7c5dbf26d47f5e9dcc27cc675ca5b3d91a292b1a1ddfb26ace7ba1fcf8769ea0

Sharing

Copy URL Twitter E-mail

General

Target
Discord Badge Manager Setup 3.0.0.exe
Size 98.3MB
Sample260620-j9sqcafs2s
SHA256 7c5dbf26d47f5e9dcc27cc675ca5b3d91a292b1a1ddfb26ace7ba1fcf8769ea0
MD5 ff606ce672bca20e7001b412f78e66c3
SHA1 87e2c6a047d06e340963f8bae99acb7109a44a06
SHA512 ec58ecc9019d381500e13013eeda7aee663d48f2ecca96713687b1b457c00d7a69cf101f3010767093d2afc95935458bbe7c249455a84a745e43cad2a8742022
SSDEEP 3145728:1BXL5ih0qOgmQS+0T9HhhgYQYbgIVNUK3PX:b5w08AZN51l
TLSH
T1693833E4A698449FF74C2BB344C5863F117D5FCA0B6C025BE26479E26EE2F94432D923
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Discord Badge Manager Setup 3.0.0.exe
- Size 98.3MB
- SHA256 7c5dbf26d47f5e9dcc27cc675ca5b3d91a292b1a1ddfb26ace7ba1fcf8769ea0
- MD5 ff606ce672bca20e7001b412f78e66c3
- SHA1 87e2c6a047d06e340963f8bae99acb7109a44a06
- SHA512 ec58ecc9019d381500e13013eeda7aee663d48f2ecca96713687b1b457c00d7a69cf101f3010767093d2afc95935458bbe7c249455a84a745e43cad2a8742022
- SSDEEP 3145728:1BXL5ih0qOgmQS+0T9HhhgYQYbgIVNUK3PX:b5w08AZN51l
- TLSH
  T1693833E4A698449FF74C2BB344C5863F117D5FCA0B6C025BE26479E26EE2F94432D923
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Discord Badge Manager.exe
- Size 220.8MB
- SHA256 d0baa5fd1c40757101f8b7ad745af06f7d413013269580d0683114eec22c8ffc
- MD5 6a603a0b7864b471bedb3b88b341bb09
- SHA1 09344c08b317f5cb87a445bb85fa3e69f9855ca2
- SHA512 4ff4ca0237668d2ecfddb77a8e1dcf521a9cc67a45275c76ac25e9d6ccbe7c85c5bdef859c761e241accb820ca4056f3a72d7452d937a44ce6b021ecf30a925f
- SSDEEP 1572864:XVjgSYwyLxU6sOtg7u3Vu6lNy2FAHDYU5/KdwQZaDKH9WK6BLd78XKSw9N360ari:1wLxT3NnzoOkIb2
- TLSH
  T15AB88C03F29A41D9C06DD1798B5B9633FE71B8454B24A3DF2B5407922F66EE82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral11
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 5be4721b8153a392428759f160fd282f28c6f1d81c541ba8db78cef04a04315b
- MD5 a9671f23c5bab92d4150767390d5997b
- SHA1 7c2054d03172adc46cb74d3f57f77af3d67059c5
- SHA512 4ea69bce8ba58b476494494d334076b38fd261df7402e1b6eb835f28ddeabe6d83ae44fe1f69e277826563902ca34965888cb937da1b50eed89b332f893507a8
- SSDEEP 196608:pKkG+l2tvb3nmgD131GYN7aPtAH+R4gQiUiV1gFould/5lmO0r:p5G+lkvb3nV1GYIP+H1gQoV1Ioul3ll
- TLSH
  T1C8473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 fa5256dfdf155074121921c28e1e3a4dddfa25bfce837b117a1b95b3f3c33b91
- MD5 ed4eaf5aecc0675e7df9f295d9c6ec91
- SHA1 3d2a3cd3c6721d88ec67d28f19eba5043ca247a3
- SHA512 8df818dd3b15735f810bd818d07947434b229a29d214c0b6bd717d9da27f6db107d959e66b533c02168c73919d976ef2d4260c8a2a06bd1d19eedd5ee0c3a9b8
- SSDEEP 49152:rkg42lel5GuCT7w5LHBXz81IQbx6i1N2SByUSo8hqaLujbLDQdQcLNZ:rWlEuSwRHB/aaLujPm
- TLSH
  T15BE59E02F6D251EDD029C03497ABE213F271780A4F205AEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libEGL.dll
- Size 467KB
- SHA256 95a80c09f9901d7a0389f9da16861c9b8b133f25a4bb9c986c5c3090b65622e6
- MD5 6dd8d003375105b1842df86297fa4a34
- SHA1 2f8da9397b2d4813fde60bccee1c742c9019a1df
- SHA512 765479ae9ab882760580b2b4c4114db63dd2d204cd09e33551bd284531d195a5f60acf49363634026b2c21af2d319c05dfe44f89f9ecfe22fa24ae664c5b0b93
- SSDEEP 12288:m6/vCrog5QZ9yJNe8DcQir3YB9ANZMBg:m6/vCrovjLA94Mm
- TLSH
