e4002f1d34937cf82adc2b717df8012e9107651236827c1534a075edd61674a2

Sharing

Copy URL Twitter E-mail

General

Target
Installer (1).zip
Size 30.0MB
Sample260608-vec7ysds3n
SHA256 e4002f1d34937cf82adc2b717df8012e9107651236827c1534a075edd61674a2
MD5 212449c92e02050ec9c34df58850f196
SHA1 8b2d432c9e00de860f50d746fee203257553db1a
SHA512 3cc59a174dd5459267dfd2502934607f3bd9efe80b81057d67979f6a270ba4a2531f960c1a15322a05f287ee484fa71b9b1e64547f85cc262ad497b149de109c
SSDEEP 786432:MBMtQg6MzBNwcwfgknU9RTqQExeX18QT2O77y/SZ4e:6cPmgkU9cWX1RaOPy/SKe
TLSH
T1F06733DA754944F7F94ED02A07681DFB07B258C36EC2764BD18E3A6CCC499422798EBC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Installer/Installer.exe
- Size 3.1MB
- SHA256 96441ea144d5abcef928718595c1a8eb951003e92d86b143a23f9a0a26301ec2
- MD5 cddd4444c5c5edb82c189ae676c75db6
- SHA1 a703b603259e6c04bc4f3893d83736ecb8ad07fb
- SHA512 408fbf611cc4e06248fb987ec903fa7a3aeb65726c46487a013bc6d4860665605d67e6d5c70527c53cc704abdedaedbde7425e407356b929a019191b861d4fba
- SSDEEP 49152:6NHtmKoLRTdO63aWJw1uQaDwyxRe72qsifnQ0i:62hgbwZQI
- TLSH
  T19EE56C427CD445FED068733188F27196BE61B8080F3667D32F626AA82FB67D14C3A765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Installer/act/OneCoreUAPCommonProxyStub.dll
- Size 7.9MB
- SHA256 c9362fb3ccfb865da7194ac989dfade277e44d7049230b4148581efc687c99ff
- MD5 dc70e2fa1684815f82fb2fd5acf258ad
- SHA1 53bed8ab4e38f6fbfd4e05fd86cda9eec77378f7
- SHA512 34f643ff66322073b1e0d669137d5e6c7ead648baf7cbedba6c361fea4f6d852821b284de41b18a011c85f67f882ea949ad18af8627f16d136eff42225766928
- SSDEEP 24576:aIQbD1BNlg7CTHBTCj05vorkPHN00Kgc33DeyvQL0Ff:YbD1BNwCTHBTCo5Q4PHS0/c3HO0Ff
- TLSH
  T1AA86618FBA4548A7C43FA33185AF0E6CDBB65D10A2E1835A409471248E7B3CDBF356D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Installer/act/Serilg.dll
- Size 125KB
- SHA256 db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
- MD5 181f3e3d0c509566283156816eb317ca
- SHA1 400debdd4fb9ae24719157132a87c4bfeff7fa6c
- SHA512 039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
- SSDEEP 3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
- TLSH
  T18EC34C2863FC9EA1CBEE75B5A0B081810B74FC9F6077EF8E695C25F91D123094A60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Installer/act/SystemEx.dll
- Size 23KB
- SHA256 a78c4d08c6726e1e560c3a47436c631847423cab95032d02ccd4e10f92e6d937
- MD5 fba0fc7ec66d149d2096ab7032f751c5
- SHA1 e2d9f46a045235548ae4d648de1d317b71531b5a
- SHA512 124966ca2827b1d11d8e49dada8e5a708047e6819fac6031d5f83150dcbad0b2935bb630304e4589845b22ce22665796c9987bd343668345875143b44f80d342
