b4d2c1fa121ca78268304fb8ddc6832af6fad95d857ea59c2ce392154b0585be

Sharing

Copy URL Twitter E-mail

General

Target
duckier.exe
Size 10.2MB
Sample260620-qe3emafs2j
SHA256 b4d2c1fa121ca78268304fb8ddc6832af6fad95d857ea59c2ce392154b0585be
MD5 ca297693668277e3cb25985378689954
SHA1 b3809abf42ff3e636d73582622e79a15ca361b40
SHA512 c22c3a86261294611276ab9f84b476bf9a3d0ab16247291f391ccc75b6679cd55c3013dec09059f9dc028c6d4ea6060ccf98f9cc871a8ce9ee386bdf3f140f75
SSDEEP 196608:VENzqrUwSGAatt0RSIwNOGNHllKod8vrOsBHutEFOz04VuT8/fyzarh9a38:VLMat2cIwzNlc28qSOtxcQiW1Ms
TLSH
T103B6338707A18181C8CC6571DD67FED3DB4004A1BD893EE633D9760ABE22AE6CD5631E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  duckier.exe
- Size 10.2MB
- SHA256 b4d2c1fa121ca78268304fb8ddc6832af6fad95d857ea59c2ce392154b0585be
- MD5 ca297693668277e3cb25985378689954
- SHA1 b3809abf42ff3e636d73582622e79a15ca361b40
- SHA512 c22c3a86261294611276ab9f84b476bf9a3d0ab16247291f391ccc75b6679cd55c3013dec09059f9dc028c6d4ea6060ccf98f9cc871a8ce9ee386bdf3f140f75
- SSDEEP 196608:VENzqrUwSGAatt0RSIwNOGNHllKod8vrOsBHutEFOz04VuT8/fyzarh9a38:VLMat2cIwzNlc28qSOtxcQiW1Ms
- TLSH
  T103B6338707A18181C8CC6571DD67FED3DB4004A1BD893EE633D9760ABE22AE6CD5631E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation trojan
- Drops file in Drivers directory
- Creates new service(s)
  persistence execution
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Modifies Windows Firewall
  defense_evasion
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH
  T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 43KB
- SHA256 067432f5b9d396570c5e99fb2b575daefc9dd7ab68b89246e74149fdc26948a5
- MD5 bc2fc558fc66de3d28fdd7862e4330b6
- SHA1 21b0d6e0a025799b6f42888be1a47b406e05fed3
- SHA512 0757fe7bc59ef30c8801f121041f4bb147760a3042746523c969c66f99178855a6829fb389a0615ed69b16fedb5cc5625b01e8f1b4de923be967e5f36f1962a9
- SSDEEP 768:p/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVGbLz205cKdec:xwODZzTrAV5Oevq4DtXHVG7oKdh
- TLSH
  T130137C49FDC57D66E7CF09712488853E4A7FC9081740C99BE3625EA2C992332AFD521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 02c97e5e32a97d896163ec68a3ea3ab0339e57f274348b8689399638b649b2b9
- MD5 7a859af9af33fdaf638eed723391b880
- SHA1 bfd5343fa72541de388b346c64b1b67237f906c4
- SHA512 8e92447f1189bc47fc4ef864d1f529fc1e286d2654bb7b4e4eda767832170c914fc1fa3d5516a1918de766d9657123f3b15c1d412b1a49815ad71e8626fdca8d
- SSDEEP 49152:AuiGh3coUtJs4nclJx9Zf123FjL3+QLlsiLR:Zi0KOcc19KFv+MqiLR
- TLSH
  T12F7512103AE44072F0B31A3159F49AB11E3ABD708FB56ADF13902A6E1E705D1D739B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral9
- Target
  128x128.png
- Size 22KB
- SHA256 da54408d5938e6d3d3791ac35ab129dd6e5167f35e315f6ef723d7743a6e854a
- MD5 e9b415acf152826ccc7b2fdbf9767c0c
- SHA1 b36dc8b60d1e87f5bbb48fa77a9d223e8616ade2
- SHA512 37e217685b9a6b1965be3cd37e5bc7e88896e9a343ce1cbd991c54c38088aa461daaf492c4bc19bad239f48912aecd01275c61e4f7bd749c5eb18ccf3ab1c1b0
- SSDEEP 384:qJF1L7e3o7FdJQUwZwS2BWcDJewnl76QlvCEl8B1ihYPUpAZLqhpbG:4lt7NNS2BJFewnXlvCm8zaYsGv
- TLSH
  T125B2F182EF1F7FC3CF5E30F5D8597AA4E8845E62E5CCAE9CC115AC6D04905AB041E4E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Duckier.exe
- Size 10.7MB
- SHA256 a6d93fd9dbc0f5dbecd30521aaadb2d5c055283b86d800ecd177d00626056abc
- MD5 9186144cfc3150d77544ac5b445dcc15
- SHA1 c44a3bd3cf1fb662ccdf3b9b219ef8abaceb9dc6
