5c1488545936951032e5ba7130847c4d68a0688dc908a53807f223ce79cc5109

Sharing

Copy URL Twitter E-mail

General

Target
Nuvio-WebTV-Installer-0.2.6-Windows.exe
Size 79.3MB
Sample260620-wccn3shv8y
SHA256 5c1488545936951032e5ba7130847c4d68a0688dc908a53807f223ce79cc5109
MD5 c9edac078855fcd5f22f1e272c1438d4
SHA1 1bdcab073c3cc4db27e7394c32e2534eeffc0616
SHA512 b07d0c0b3c3b313e8e0dedd624d2cb088ec4d6c3a6a7c4235ddb90f356a95e23d27ebcc2b39c6f645817a969ae50671c8a8d9e91fac85813005a2781ec369b3e
SSDEEP 1572864:vD+BaWatWUWUlmu+DRhloJW6KquBhQfjLXkvARmmKqMs669F8x7:b+ZQWUlASJKqqYjLXYomHqm4F8x7
TLSH
T13408330659DDC7B7D8C1ACF1A1A3C47A66A02375647A302787987BB048ECCDC9E3D993
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Nuvio-WebTV-Installer-0.2.6-Windows.exe
- Size 79.3MB
- SHA256 5c1488545936951032e5ba7130847c4d68a0688dc908a53807f223ce79cc5109
- MD5 c9edac078855fcd5f22f1e272c1438d4
- SHA1 1bdcab073c3cc4db27e7394c32e2534eeffc0616
- SHA512 b07d0c0b3c3b313e8e0dedd624d2cb088ec4d6c3a6a7c4235ddb90f356a95e23d27ebcc2b39c6f645817a969ae50671c8a8d9e91fac85813005a2781ec369b3e
- SSDEEP 1572864:vD+BaWatWUWUlmu+DRhloJW6KquBhQfjLXkvARmmKqMs669F8x7:b+ZQWUlASJKqqYjLXYomHqm4F8x7
- TLSH
  T13408330659DDC7B7D8C1ACF1A1A3C47A66A02375647A302787987BB048ECCDC9E3D993
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/nodejs/NodejsStreamInputAdapter.js
- Size 1KB
- SHA256 dcf35c72168e825d2e634cfa13a289ba8c7a76da0584a39b785611d0d736ddd9
- MD5 ba7572e9cd7a93894f67f7fe68866360
- SHA1 946c8eb1a1ab8da31abde986fad142db6a708223
- SHA512 294e20b6dbdd6ec4a4d78cc088655e5876c06e49b042d5a3dd2bc4973525135e9e128a9a2c632f9a7fbaa9ec67c50228faa1ab7daba0ec7c679d3c3ceeae8084
- TLSH
  T11341AD9F0EF53026D25376B49A8FD345A1AC906B100E48523ACCC2E55FA687C97B5FBC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/nodejs/NodejsStreamOutputAdapter.js
- Size 1KB
- SHA256 cc88c3a8e6aa74262bd1ecc452ee8f78c48a16a0b6095d2f9df7500320957799
- MD5 fe378cccb91e45ebf8b5faf510b8d339
- SHA1 122865011b214d0c334af5511d36cab6819457ed
- SHA512 a989bd4d21e18fc7fbb44909cc0569fb5ca92c5d0090863e59db0882ba1c0166e01a4b481d498bb3b1092c575e56b784bca387ba9022465ee97ff1fc2235960c
- TLSH
  T14911ED5A4DF03B11457371E8A81FE2A221D1C267224E88107A8CCEC20FAD0B49BB6F78
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/nodejsUtils.js
- Size 1KB
- SHA256 763d0af1cde619da6d9cfbe1ee82e2e32d86349d8abe32613c7481e8143740e1
- MD5 fefacb3665ecdf94651c534cc9dd490f
- SHA1 842aca3516e6cb8cba0f5a8f2a6aa10efe6b0559
- SHA512 308e67bf01c42af5687306c056f9f1845301473342a6f67ac15fb9d7b1c1f4315c63ddb7a7bb60cd6c33699df1b79e76ae64dc276b5a5171af1c6d5d5d4bc6f9
- TLSH
  T17E41ED48AEF692110563796103CFDDCFF164E05F276848817CAC4DB82F946F8DAB22D5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/object.js
- Size 12KB
- SHA256 51f8d689e02f62837edeb449866238cf03df7d779d260d19a683abee27651273
- MD5 08968390a420c53002dbd733024b357b
- SHA1 e85ca65b74bcba38e83013859f9535cedadb7c42
- SHA512 9e127f85ef99ed1db10548d899d856da210e71575f1f4e2459c61de2d08abde272c6da33dd3d9612f3d072216b2002cb59717de8f69122b6e991296985af20e3
- SSDEEP 384:poZYGJmKS73IRwRxC1N0wRHYWlW9WJB3VDG:4lw4oYrYK0EBM
- TLSH
  T10542859D2AE76222516376785B8F2448F238C00F236CD8517D8CA3E07F90A7496F6FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/readable-stream-browser.js
- Size 441B
- SHA256 ed51f0a96964f61d5700b6c681b055dd07e27140f1b719d2fe1c64fd14b506e0
- MD5 72c894328184433f38138c85558fe0ac
- SHA1 1cc48eaeb6efb47772fc22bf34c9741db98ce506
- SHA512 1ae55cb9586b9ad563298960454076002986127315a59bd2516365ba0af3c4141d032405945ecdfac28ee9cd43cecd1c6db2dff25088c5d640c3dc124d0cb967
- TLSH
  T1E7F0F18AC9E873336A0B5DD1D70B23EB87E6E0CD2A11E101283FC3484D28D884377DA1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/reader/ArrayReader.js