- SSDEEP 384:TZucmhNHUrP0p/gN9ro7zjLIYiVTAM+o/8E9VF0NyJWQI:8LN0IgLE7X0YipAMxkELI
- TLSH
  T117B26E0A9F489803CA5F5A7070D5532AC230F69A6BC2D7E7369CC1359F4338639E63E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Installer/act/bin/shellext.dll.mui
- Size 3KB
- SHA256 965d0e8e10aa6b54143ee53fdddab4d741c6d98d25d98178b952ce59525fc38f
- MD5 efc6c0bdcfcc4855ffaa417c21dd974c
- SHA1 09ba48ecfb36e41e5c6cd15a26f2107b5a306e4e
- SHA512 2a69e0bf20ab668397a6d1bdeb4dff03156360eff00dec42b898e03174509de8ac05adc384db129a17e05d6d3f84b4fa82fc93331b37dce83ffd8527138c6456
- TLSH
  T1AC71A10F9BBB4117F0A65B304BE745C227BD7E137392A56FCF0A142924641386A90FF2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5
- Target
  Installer/act/extensions/MsMpRes.dll.mui
- Size 9KB
- SHA256 7dc00f580512cdc58fe0625234760a3564edcd5ceb27871c885aa76b901f843f
- MD5 08ea6ca706a9450d3ada3409623c17f2
- SHA1 12cb203016805c1e447e6230adfaab5208f1e91e
- SHA512 93a23c2822aac18ceb4c41b611ee8672921d3c732f31de8a3737c91bb023afe44363b2733a732c2c7cd77fe6abb654b17d53709fb882d738280c7a74999e0175
- SSDEEP 96:bRLh6zFE378xxYWYFYDYi2YqIUTY+McKBu7mfa7H67mfa7HK64ftlZSOcBz9WPEw:JIzFK78cd28sT8K6mMUmMRgAxWxBVt
- TLSH
  T15D126A4F96FE4151F4B6E6301F7304E20A7A7A41A378968E838FBC5D34646346B21BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Installer/act/extensions/OfflineScannerShell.exe.mui
- Size 8KB
- SHA256 bd9d30abf6636560a421a2e310c56d2052a8336d2db89a85d411ab563c25a751
- MD5 4e64213c8a3679498e8c04abab65eb20
- SHA1 83de413d03c2ba285a03bef445272e564ed87050
- SHA512 423a62133d801b19001da5a1be728203f14b0701bf3e87a62972a89595e8e47af9f0de5610e84fde2e57d80d13dd20afd86ecc36eb7f79cb65d9e80f32b22c78
- SSDEEP 96:xIxJttaQESpy99V9KzEcEKLqs0xAgig9p9EjGdVUIu9Wd349bfr:xIxJfaRDAzzLgige+KWNUfr
- TLSH
  T1F2F1AC0FA7FE8114F4F69B300AB24AD21679BE517B34C28D868F782C5474631BB257A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Installer/act/extensions/ProtectionManagement.dll.mui
- Size 38KB
- SHA256 0d7e9308bbeec72ffa091019d75c831be7ed9c9ec9b19273b7720ad15f7f3540
- MD5 8833d843787b0a0e68aa736eb930c403
- SHA1 ed89e93cfaf9886b0d3f00c76aa88b22ab1f767b
- SHA512 2a709586a1182e0cad075fba3afb29703546a749cf79e6f063a006f8414b9616afe6ca3b1e02ceccc877803bbb3ad7c3841432d4b42ac7eb0540c0ced0052237
- SSDEEP 384:nRQCYKhcqGFzkg8uTjDP+T6kUHuQhgg9auYk7AY54X74yX31899iWdK:nyNjDmT6kUHuyx7N074YkZK
- TLSH
  T17203404FBAFC9564FAA5D2700F7348D7142ABB402325D6CA968F7C69202CA3177243E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Installer/act/extensions/sfcdix.dll
