cb90d87cb806c9be6cb3c65329bb0a0347f6872d7f78a92dc2ff7e0d1454216a

Sharing

Copy URL Twitter E-mail

General

Target
Pro.rar
Size 99.9MB
Sample260620-ndh89aev9r
SHA256 cb90d87cb806c9be6cb3c65329bb0a0347f6872d7f78a92dc2ff7e0d1454216a
MD5 65eb3dc03d49526f2880a96ea13f47e7
SHA1 f757d74a76c698c6f630e23bb24c5a5270afe1a5
SHA512 56f5a220ce4e363989e57f83531551780a6a70ca1d76046dbeaf61fe5e257dd1338fe2b5f3e8e8379430f8d2daf5e417e055d3159928d21c923564fbefbd80dd
SSDEEP 3145728:C9O/kLO1QFeHYSryO3N/pbO+6DUmed6D5y:CAsVKYmyOlpbOvDUh6s
TLSH
T14F3833888A3F65A0CA7D1BF062F9471B76D34AED93E12A5F846F0BF14905B3460F4C69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Pro.rar
- Size 99.9MB
- SHA256 cb90d87cb806c9be6cb3c65329bb0a0347f6872d7f78a92dc2ff7e0d1454216a
- MD5 65eb3dc03d49526f2880a96ea13f47e7
- SHA1 f757d74a76c698c6f630e23bb24c5a5270afe1a5
- SHA512 56f5a220ce4e363989e57f83531551780a6a70ca1d76046dbeaf61fe5e257dd1338fe2b5f3e8e8379430f8d2daf5e417e055d3159928d21c923564fbefbd80dd
- SSDEEP 3145728:C9O/kLO1QFeHYSryO3N/pbO+6DUmed6D5y:CAsVKYmyOlpbOvDUh6s
- TLSH
  T14F3833888A3F65A0CA7D1BF062F9471B76D34AED93E12A5F846F0BF14905B3460F4C69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Pro/Capcut pro activator.exe
- Size 3.3MB
- SHA256 4ddb12ed1e4e6ff13c3d93763a652de7df620141941c62f617cd0c39fd5747e5
- MD5 e9116b95465d073cd84cf266070b19b2
- SHA1 691046d8839d38efb56ad2f971854876e6aa5e01
- SHA512 bc765208db8cd999d30152ef451ab8fea5e5161fc7919f157a8b11f1fdddd28fe51ed6247e1d61fd9b41dedd0caa09175813bd0e1705fab6557d3047a04a41d8
- SSDEEP 49152:8co8WHnjaGL9wPHq1wPB2PRARwWctmT4tXjblvZirM:8ZAKJQGmctZ4M
- TLSH
  T19AF57C07FCD599F8C42962318ABA5A827725BC091B3267D72A61B7787F723C03C32765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  Pro/chrome_elf.dll
- Size 2.3MB
- SHA256 db580e37cabd8a804e48ae9035383c6b7e3e9ddbc8d05abee242fd3c3ec7c8dc
- MD5 a141ce49faee3e4402ec7b22b2739bcf
- SHA1 42e56ef060a438591bb2642ff05b519bb2eb4b2c
- SHA512 81219091d8b95d7a8133e8434395b3770a9835e4fd82c234af2c346deaf3e9e570908390a0250e76c08cb898fe953b62cb9d5eafc5bcf9c587f74c1b86fe0279
- SSDEEP 49152:6aI8PLKkBrx52j5gjCOQ8fFp6nDIFazNBlPAHR:6aI8DF50g6MMDleR
- TLSH
  T1F6B57C13F2D901E8C05DC1798B5B9632EA61BC460B35B6DF0AA076161F7AFE4673E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Pro/chrome_wer.dll
- Size 115KB
- SHA256 62c426bf55911b226b9a46c3b6ddcb58d8ad853fdd43a4f12d44750e31a5ce2d
- MD5 37a3059ff58213cc1fd854096d0d7e76
- SHA1 6e130c3c5b123e79c1ba588d19d1a8f6d90f298d
- SHA512 de9ec1368dc9eebc8866ded25a250392159ca20391eae334a7b8f3959345d4ad7beff34e5b1f188e5d2410d20946afde1096a981cf17f4fb69df88d58f96cab0