- Size 1KB
- SHA256 bb711509472587e8c88e8e311d5c86bde76528286793afbc6573c1ddd9674814
- MD5 e5e893351f69d45458af1592603c70cd
- SHA1 184f88d4a89dff8a1f58f7ad9779cf5ae2cff59e
- SHA512 7143dc3ab2b834a346b728b9983a0a810375c62246a6e90933b2181d8bdc4a4be9c4be31c3c0bdcb8119e31a1acb559261a984d6c9b8107b6123bb89c8d94237
- TLSH
  T1EE31699E6BFA381089F271EE9A1FCD417D62A91F4149A008B91CA1CA1FC8414777EF38
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/reader/DataReader.js
- Size 3KB
- SHA256 e8e0b4728ddc6fc3dbe5b449d87b884c4b3be99862bd1edf6a700ecfb3b3b247
- MD5 52ee7ee2f16f00cbebd608cb72703f0f
- SHA1 bbc6b26a138830b8b92efdaf7bb8eba181142aee
- SHA512 d87ce6635e41e6e676816ca1cfb10984f980eacb28d711e78ec463e424f7f1ab0ccebfbe16ee6fc8ace134c8df54191cc02bc0df6acc373b7cac4b9e64352f25
- TLSH
  T10471540FBFF95222971738684B0E58C0E922F12F5A29C648305D12F41FCEB34D5AD9E1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/reader/NodeBufferReader.js
- Size 519B
- SHA256 1703f32f1cba687ac630690901848ab07a1b6a06b0e8fbe88a8ae6f5a67da84d
- MD5 f78558839b5346db160f24efa6276c67
- SHA1 8c1d025c72fedb2ee45197016dc096135b545a81
- SHA512 47dfc850580e7602572e7201164459b3af5ee4b2ce1f02701a73982e8c96c7fc6c51179cba625182f695ea544722321166310c71886babb59773aa7282ccb9f3
- TLSH
  T130F0C9C22FE93C43A22CA2C2C78E8D8324D1CD680249C208B2A540DA0FE45B5B0BDF38
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/reader/StringReader.js
- Size 1020B
- SHA256 477a2e887eee11a56a50726152327b2a4d75d778f96463933197706e1ce90d59
- MD5 2b9383537d4faf477d929f8fe2692403
- SHA1 114bba041636eaec5cf222d3823800e916d37e13
- SHA512 92257234029468c94244fecf5d942195f812c1218b04112644b42da839a415fca2a955680070cd063ea9965a8b555681db7c83116a0e73eb0659c60ff5b48e47
- TLSH
  T12111EB9A2BF63C2057A036F0D61FCD046A96BA0841CB8045F6AA80DE1FF8415E21EF70
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/reader/Uint8ArrayReader.js
- Size 652B
- SHA256 198816389bc1c62b3ca7c5c6f5fdff1b076f83e5bd74b37ee5b504e6d7e155d9
- MD5 373c25095f4342f7582735c0997940ab
- SHA1 7ab3d1d0763745c14dc6b98ddee06fdeb2aaa5e4
- SHA512 29c37d1305eb3c5c70c7f3fefc1e6fefb95e9c479d3db05592f9f7d444ebd0a2bbd72bca31ae598dccad7faff3695666d263b8776a976c029d68df6c743f2172
- TLSH
  T126F023862FE93C80D61ED1C0C38F8D0360A0CE2C0145C288F51E8CD59FC4431BA19E39
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/reader/readerFor.js
- Size 904B
- SHA256 1eef5a73bba844922812893f9a7e01cfdb54072aae42f7ecf67c41dc925ea9cf
- MD5 09ebf51540b302be8396f6bc68bea975
- SHA1 0e7049ce13a64417d7e06de2d45aa1585bc5d3c1
- SHA512 8b4cf433a1aaecd7585226774a8e19cc33e47afed815af2e6f24418cb720bb2dc6eef826606ec4f6294ec8468d701b3efe6f3c2c14ed0ec905dd803ddc1f8086
- TLSH
  T17A115C807CE73C50021774E6D1CA4C8315C4DE7602D4D0A1B60C896F9BFC0F9EABAB98
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/signature.js
- Size 294B
- SHA256 18e10348490604003a2480aea813a6e90eaaac26c050d559c281618b9aaded56
- MD5 a7f9d2bd7d5c2d3ae7d13fcaa473f85c
- SHA1 7323b6a0232fedab2fc244a2467a311f747966c0
- SHA512 0b049291cd465fa479a34fb187cf983f45a659a71025b112d831a156ca300f6d3f56da4a22436eb4ac964e101e5f3fd1fbc16d3564cd2f2f213a9c2cf8a06417
- TLSH
  T149E017EF4B63D6D6861580000F0084988A4A398B7B4847B28F20DB1370FFCE048B3975
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/stream/ConvertWorker.js
- Size 648B
- SHA256 ae1dc8573bab7e5be4a4cb9958201e3e763cb2f2392a04d9a8dc440d683042f0
- MD5 37ad3c383fafa7c54d07db846e3b0b27
- SHA1 f14509307fc82511b1056e20c70b07f744f33c6f
- SHA512 b606edaeadefe805a9d10652d84eedc31d27df2794e6b9eba199d57447b8d0b23bb41a90d784133ba42f368c2044b14a2d42c419503afd4a7142f25dba02f210
- TLSH
  T138F0735F36F5A81472125FC0D74AD305079C42DB42956261774CC3E50FD9851A7B2FD8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32