913f064f92f714774ba4e54d3039c38e59d5f57e875253f1110057a3d0499cc5

Sharing

Copy URL Twitter E-mail

General

Target
Silent Client Setup 4.4.1 x64.exe
Size 70.5MB
Sample260604-my145acy7x
SHA256 913f064f92f714774ba4e54d3039c38e59d5f57e875253f1110057a3d0499cc5
MD5 76110ec169e8f545dc34444f142319d2
SHA1 eddfca40d428b5978d356b22329ff7ec8d83abc7
SHA512 38c9454b83fae53b3bde2c9d4795c367dfb37696d3579b05eab85110398c224ee70950f6516efc2dd08a9f8d58f6e0dbd6d7df0460754b0bab0ebcb366921a13
SSDEEP 1572864:uy4opqebKps+v9xFJgHaXOTqPLk8rDbDkkagQkpIEirYY5xiPa:uyHlbKpswzFJsNH8nkkagQfXYGxUa
TLSH
T1ACF733D1CD7E8812D8800D7D6A708BFCDD8A72395AAAD9C9C581796CEFF343C074946A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Silent Client Setup 4.4.1 x64.exe
- Size 70.5MB
- SHA256 913f064f92f714774ba4e54d3039c38e59d5f57e875253f1110057a3d0499cc5
- MD5 76110ec169e8f545dc34444f142319d2
- SHA1 eddfca40d428b5978d356b22329ff7ec8d83abc7
- SHA512 38c9454b83fae53b3bde2c9d4795c367dfb37696d3579b05eab85110398c224ee70950f6516efc2dd08a9f8d58f6e0dbd6d7df0460754b0bab0ebcb366921a13
- SSDEEP 1572864:uy4opqebKps+v9xFJgHaXOTqPLk8rDbDkkagQkpIEirYY5xiPa:uyHlbKpswzFJsNH8nkkagQfXYGxUa
- TLSH
  T1ACF733D1CD7E8812D8800D7D6A708BFCDD8A72395AAAD9C9C581796CEFF343C074946A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 6.5MB
- SHA256 0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c
- MD5 180f8acc70405077badc751453d13625
- SHA1 35dc54acad60a98aeec47c7ade3e6a8c81f06883
- SHA512 40d3358b35eb0445127c70deb0cb87ec1313eca285307cda168605a4fd3d558b4be9eb24a59568eca9ee1f761e578c39b2def63ad48e40d31958db82f128e0ec
- SSDEEP 24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
- TLSH
  T16766942F7B48037306C602A2AB8BA5CBF21B903F3B565654345CD1681F6BE2543FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  Silent Client.exe
- Size 154.5MB
- SHA256 193a40a8d93f6677aeaee741e05668684d3dc00e0b2dd2e5198d8490d2be904f
- MD5 a6ffce4bab0baa24cda42dd038b0cb7a
- SHA1 ae6df79050bee78bc2fe54b2b9bab744130f21ad
- SHA512 c76cafbf96eec10483169997a13ddbaf0671999996696ce76833cbf6f136d6639964d6383bab8bda14b198e611f7eca0bd2ed2fdc9b0821fde147bb6fba6de13
- SSDEEP 1572864:0CquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:+DAgZi
- TLSH
  T108788C03E29A10D9E05DD1B58B579637EE72BC460B38A2DF165427522F7BFE42B38B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral13 behavioral14
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- MD5 cb9807f6cf55ad799e920b7e0f97df99
- SHA1 bb76012ded5acd103adad49436612d073d159b29
- SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
- TLSH
  T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014
- MD5 d49e7a8f096ad4722bd0f6963e0efc08
- SHA1 6835f12391023c0c7e3c8cc37b0496e3a93a5985
- SHA512 ca50c28d6aac75f749ed62eec8acbb53317f6bdcef8794759af3fad861446de5b7fa31622ce67a347949abb1098eccb32689b4f1c54458a125bc46574ad51575
- SSDEEP 49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
- TLSH
  T182D5AE07F6D60099D019C574879F9233FA3038468B24A7EB1B91A9242F7BFD46E7E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  libEGL.dll
- Size 468KB
- SHA256 d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577
- MD5 09134e6b407083baaedf9a8c0bce68f2
- SHA1 8847344cceeab35c1cdf8637af9bd59671b4e97d
- SHA512 6ff3adcb8be48d0b505a3c44e6550d30a8feaf4aa108982a7992ed1820c06f49e0ad48d9bd92685fb82783dfd643629bd1fe4073300b61346b63320cbdb051ba
- SSDEEP 12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
- TLSH
  T152A48D25779854A9D06AC030CA534652EE76B8860F21FADF0294E23D2F77FF85B39724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  libGLESv2.dll
- Size 7.2MB
- SHA256 50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e
- MD5 a5f1921e6dcde9eaf42e2ccc82b3d353
- SHA1 1f6f4df99ae475acec4a7d3910badb26c15919d1
- SHA512 0c24ae7d75404adf8682868d0ebf05f02bbf603f7ddd177cf2af5726802d0a5afcf539dc5d68e10dab3fcfba58903871c9c81054560cf08799af1cc88f33c702
