1b25d688b3611ee5e1461663532d43e4e235b868d00be621aaaa65dcda1a3925

Sharing

Copy URL Twitter E-mail

General

Target
MCServerHost-Launcher-1.0.11-x64.exe
Size 184.3MB
Sample260620-j5f6rae18w
SHA256 1b25d688b3611ee5e1461663532d43e4e235b868d00be621aaaa65dcda1a3925
MD5 b110c3c0cdc78f205e80a9310d3adc79
SHA1 05979513e07ed4eb4f81c7c5e8bf70987e0e9ad6
SHA512 808114a7328db0e04b4e2f2bcb36b0749c35a54765c86c591c4f60bf00f24b8bd33e2c741850d966def39f8737ebeecc7329d26a74558a9baa7dd6476f1834a3
SSDEEP 3145728:9HM9NNNvG0vbqoBRqpuycs7Lm4Y9Q3gl6QlNq1O18V6s+Xjq29FcmYfMyzLKe7zv:e9Nb3zjIUyVfaUpaNqtzScmYfMmz6C
TLSH
T1B59833F0AB46B673FF71CCF8BEC45D62ACE4978F719880738514D288BA5858DA4B42D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MCServerHost-Launcher-1.0.11-x64.exe
- Size 184.3MB
- SHA256 1b25d688b3611ee5e1461663532d43e4e235b868d00be621aaaa65dcda1a3925
- MD5 b110c3c0cdc78f205e80a9310d3adc79
- SHA1 05979513e07ed4eb4f81c7c5e8bf70987e0e9ad6
- SHA512 808114a7328db0e04b4e2f2bcb36b0749c35a54765c86c591c4f60bf00f24b8bd33e2c741850d966def39f8737ebeecc7329d26a74558a9baa7dd6476f1834a3
- SSDEEP 3145728:9HM9NNNvG0vbqoBRqpuycs7Lm4Y9Q3gl6QlNq1O18V6s+Xjq29FcmYfMyzLKe7zv:e9Nb3zjIUyVfaUpaNqtzScmYfMmz6C
- TLSH
  T1B59833F0AB46B673FF71CCF8BEC45D62ACE4978F719880738514D288BA5858DA4B42D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/assets/local-mods/mcshcontrol-1.20.jar
- Size 37KB
- SHA256 590bb788485c5c75ca7cf125c3bf622b45aecf17f099e5a2fee3c1486979d4d4
- MD5 5a7a1815614a30726e088536f13b0b5e
- SHA1 11436069f3ee74ef8bdd7a946a7701a03925ab6b
- SHA512 029c4af9c1c5fcb3acfc61ca31e0fe5accb19a62df414d1a8c06b96348b825681e90eea0741e6475ac4e7b2db8c7028dc0c9519c7de0b6705f55dea2fb4d16c9
- SSDEEP 768:fRd24i9zmbM1fRgXCYsJNFoThLX2X2m14FVMt9IN+zHFLeJgvmyHwE:1sp0sJUhyXf1Lt6gNreyH7
- TLSH
  T12303E1034974D59FCA2743377980F6E8A3B91A88ACCA404F26386F948851D6B7F635C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/assets/local-mods/mcshcontrol-1.21.jar
- Size 37KB
- SHA256 576723633fc06ab82441a24ec835d89168b3985cc4fafa498534c1dc695e62d7
- MD5 7fecbd26e315723a040dfa432637928e
- SHA1 c313255c25703df206dd867cf94582c768063127
- SHA512 c2638bc66bdf0ee36de5c21ee0691c8ddad14bbebaf2770fd4a9eca1ba53fb5829b08812942af49b1626a792e540eeaa15fa9bccd0f8a43889c1743108f59ebe
- SSDEEP 768:dRd24i9zmbM1fRgXCYsJNFoThLX2X2m14H7zC+9U:jsp0sJUhyXf1aG
- TLSH
  T15103F1024D74E1AFC643873A5AA4A3DC63994989BCE5801F7218BFC09884A0B7FD75DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/assets/local-mods/mcshcontrol-26.jar
- Size 80KB
- SHA256 2181478b9aaf867a43d36bfb64e8c7fb470509c7b9bb07cf637208e438034cd7
- MD5 585e66efd314da436454cfacc40fa560
- SHA1 465a1e2a8f2e43cc40aaf887730635eaf15f274f
- SHA512 8b0075912aca40709797f85aa3a807b94552eca9a24ee2799b43413229d5f3dfc9cf42a8bf7b20917f8609262bb250505bc3578c4e8936ef5fa13ee8ee8d741e
- SSDEEP 1536:pA+m6H1vhX1fVgPmWwxfKGTJNhoNgQO0Osp0sJUhyXf1BoE:d1vhBVguWKioNoTP0sJU0Xf1BoE
- TLSH
  T1D683E11265F8C1BBD737563AE708A543F199858CED8A113B30B83EC594F64222BE77A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/assets/local-mods/mcshcosmetics-1.21.jar
- Size 49KB
- SHA256 a454e84bde0be62ca05466c73dd486bedad2c4010042660d45a2d963c52583fe
- MD5 8fb6b1b203cf30ed0ea9bb9adb0fa1dd
- SHA1 8c9c58602b6a5f9197072311f9d04f4914ba3739
- SHA512 e0067da51fc2ed9c93bd1c421a04e8b7091c73990b9c85f5152c68211a1c2481ecb00729ecfbf146b5c30725e60a28deaaee36e42156748665479062bb0b807b
- SSDEEP 768:gn4zHlvsXZ0iCjU0sDuuUWT7uBsWLKji7EociWk7WC9u2XyhySb11lgIU2+:i4blvE7ChsqjsbOs+WiUnrlgIU2+
- TLSH
