Overview
overview
7Static
static
3typeUp-Set....0.exe
windows10-2004-x64
7typeUp-Set....0.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
4d3dcompiler_47.dll
windows10-2004-x64
3resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...ch.exe
windows10-2004-x64
7resources/...ch.exe
windows11-21h2-x64
7resources/...ce.ps1
windows10-2004-x64
3resources/...ce.ps1
windows11-21h2-x64
3typeUp.exe
windows10-2004-x64
7typeUp.exe
windows11-21h2-x64
4vk_swiftshader.dll
windows10-2004-x64
3vk_swiftshader.dll
windows11-21h2-x64
3vulkan-1.dll
windows10-2004-x64
3vulkan-1.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
4resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...ch.exe
windows10-2004-x64
7resources/...ch.exe
windows11-21h2-x64
7resources/...ce.ps1
windows10-2004-x64
3General
- Target typeUp-Setup-0.2.0.exe
- Size 174.8MB
- Sample260604-ppb5raex6s
- SHA256 b3ce1e972ab9515ab3715b7336abed36955d09d049e765a068e94e182ce58111
- MD5 82eb10e661ebaceaefafb4d7cd777b6d
- SHA1 1e4094d4f0f3ad91a99ffca92de697122ee1d104
- SHA512 c6fe00a532669a97229d3d28ec90353f2614acaaad6fc1e587c6512f00c670cc9c7c4e6666c7dc2cd1a402e4f15c411d55d0d6cf6e95c06fba6af51f46ac19bf
- SSDEEP 3145728:Z+nuPyCnM3rczT80F1UNQlco/hB0VnuPyCnM02rczT80F1/W8Nq8:4uPErI80Flco5BAuPYrI80z/W8Nq8
- TLSH T100983354D2249EB8F3BD8F72209EA8E7C7B2853C4014B4B7862E554139B9FDF8D265E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
typeUp-Setup-0.2.0.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
typeUp-Setup-0.2.0.exe
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral15
Sample
resources/elevate.exe
Resource
win11-20260513-en
Behavioral task
behavioral16
Sample
resources/resources/dist/launch.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral17
Sample
resources/resources/dist/launch.exe
Resource
win11-20260513-en
Behavioral task
behavioral18
Sample
resources/resources/format/FormatService.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral19
Sample
resources/resources/format/FormatService.ps1
Resource
win11-20260513-en
Behavioral task
behavioral20
Sample
typeUp.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral21
Sample
typeUp.exe
Resource
win11-20260513-en
Behavioral task
behavioral22
Sample
vk_swiftshader.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral23
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
Behavioral task
behavioral24
Sample
vulkan-1.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
vulkan-1.dll
Resource
win11-20260513-en
Behavioral task
behavioral26
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral27
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
Behavioral task
behavioral28
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral29
Sample
resources/elevate.exe
Resource
win11-20260513-en
Behavioral task
behavioral30
Sample
resources/resources/dist/launch.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral31
Sample
resources/resources/dist/launch.exe
Resource
win11-20260513-en
Behavioral task
behavioral32
Sample
resources/resources/format/FormatService.ps1
Resource
win10v2004-20260513-en
Malware Config
Targets
-
- Target typeUp-Setup-0.2.0.exe
- Size 174.8MB
- SHA256 b3ce1e972ab9515ab3715b7336abed36955d09d049e765a068e94e182ce58111
- MD5 82eb10e661ebaceaefafb4d7cd777b6d
- SHA1 1e4094d4f0f3ad91a99ffca92de697122ee1d104
- SHA512 c6fe00a532669a97229d3d28ec90353f2614acaaad6fc1e587c6512f00c670cc9c7c4e6666c7dc2cd1a402e4f15c411d55d0d6cf6e95c06fba6af51f46ac19bf
- SSDEEP 3145728:Z+nuPyCnM3rczT80F1UNQlco/hB0VnuPyCnM02rczT80F1/W8Nq8:4uPErI80Flco5BAuPYrI80z/W8Nq8
- TLSH T100983354D2249EB8F3BD8F72209EA8E7C7B2853C4014B4B7862E554139B9FDF8D265E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.4MB
- SHA256 ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- MD5 e400cd908b8fb7c13985e2f5cc7a7044
- SHA1 bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA512 e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP 24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
- TLSH T19F96A42F7B48037706C64262AB8BA5CAF21F903F3B561654344CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score4/10 -
- Target d3dcompiler_47.dll
- Size 3.9MB
- SHA256 35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7
- MD5 3b4647bcb9feb591c2c05d1a606ed988
- SHA1 b42c59f96fb069fd49009dfd94550a7764e6c97c
- SHA512 00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50
- SSDEEP 49152:OS7PQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ir:O4PhqqFVUsLQl6FqVCLTzHxJIMd
- TLSH T131169E31FA41807AD8EA05F0666E776E943C9B341B3444C75290ADA9ECB01D37F3EE96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target resources/resources/dist/launch.exe