- SHA512 3095c8154c13e5b60e12b8a5bd86827ff3b7a5e20eb364d88bdbd70ec802a9676fefc56815052e02d48b6df6f5f31ff11721d632519b8d01af40d8e52b56f438
- SSDEEP 98304:+mnOrtjzrEnuOqHsf8A0U3JYAMjPuH4TVygS6FMFF8aM2BQyeZJb2YgTyNj7DGoz:ChWqCNqGFZdBjuNhg8HjkHDqlxx
- TLSH
  T143B68E03F69181E8C0AEC578C35BA633EB32BC8D4525B26F5BE44B112E26F506F1D769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution persistence trojan
- Adds Run key to start application
  persistence
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral11
- Target
  duckiervpn-daemon.exe
- Size 4.3MB
- SHA256 c36e275938367cd8a512cfb6904695a985fed72585d55ec7cea4c7932c72213e
- MD5 14ce2f967fa9e3416ddcfb865441b0ae
- SHA1 95cbdce6a358a6e7ee8b4f0213768ad386e0f593
- SHA512 3ab6ffd3d4fe07608856048b7d9e1fbb7fe527af3532c2e90735c72fb6876957fe443fa18e417966f65df2843df57d511c42b5f0e0e7af4ccbf893069a7e0fc7
- SSDEEP 49152:y6kAMt4WT72MsBBrrdCtlQsE3VgGxjS2+KcXUIE5eISPX89Vl5BbaRqbLVuBr7cz:BYyORX3IWsTWa04RD69TW+YR
- TLSH
  T1A0266C03F69581E9C09EC178835A9332AB32FCCD4A2473AF5BD44A212F66F606F5D749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  lang/EN.json
- Size 23KB
- SHA256 33f332e1b3e9be9829a67688575cce40e0f9f4f0fdceb4892c2bcc14b9228f02
- MD5 6a84bbb7a50229f647d5f61f7236387d
- SHA1 6e32fe96c56eee2da7657079991283b9919daae0
- SHA512 eae1781aa8875effd8c173991a6434231ca7eed5b0c9d9bc9e83c91ab81ccb5ff8158d0c021c0aa18b97a9b72bb8ff9beed220349203adf29f1a5a75f93d42ba
- SSDEEP 384:luRboWAQZ5WFQw2ZzpgIJIDt2Eqm2x5cxfz/66TT2l97/YCFFQC1dM+8pmQu8EBa:lJ/4IDt2EqJc0DaC1dM+eu8Pj
- TLSH
  T1E3B2C53D8A00107B4AE2424568660B9377215FA70710341A5B7F42AD27BE17F63BBBFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13
- Target
  libcrypto-3-x64.dll
- Size 7.0MB
- SHA256 fdc835f0320261693e8a542c4cc91d7819967d7e9a850d6b4621b9d5cb180b21
- MD5 bd223308c462b1fbcd1b3f86cc1c21de
- SHA1 bcef6a6301be28cd39e47b2efd1547408bb63048
- SHA512 84ad68b176327def18aa8be1277d32b78fc2f9283a39d92e2a8646904e06fca8459a1493f2ba0c8908c11bc98fe3b3883d2b45b84c93b366fe2203c5f0317004
- SSDEEP 98304:hDtGVpsMh+Me+76oBtLI2U0N9J+fp1CPwDvt3uFt0C:R0HsMhP76oBtLIhAjU1CPwDvt3uFt0C
- TLSH
  T112768BBDA2BC0105E4AA81BDC2875227DB71B91957B013CF596186F81F33BD62B7E780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libssl-3-x64.dll
- Size 1.4MB
- SHA256 71c43b620ec4e41b95b73f1c51a32a474f25a9116fa270ab83b1a671336457d9
- MD5 6aab054a2e0fb1c96c621ab8ee2ba12c
- SHA1 dc23844d5616387dc3ee759a0f836ca70079eedb
- SHA512 8e49a94b48f41811fe9a0285dec5f72c2eba3ed3a81f248473f50b2babc4791249869b137a8bb9d771e40dd99b483b591a9434a2421e88050e5bf2bb62c29ec7
- SSDEEP 12288:Q2NajFIvLa8ssh8L1/PX6hB49iip/XslqscfInSXSKzxlDDyV:2CvLaGM/f/iilXsc7XSKzxlDDyV
- TLSH
  T1D6657D6AA7B8019CE5B6C17CC6934B13D2B6F4162370A7DF0A658A381F63BD6173D384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  wireguard.dll
- Size 1.5MB
- SHA256 b2c5082289c8d212d0cfa3c9da922d9557d44ed5910beb817176401f06f8c0ea
- MD5 a7cc1db9dcaa2550ab9bbe451aa490dc
- SHA1 bf5bc13d11f3ade5507e22022bc0b7a6303ffd6c
- SHA512 4932e92432f2b3f94883b552ebd584ee286efadb29bce5131d7085c8686931a151e3e85ac1338b69f30c631af357f956de7ee50f3bf1e0b3de53f616439b1fd4
- SSDEEP 12288:4UenDNpq9bKeKqM7cyOcN7kWCEKI2ExcN7kWOpsr2:4pqFKew1N7VCEvcN7VOaq
- TLSH
  T1B365BF42B2481B81D99386FCD4D5C536A675BC042B20C9FF1034F2686F73BDEAA7AE15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16