b1f3b275652a282aa6f245d5ebe9378707e0107d45624d2375f9556c108c82ef

Sharing

Copy URL Twitter E-mail

General

Target
trezor.rar
Size 425.9MB
Sample260623-k8j79aby9s
SHA256 b1f3b275652a282aa6f245d5ebe9378707e0107d45624d2375f9556c108c82ef
MD5 0c18d652dcda1cb99abb94be839bbb7e
SHA1 1c8a2bc878c9d377700463fc20d2d94c97fc1810
SHA512 66e9c790f6fb9d3d52aa5edabb7f5a9e179364772af2a20193a07b8bb016ac41c4d5f257363ced760e617335199c7d9f66aec7e9789840ba9dfa83a5d55a7d56
SSDEEP 12582912:F6T9Vf6v7i6BcQ9NG0zP4uOmpKWSM3jdTs3o2S7YKEyu:k9VCekNL/vxTcyYpyu
TLSH
T1FB2933D24AB61DBF4863213B7B72309BD730EF3E59483B9A6EE0BE5272D4D036855109
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  trezor.rar
- Size 425.9MB
- SHA256 b1f3b275652a282aa6f245d5ebe9378707e0107d45624d2375f9556c108c82ef
- MD5 0c18d652dcda1cb99abb94be839bbb7e
- SHA1 1c8a2bc878c9d377700463fc20d2d94c97fc1810
- SHA512 66e9c790f6fb9d3d52aa5edabb7f5a9e179364772af2a20193a07b8bb016ac41c4d5f257363ced760e617335199c7d9f66aec7e9789840ba9dfa83a5d55a7d56
- SSDEEP 12582912:F6T9Vf6v7i6BcQ9NG0zP4uOmpKWSM3jdTs3o2S7YKEyu:k9VCekNL/vxTcyYpyu
- TLSH
  T1FB2933D24AB61DBF4863213B7B72309BD730EF3E59483B9A6EE0BE5272D4D036855109
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral1 behavioral2
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