  T188A48D15B3E948A9E07BC1388A538643EB75B4520B61F6DF02A0D2793F77BE45A7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 bdd409acd8ba96317f030cc2be592bd19694e30000a231bff712d3aeb046be09
- MD5 3c9df54a4f2594dafc757dedc3b232ca
- SHA1 2ff52a1399e611b8436c1eea12a63d53f6e86385
- SHA512 5510c3454b319d74060722dad5c1b5d22ccfd8adda169d4e4759bbf9863f3560b42f61cbb2f8d9aec95a8ebfbe0c21498e9ab06100c8179748ef3b69541e0b12
- SSDEEP 49152:IEIaAhXNJzKBnPVnCxQOT2aJcuykV3XF5s9ZTwGULj4zCfvMqYGI64njszMC1Hsg:cHhXECBr/naNY2ZBi3bumoq4hY
- TLSH
  T1D6866C03F69681D9C05DE2B88757A223FA34B8450724B6CF2BA457152F6ABF0EB3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/app.asar.unpacked/node_modules/rcedit/bin/rcedit-x64.exe
- Size 1.3MB
- SHA256 b8dda19cd775798beeca7b4bf6fe2d27580d38d7d8c833ea173f7a1ba529d9cb
- MD5 78a23bc6548f7c06051864c8ebfabc59
- SHA1 e33bf8eabdeecae85a5667aeb468e0897b110341
- SHA512 4f481b7fecd47d253386da3af093e466be0a787d092edc358d1c3d727a4ac814c9a4aee856931b6823b3bef97e92054645d27bab4d4af9cc6ab555f3383c7e47
- SSDEEP 24576:3EyXNImAx9NyoFP0gP/4C2bO1qIQP/JPlfg/OXnE:3EydbMyuqIQbfMO0
- TLSH
  T15F555A25779881E5D17BE23DC9878B8DDAB1740647319BCF159C42AE2F23AE41D3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/rcedit/bin/rcedit.exe
- Size 933KB
- SHA256 a4ccc63aa48137a1c05e9069c8f744103cb907593eb8f902d873bfceb19089eb
- MD5 3213f5a9b6945ab5ccf86719c95fd826
- SHA1 51bd273e3d5d5c2b0c466665f254630481bd0d0d
- SHA512 ab67129b13626c9b7848f9421ee7a8f71fb335b709ce6d099a88fd9804188365bab5d2286f3c2daab009763fa6dab23135cf3d000b0453a86afd50200920b206
- SSDEEP 12288:raKwwMP7EpEzsXMQmgEySArWgH7irNxkDzfRF3sriU8ivsAQm5:raKTk7EpEzsHfBDzzsrj8esAQ
- TLSH
  T133158C2139C19572EDE220F647FCB926115DE4700B354ACF62C847EEDA206D26F36EA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/rcedit/lib/rcedit.js
- Size 1KB
- SHA256 6016ac90a9ade1085d5045f5b04acba6e75f16352a407989ca18f2e60054d1ff
- MD5 4d1c65dbc787732a4849a321d19d155f
- SHA1 626b7b677082f86e5059c2caf1201e23f41a175b
- SHA512 1111dd81544b757c6eeb7caa0d338804a2dc0073c30bbcc5a75838c17a3419758b21caf2fd3ccf42a67c4041edd9841f83727010cc1fba5d8a159ff650125e1c
- TLSH
  T13021B10755B0167D07B71EE7856F29217375C043B11988F4BA8C43A19B9293B8EF7EA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 b9605f10cd7da15812f5bd42b33afc79c30b49face83b265a9d340eb58b81c2a
- MD5 08c0cccc3728c2e1206811d4cb81d17e
- SHA1 e155ffb5c9f576ebe79d1aad7a95f92a86b45b5d
- SHA512 399a3ed1f9e28b69c9036bf9535ab56c528b18e194409b55381d26548b4f7c6bd8241fbc883ae751e622584151450a48b3f82b560634144a34566a52ac718ebf
- SSDEEP 49152:vvMQibTIlI/EyGhcIDlpcSJ13DFDUgcD2Qn9agdGgkkDCqBK2WgPM+2HryKAoxw:vvMQCkgUrr+2yso8FX1+
- TLSH
  T178464903F68681D9C06DD6798B5FA623F672F8800B2276DF56A00F192E65FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  vulkan-1.dll
- Size 904KB
- SHA256 502d871769ce2c51fd619e46a4c14d4598b468b71b84d93ab978b6415fad9f8b
- MD5 cff3c096a93fe906aabf2f870d2c1e11
- SHA1 fcea278983ec8b25a7149d0fed1cf70fd2de2f05
- SHA512 0cd7cb901a6f131a08b9b95369fef0a5fd43a84e5bba2217ff55c0e2b1c30aa85415dfdf62d0e4c3e552c7d4d23e87b9767caefd03cf1f697e1d2e6490943560
- SSDEEP 24576:wGq7F7pknIiAXUMKzUjvg6Z5WzcxDYsHkDE6g3P0zAk76oOH0Yb:DGF9kIiZAjvg6Z5WzcxDYsHkDE6g3P04
- TLSH
  T1D2157D23DA548B69D67AC074D8D18A0789F074851322BACF07B817147F6AFF42B7DB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32