- SSDEEP 3072:snLR29KNnTNX3ZEng0j4RV4eWAtpFrpqpqpvIwT25k2hdW:sLR2aZZf0j4RVznMu
- TLSH
  T1ACB34A5763E900BBE5B7863884634F06EB72B8124761ABEF03A4421A1F637D15E3DB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Pro/d3dcompiler_47.dll
- Size 4.5MB
- SHA256 464ac23f4a5e5d92a9e99f92641f3a0c5e8326b378a45140dd9f880686b9d1e9
- MD5 fe8b95e5941a2112c16858945f952d8f
- SHA1 72325b2fe4e1a6d3a3f7b623843eeb61c9162300
- SHA512 9d4a00e30c15af6fe0cf6a9b2d4671c7f826c4b2b048442d0b889302ce06410c4b4d4760f19eaf3c6ddeaaff31738dd8f0461d422c180bd64389658f7c5c5220
- SSDEEP 49152:h6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/B:hUdeqt737jFm5w5
- TLSH
  T109268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5
- Target
  Pro/dual_engine_adapter_x64.dll
- Size 5.1MB
- SHA256 d5ec2ca6c7c116f57f45b3a80a99664b68f02be305d8d41427f4af877421011f
- MD5 28a22c699f09dba495f45c6ad3f2ed82
- SHA1 461337b7cba23c02a856e426abac1b7c6b9d3691
- SHA512 964dab1d13df07b4f0e69517779d5ed71f682e72651e2b6fec268ddf9fcf2cc02e18d6cd2d003d442191821338f0797114632e28a7c90871b513aef1b9079af6
- SSDEEP 49152:9IrYTlptJDw/NIbupGgQ4HZBlubdkD3TvvOuXuGv2MfvfkMNODsgXmcCxOJm4wwL:5rIl8cFNF7Rknrz64Z
- TLSH
  T1BD365B53F29611B9C00ED9B88B2F5632A5647C4A4B31A3EF0AE936210F75BD85F3DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Pro/dxil.dll
- Size 1.4MB
- SHA256 3855461625ced4bfc89171ef465b398f75ce1bdef4fc565d850159e35341744a
- MD5 209b426f1b967f86e5de49232d57983d
- SHA1 21ee8b869ec33bbdc097e47847efd2af5f8c6136
- SHA512 c83eb25ad7b7f2365af99fe126cabbb140ed373b0ea82fd73414fb2fcf68a71b0607b13095e258d63d8ebcba70f64ac2dd2ce66a7672686a041c255fd5d08d73
- SSDEEP 24576:ycuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/c:ysHMPzbOxBduHdSCde8ZF1/0Wy4oV6bB
- TLSH
  T11E657D6B66A800B9D4BFD174CA438E0BE7B2B45503B0EB8F16F442A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Pro/eventlog_provider.dll
- Size 15KB
- SHA256 ab44220f0647d6d1a5df27d11be725a937b1a096b620638bacef5ad01db50646
- MD5 f1713aa15b05fa70bc45d6eb186e651f
- SHA1 663163f56f6829b2884cb109c68aa566914e5770
- SHA512 4e70ef67f7b3492e7dc842b3486ce2ecf845f135426a2fb94514b74ad083b4fc60142dca7e2a3afab0a3a4b9dea3fd7fc9f4d6682e8520139963296c73f825e4
- SSDEEP 192:1qqnWd0LVWc6Wz2DWHbNpofeBWseaAWzQcNpcspKLX01k9z3AbJ98Jt:NWd0LVWcr2y4GlNSscmeR9z+Jy
- TLSH
  T1187229D697A88502FD9AAEB052B8CD533D3CB7C21B1096DB1682F0581C627C4FF3066E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Pro/ffmpeg.dll
- Size 2.9MB