- Size 10.0MB
- SHA256 7abc2b2b8544cd3aa9cd03e0f19fa1447c6636c3712ae4cfc5e02db3105b520e
- MD5 9eddcdce6dfe6812b282616a7de33699
- SHA1 4b30e7882dfd2643c639d6f74035a22cd28d6471
- SHA512 02ffb8a17b27754f1cbd06a814a6cd377ecec25392e08a2ec72bb6c679e922ff232d240d858ff2ff319e7f52787af5d919ab0f26cd26d2844033e2bcc5a4edfc
- SSDEEP 49152:Ml7PcvfsbYs9lYyaieo78r4y6OVof5p4F92I2q2q2q2U2d2E25Y32j:V+Xazo7U6OVI5pkL
- TLSH
  T1BBB6A30572E8C247FEB27A3059B752BD492E7CD19A35C39E12437BCD9F31A908963722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Installer/act/lib/EppManifest.dll.mui
- Size 3KB
- SHA256 7e1ebbefca708f911b9ec83a7a5b5e0d4137950a2ead5eaa8040e91a4395dc6d
- MD5 5fd4c80b53fa105d4ab070b6ab32278c
- SHA1 21eeb2f26a52e84eaaa4a6af9fd5b7051991628d
- SHA512 5deb775c514eaa1988e2d73bcfb8ad4ecdb40d20bd9eb956f73073b5df5fab27d545b6917f2663a50fd737df1acb11fdeb88f5f3c201967ba473c74ca646cde2
- TLSH
  T19F51390A9BB74117F0AA4B318BE745D62BFD7D137692A16FCF05201824A41295AE0FF3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10
- Target
  Installer/act/lib/MpAsDesc.dll.mui
- Size 57KB
- SHA256 5ce03545cd628d5b3b2756690449a4895b38233db328c42b7c590d410acd058b
- MD5 ebf57b30f3ebf0a190e52d23d404eb9d
- SHA1 803f3875e5ce9de8ff0129956a4e1693f8063bfa
- SHA512 0c42457780e32e9103bbe6cb2958e5cf5729aa2201d6e3015f0126baccd914264e95abf1f99542bbf38919d7fce2c25cfc54c641705f9743b262b61d2763caf8
- SSDEEP 384:Y3PMBRJYGHUp8wtVM8xrYXoHEPbl0af619kSG9yvJGNV8GzWE0:QbrOh0
- TLSH
  T18843F44FEABCE564F899F2720F6348E7106AB710271895CEA68F7C68602C63573356C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Installer/act/lib/MpEvMsg.dll.mui
- Size 47KB
- SHA256 337d7db6d5b025f7ef9cd4b3451f70e03367b9bcf2e5cd27f79112b56c881f93
- MD5 c897fcc7aa7076cd5811eaa0bec573c4
- SHA1 da6279b19c3ceefce26f1d28d09bfbda4e18a54d
- SHA512 3a246260a0a2e476efa805bd88472cc2b3338888e6533aada62ca08b1cf20df0ef60b74d73ce09913e4be8fcc9cbab6e94cb4d7d87264342d662f1c659b7dd00
- SSDEEP 192:FpDOkKFqqXbRFp/opQ+yARMFTw0Thx49laYZUBmynWeIxbNxXed2DB4iW+orDgFg:FpDtGbvhMhmMUBmKYDp0ra/rkfzkWc+
- TLSH
  T15F23AE0FA9BFD290E854D3711B6284E201297B9063B9D4C9978FFD7870985363B247EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Installer/act/local/DefenderCSP.dll
- Size 205KB
- SHA256 e9e08a225fd2b0e405fcdf941ab801a392c730b21a960012af5da583731e2586
- MD5 a9665cb49312498993a85d7f42e05f01
- SHA1 744d49cb7d4facdf796f7652f7ddca9a665258da
