7fee907751c75ac86ba1fac3e09097db61f400392d8
- SSDEEP 6144:2KFVMp2yvRO0SHs/oQlMrtdLqAKoEfn49t0QpUstbvOXLhw8:wp2040SHszlMDnKownX
- TLSH
  T1B7A41A0BB6664ABDC09DCA32455FC132647138A41336693B3784FA350EE5E64AF3FB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Decache Exporter/bin/7z/7zCon.sfx
- Size 415KB
- SHA256 5f5a7f958c8a9cdbf43a8135670a8e389050b5aeb0c0325300f6c08e640aa24b
- MD5 91504a2c2d6a44787959bce544f6072b
- SHA1 3b11b27e7b1a236cfb54413c972a99263b17b65f
- SHA512 ad347bed26f124e170ec5208ace90013245864d6edc98edb97cbcb0a169a4b3d2a2c2abc60c610e4d0b8439e3fa893bcd5d67882e097d03443b77d23893656cb
- SSDEEP 6144:pC9jKj19cJ7ljZjMFFzTNI4xYHrOrmiojJVJVIrWaVLEQNubwe0nb0KxvfJP:pkmjfggHpY6mrVVviVLEgub+bD
- TLSH
  T14D947D5BF76440F9E0B7D038C6525A07F775B89A0360EB8F02A887762F236A55D3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  Decache Exporter/bin/7z/Codecs/Modern7z.32.dll
- Size 338KB
- SHA256 7b65219a1095cda0bb8469bc9728177ac727bbbc1a8ff069b53a0408d7108ca0
- MD5 d17baf2aa7e097ad1faf4272b762cc2e
- SHA1 9e20498f5ef4f856ddf7d8f79159c64016e32ce1
- SHA512 ba03f88d9036cf54656633943f354428fe565ab85615fa65e68c90ac20edfd22a8dac5cd3484bce49149700f4cfd361f7c1fc7b4de02297d47173d26321186cf
- SSDEEP 6144:LDANS5esvcU8ljTrocKLX9rGrnw2lEHdGBQ6PceoX:L8NS5eMRptranvlSdoQ6PceoX
- TLSH
  T100741A33E6904033E16F0A3958E7B31465FE76E1AAE5740B1EE03E5F4AB9642583CF52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral11
- Target
  Decache Exporter/bin/7z/Codecs/brotli/libbrotlicommon.dll
- Size 132KB
- SHA256 98ed8968fdf0b0f49dcf0438bd02097f62bbf17c3a197984f2fe938ab48fcefe
- MD5 04176598b71ed83e15612cb407b3d0df
- SHA1 07b92f98db283466e4856f554a46001f7103f199
- SHA512 bab6e54b95b29fdaac33fb3731f0bd1906445c7e4d11afe228781f780a6798fc51bc072d09927367074846a8e0ddb3ec43735515b22434b0aed1b563de8c30ed
- SSDEEP 3072:cc4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBG:V4AhdNorGvHdbi09GJ
- TLSH
  T16AD37CA1B3050736C25B227AE49A6BB9F33581B597670520F4A9466D20C3CA4933F7FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  Decache Exporter/bin/7z/Codecs/brotli/libbrotlidec.dll
- Size 49KB
- SHA256 22867c89943eff315e5e811564e6d96a208134470e4e5adf0d46ba9a4f9ad3cd
- MD5 198affe102c5998980300fa307742f11
- SHA1 854845c60ed8470836c435a7a1131a3d015de4a9
- SHA512 5644c2647176285dbf8bbf4c9d37dd5169088104b5b0efa6116521d7736722bbfe62c9375a98e9e3872f2649ac3187911a0106cbc25d0ba1797aad285fedede6
- SSDEEP 768:2Q1n9COlu6I3cY5487AekN5X4Sa0ValJ7diL1BFnbx0vuzd6+7fT/bnDvLXzf7jz:fn0x3cYFMRN5oSa0g0fJgMap
- TLSH
  T1EB337D41BB932CBADD5B03B452427F7F06BD4B025926C66FE1B4B9DEBE232137644148
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  Decache Exporter/bin/7z/Codecs/brotli/libbrotlienc.dll
