d9d9bfe3f24565eed1e28cc3413fc68418de240779bfe940bbff7894b87b5faf

Sharing

Copy URL Twitter E-mail

General

Target
unMiner-3.3.1.exe
Size 90.9MB
Sample260620-mc2hrsfv9w
SHA256 d9d9bfe3f24565eed1e28cc3413fc68418de240779bfe940bbff7894b87b5faf
MD5 fa12f2f45fe104f46fa537c4a3104ab7
SHA1 dc52e160d42d67eaaf3e971e41b6ce05ac6fd566
SHA512 52c3dc4c09f7de753e63c63b6945cfe82ec6c47ee41b8ca7667b03e08d12d67e6801f1ba6b0f05f238ecfc57b0aee1292cfaa79b7bdd2a0d24a41b67fae12e2b
SSDEEP 1572864:+ueNZcfXXYJRQn273iZnWkyb81nFQlRbZXa7nt9zV7NDK2DEDbT8lkaoEe3GjjdW:+ueX20r+iMsbZX67pND7QfT8lkFH3iJW
TLSH
T125283357F694D536E129013C3151A8F7FC4CBBAE690929CB393592D27CFBC81F2A2168
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  unMiner-3.3.1.exe
- Size 90.9MB
- SHA256 d9d9bfe3f24565eed1e28cc3413fc68418de240779bfe940bbff7894b87b5faf
- MD5 fa12f2f45fe104f46fa537c4a3104ab7
- SHA1 dc52e160d42d67eaaf3e971e41b6ce05ac6fd566
- SHA512 52c3dc4c09f7de753e63c63b6945cfe82ec6c47ee41b8ca7667b03e08d12d67e6801f1ba6b0f05f238ecfc57b0aee1292cfaa79b7bdd2a0d24a41b67fae12e2b
- SSDEEP 1572864:+ueNZcfXXYJRQn273iZnWkyb81nFQlRbZXa7nt9zV7NDK2DEDbT8lkaoEe3GjjdW:+ueX20r+iMsbZX67pND7QfT8lkFH3iJW
- TLSH
  T125283357F694D536E129013C3151A8F7FC4CBBAE690929CB393592D27CFBC81F2A2168
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 90.4MB
- SHA256 23d14bdda32bdff5fa43def91fbf399b11bd01233fffc66937b83156e9df2cc4
- MD5 d78c98074bb49628d1b05f5367b792ae
- SHA1 c123db7823f9553db24c1f3141a4d797c271e18c
- SHA512 7e77eaf5afee7fa392fc27a125c0b3b199f841cd44d36d764a86008aa944ed05d5b92bcb814365e8218a90883c763d53ea415963dac7cef58ecc3093dd400928
- SSDEEP 1572864:5eNZcfXXYJRQn273iZnWkyb81nFQlRbZXa7nt9zV7NDK2DEDbT8lkaoEe3GjjdUc:5eX20r+iMsbZX67pND7QfT8lkFH3iJvV
- TLSH
  T1FF283397F654A5369528013C3111ACF7FC4CBBAE690968DB383692D27CFFC81F1A2568
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  LICENSES.chromium.html
- Size 18.6MB
- SHA256 c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65
- MD5 68bebb0e4b93ed694e4493608a77f457
- SHA1 da90f6238eb91d6369a45f075b7c31a26624f8f2
- SHA512 cf8bd94f45ed137e383ebde6ffadec046609cf8c18e17d5017031a7ae9b3105c1883ebff1ac31d3389301608416c729c42d82d027c1782da1d96318b82623d5c
- SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6I3r8xsJQf8xFTneQdt+lHx37DoB:Y
- TLSH
  T16C17B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  chrome_100_percent.pak
- Size 113KB
- SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
- MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
- SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
- SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
- SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
- TLSH
  T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  chrome_200_percent.pak
- Size 183KB
- SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
- MD5 e0d4001307e8e8554810b27796ad636f
- SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
- SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
- SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 d2ca3355a39c8a299562a9cd8b581d47f349a75fd1e61cd3fc120003e8bb7006
- MD5 0631850fe55b2d991d3ad5eedc61c85b
- SHA1 18eb16a70e801006c4a8dd061164be1581204e8e