- SHA512 aabc8e0f3e0666d48ebba87ccacda5b90dae9e7fb6c08d56b21d5942b2dbc55012ba6c216d429d80e72ccf08e4a18e156277d46ac27cceee5e18f3256694fddd
- SSDEEP 3072:ce0Te+mTVxdl7Vk/BBs8H3iqNJgmDtT+kgJoS0MTU8ZVKTegU0s5nAqX:c9e+OVPEBBFBHF98Zt
- TLSH
  T168246D5A73A400B6E977C135C9538A06F6B3B4591B218BCF1364437EAF6F3E09939B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Installer/act/local/EppManifest.dll
- Size 716KB
- SHA256 00395278372faaa6d1218598edcf71c518a25fe1294444ba925d185340669f5e
- MD5 54abd7931a6492b29bbb3bb413b036bf
- SHA1 7e7bc93f3a993b6703ababb0514763008b0e393e
- SHA512 ae53fc7c8e619b8fcdbc3feaf663e4f3ee7c9dd33c22d3d56fa3426d8fba259ae5e0fe1d8b41cd1d92d7ab0227533aa086195ad4ac14a886225d41f3d045c3ce
- SSDEEP 3072:89QqQUH6HNaTx9F7qIIuwSJ5FSpw2phBB:ma
- TLSH
  T1EDF485656A88E333C8029738CC13A5F5562A3DC5DA18415BFD783E2EF73E9B024ED994
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Installer/act/mshtmI.dll
- Size 22.4MB
- SHA256 6b3eb32ff53bc3dc5e315ee9d427194ad33e41414fca50217e99e22f179b906d
- MD5 bf26ced3e757f560ef66151e475dd7d8
- SHA1 a4598bdca53710bc33550756ba494039cdefeda7
- SHA512 2b3c96784770b4beca0c080c076d3ec19cc1e73cd1b8cc0add36c8ed73826f8ee07e5ac5564a54083e76716ce5d3ea6f75ef2b95734a0ec5a80013640a0edcfc
- SSDEEP 393216:CoQwzklNkFNV9bUR53WGm2UQ87gDmPSsRNy:0wwsR
- TLSH
  T1DA377C1A66E88184C4B6E038D65B4A4BFAB17C21233157CF01B177795F337E66A3E7A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Installer/act/mstscax.dll
- Size 8.0MB
- SHA256 9430965c7c980faa356025e139f983624fa67565d4c5b2cc776f698117325b60
- MD5 96bd36ed3d5a04e8a9f44fd38b0bfa91
- SHA1 6ad76494cad227633b01f52ed5bae6e28e2acb1d
- SHA512 d2f4caf5a2c78c75ee267574775c996490b4f2c08e790075d6ab9e1dc07aa4e2f7153d4a8df6297f3928bf213b912de058606fe4b582ef400f1b40355e4ed09d
- SSDEEP 196608:frDIdWVp5K3s3V3w7t0K9TkHge7nnB1IhTKMa4JVl8tkxQDdRfKez2mW5iIAa2tG:frDIdWVp5K3Q3w7t0K9TkHge7nnB1IhH
- TLSH
  T1A1865C18A3FC2054D4BAD23886454A1AFEB17C1C3F739ADB4066812A7F77ED15A38F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral16
- Target
  Installer/act/ncuvid.dll
- Size 19.0MB
- SHA256 21ef8438a1f4b3f645edd20aec1989943d32d72f35ad9d983c548c5c71b480d3
- MD5 bb82a77952eace70b6de3267aa573a9e
- SHA1 ffca4b1fc6663af6b2c57fd06f769b56bde719b2
- SHA512 131d177fd56575e2e29c0e65a724798a4d91ce5bfddcac9ba162a46d3ef2cf7d339057879f38e99e880f53011932f539a6782ca1121b6f2ce03d8c5bfb62270e
- SSDEEP 98304:24KpWnNrEhBRGgyDcOEl/QCAWYGlKMifJs3asrbcg4m2oY:2snNYBnysl/Y+KMea2oY
- TLSH
  T1D417E9C9B496DA07C50A463C94EBDBF4EA39394306258BCB67C016FB3DA7BF65931021
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Installer/act/prm0019.dll
