940939c3d277b7883af523dcb659d7bafa684f523eb844d59905201022532d8c

Sharing

Copy URL Twitter E-mail

General

Target
9xbuddy-3.4.3-x64.exe
Size 121.1MB
Sample260620-blq8lsdy7s
SHA256 940939c3d277b7883af523dcb659d7bafa684f523eb844d59905201022532d8c
MD5 9a6d798ee34245fdb96f532bfb490ac0
SHA1 5abfc4f46143b9c7359043847913642a1e96c904
SHA512 787f0558b91d7f3fb7f146bca6ecff060dfd9cc7a7589ebf4aa0c7f1b946e9e65109ea5eaeaf60f75242e8e66e66d4d0de65761a3fd86c90175f82fa4186d41e
SSDEEP 3145728:J/5qfkwbpmO8od5ClgGPVrpjDvNfGd0i7S6fJ7IeTD:3qfkwbpUoHfkVdjDvNMfNImD
TLSH
T12758334E82A1C11DC8EEC3BBCAF1F02E6DACF3E270ED497C765A1605A49D975270581E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  9xbuddy-3.4.3-x64.exe
- Size 121.1MB
- SHA256 940939c3d277b7883af523dcb659d7bafa684f523eb844d59905201022532d8c
- MD5 9a6d798ee34245fdb96f532bfb490ac0
- SHA1 5abfc4f46143b9c7359043847913642a1e96c904
- SHA512 787f0558b91d7f3fb7f146bca6ecff060dfd9cc7a7589ebf4aa0c7f1b946e9e65109ea5eaeaf60f75242e8e66e66d4d0de65761a3fd86c90175f82fa4186d41e
- SSDEEP 3145728:J/5qfkwbpmO8od5ClgGPVrpjDvNfGd0i7S6fJ7IeTD:3qfkwbpUoHfkVdjDvNMfNImD
- TLSH
  T12758334E82A1C11DC8EEC3BBCAF1F02E6DACF3E270ED497C765A1605A49D975270581E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  9xbuddy.exe
- Size 212.5MB
- SHA256 586bca24b56c1c94be7d8269b36e94a555b8984e05bfc6606c58835a20324832
- MD5 d1a175c5fac7a8463642b64e8a3769f6
- SHA1 1060be440cdddb8164e740c32e9d59e8cd994196
- SHA512 da4b06b7fa8aadfe9d0d8d05c3bd367ecdd1a79bb80c8d8f276d8f7a176aa78e5fa596abb1af922609da95acbd9f89d5f1a97860658ed51140d10fd5a609db05
- SSDEEP 1572864:LYOueq/jLLjV4Z1A3IddZPFR7oFoTBY1UIxCsGimyApMMPsTEVtccEAzdFkAEcBP:yjIoF4dJlzR
- TLSH
  T192B88B03E29A41D9C05DD1755B5AA233FEB1B8054B24B2DF2BA447522F76EF82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
- MD5 722c2b2dbeee143a14c7ba04edf8e3f7
- SHA1 88321c5c15ed00c72570b28e8183b2440bbf6419
- SHA512 0537a881c397d0bb0836ff74a881d650d59fc151f0e4ccb1c4f5a9fe84549dc9753b886b3e14534c551c167ff702fae71b58fe4fe90c78b43ef05a4cb2761855
- TLSH
  T11C115CCF4B4A2678E3F2B7C1EE21E94E046442E47A5A0824C0CC1DC139AB15A78C6DB6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
- Size 3KB
- SHA256 dd195036c9b7e7fb420c7e9ee118b33a9be9a5e61266f66663cf7f14b9844257
- MD5 99d9da809fabafaa59d59bb7cdffd744
- SHA1 0f90eddd4b143c59cd9bd5c5b89468ddbd8b2431
- SHA512 4e1961e1621e0d04be14c9c32c60d7825063f64b59fe4f747ebdfc4f76319c59e1e1e1c20e1b957a790f83f37c389212b4aea458da7b450bd64abe67b2a95f58
- TLSH
  T17B8161F76789067D24C70029A12D61CABA23C32F8B7478484089566C0530AE45FBACFF
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution antivm
- Executes dropped EXE
behavioral14 behavioral15 behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/database.js
- Size 4KB
- SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
- MD5 952ebcfa3d8727e8b1d7b681c9f5bf32
- SHA1 6168b5f5ed77669b3c6c1f1d526f0eb116bd3a43
- SHA512 d2dc310d2e4a491903988ed88228d35e9688e48c9b6180c797fb58f84d1105724ab3933ade92be0e73c8a27fb6f3064449bfe00cfa1dc92919ad53a81af2680e
- SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrtRxtjFvcLd3s03M:ac1ZFjQBG1oQZi9qSvNRBkLveomRz
- TLSH
  T1EA818388DBF5611247EB30D4A674A48D6234D27971AD08E0D8CBC3F531E60C9BBE3B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
- MD5 26660b3078523a953ee252b4e86e1c8b
- SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
- SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
- TLSH
  T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
- MD5 25fdd950809b2b22d0ba6917fe014c35
- SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
- SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
- TLSH
  T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/backup.js
- Size 2KB
- SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
- MD5 69638dc10c19961a0c05350ae333d6a4
- SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
- SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
- TLSH
  T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/function.js
- Size 1KB
- SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
- MD5 1036ce624efbb9fbbb387fec25fd1bcb
- SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
- SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
- TLSH
  T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/inspect.js
- Size 174B
- SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
- MD5 21784edff107eaec0e9ef7e66e83552b
- SHA1 6b59caa4cc8a568a8ed3f184a075d66c68f17d08
- SHA512 9bf6d36dbc01dbad11d5d01c0b662620bf6c0cebd85c0065882e8ec57e3304bc4d301add25bf57ea425a270f3ace6a44fcb958dcc8bf993f411eb81a5369adfa
- TLSH
  T125C0800973F1B465554F30D5955FD00451E5F0242CC450420D1DC684CD708697F3790F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/pragma.js
- Size 536B
- SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
- MD5 9354074a096ee1cf58905ca8dabfd60c
- SHA1 63e6c02339c45c252ae3bb24267610a636117eb6
- SHA512 32bdf8866d1c4e3db8a2ca65df2c1bd0d33c064d4cc526e264587cbf9c09ba7b97c8adc430a9dc019d9863e0e90b4318442ffb5cd08e0de52cdd4f081b5150b5
- TLSH
  T155F0C91602F245530BFF14C094E5F534F4B7C668B50E94F0D99E83FE41808DAEA83E95
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/serialize.js
- Size 625B
- SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
- MD5 41cfeffe67a2975f68aeeaaed0bf384c
- SHA1 321f3f817bc095c34b76d060d706ed2cc48f204d
- SHA512 8a0ad9732b5a07866eee742b2e884e521111f213af9ae39ebd92fa029d88f087c43f8826672d1fac5c571d14b284f20ae25e12aa4058a7881d6fd5e93c0b0a0c
- TLSH
  T1F5F0783A3365564B0997A0C050E1B429E9B5D324312D68A0E989C3F511D48CEEAF7B9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32