- SHA512 ef81d54d6f7d259256d07773157d541de6f491a91e26fe0c509ff6f8264baf033aa2c1bfaf354899d505299044ce672dc2a80bad96346869780d803bf5630957
- SSDEEP 393216:jUTn+V5ObvlrOM6ONrkCoXAroHeOKxi6e:jeb4eCVwi6e
- TLSH
  T164473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 bd6383ce8fd2be675610a2b91d087890f01840c235660819401f78f84c1c9658
- MD5 4c8da93ab772132d60ba6663b441bbc0
- SHA1 2c81b261e0ce01fb2cc585702feb2b4bf26ce61f
- SHA512 386d32e2a69527c740b26ef22717738dc941d81070fe89f2dc37e8b73b6661f30a0be1cd653428d6cb13e47486783b60277cb0e2e1b991826bc476a8d55164ed
- SSDEEP 49152:vlGCNdPwp1E6o/xi59rx2yrT3199aWLKIb07k6hlVv4NoJHDDGgwvm:vlFirE//w9N2yrTaHwNoJus
- TLSH
  T1EDE59E02F6D651DDD019C03497AF9213F631340A4F209AEB16909A263F6BFE87D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  icudtl.dat
- Size 10.3MB
- SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
- MD5 5bfd3eefca4b5ef2d1a869396390a7de
- SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
- SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
- SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
- TLSH
  T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  libEGL.dll
- Size 508KB
- SHA256 ae32b2441b4ab85cd100fdeaa9dcfd99b1da15e8fd41c8de78512c69cb96f596
- MD5 809a8844c5322b3c9be22c8b9b3fc23b
- SHA1 1c09d6b8ac460a21efa2f65a942a4ab740bfa684
- SHA512 46b34a948c7cf8d6ed003378a43b0d5c4c22906887d368cd5a41644e3f5a6c0143e739b843b395db8c02d08e331a5d9093f77f429bf86af83e9bc734bcfbef6f
- SSDEEP 12288:8162HbwE8+Tj5I9dWnQccIu+GwhugaD1:c221IKu+5OD1
- TLSH
  T10BB48E15F3E94BACD07AC1348A438646DB7178921B65F9EF02E052352F3BBE45B3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 b4f6d2158d1bd27ded6c65884efe26005c45e6d15373ff1230a5df2b6d2dfe00
- MD5 cdb830538b1c45f31efbf1c335e3a763
- SHA1 151add895319147d6191481ad7aa5a66b63f43e0
- SHA512 0c0df0367a81e91bc75d79c226cf9dc6160663f8c9bb1795335dece51e6eb7305c1c918f8ef11fc67480846b47f872afd617bf98f7606a466ee5d9bf2b63dfa3
- SSDEEP 98304:wSqq37sgK2EEDXCrfI8g++OGwBeAM4HdBZ:RqQ74KDzTO5CGdBZ
- TLSH
  T1D2867C03F68641D9C05DE2749B67A223FB34B8450724B7CF2AA457152F6AFE0AB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  locales/en-US.pak
- Size 548KB
- SHA256 a15a41f74f809ae908b95645565c34b151483a5c04a94265b44aee12fd413b55
- MD5 0bdc9ee1a9ddc83a008c4072993734d2
- SHA1 6d99d0dd57100072fd26f0bd620757b69f031188
- SHA512 8d9f28e48255e433e2f4ff968fb7d7c467b096f33978132dda53eda987ebd22225c8eef51f3946013b9bba4f8d8d65b757c8cbeb9b5786cefc154b711d4f5d9d
- SSDEEP 6144:wtobk+PcOYHfYOMJxjScMP9sQqblfaYQhp1B1OjRng98//Swf:k2vPc5HfiZM6Qqbg0jSwf
- TLSH
  T1DDC44D1FF744112A05A352A2BF0995B2FF32D06CA35112563CBD812C33B6B6693B76F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  resources.pak
- Size 6.4MB
- SHA256 4a1a6541797afbabddcc08eda4d5d26e4855c7fe1219a3e978987bf67b1595be
- MD5 9ed33b1cff81a80053b225c2353f05ce
- SHA1 0eaebac883e5f745c93c4a5c833f685b5838137e
- SHA512 96a9602d4403e5bf688237a68638be58e82cf6e7393a82a8de50535d3e4a82463795add66f9ccf59803686a8e75a4b466d757c1a9c1955a83dc149f9c4affa65
- SSDEEP 196608:pirBR0ftbNQoYmkrB0QMguFBgt3m06Rw+Ki:pirT08Tmkr4jFWBm0iw+h
- TLSH
  T1256633DB71352C4FC54883FE4528417EA95CA7A13D899192158C7228CC6E38F7EC9ABF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32