50c7835b31bc736d0b5e5f894aa8ec08a95185873fb64d29a95727d2859107d8

Sharing

Copy URL Twitter E-mail

General

Target
geany-2.1_setup.exe
Size 26.9MB
Sample260621-etvsjsct8v
SHA256 50c7835b31bc736d0b5e5f894aa8ec08a95185873fb64d29a95727d2859107d8
MD5 23250e9595bd432e8fdf111179062ce7
SHA1 01bdcba989f9d19eb5aaf51d99fed6f0d2703d7a
SHA512 c33732ad5146e3dc320d9e8a3157ac360a2e3d3053f9d155d3afe5ef75d82b17a7ad3e22caf2ab4d6fb32356c4a4b77c1d8f61e0a3103b001f0a4ce121cd7438
SSDEEP 786432:2NjTvrV+/xKjfm/4FA1XRyqj5uSbw5MY4o/N/U5:25uxKL+dRyqj5uSbOM4hY
TLSH
T14A57330972B4D8DADC944FF4C9F267F7506E3DA61E2D00A725C9BCDE6825492DE832C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  geany-2.1_setup.exe
- Size 26.9MB
- SHA256 50c7835b31bc736d0b5e5f894aa8ec08a95185873fb64d29a95727d2859107d8
- MD5 23250e9595bd432e8fdf111179062ce7
- SHA1 01bdcba989f9d19eb5aaf51d99fed6f0d2703d7a
- SHA512 c33732ad5146e3dc320d9e8a3157ac360a2e3d3053f9d155d3afe5ef75d82b17a7ad3e22caf2ab4d6fb32356c4a4b77c1d8f61e0a3103b001f0a4ce121cd7438
- SSDEEP 786432:2NjTvrV+/xKjfm/4FA1XRyqj5uSbw5MY4o/N/U5:25uxKL+dRyqj5uSbOM4hY
- TLSH
  T14A57330972B4D8DADC944FF4C9F267F7506E3DA61E2D00A725C9BCDE6825492DE832C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 11KB
- SHA256 effe60b43463322863e8418f82c53289361ef01bf60356500a2b48744fd6cff7
- MD5 3e28273accd1599f3b802132fa886d70
- SHA1 08e4df00b9fa354e2a06c2502310eba2d28b7aa0
- SHA512 d94c7e41706b774b7eb43ac4fdf5b25ce9591be6ba3db6ad9a1eb6a7383e3877180edea113074106271b311783e042cfbb21f1aefb48a4b43a2b6318284f12d6
- SSDEEP 192:HvJ9J/0aKTshtOJ1KNzv2UiiBo5BoYbK:HjSaKTsh8PK5vFD
- TLSH
  T1CF32D73E7ED141E9DC7AE334E0FE9A3465B2B414193A670F161881CBBE71BA19C78B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 25KB
- SHA256 b3bced739f46db4bdad114313bb3a6b35b4d6968f0b7721e987d30dbd0cda354
- MD5 da70fcd8f401abd9c8fa6a2dcc2c07d5
- SHA1 480921eadce0fb40473029d09b29cbf2264bddfc
- SHA512 498fd32e1a40987e4a52fecd7a59b22384740e2b3f56d0b4a5c8f012e085683584fa542ba4b827523d02ac7644fcdc2f6b52afb8bb41107827527d9e444dcbeb
- SSDEEP 384:5lTiMPpf08L+1BK5vZEKDSK4oksRkJk0njEEKGh/Gs:3fa8L+iF+ZPkkE4h
- TLSH
  T192B23B0B73D258BDC617C038D5EB8BB1E233BD412235BA2E1525F1366D75EA0CB1E58A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 7KB
- SHA256 633d83da20a8422a9841f604c01b3ba67b141b256849808716c118e136236721
- MD5 65960ce19034a8d411befc4f175e8335
- SHA1 244a24e25f072fb828e7f6b778f9930cb2e8a814
- SHA512 70d4924356efc4d31ebdf77a905d8ec31458f5be87f50a394e7c8f8feb8fefa98ed40eb245ea307d5ff9c7bbe8b257950f94276e93877fcd38e4bfc20441cc17
- SSDEEP 96:lyubewoiLOeI/Zhu0uzkrVdKNzv+2uKKbuajOS2gwiCsJ8rdbVtKbdj:wuC/h+BeKNzvuSW/
- TLSH
  T179E1B94FB3A12A96C456F27CC1FA5E227CF77D345536621D480111263D34AA1F335746
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 fd4a4deb99ddc9911846588d8b2d51021345007a5edd4b84ba99d974428400e7
- MD5 6854cf497bfac20ee60c6d41013a0a0f
- SHA1 cdd66550642d036aeda133dc32ca64a7d3a8429b
- SHA512 b1fddd5966c701af77891f7fd9ec4c628d2ec6267e0fb38c46c4d6d5796a64ecad04e917d5563f6d8589937b3e48c9cf0357722f0ccf573afe6a064c6ff5c2c4
- SSDEEP 192:nT8A5opfXXnnHluL/JZbFp6CLjKNzv2HUVChrltyHpE/HsgYsgxlSv:nTmfHlutZbHRXK5v2k2lcq/HpYpxl
- TLSH