- SHA256 2709ac9a18ec0aaefeab7e096db7cb7c06f7f87e1026d84b15579e2631662a25
- MD5 094ca551121772f22ffa0640ac658796
- SHA1 c657f698c435f2b7fa3662f66f9fca6ff0eb321c
- SHA512 f019ee2f6b334bbc972020dc91f1c138405b76c49ead9dffc15554ae5f204401c61780dfdb007cdce4866f699e22f5915556ccf4306df6c32b4feae52651988f
- SSDEEP 49152:RoZr/c81IQbx6i1N28c18oSh9aLuS6FnFizu6vIGqB9OG+CJtcjA5m:RoZr0iaLu/ivvO9bD
- TLSH
  T17CE59E02F6D251EDD019C03497ABE213F271780A4F205AEF17A05A253F66FE86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Pro/learning_tools.dll
- Size 1.2MB
- SHA256 c4b3c8846438fc2461dc8603d1e47e3871c8e5fef4a30a8b1894d485a8715c9c
- MD5 eb043f6a58ba277f85cd08a0ec26aa32
- SHA1 600f9753bd9bf8c5c45df21c73372aa0a6dc5385
- SHA512 f34915d2c71d846b5805693d5fa6120b958cd39865dc1c3ba865e7ad0292cdd8e6cbbd1df0cfe95b7aebead6c62d6c99b3471a60265f7c71dce5b6501d03b574
- SSDEEP 12288:WA6pUB7ugVy9gb9DvE9GeEJNklh3YgkLcIzOcaQoVgkLcIKcaQbgkLcIZcaQMsnI:WA6pUBMQFeEJNklh3pvsnv/CHgXxpgn7
- TLSH
  T10C555B2172066837D99E81B5E8735283F3707882251744FEB21CDDDF2A6EBC521BAB35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Pro/libEGL.dll
- Size 499KB
- SHA256 6397808c0745f08bc971dcf1eda61deb164d9c372dc6d5dd2fe8eccbdb7fc341
- MD5 2623d37b55bf9369f42d2a5a70ee51b4
- SHA1 78898fb21c20e085c34dfff9822fb05e9831fc77
- SHA512 ed75b7a6845175cd32a5e4fd6e091b41d6eb4f68139ea37d7a4207919d10e722d9508a512be6581114ad28e6411ec9ad1a35818e41aae05baba0e29277f11260
- SSDEEP 6144:ngfx9w55AkgG95e1xnaEjbiKaU3kQaJjkcWcfRYCx9/pt/BCSKxJIUgq9WXA:n15z5kbiokQaVkcWcfuCpCSKxuA
- TLSH
  T1A7B48E16B3D849A9E07AC038CA438547DA7178460B75F6DF02D0E27A2F77BE46A3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Pro/libGLESv2.dll
- Size 6.8MB
- SHA256 dca8d78efd1cc0823c3b044ddc8043035e2e21467705e140a6409d732eb23670
- MD5 155b895c53f0a3aa401f9e4850636fc1
- SHA1 316bb486a4b2eda476e5e9e3eb29814bc115d69d
- SHA512 61c90a3d045895cbc9395b541dc247c312a8338a802b68eb1426aef3572639f0849d4d05459529b900d40445eb3b345564f4a952c15874a9d92ce3c84d339361
- SSDEEP 98304:Z/4bGKn5Ot8E8LQIpKeZJD4ZoLS1ckAC/67:FluPZUWS/i7
- TLSH
  T162667C03F29681C9C01DD274976B8623F635BC850728B6DF269457212FBAFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Pro/microsoft_shell_integration.dll
- Size 449KB
- SHA256 d1fc28030b6e9974cfd71a3bd6fab0d5e3f31b375573f0d10ff957ac4146ef00
- MD5 775a61324343c32907ca4fcc3b980e19
- SHA1 573b39ad61639257448a1e4908c5ab1f3d0ecd0f
- SHA512 793b20a0e450760aae0a740d49695552846597a1e4ff5f733aa20e1bd686c439471da069f58ac3fb2b3f677a5ef0fb75730e9cee4538d264b773690465b6f992
- SSDEEP 6144:unFPvNtCHUcKTmUAh9dPQ0w7lWYHE35zmxIlD40RLtMFN:unFPvXOKiVY7lWYHE3RmxIlD/+N