- Size 14.9MB
- SHA256 e18215c1b7f148a6ab65c4570cea8e9610eae44f2a76e7a236729c10bf4021e9
- MD5 01af072d0715a9a6c71ea540117b8eb8
- SHA1 16a70c33715c5da0cbf5d3835f34eeb57340e23b
- SHA512 b08333a0095e0710546afc4ce647b45bbdbd3c47738e35e968b84c37bf29d90bd01a220988cf949050fb31b722d590b913502132da6a193950823bb28ea00ada
- SSDEEP 393216:IurbUouVlj87dr9aCOwW+eGQJIMTozGxu8C0ibfm+TsgjlF:IurbMVl8ZrsCOwW+e5J5oztZ0wTHJ
- TLSH T114F6335013B80DBAF6BA4A348064CA17F761FC315391DABB27D887573FA32469E7D284
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
- Target resources/resources/format/FormatService.ps1
- Size 21KB
- SHA256 c14276a8fc1f1f0925d506933a07ee271c2d1cb20675de41d5d911503cee42ea
- MD5 d7c5116f387c45c7816df320ed5b2404
- SHA1 34862064962682491370de9aa35679e87e200547
- SHA512 722f547a7f83884192bd8da3a3fb4f2b9b3a4cff49a9cdfc1e4da5bf091aad26d8794d39440636d16dacea4eb9070a96e4bc23083882b91be64492475cb25f69
- SSDEEP 384:/qkOiFXlSd80qfs8LFnieEB/AMyhyI7Fvb1mP/atDtotgDswcIr64tq:CkOqXlSd80qfLRniew/AhA8vpmP/atDc
- TLSH T146A2ED247186F26931372B7BCDC7105EEEA1007F42D126647AAD91DC2F758268B26ECF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target typeUp.exe
- Size 133.9MB
- SHA256 f4af4564b378bb9425791d47a71263f3740594baa936f62fda8629e676ed20f2
- MD5 54db05f0563022825cc1c582a1a2d3e5
- SHA1 f1edb3152d8d07a0e141e920701cae027a516dac
- SHA512 0010bf0f6daabfbf9d7687dc70d52d811f79086cc55909e257d38b7b8cc172eff5fcb799d878b4b184ffbe170dae2561897d89cd7c8060f72e20eaf5bc55cf44
- SSDEEP 1572864:m/HDqMfZzmlKtqLnjJ/fNV7SLsmiqbemSF+F25RqfbTunqji8J1KHPEpGEAUAR9J:rsP8+iUs95fNObOUlqAMbP
- TLSH T15568AE41A46164B9D88731B2353DB73E5D31461387398ECBAA8C7CC46FBD5E2223A74B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target vk_swiftshader.dll
- Size 4.3MB
- SHA256 71f7b84cdd5b318f8b545c667a0b18d892ed60f97dcca4f36adcc328f4e4d0dd
- MD5 bc3655e759f3845ef4640ab9228c6551
- SHA1 429ea875746876014b1f9d0100368ffd741e846c
- SHA512 07a65040e32f7455a02abf8a62413d572b255437fb7c68c7308c9ab5f0d214d736d6185a32cd0378687a88e090510110dde269bc301f7a85656c3bd472f752ca
- SSDEEP 98304:P9uaF4J1rfg+RCjb4ECOz4XWl8xj2mrpd47VkO8Ykh9e6k:P9uSG1ysg8xj2mrpd4yRk
- TLSH T153268D41B211A075E44B30B53A19BF35AE70873067924BC7DA586DEC6EB41E2A63F34F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target vulkan-1.dll
- Size 796KB
- SHA256 12718132a724256642d3a507b912cd9dc79dd595b2839a2f223983a4ac44ed15
- MD5 b8279bbdd84b052b435036f8a060ca36
- SHA1 9723aa432c931650b6a365fdfd7f5d37964787e9
- SHA512 fcee5cc71eb4a2e94525ae3fe670eb2cd795f211231c725e03946f883140624287b074e8dd2e439533105c48abf974cf4844e4306d1c5d6455432234a60612b5
- SSDEEP 24576:99sbXeJ1RFYUEQmP/WVpx6Z5WoDYsHs6g3P0zAk7uH:9tROUTmP/Wh6Z5WoDYsHs6g3P0zAk7q
- TLSH T140058D16B7CCC4B4C51F3031BD61B2F60676956163A448CB17ACBFA9EBA02C12B7D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.4MB
- SHA256 ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- MD5 e400cd908b8fb7c13985e2f5cc7a7044
- SHA1 bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA512 e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP 24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
- TLSH T19F96A42F7B48037706C64262AB8BA5CAF21F903F3B561654344CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score4/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target resources/resources/dist/launch.exe
- Size 14.9MB
- SHA256 e18215c1b7f148a6ab65c4570cea8e9610eae44f2a76e7a236729c10bf4021e9
- MD5 01af072d0715a9a6c71ea540117b8eb8
- SHA1 16a70c33715c5da0cbf5d3835f34eeb57340e23b
- SHA512 b08333a0095e0710546afc4ce647b45bbdbd3c47738e35e968b84c37bf29d90bd01a220988cf949050fb31b722d590b913502132da6a193950823bb28ea00ada
- SSDEEP 393216:IurbUouVlj87dr9aCOwW+eGQJIMTozGxu8C0ibfm+TsgjlF:IurbMVl8ZrsCOwW+e5J5oztZ0wTHJ
- TLSH T114F6335013B80DBAF6BA4A348064CA17F761FC315391DABB27D887573FA32469E7D284
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
- Target resources/resources/format/FormatService.ps1
- Size 21KB
- SHA256 c14276a8fc1f1f0925d506933a07ee271c2d1cb20675de41d5d911503cee42ea
- MD5 d7c5116f387c45c7816df320ed5b2404
- SHA1 34862064962682491370de9aa35679e87e200547
- SHA512 722f547a7f83884192bd8da3a3fb4f2b9b3a4cff49a9cdfc1e4da5bf091aad26d8794d39440636d16dacea4eb9070a96e4bc23083882b91be64492475cb25f69
- SSDEEP 384:/qkOiFXlSd80qfs8LFnieEB/AMyhyI7Fvb1mP/atDtotgDswcIr64tq:CkOqXlSd80qfLRniew/AhA8vpmP/atDc
- TLSH T146A2ED247186F26931372B7BCDC7105EEEA1007F42D126647AAD91DC2F758268B26ECF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10