  T14C33BE1D7CC8E22DDD13F33485509AC1E1392A65451AA8BF7ABE032DD8A8D97039B7F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  resources/assets/local-mods/mcshcosmetics-26.jar
- Size 47KB
- SHA256 6eee20b8b02143cce704b9c65e4fd212bac34938e8b43b865026ec67adc3016c
- MD5 0363c1d4087aa6d95ba161466744a799
- SHA1 48ac03957626df2c98edb2fcfb04d35d22310e7c
- SHA512 50ca39c5cc60e34654eba7913b58745a8bea2736e33eead537caee9fd9095f7c595bd2b2fa27e2c1b482142d460c30505d2a58e214d54a7d3bbdd52d41bbcd1a
- SSDEEP 768:xN1cpGNukUg8G9c/IMppJ5KMllr7+MunDfvZgEmrdSwkVsDvHnfYbohoNSO:xN1YGu3c96Fp1KWDurv7mx7N/nfYbSO
- TLSH
  T15323C0197E8CE95AFE37F376D0A44DE1E43A066C582AD87F3C39072AC969D5036A5320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  resources/assets/local-mods/mcshmenu-1.21.jar
- Size 3.5MB
- SHA256 b7533819560dde4ba4871335940b6efc43bace675ddf62d5a0f17a57582970b2
- MD5 916ee76a7db56fc02ddd4312675289ce
- SHA1 51e55c7a328a332987add10a404f96c509a7b847
- SHA512 bf02bd4b067de6351506a1a59733295b03b4db50f41848de703750eaa9a20d63891841e3d35c295bdd56daeeb8da983a9a255e33d2f4f77603478ae3d1cb7ff5
- SSDEEP 98304:LP9LjVxYT1NMbY4rj/0Zg8aj71HtOcd8Mpjr:FhChNMnrwZnajRHkYzH
- TLSH
  T171063379B790793DCBBB75B0ABCB66207497D74EB6C8006B2268D304B297C0FA271574
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/assets/local-mods/mcshmenu-26.jar
- Size 3.5MB
- SHA256 4e6540c6c23a0319c2c7d86ddf4a79fd89b7ea781c3b8b02b824ed042948697d
- MD5 472e55caa075c96e33d635b65a5558f8
- SHA1 53d35b82157fda2a80385077922308b7ddfae86f
- SHA512 45ee2f7ca8fdd3adb15ae8243d6e7fea16ac2ffb9620ffaeb5ea87b89dbe326b5578ccb2c0217b75f6c459ca2207e6e96c5d25a731cb2f437b14ef622ea39813
- SSDEEP 98304:eP9LjVxYT1NMbY4rV/0Zg8aj71HtOcd8Mpjz:2hChNMnr+ZnajRHkYzf
- TLSH
  T180063375B7907A3ECBBB75B0A7CA252074A7D74EB6C8017722B8D305B297D0EA271170
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/assets/local-mods/mcshpin-1.20.jar
- Size 6KB
- SHA256 ea4bdebef582b064d3d5ec53063144babb62bad38fbcbebf82cbf81ce0d675dd
- MD5 ea8a1f06e4740cfed0e94e1f72dc6172
- SHA1 e48744f3bae9a2a6098f638f9a9c6c79d54f3ef2
- SHA512 ffe710fb6721019c3c965b767619275cd293d8ff91dda599490890e2ddc4d2aa4a86d8b85ab43a378f1c584487aaff2de6460996fb39b62893d4fe39362b351a
- SSDEEP 192:peOdLR7M2O08ER2Vrto88VTFLoZNFQA4M:peCW2dlR2Jd8VT1uR
- TLSH
  T1C8D14B396FC2821DDA234A3AD0D480C714B54719AB03952F2CE12EDF1ED5E870B169CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/assets/local-mods/mcshpin-1.21.jar
- Size 6KB
- SHA256 53489a86e3c2322f577b1d08dc17396216875c12927cf1edee066fd8a41eef43
- MD5 e1336a46331131602bb2649b4c651fd2
- SHA1 1df7bf2145dfde6196f93cb7023447a0a8fdc63e
- SHA512 03477a1b0e8a4901a0729c868af4284da3113bd1951f5ae91c15f46f9080ff2c87986fe000d4286d5b2bb70b54e2af0c5c6c7f53e01f9db4cac99364cdc61667
- SSDEEP 96:nImtWvXe98UNDkN8tN0jI5Q++JsXrVxM70dgp+hCh7bi73zdCkZFi9dMXnSAb970:n5W2M8aNCZxPgpiI67pfCejZNFQkDM
- TLSH
  T1E6D14B783BDCC51DC943423540D8D1D671822B4DA593E1AF28D83EAA49D5A870F0BDDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/assets/local-mods/mcshpin-26.jar
- Size 4KB
- SHA256 f353c6263a666d5bd7085ed0002c9f60a622271bbfaafe73dc56c2dc79e32632
- MD5 3fcf3e31575089f3082024bbafe79b6e
- SHA1 ffe1061374a32e5291d9a6a81a773ed516a8e119
- SHA512 45cd931de294b584891064cad6cefe7c58f861e24628f3eac3f93bd25e6d6fdb28ebf2a9133d9efb35cc2874b84de7f7b7e6815ea80ef543817575430174df32
- SSDEEP 96:4VEx5ePcIjD79+9IvhQX+W2tvWGYiw/VF9+wp5X05U5/vnQHY6rF:W6IjD79+9cQXL2tvg9DbX0+QHlrF
- TLSH
  T141A1192623CA8126CA730F79C9E81447D32BA19DD766266B2CC03B734EA3DD40736394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32