- TLSH
  T151A48C05B7E448A9E076C138CA538546EB717C960B71E2DF03A0E2692F77BE45B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Pro/mip_core.dll
- Size 5.2MB
- SHA256 b91132b09bccc01df0d0a168691bb9e3720d7a5c0f69f1fd838ea6f87cceab0d
- MD5 0622b767e9e89eb0edba095d3219d660
- SHA1 6af7744dfa8af85bc2d54954f1586e968dd2a3ec
- SHA512 2e0562acfd3faf7e102cc1380df05efba88fe29f95333cbaf1cca44b44a4070ea0bd056ec6ab7ece86b921a35ce5b50708c68a3a9f427ec35349d9c0e412591c
- SSDEEP 49152:DuBYH146Mvl8bR+WM7ZvaL4Zrzi8n8sJsRrlurPuTtuGKc7mhT5Ci6uBtiLVja3c:/14lLfzhuTJytXiYjGPwaWu
- TLSH
  T12D467C57B7A800ACD4BBD27D8A4B8507E7B2B806573197DF02A0577A1F67BE15A3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Pro/mip_protection_sdk.dll
- Size 2.4MB
- SHA256 3e46c961339de0359adc33e27aeaba932fb609304bc764aa0fa49b7d11dcfd78
- MD5 17ac1c062c43f00b3ebe5bb15f866a5e
- SHA1 9f8f3001e81b4d64a1833e071782f22caf44d7ba
- SHA512 6a57422a0f6e0cfdc18b1a57b3153d4b2179c8a79125e9547ffe7158356dbd580bd664d0336a3e33a95d39343b0216b49a794c8506670109876e58bce750b51b
- SSDEEP 49152:OxFDqq8uX+lXcW9vDbslAbjE/rHnULSv+F6i8a3isHp:r1Wmp
- TLSH
  T182C53C477A554099C1EBD2B99B1BC943F234744A0334BAEF039097572EDBBA0AFB9311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Pro/msedge_elf.dll
- Size 4.6MB
- SHA256 20150099f08f29714d52137f6d2b9e9799bc031c4f7228912772643d2e634bc3
- MD5 ea68c6ee94337a94f8a3d461f1d67917
- SHA1 5e058eeb6f47f8a0053ca453db506482ea590021
- SHA512 b54651c5d58b7bda94d89ca328bc4f9130ef5ebcb04cea721cbf4a32d3c24eb7173a3ad3dbbec5695a8ad3b5ae7471456681d03941bf0155bac35dbd09863722
- SSDEEP 49152:3FG9S61PDnfxmn2i6TYTcNVoWc5mpJ9QTj2rTGCVOxZzZwY9mJWuoowUzdtYgdZv:Turyf9iTAPEnwc39tRVye
- TLSH
  T1AD264A43F25211B9C44EC8B4CF2E552297643C8A4BF193FF25E83AE11A75AC97739B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Pro/mspdf.dll
- Size 18.4MB
- SHA256 52c9c7b146d5d747e113b4b35cb4c703162f2d985ea242ec4291db54f7377bf5
- MD5 b0785c4d57214a791643ba9d59549cf8
- SHA1 35fa9f69941fce1d1a29aee164bc956f82b87aaf
- SHA512 bd568668ea2b5ed5a93504de2091ad845d4a27c28deb330752d9392d30d149b313a6f59cc133d0777483099b71300ad11916da8514dd8081decbdc09e7855961
- SSDEEP 98304:yK20/CdTySbSI8/tkyTQQv/45Ok16RMBQjhWOvPy/UO0JV6xEnwjql1UntpC4X0I:yOTTQQv/45OkMK/7Y6x9bX
- TLSH
  T1C6176D06BB9A49EDC04CC874934B86535E20B8CB0B75E5EF45C962192F7ABF85F3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Pro/msvcp140.dll
- Size 550KB
- SHA256 f23ec08cd51a0377de3d5e15265f28696e3602270df6f9057ace13a26d9a48bc
- MD5 ce4433a1b66d6e3f123d4853ab31b79d