- Size 548KB
- SHA256 ba9675ba658f609e01a6cbd4fcc10f4413ec40c720824dbc25ade5edfa6299fc
- MD5 e33e47300deaf84d658d225101a51dd5
- SHA1 b03c75819abfafb7b20608e392d4cc68a6ba824b
- SHA512 1fa9f983789eac168ecef370ece11baf615d990cd01d103687b16a26319fd7272b106732b2023a223ef4063e685f9b02006b3b4d503d5800e546447c4fbae4f5
- SSDEEP 12288:1MOZpu6WGnJSP+aqnKYufoMMzXTw05nmZfRR8:1MD6WGnJSP+aqnKYufVtAmZfR2
- TLSH
  T1F2C47D06DDE383F2E84749744DA7B63F4A3467118420DC7BF76CAE51FA93B06019AA8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  Decache Exporter/bin/check_dir_exists.bat
- Size 500B
- SHA256 630cb7e4db8334c5a5245f1964d2e7508e2aece7afb54adeb34e30d2256acf54
- MD5 e8f12cd121ec63c0218ae98067f59d23
- SHA1 fdd9c0b3725e13a75402d9e402d3712fe79d1b19
- SHA512 21e042d33df8e0d94bf4c35b99bd5c543036df1520212ab8c67c7d777db0650730d47c3412507cff6930360c5d72ee4f9054235b0a23b4d4a6f4bf75681b45fe
- TLSH
  T144F00E93A8711D0226FCA26ACACE71613E92800C031817F9324071FA91647A80FDB9CC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  Decache Exporter/bin/check_size.bat
- Size 588B
- SHA256 9c1ee564da975281f5f9d6deb93497a3a389f0908d85b6ab25440f02caebb1d7
- MD5 7e99f785f7d3bedc25c2674265656685
- SHA1 7603e466852a1f77642273a155de1caaa402e427
- SHA512 187643687d938d7dcbb53b6f20c25af081fb4c996fea1b98e708280a708380f1497aa67231b1059b2627c7b29a01f95ab9cfd34c69ec70daa22660f8545fab8e
- TLSH
  T197F0F6ED441862527CB6CA767901D052F74A581B1101A14C3B9EE6C5AF3635242EA6EA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  Decache Exporter/bin/curl.exe
- Size 3.5MB
- SHA256 91bec35c02d901fa4e9cbdb84a59bfa538d82f5a4d81fd0f3a6f8e0b907e82bf
- MD5 43d76e80407faaa9f076d28a2eb62d6d
- SHA1 3e1bab1cf235f715791bd622daf492f6f94ea251
- SHA512 f443e283a5cc097e2fee6c712005f14c06750717c5065743a92bd9a0850b0ac3fbc2d85ad19ece4343837022460f7142ae98fb4e663eb9d380878a9f2ba94a07
- SSDEEP 98304:M8eY0vJLrYS2LeHqRTaWkD5mZR9pEHRWWZOI2KiMDJmEF9BV+mRfO685Focpquwt:M8envJLrYS2LeHqRnkD5mZR9pEHRWWZj
- TLSH
  T1E6065A84FA8350F2FE5B5CB1A04BF7BF4B349601D830CEE6DA44D945F823A52660A76D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  Decache Exporter/bin/dd.exe
- Size 334KB
- SHA256 2f3d16ef80d336ff1d270af9c101443a6426600b6d7c6506d984cdbdc7c6e8f9
- MD5 168b73cc0f3d8c92c98c5028aec770df
- SHA1 7efcd6af6a0fda490b42e0ed4c5aa969079040d1
- SHA512 eed96b1d013e597bb9495918fee5260a8e17c5ba710315c4f7d3f92202a65a9751ad14248c5c7d88aeae9162ecd10a11c2806385268d18ceaa6bbf692ad5c421
- SSDEEP 6144:4GstW634w/+YvExOLm3hfpH2NqdMsBIdvHy/+o2tIxwgCQ:utroO+YvEkLmYzPda+f6Of
- TLSH
  T135746C73B6A04437D123267CDD1B9BB4983EBE103E2815866FED1D4C8F396923A25397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  Decache Exporter/bin/ffmpeg.exe