8^/10

ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  LICENSES.chromium.html
- Size 15.2MB
- SHA256 7700bce2a052ebb6057f5df06f605e01e9b6677ab5d53ad4437b79d22185e4f1
- MD5 4ed0035d5ff6bc2b031cbe525aad27f7
- SHA1 488c3fab5701ce0a6ff8f167fe9952e318aac857
- SHA512 701347dbf819546e8f2267f11f5e9348183b24e45879edd43bf1df6fac3be02a5b7aab86523f0ffdc07840457e47c62e475b49af5c31f11a60c8315b0ab0d8ee
- SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+U3r8xd2zJQf8xF6DNgQdGxw:C
- TLSH
  T127F6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  chrome_100_percent.pak
- Size 112KB
- SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
- MD5 129f8cee761c5bb414b2270356177f6c
- SHA1 0a10b55daf24c7f9fff1b22f853dd87a98433b7d
- SHA512 33f4ceb0ed18b2172e2f6d203ccab2954dd900592b2e62ce4a1019ab9404889ebdcf462a2479f1847c01b2835473e83859c77816e83ef76ee133990be3d55eb4
- SSDEEP 3072:DS4PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:LYWFUbGz8LI1TnjQBQCrC
- TLSH
  T136B3D0D7B3B09D7DDA460BB783560170FCB31B2D06C2120A5A9AE479652BF88C8D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  chrome_200_percent.pak
- Size 182KB
- SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
- MD5 ed7b4e5eb15a086ce7e117a3228e3f15
- SHA1 bb6debc27ed4e2f20149a17e36a24ef4482a96a7
- SHA512 7278e0acdd8a1806bbdfd147d5439f7f849fbf95f1be1ffb741ea84cecad2557469e99f91cca66ce36349a9aa55d0107e34b9499b8fcb3e7fb3a8bbf84c1e911
- SSDEEP 3072:CJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:7GQ+N6uSZQDQYakvyAkcjQBQNd4
- TLSH
  T1EB04F1D723B8AD3DD9570B73926610E0FE7A20291EB3110A5A9FD8397925E8CD9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 1565adbd62a0e8ba2a8b25b3da5d2e2a45032c13aeffdd061228abc3ee5c1585
- MD5 a41223961c47f5e60f2a83597ccc125e
- SHA1 d3050c6e99fa83919ab02e3c7b5d8c40eb566200
- SHA512 7a25b88a9d044cfd471a6c131d85a82ab395168e069204117fb0176e3b393c549b0be23794e48b3ea09f6cdbda83bc20c90795e750e579c9989bde6a19dcefef
- SSDEEP 196608:ysq7jjh1u1/1i9iJj24AD14c9TR8Z6GmfozCEJdXqaq:ysq7jjh1u1/Dxc14e8Z6GmfyFqa
- TLSH
  T1D04729122646D49DC059C879C7678B268A6C30E73FA7B8EBC0F451252B79EFC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 26eed00c4da27de095ba76030b47bc0436ba659a7443e05f11ee162dc225e828
- MD5 38c4d1074280e903212f6b4bf7e650b9
- SHA1 fdece1b93bbec86f949eca244c780b6809ffb2b4
- SHA512 0904363e03102b8ee72b172ab02b78456472a5c726fb1c6b990713c640f48ac16cebb2ac2374dc82a62aeab589b46b9c851493b5768ed28c1e8358d81bdd8e48
- SSDEEP 49152:ncHnAGZ5/wriV8Ay6AC6L6BEH199a1LKIbQ7k6xQv8VNoJHfmX/6s6l8b+:cHnh8F6lC6i9rNoJM4g
- TLSH
  T11AE59D03F6D651EDD019C03497AB9313F631780A4F209AEB16905A223F67FE86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  icudtl.dat
- Size 10.3MB
- SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
- MD5 5bfd3eefca4b5ef2d1a869396390a7de
- SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
- SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
- SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
- TLSH
  T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  libEGL.dll
- Size 503KB
- SHA256 61ebcd780d17d37ec09a5eb7ff7399ad67726a5a1ff73be1c37734551c3ef1fe
- MD5 e2125f8574719b50c955f8b3e9444d68
- SHA1 75ef9ab467080e726eb8f1a906deefee5c1980b8
- SHA512 8ca2cda69c61aa78ceb2a869cf757a68365bcf801892ad7250807ce77ba8312fc54e6347a381cb399c92337fd43aa82518973aa92345cbfae000306a117414ab
- SSDEEP 6144:dQ4VIVcVQMLMVwCtKpDaLnjSFeN+a+BAiLm4LiE0z0WhcEuvBLPdvtYPqQa:dn0iCZjF+CymG0z0WhcEuvRltY
- TLSH
  T147B48D15F3E84BA8D07AC0348A538646EB7574960B65F9DF02E052792F3BBF45A3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 b35d3337ef4cad5423f4e11a06e280763deae634f7e39c7844e4f0fcb455b3e9
- MD5 c9b6de9b18d0f5dda94589cf038e1bfc
- SHA1 6fbb1ec482e6c0988a5b5fe84b4ca9695d960039
- SHA512 4a59fa62445ace0b27d51ca246b02d5e9ceaf6a4edee2d02051aad52de63b70376406347fb2ab97e42a9d70f3844dfcb0c2eba301bc54a3902b8c11a316f7957
- SSDEEP 49152:4upJ61ZvUdnnnzCwAOqBmONJAbLfkcO0VsWkgp9rnnG45/ifbKnNdCusheIYklbo:LeCXaoJl9aWNd5JIBhhpJK1Ixe2l4
- TLSH
  T1A3867B03F69681D9C05DE278875BA623FA34B8450724B7CF2A9453162F66FE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/app-update.yml
- Size 197B
- SHA256 615ef877f137b25f95750adac74c8cdac26de7bf96dc67ad99bb9f861585b0b6
- MD5 afb4991674426adbbb285ac464334b35
- SHA1 51bd9a2361d56c71767edc075f7784f947fb8ade
- SHA512 e302c1d94dd586299c09e5c6e0f4fd10feb0f35c64b8628bca57d6fbb4a0787ef219656c0bd53affa89868624a6e22960f2e3b56278c959b8eea3724b3314345
- TLSH
  T1C0D0224AD72BB01143200820AD5BBC38FA878A51C0921020F8E2880843028A0C0176CC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  resources/app.asar
- Size 955.1MB
- SHA256 e45f93175ca557a9d4380ebdc2b57ebb8704089f36cc4d157fa6f1d4c211e9ce
- MD5 7054199ee3243cbb984bb6a92eab14ac
- SHA1 422b3ec89da94685ce67b9efd8c512e22bba5aa9
- SHA512 06302bec46d063a50e4f67145c5fba08fcf872401475e767ac7f71bcb5d32859f7db66afaad8367517a695edc22d7fcdc4d43fe2ae591ea9162e1da14ad89987
- SSDEEP 196608:OM2WM2MIMvnwjbTPdC7J/iVFkIgnwLcy0v2LH96G8rSE2jNmKCG2Wz2onDUZfq5Z:OM2WM2MIMYrAQQy0OTwTrpBVG3MQ
- TLSH
  T1EFA91A554E592C299B892EF2BCCEA6F7128F1702282114D9B85EB45713F9C4CC7E8F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22