  T11552082F3B469299C81EE338E5EF4B3297F3B8255635770E0359D604BD91A61CA3C18C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  bin/geany.exe
- Size 88KB
- SHA256 6d65730f15e1dc425046412ac243e492467499d41647bc15090e93fe3768f016
- MD5 ecb9fa3a2bba24793e98aa3f53982c34
- SHA1 597941ece2035b036c07cc887fc619b45dde75de
- SHA512 9df9fb602833d37ce705b759a9fdaa7bc716be3db4867e6aef2d9c5fe544c15d5394b7be24986ca01d053c55dbd8250c76759832b3082c64651946c4d8b82c21
- SSDEEP 1536:sKtyQtTreJyB0h5GhXEUbxB+x80IuyVDHQ1riv0nBLD+g:sKtyQt20BgGhpbxUxFdMqGv0nBPX
- TLSH
  T13C93AE95B642D0A9D254C2B0CCE38BF6726AFD12CE1406273650FFAFBF764935836206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  bin/glib-compile-schemas.exe
- Size 68KB
- SHA256 47e635853af96c2257d500ad3a0eecfe82630754394514258a1311b5362e7440
- MD5 8ed757d85ca14df74c1bd84403b23ee3
- SHA1 8adf46a98c8548a3018a7f96de4bd7f301890788
- SHA512 eeba3a89f4e18239cd8d44123a55b354fc86c64c475ef14475641f0b41463931103fbeea7f0ffa0732147d1360a20716f82a79dc72129cd26acec72ad86fb412
- SSDEEP 1536:pSzPoEczGYJ20zbeMfDARt9tTH8sRsmW4eoOPO:pSzF8B20zCwDKcs234eoOPO
- TLSH
  T18163183BB181169EC494C2399DD9A232F339B41987357B6F5B14E2386F60F680D2FE19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  bin/grep.exe
- Size 392KB
- SHA256 b16888cb14bbe12d9685424aca9477206caca5857e3fa11b15c690ea8d49f9fc
- MD5 343b51e6a3c79444533692894694170a
- SHA1 5c2a67878dc4019ec91baf1a2eb0b7228d5930e3
- SHA512 41da2f2fdcd9070a93fbec5672be451d3bffc1ae37682e9137c0aa05ffe5c25e7a8ad446cb2275ce9a0be1c12f71419f443413f76e9a531b3202cf0f011d0c69
- SSDEEP 6144:8BfyrvPNhGCNJX1YmYLWEdlKqGZYApXoUIT:8Bfyr90yX1Y8E/VQYApXoUIT
- TLSH
  T145840817F246A0ECC5AB81748983D7B2B572FC154A207E3B36A0F73D2E71D50AA1DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bin/gspawn-win64-helper-console.exe
- Size 24KB
- SHA256 5e38c633d0a7e2872ac94885687ab85d87591a0e5c06f7404d5dd1f27e2a4e79
- MD5 ddc260b2aa2a8b579905eea1746f09bc
- SHA1 643a723e7fcfedfbf043b8c7fbd4ca49692eac5c
- SHA512 6394bceab149e5106c52577c4f9f5a568bd3153189c1433e42079c3cfcd9534ea472d63fe4855bacbcba956aea8d9b5efc4232810929deb739becd4ee470daf6
- SSDEEP 384:vVNW+GPNJbJn0pBZAOt2n8/ZylWWeZySCTynBCWdGlelO+N:dNWhDbJ0pBZl68RywvySWpWdGlWO+N
- TLSH
  T18EB2F93DF28368DEC656D238A8C69770F5F9BC118326773B2654E234AF71B92482A135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bin/gspawn-win64-helper.exe
- Size 25KB
- SHA256 18ce5927a1ef1bb3403249fc171569d93b362c0f72aa6f3cdfdc88cea15349ff
- MD5 98b915f973b33697268581f0a2a8e453
- SHA1 56911b8829bf2e6e964e01ee308e32c342727065
- SHA512 0b4ab6a0f7cb0ebb28ecbfec7f9a48af2aa459875ea73fbe5dee3bd34f660b5ecd95d71f2debcff36b9bff3caa64b18d7a48083d522c95515e503fa1948516af
- SSDEEP 384:1yft04PiZ7MZavM3eLsUNWjKnl82WXXH993e7XBCW5vSelO+k:1y10m077U3NqWjKO2WHH99uwW5vSWO+k
- TLSH
  T1A6B2E73DF64758DEC541D278E8CA9731F5F6BC118326672B2684E138BF71B93881B125
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  bin/libLerc.dll
- Size 743KB
- SHA256 4ab688c7c5c4afdfee0f519f942759137067a7876a1c1bb825ee575b0a5760b1
- MD5 455fbc3b200e6a80d424e8d35a4376f9
- SHA1 401583155e536fc0d9179a6931f737b828ae172a