- SHA1 1c5d64e4f7147928835e7b3260d81cf448a651a0
- SHA512 5d933333a69ae1f12ab1aeab822caf5f975a685464d782f8b582b92e84a331ccc80258dd3251016f73561dd3cbb0872b5d781b2d30dba96451ff5da388fd483b
- SSDEEP 12288:K0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7h:K0p1F/IiQEKZm+jWodEENh
- TLSH
  T1C7C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Pro/msvcp140_codecvt_ids.dll
- Size 40KB
- SHA256 3ad45d2800f13e5bedeb1e0fddfcd40c392622bb8649c4321992d097941518de
- MD5 74e1f207b7097f6a35cb073e948fca20
- SHA1 f8d00e910218659f08301761bbf4703e29958109
- SHA512 b68dde42ca484a498a9f7b56090dc6d73960cdc0dc75e47c334883a780b6747d32204733a719292c2d38be1b6b8b27485f0f2dd8c332ece40a4f070b99741fc2
- SSDEEP 768:2wA1mjzzGgU9IX+09zo8AjCf9zcfFJq09zoL:2wA1SzzG3e+czopjozM8czoL
- TLSH
  T1B8137DDADA788083EEDB5DB082A8DE877C3CA3C70A5095A71362F1540D537C5EB3426E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Pro/oneauth.dll
- Size 5.7MB
- SHA256 adf8a824a06c62fe92efb03ea07423e182609017f44e6a1ecc965a63e4513bd9
- MD5 c2de63ecf27c2c67943dde631298eca2
- SHA1 0f9d0309ebde88c473abd5498f2900461fe1107b
- SHA512 5467496f65cf578ae26c3b314d42378cc6a76bef435ac306dde5b5918f8ed08b2857f3720a5ce243345ae40a05bd7002214401df6de39d2aa02db526827a99fd
- SSDEEP 49152:YIphIXwBuXtFtLQQqB76mf8oR6L9BW0JOBKSTaCYgzyTMbKfujWZZmEDxP3AmT5f:Yo8o0/FQ0Mc9Aua6/3LLgtkt
- TLSH
  T112564B017ACBE598C0DAC47056438513AE507CDB0B39E9FF01E1F15A3FBAAB45FA5229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Pro/oneds.dll
- Size 3.2MB
- SHA256 af48988967bae769f3031f0d9fabc5ff7bdda72e8224050190a16988de21e611
- MD5 d2fd39d1eeb4f74da30d0e4a0c4a701c
- SHA1 0efaf97c0a7f477e4d9502b9ed168691c57eac78
- SHA512 8cdfd1cd1104fb34902ad1f15770fbdd21fca07b94658f21d37d7b55e7ec0c0ea6f35ae483d76e08fe6b760fec64e5030232b4eb63662376a4b2d7785d4503df
- SSDEEP 49152:oeqnNyCB3ocUrGaXdWycnZT+S2cKrVRzTMyBf4MVOZtDc:zq4XM7VcZRfceOZBc
- TLSH
  T1B1F56B03FA5641B9C08AC174C7678733AA713C8A4F74A6EF06A856153F7ABE05B3D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Pro/onnxruntime.dll
- Size 3.1MB
- SHA256 1f11ded7a52be5994c8944ce4bd44d82e0a63c955688aa8e727cf22a9c65a42e
- MD5 f17a75200adbc2ee4ed315d7cedadc66
- SHA1 2cd0cb4e486ba2955f87d2faa3897d31ba15f6b5
- SHA512 488241130a49b82e988bac83932334305c2bbe5b5fb73a1cc0ac03811d577f78bde287695702b208bed5d9c2b1708c41ccbe984fa777110ee9569ec72f95be74
- SSDEEP 49152:89dUKzyhC/ni1yzbArKqzr/fpSILTSPtBgwZ4iruMF/cH9nmoh9kXpw9XpzwYMNg:VgBm
- TLSH
  T154E5AE2AA3E802E8C07FD179CA4B8A17EBB27449C3705AD703F185552F6BBE0567E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Pro/optimization_guide_internal.dll