- Size 8.2MB
- SHA256 706b25874604f74f20f1edac93769a08589114ed87cacec8f2d7b2ca8ab32f67
- MD5 95e3c7c5af6b29749ef27d5f6d49c67a
- SHA1 51ec3dff0cccb502e4f2c278d284f094548bfae6
- SHA512 6b14d302f888cfa2d78567f89896dd1c5a82197ec804af6c8e86c659942bc9964e3f45f0cbabedc516ec215c49423a4c1db66bbfcb780656cf418334f67c4f0d
- SSDEEP 49152:zwDbIRcWGudJcDomboWWCsFA5O8WIjFsQt1/TL97hQjSHDP7iDHVEC5WHzeejZMM:zinfm3DvYYisVQBP
- TLSH
  T1AF9609CEABEB882BFE1D8C37A6C54F65B200B492C8E30D554168F660DD766DC44379B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Installer/act/windows.storage.dll
- Size 7.7MB
- SHA256 3aa0f13fe0b9a2bb98b1a9d0fdde3c2ca35ef04e35bf5a3c3545a7b7cf90e826
- MD5 671416db764d153463b7bb4e01910d3a
- SHA1 4412711364f3c3697595c1fa54356da7867458a0
- SHA512 a434ca292ea1083554f62a602469e8ef7ff2565167ab1517e27217ea9e9398ceb25fb5346eb3d9c39866e237180b1dcca96276d9d302acb6a43150b591af68f3
- SSDEEP 49152:6nQqxnPRrbN8fy/4RTum/LTw0gm1H6xlpudPn4ih1QMTa7FDFIThcs58LjOM9Zix:6nxPnAnr07IyVbXW/XK7FKjfZlH
- TLSH
  T1E3865B5E16FC01A4D2BAE23DC647424EF6B27835132297DF0121827E8F2BBE6593DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Installer/act/x64_x32/ProtectionManagement.dll
- Size 678KB
- SHA256 049f84d124f419f11f47a2e24dba15f289eed4587e426779c747329009a90222
- MD5 642ce7226b6376d01e89ac40f7805cdb
- SHA1 2590411155db3b365384607e3e86edd554321c7e
- SHA512 ac32e337b5cb536433ea00a0006e0ebfed57cdd1f9b918fd4494938b7c06e62e8fa56851ef6f658cdedc597f8ae160595a152fe156e26c2254a3989008faf8df
- SSDEEP 6144:tzU9gF+RtP1UjCPCXD099yNoPyvQccWnEeSi5T++vgCmrOz57ewij7w8Q0c6+6TG:BChsjssQcQeS4+LLyewijPc6+0bGY
- TLSH
  T18FE44C1AEBE84466D1A6927784A34A15E7B2B8191F21D7CF0264B32F5F1F3E44F79320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Installer/alternative/Fix.exe
- Size 3.1MB
- SHA256 ea9db4fee228003e1a837974a8c41ca591284cb1f54912d8344d055c713f93ed
- MD5 7621c23308859a2f62f9245b23e65e34
- SHA1 711b9c4050ce09b1f0d6575e61b3ba7ded0f2a36
- SHA512 ab9d68cb3657ba058a87abe6617fad44e3c8f3a52b48c31678cfcad607c09c2c9708500f8d7eba20f2395c902eb75f7d662edd55e9f12632b192d4d4c78ff513
- SSDEEP 49152:ttzkmFl+3hsM63eGrQfXXnBcUhBfzXypwOKRu97T5yu1mAMSsIvzRO3nC0:tRmbnBZ7zipD8Mou1sI2p
- TLSH
  T125E56C427C9109FEC159B33188B2719ABF74BC89073627D32FA16A782E72BD41D36716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral21

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Event Triggered Execution: Component Object Model Hijacking

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21