766d2d9155604a9b8898cfabc910dd7fffeea5940d051fdc9edbcfdf23c5465d

Sharing

Copy URL Twitter E-mail

General

Target
JuiceWRLDVault.exe
Size 97.5MB
Sample260623-e5bttaas7p
SHA256 766d2d9155604a9b8898cfabc910dd7fffeea5940d051fdc9edbcfdf23c5465d
MD5 d9e8618d861e07930423417ed0e5cb30
SHA1 060dc0762089edac98086e811f960cffe8ac1d80
SHA512 9dec6fe0e885115c54a2d60bfba2f615563609f91f16e92a24f5580a3a6132771d72b0680022fc6006b9dd0062242669bec835f79a99950008bb2f387b90d359
SSDEEP 3145728:I6M9NNNKNq1OP8rDLQ1c+jLu7pMr6PAmHPb:49NbKNqtHLQ1c+jS7p469HPb
TLSH
T116283391B88D9423CC43B339EEA0E75BD6502FCAC0A001679F59BD74D23C94B7DAD8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  JuiceWRLDVault.exe
- Size 97.5MB
- SHA256 766d2d9155604a9b8898cfabc910dd7fffeea5940d051fdc9edbcfdf23c5465d
- MD5 d9e8618d861e07930423417ed0e5cb30
- SHA1 060dc0762089edac98086e811f960cffe8ac1d80
- SHA512 9dec6fe0e885115c54a2d60bfba2f615563609f91f16e92a24f5580a3a6132771d72b0680022fc6006b9dd0062242669bec835f79a99950008bb2f387b90d359
- SSDEEP 3145728:I6M9NNNKNq1OP8rDLQ1c+jLu7pMr6PAmHPb:49NbKNqtHLQ1c+jS7p469HPb
- TLSH
  T116283391B88D9423CC43B339EEA0E75BD6502FCAC0A001679F59BD74D23C94B7DAD8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 96.5MB
- SHA256 b792f4d52ee75d7913c5a8db4d11f7e06973d5a5ed16d4b4fc34b0141cebf658
- MD5 15232c532f7c7ecf623167a064d37bd0
- SHA1 e69ae9509397e34a6512f19d5aadbe450a9b0da4
- SHA512 e272f36d38d21b495d3bc50256829391119592e975e40ccd38b63b52f9f40108e89948d2bd2ad035fe103de67283d50fbd637b49bca0be207b35818cd30bc1e3
- SSDEEP 3145728:IM9NNNKNq1OP8rDLQ1c+jLu7pMr6PAmHPv:l9NbKNqtHLQ1c+jS7p469HPv
- TLSH
  T1792833D1FC82A574CD87913EB1A0CA5B56202F8F00D114779C6EFEB0533895E6DEACA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
- MD5 750913d55e87def9108e55728ba67d00
- SHA1 a5944bc170d1f6c3223195c043134566471dae1d
- SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
- SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
- TLSH
  T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
- MD5 d476c19d21b3c2861f08c1c82fffddcb
- SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
- SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
- SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 c5da2fc389d1bb0ecb13fe22a8e069b7abc491f8aa5d16eb65d4ff32c85a46b6
- MD5 5b29b82022f9697b3010b05b2a71535f
- SHA1 eed88ddce48046b1a5c5fcdd19cd9c5a81d8c4bd
- SHA512 bffa945bcb95b13e69a438afdcbd6d5a490db902896ed4380c7d7c61a4e53b35d73d44d75eaa7debae65e308b01b287411f168ea4377360045afe8a6b9cfa09c
- SSDEEP 98304:D/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndP389o:D/cBhORok2HiXUxO/RJk3IWhlYntjdqo
- TLSH
  T179B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  locales/af.pak
- Size 605KB
- SHA256 dbf68bf3227181d7c047161c6c704ace32d6880bba6ea02bfbd33475f3356e91
- MD5 a4eba95df91c6061061cf1c99f1eb484
- SHA1 244dacd0fa028d7d9385105e49db42e55be49d2a
- SHA512 aaa137e5e819df16efb41b772620f07ac78ab9029d60a1da4d05bb4d74820632d3ddc087c7d579bd2c255a30a77a7a47a14c81149de60f6d2cf4a2f3e27dcd3d