- Size 17.7MB
- SHA256 608239e89a43fc482cbdd283c42069671478534c0fded508d780dac603ac1611
- MD5 d31f5e7d0e950514c860430c5ccb8f43
- SHA1 d51cdf30bfc673e66a76953b2ba0de3b9555d1ab
- SHA512 294e511ebc65ff40cd28c88b8793afea01e69255c72c3b9312131ecc3c74474822c856625abf3ab4a80d5d74697f94dd1030675f740afd4125f97a0133ce8a1b
- SSDEEP 196608:U2mEIQDREt+AbmuTDILo12nvjUs5q9Z5j4Mc:6BbpPC/nvjUs0j4Mc
- TLSH
  T1BE174913E2A641D8C05AD1B9475A9233FA617C494734B2DF0B81BB122FB5FE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Pro/prefs_enclave_x64.dll
- Size 113KB
- SHA256 27ef7b33f09808b3f1b23a5d1f3bb057e5774104619b23b0908b620d074a41e6
- MD5 6284d259ba392db0e45ba4446a735863
- SHA1 71d484a0afd3b25996000566d24941d18ff458d3
- SHA512 3a1211577a933cb8d2136017fd0e6da4aeb6d76ae895172370e88088eff5b23e446d25cf9027e9a83ae3097e47f5e2d6c1ced636c09445f56078b2a2cf9146da
- SSDEEP 1536:2hk95BP9K5dv0EzEd1GP4ufY8OZjknvooLqF1Pm1Yzgizh:2i95BOMEgHY8mwoLqF1PmaPd
- TLSH
  T13DB36A46B26442B7E66BD175C5D31E0AEB74B4848370A3CF07A94A950F23BD09F3E399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Pro/telclient.dll
- Size 3.8MB
- SHA256 1c7ed563eb7a9385f2d6cbd4330ab9ec6cd9afac4dd8b6699408dce9f6686ac2
- MD5 72a851749f03221e668c335d84a31038
- SHA1 97ee67ba4827cb63f498c8e887818ec9c9514f75
- SHA512 9e6f871c2cbb27d8a56915af3b016b22557fc6cd710d65938ed9a703ce2835c0e3c9ae007c657ba57c4d7f369c003b7550d31fbece2f7f319ef3d6a1fbeb575b
- SSDEEP 49152:bBGDNi/dn6X3Hoeib4wDH0pWqx+Uo4Ok+QjDi46tpI5GMU4tgfjsoIIIQDN/5h:EcEoY0k+8yIBtwb5
- TLSH
  T154067C03F19901EAC09ED1799B5B8222FEA1BC454B35B2DF0A9477121E7AFE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Pro/vccorlib140.dll
- Size 352KB
- SHA256 d30739d16049c3c9fc4fa2ba81321c19c5348c3141ca9b633f64fffe9a8b3d83
- MD5 b1b39ae8463b46d9d73757015828c023
- SHA1 983a4290963a646ec690a0352b404b89a20d8759
- SHA512 df5123ccee949361a0c90384b102094b48bc2f25ee491b000de52f35c96a8e1010de98f34fc77ddd1ef098da835df72456c7891aaea7e08c6f062c6f34315c46
- SSDEEP 6144:1vo2BrDTiplPlXpd0x8GsiUcOIOYFjLux11Go7HbcQ6WMQbyH2KNRpYpQrA:1hI+klbwTQmYQrA
- TLSH
  T17674E5677A9C4CC3CD35A0794A978309E3B279520751E3CB1294470E9E3B7E8AC3B679
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Pro/vcruntime140.dll
- Size 130KB
- SHA256 dc23dd3073c98bb60f7e4843d09343652bbddffacd804c3d2349517c40f853db
- MD5 347228e92a621d42c192b4ecd17d1142
- SHA1 ee2bb8e14bbd22651ad7fb4b2a414d5a69ef5c74
- SHA512 0a9177223fb167ce58bbb4f04c184b9952e01e7a88f37d84ca9a17c0d415393ae691722f27ce760322dfe0ffa2797af15a5416ec4608f8eb45db094dd42dec2b