- SSDEEP 98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
- TLSH
  T124766B07F69581D9D04DC2B8CB4B9123FA30BC994B24B2DF269837152FB6BE06B79714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.node
- Size 144KB
- SHA256 0ecad90320c129c5e6d57cf4a142a9148d1dda534bff9a47b527d2781aec73a7
- MD5 b9fd741832f7174362c0e8dfd5c19574
- SHA1 eeb4cc5b742552a62904bed3c90209eb492a491d
- SHA512 1970268909b5728a3d4d6b1525f1edd2ba212d58b0355b70d2a4faacb8a0fce3b2d7efdfff0071c2fee024893e3b58266af06c66ce889e6c012ad645f5490fc8
- SSDEEP 3072:FMpaTHsmOYrr3sFsHuhfbty0SN3fzF3yUMC/1:y4TMmOYrIhhTty0NC
- TLSH
  T1BDE35C1BB7A500BBE5B79235C8534A06E7B2B81107609B9F03E443756F237D1AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/assets/icon.svg
- Size 86KB
- SHA256 ad1d859b9f2f5b7dcecd6b199a96b6bb164655b33b9545506f1479c94899fcfd
- MD5 d22bf1aee0486d9ce98e69e9507fd357
- SHA1 62b828b051b4773185d0414905574e9b8b17d235
- SHA512 dfae09b7871f26e0aeb12799dd60ff79e61b590d8e3537caa3aa2a898f75788465a9780360ca4fbfba192d1f76ffff766d3113ccca610b5ef967b5420cae13e3
- SSDEEP 1536:yxzVcjBgQybTGNYqJkLbG1uokIOOKr4r85ujR7b7TJVHeyH9qEW5j4Q8T2yeBvzb:yxKjyGgqSOWGR/7TPeyH04AyeJzb
- TLSH
  T1D593F1B6565874CE29989E3EF23C2A44AC35613756D062CDFFC11102B0F8D0DF6AE796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral24 behavioral25
- Target
  resources/assets/images/full_logo.svg
- Size 7KB
- SHA256 57492f2cab5858e746ff51282ffe5b9e9636c0313114e9051d3898a46dc2dd3a
- MD5 3a1ce5da249d01d6dbadd602223674b7
- SHA1 3026dcf6ee2e84e2d42d9a4cfb97b06712ae7f0e
- SHA512 c401170ae2e7cc76c5051b22de056d0c9e43688e7a0319b9ef987243ed258af8b0bb0ba513dfc4643b4c34cd77aefb7bb32a7478f2134b8b53b0808d570f3bda
- SSDEEP 192:CNv2uilYt9Nn7Dphcsh2Svk0X8Sg720t9m0MlVGHC:vUPldhRhTNMDXo5
- TLSH
  T1DBF110FEAFB11CE19D89CAD2EA2345EC750B597B6F528B10C229C7353907C9CC855983
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral26 behavioral27
- Target
  resources/assets/images/logo.svg
- Size 86KB
- SHA256 ad1d859b9f2f5b7dcecd6b199a96b6bb164655b33b9545506f1479c94899fcfd
- MD5 d22bf1aee0486d9ce98e69e9507fd357
- SHA1 62b828b051b4773185d0414905574e9b8b17d235
- SHA512 dfae09b7871f26e0aeb12799dd60ff79e61b590d8e3537caa3aa2a898f75788465a9780360ca4fbfba192d1f76ffff766d3113ccca610b5ef967b5420cae13e3
- SSDEEP 1536:yxzVcjBgQybTGNYqJkLbG1uokIOOKr4r85ujR7b7TJVHeyH9qEW5j4Q8T2yeBvzb:yxKjyGgqSOWGR/7TPeyH04AyeJzb
- TLSH
  T1D593F1B6565874CE29989E3EF23C2A44AC35613756D062CDFFC11102B0F8D0DF6AE796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral28 behavioral29
- Target
  resources/assets/updater/updater.html
- Size 423B
- SHA256 6ab2c4f63e9c6fb6b29315b9a0909f0977d935e61027603dc4773f1f673848ab
- MD5 80ca9f9545a5cb816ec202c5ac7cc6d8
- SHA1 383035241b86667aa8cc192d675706974e89eeef
- SHA512 a78d8c9ae1cc2e40a113c1843bb03efe7a09ab1125338681a580bf2457efa582a3c4c72c61b3a3e06849d9fe200a2005648ac8276533f583abf7fe03eb8a786a
- TLSH
  T153E0682E89AD8472D8E1119EACD1B7E93DE5D509C78F902030E4A948DF6AE81CC4F426
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral30 behavioral31
- Target
  resources/assets/updater/updater.js
- Size 606B
- SHA256 8f27a967789167ec390e233e30dfb140cc0db66260fa786e725b074402a4621d
- MD5 83b1bf75fece90a4c4c38666c825446a
- SHA1 b84e504367405feeef33d136d7b6e5f43cbcd8aa
- SHA512 d5808d242367151f7fab672313f9ac4f976a4f437b9f9a8b441f0322cc1cde922a74ef9f82ad2200bafd6793b270f6382ff858dd51e67ab7f9c363a76202277b
- TLSH
  T195F0D39E74972D380EE7B4926032410938249C11980A9445552C69B56F58ED2E56DF5C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Looks up external IP address via web service

Enumerates processes with tasklist

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Looks up external IP address via web service

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32