- Size 13.9MB
- SHA256 78ee9aaa6d4a84c0e37bd1dab90710b5be9d4ee69bfceb79ea89e2a98b50ee28
- MD5 8bfdf34d127d3e27a7ab819ac4b3bb64
- SHA1 e74fb9ad94cb626ae0c10314e31d6340caa9f0f1
- SHA512 9c7ffb9772dd3856ac22728858f5edb2cfdd4612074719e656992ab194c324395a91e92561c2b1d17ccb8d41ea21747bdd9a377f097ed03c2b054ee6fa5bb82e
- SSDEEP 393216:3Aow4DHYa8TJfE3ufInfUkI6EOglBGCnrpbt6n9QtKER8ppvJ:9HGlBJrKEKpX
- TLSH
  T1DEE64B82E6C742F0C86B0870409BF67F57302E09D824CE5AFFC4BA65F9B3A716925759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  Decache Exporter/bin/history/BrowsingHistoryView.exe
- Size 646KB
- SHA256 a14055e8b09fd980e82a3eb551fe7ca60018b5486d46e462fda29ee88f252ca0
- MD5 0f5aba101aa4d94be74690aa60bf7840
- SHA1 40557e751e76b1f9608c2d0c12ce0cccd2588e11
- SHA512 a987c36c3b5ab8b5e65a5af8542c3cd9ec67187aab899211809c86aab93dea962e4a4ffb8107de60d0e9c6661c275a9b2f563165c2a7ac92b68901ddfab68789
- SSDEEP 12288:RxNu2A3uJepO0u9VMpw5i/9U2gI4Ka0N3E3blMq3ZWb54D8XYEcGFPH2EEYiBB2i:TYZ30epws6Civ50u3bX8b54D8XYEcyzo
- TLSH
  T16EE49D83FBE380F1E8A614B915FE567B1D35AA054336D6D7ABC42C408DA12F1693E387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral28 behavioral29
- Target
  Decache Exporter/bin/history/ChromeHistoryView.exe
- Size 219KB
- SHA256 2c1590d687a8609fb3107f454bbbabe12b63e2fd84f63e4cfbef44be3a810223
- MD5 853406ad48646e2ac2069c69882ca7b8
- SHA1 64652560c73677696537ecbeeee64bd032b69c1b
- SHA512 421d37f8f6f39753679129d1566629f345d7e2cd731815b8c6a4df58ec86cc5a7e5d19dbc6f064fd688602caebd988ce36bb52dceaaf640fe4a62381a582bc39
- SSDEEP 6144:RcCDbGfc8sg2LcBD1o9pDjNaazqpDbqjuNlPwJ32I:dbGU8sg2oN1SWl2juAJmI
- TLSH
  T191241206FA458EBAFED3963BD2C20319F504311483FE9746F246EFFA7A14690A055D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery spyware stealer upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral30 behavioral31
- Target
  Decache Exporter/bin/history/MozillaHistoryView.exe
- Size 223KB
- SHA256 b38d79eed498d0aa6d310e86dc8044f9684f5b8d350e9bd7cacf79a881b873ab
- MD5 561621bd0386450c39ca65849482f6ac
- SHA1 d10cee5d89a6b42dfbc1203098f532b89cac58cf
- SHA512 f1d74a15d37cd36006a6ef22217fd459ee65a2b7f0659f75e11ee524a98e37753a0f8a2c9531a4ebe6737d0a09cff0a2cad6409b08feea24b9b2882785f1d777
- SSDEEP 6144:0kuGpIpLrh48KMY0sC/dmdiEkjPW0nWZy:TuGpSq8K70XVDdW0nWZy
- TLSH
  T18D2412E569D61756DC2F59784157CD323CF8B2D92EC281BA78A8D83A38B2B403F63017
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery spyware stealer upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads user/profile data of web browsers

Detected Nirsoft tools

Reads user/profile data of web browsers

UPX packed file

Detected Nirsoft tools

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32