- SSDEEP 1536:Q9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lCg3ezqzN/yLzX:AyA+3EOfmpcGSdOecbeQ6NxC3+ZsL
- TLSH
  T11BD38B8272B802FBC56BD170C292DE27FB76B64287605BDB07EA86610F637D06D3C245
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Pro/vk_swiftshader.dll
- Size 4.5MB
- SHA256 80076b31d9e428ad8cdc4eb75d9859c0436e5cd3f93082332791c5f534ec6f3c
- MD5 79d26c0eaa513d6b5cb2fd3564a0e5d0
- SHA1 f8b505c4f0004f450626e71e54df2695fdace686
- SHA512 f88890bc5d4009ad277c77a8485dd1b93b66595e4165f5d5d3d4f3e8d1067abb5523fd909c44121af051e1c68a52e4f02890eda723cfd0c692485445d0ffebba
- SSDEEP 49152:j8qhACTtTS8yMn8AQ+ithc+r+DwiF284LMBarUti8cbFcs3c5xLQrkfotDiVORQZ:RACT8RMAdxgwKBn
- TLSH
  T12A263803F18A80D9C05DD5B98B5E9633B232F8810B72B6EF16945F162E76FE0672D709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Pro/vulkan-1.dll
- Size 915KB
- SHA256 d576750ec1d2a864026e5aea4c01052c8822332afc0fd38dd56aac23d4a46e2f
- MD5 a9a461621948900ebb742582cab78d26
- SHA1 a9bac3da6fdb43afac19cba8212d079925abd2bb
- SHA512 1d8da1db82e511a9f4b05c573155e4d79455d364b03c9cc1beaa7012ab635e8c7f0891ff95a183c08b5aa5f8ea337d50f7e8d1d0e8ae866cf4d236c5d8eac3ea
- SSDEEP 24576:c4dkRMLU1CQFeyGrth3hGnhKSgyK6Z5WzcxDYsHkDE6g3P0zAk76oOH1Wa:VdkRMLULey4ShKSa6Z5WzcxDYsHkDE6p
- TLSH
  T179156D13DAA48A6AD6768034D9D18A078AF07481132375CF13B857187F6EFF46B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Pro/webview2_integration.dll
- Size 30KB
- SHA256 479dd831f1e233525cce9a0f5c1ad99025f58dd17bada263fd0b67e2dbfe6c0a
- MD5 59a526aba1c359df59967e59bf5f69fa
- SHA1 5b1f969aae69cf74397f6c62d4d7dfa1455bff1b
- SHA512 b50de34f76c3926c5c2b4e678a3c6aa0447847d0f138d3af99e63cfee8bb7573ed8aa80f11cdcc17fb010d801f514f7d94cf6cd6cc7867f943e9733b963461a9
- SSDEEP 384:j85pJe4VRr5/h80+lSeLlqjJcFAz3tbDqlNW+RyWfaZ2y4GlNlIKki+R9zBGf:jSq0+l/GJPDZDkL7qQ9z8
- TLSH
  T1ECD26C9AEBBC4182E9D5E67884319E17F831F3410B2197DF5352922C0E73BE4AE38755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Pro/wns_push_client.dll
- Size 545KB
- SHA256 db4fa83a0154447ef4ac03899f511d6df08bd82409340ac30dc6624f9477b032
- MD5 917e435ea4da64700d922b568e18b95f
- SHA1 a0b8917220715dff6e72f848bae4ca469629beca
- SHA512 cf643ad89c66c1528f4cc8975f92b8b4ae9f2583f95184e6fd2e78f649cc0a1cb6da9d1cbe53ce1e1c61377c55dd8419a9522b3a131afecbcf1563dcc9dbfea2
- SSDEEP 12288:GR9Mwy4yvbgJfsFCoWhG5TPEaSiRwaPjDLV:GkwubgJfsFCoQG5TPLSk
- TLSH
  T156C42912BAC946A4D056D0748687C592BE7278CA0F75E2EF41A1F23C3FB6AF81F39154
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31