- SSDEEP 12288:l+Ifrr9xi2tfxgtRGt+TkTnPxxNtEKY+53GANAn4H2JynwN+kgnALzcGfozvhpIv:ZvZtfutRGt+Tk7PxxNtEKY+537An4H2R
- TLSH
  T1A3D41B0AEB91173D05B07696FB0945B7FB9CA26CC770B2BADDA982310566DFC10BD0D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  locales/am.pak
- Size 983KB
- SHA256 8d3d5dfc64acfbb0c35036d74561d09ddf3b22058eeed0f8d26a2e9c0703248e
- MD5 ca12f04a04bc27a3a5fe78789091ce51
- SHA1 eefa0606bcf3aa65edc124978f731336c60811f9
- SHA512 07fca45e2c99ab93eda0346550f083c0e0fc7abc50d9610869ed9f558cec399a0b88434b4d8cb5a838acdec7e8b3e7a2a6c9b1171050293647977b15fdbdf109
- SSDEEP 24576:Ueb6TG1orqThTCKHyK6ax0hHfjnNWNT5zaAfX8j5xi8bVdwZtPBE:lI
- TLSH
  T18425AA547DF9F7570F8E8A1994320E4EA594AE4692803C38C35AE3FC2B2DF1B4DDA215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  locales/ar.pak
- Size 1.1MB
- SHA256 3c253eebf4207c416fac047f1f0bf425a7d9a12fe63714667c69841d2550b89e
- MD5 fe6b9d34548806f9faa7fba231ac1250
- SHA1 34106c26f9023f38e26fcc0e73473f9763167f66
- SHA512 b7eec1bf08c303dc793bb958def3f9e8a03d12247cf1c6e5d30a8cd2df200e7f9cfcd9ce46e320107fe014dd9dcd6fc9340e24bfafa93993bfbe5aca510e9870
- SSDEEP 12288:5k9562BGop7mNo2GEeHwjdggzP3v4Uzbgkb2QSVMNjXEioHDAi:5k956dEv
- TLSH
  T1FE358BE21B2984720B56DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 2789212aac5f2133ed23c1f84623bc64eb4cfbd93aef7af751d1221e27a21daa
- MD5 ea6519b0214acdfe80b9ceb590ea4dce
- SHA1 49d14345b6baa6939055d7f50bf0984791481706
- SHA512 28a1ddd55b55e792db5a114fd305ec3631579a3e8e5507a629144769bd25c4e2de6ef9e969ddb037f7945330be02e4951a5ba8a27881fc5e413c2a33c436b84f
- SSDEEP 24576:0KWulJLYAgCzQkEC2U5Vb6IqSsl373ZWmKf3p2KuUfVDrzQE74uOVnQxRfkn4wxI:0KWulJLYAmFU5Vb6IqSsl373ZWmS3p0g
- TLSH
  T1863535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  locales/bn.pak
- Size 1.4MB
- SHA256 e72b72977b40fb10472fe1a3fcffcda8b434bf52e2bb2da2935faa80da224812
- MD5 ae6da45169b7a3fd99da8218c92a1e2b
- SHA1 2552cffa1f63012b2fa7ef6209869f3eeae207c7
- SHA512 8328e598f9c30636d60547a1d31e909b46ab6f92b3c210274c95886294af7ef20552718a536ee55c0a58d7947d2932061fea8e3113b8b331b4ca084501f51c4b
- SSDEEP 3072:Y2M24emMNfpp1pomjwuquXCg/V7hq2XOUU9qygEfK8tRs3F+IBEBbaUqQsjkwgw0:Y2q+Nfcm00yg/V7hJF+IBEBbjwg/H
- TLSH
  T10165EF209C6E81B6A8C5CDC9434C6370C523AE9B9B65F74DDC17A24538ADC3C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  locales/ca.pak
- Size 683KB
- SHA256 bc36a54e977f67a09090d5565f2c5664d5e01dcc4fa01a9b418fe55f32dd9026
- MD5 30d06b7ecad8c2396e12ae2e3830dbb1
- SHA1 2e8bc2fa26ed82ee8da9972d709dc7540c487641
- SHA512 9f3e55d247b76f2874342cdb5325e7b7681e1fbc9cddb7529e58f0e3ac7488dafb8b83d476964a166052af53a3e592baa271cbd47890cb5d00df913dcb6b16d0
- SSDEEP 12288:9mpmaIM7hjzlCiG78lpGa8D5PsF4N3Mw2juwwPR9zejm0t3l7C7ThALDq9wTLX/X:gEajQf0LApMZ5M0wrJhXs3
- TLSH
  T1DEE4F8239FC93B7704D2330EFB46C253A48CA9847A16D254F4AE1B1622CCADCD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32