- SHA512 e5553b1cb9c95eeba7c0ef8b8e37ccfaa2a38f70dba5a24aa0c83cc2a95aa17902775c161efae3f3c950056dea2dfccee6b00a273914962bf606ecd061123721
- SSDEEP 12288:Q237C2QB7txCqagUD+Czymc6+r+RqlGLaQcgWCjFoKd:PLszEqagUD+CxLaQdjFoKd
- TLSH
  T133F45B86D19394ECC46BE43043B6B623A9723C6D413C6D7B5B81EF342A6BF509D1B728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bin/libasprintf-0.dll
- Size 135KB
- SHA256 11afa13d276b7c87e8fb7619a26ea5a090001e00722a27bf6046a593052e9539
- MD5 62a5894ebccee0200b805566d3eb38ff
- SHA1 90c9849adcc611a8e097bb65829a52113dad6817
- SHA512 2e570aaa51351c252e993aa4cfb72f15dcdf52affa1ac928b7d197638c9814ab6360e7c5bbdfa4141a468130241536aacf47453f7440e467dc46f0e199d7663e
- SSDEEP 1536:qm8V8h9/+fW0xXwnTA3SM+5WqNr+qcAbQlFCQelQ2QVIV4MZ5+0tCXZ5+09sbXK/:qma+9/+PpwnTeE5Wcr+qLC8Q2PXKVbFr
- TLSH
  T185D3B407B342E4D9D46642744C87D7F1AAB2FC211F20ABB73270F37D2E719859E0A666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  bin/libatk-1.0-0.dll
- Size 156KB
- SHA256 87e34d64ebadb8b295f598d1c15655228bd82838424173314443576bd826a90c
- MD5 333be0fe23e1745528e32bb43abc9515
- SHA1 37ecef97884feb0f453833e3b0f02b37e0191624
- SHA512 b23fdd065159e037f58a1bd984e7269bd6c89ec6f21a8051d39e961877e60f184f7355e49dbc2194689fc235792a01e099d1f07bd6ac174f3e27dc7dd5d6d001
- SSDEEP 3072:GQbmCRKahzwLfdzxyCJC/c7z+bNwsoEF7RTrT:4CRKCzwzdzXONbNt/79T
- TLSH
  T1C7F3D42A6292648DD9A7D234C5679722BF7230206331F82F4F60C178BF61A39F95FE54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  bin/libatomic-1.dll
- Size 36KB
- SHA256 54aaa5f8b4a7315e328e197925b0826a12773678b00e726a5a292fde84d518a8
- MD5 3dbab7d55bc62728b355c66276ebb249
- SHA1 fad477957bc886ca5f1c1eeb3377fb98e8641db9
- SHA512 776bf9c74d3d2d1834b9c124ce9f89f335a98078b5a4a1ed21fe588d148b1a26d0b8ed31ec6f09aa3e8a752bb4762d6379171ffbac73862393b687018ee23cbd
- SSDEEP 384:am6sKr3lkhrXLLznDYogUgqfn559DGJyChveHeeanTHvKO2eG4ikwLUaX+lHHHHW:h6R6LHTDBgIfmIL5EHHHHHv3jV8
- TLSH
  T134F29576B606D4A7DAD9D2B099D2CBB1F014FE240670F53B3394F2EC4D7696AC80DA42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bin/libbrotlicommon.dll
- Size 140KB
- SHA256 276a12fc7249af3fdd604609d4a46386082f760324afbd83008f72edf304880a
- MD5 8a1196e906ed54e4faed5fc42184cd58
- SHA1 017ea336186566ece0520d69f787c30e6781ba7e
- SHA512 56c82809f9e1bb87a39b600aced3f5638cffcba0f62a8bfec90fd0e2e9c87886c42d8fd9d2923f449166dcb14a342799cb56c7379e89a2fb193bda72fcceab7f
- SSDEEP 3072:f77G1M4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBIYkhs:j774AhdNorGvHdbi09GJmYqs
- TLSH
  T154E37C61F3051337C66B627AE49A6BB9F375817493630521B4A942BC60C3CA4873F7EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  bin/libbrotlidec.dll
- Size 58KB
- SHA256 368fa8da7478a441e07ff1c6ab2d20adc8e16b2dfe4dc9231c51f600e914ed92
- MD5 dc4ac5e7605909a9ba03fa49200c11cd
- SHA1 125a6c05c8323457f7dd2168223cd50dd0b94f9b
- SHA512 5046dc62c57c27fe266a79ebb124b896a653dbf88fca40d0a509024ba0236b404d19899cc65364b1ba29d099f7122148044d7b4580f8f8533af36b012fa2e1b6
- SSDEEP 768:ZU6aXhKt/pLb9L34LhLbQELwLMCl58p+4yVsZTTzaxdWntazQxARbYs3PKqtF3iT:HaRc/9ZoCcpDyVsxT68nu9F3iT
- TLSH
  T1E6435C12B6A3B8AECE5B81788697D772FA76BC151311EB7751C0F1312E23E60AE5C424
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32