aae79385234d812ab2716ade0f2b98eb005f9d075bd0b9f8d7d3c646a74d1736

Sharing

Copy URL Twitter E-mail

General

Target
xmcl-0.59.0-win32-x64.appx
Size 116.8MB
Sample260624-la8zdsa161
SHA256 aae79385234d812ab2716ade0f2b98eb005f9d075bd0b9f8d7d3c646a74d1736
MD5 503f96197797146ae2568a770aad8111
SHA1 f4627824830c1b87a317415c853e84b14fd94095
SHA512 95d5d3b1f2bd96edd7591746479699d521d19755419f139c204533ab954c5fdfd00ddbe73830b6354fc26b8dc09112d2bcc5a4ffa197cddfcb145e34a8d93c8c
SSDEEP 3145728:FQrnA08Y09aDe8tjy3f1M9xmAOQjx8HjKdAumZw8:onp8YqaDe82koO0jKeumZw8
TLSH
T13A4833F77EF0C4DBD8DBD53359DFD5F80202A27AA971891A04C8339FD46B060B269A52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  xmcl-0.59.0-win32-x64.appx
- Size 116.8MB
- SHA256 aae79385234d812ab2716ade0f2b98eb005f9d075bd0b9f8d7d3c646a74d1736
- MD5 503f96197797146ae2568a770aad8111
- SHA1 f4627824830c1b87a317415c853e84b14fd94095
- SHA512 95d5d3b1f2bd96edd7591746479699d521d19755419f139c204533ab954c5fdfd00ddbe73830b6354fc26b8dc09112d2bcc5a4ffa197cddfcb145e34a8d93c8c
- SSDEEP 3145728:FQrnA08Y09aDe8tjy3f1M9xmAOQjx8HjKdAumZw8:onp8YqaDe82koO0jKeumZw8
- TLSH
  T13A4833F77EF0C4DBD8DBD53359DFD5F80202A27AA971891A04C8339FD46B060B269A52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  app/LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- TLSH
  T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral2
- Target
  app/X%20Minecraft%20Launcher.exe
- Size 168.3MB
- SHA256 11a098ebab8fb0211c37952315af6a3e6e68365d879e0a9e997a3251134b05b6
- MD5 2fedbba085f33e85d63e309bb94fd874
- SHA1 1fafd71d51e994b3e6bdda9d91af02494c50ad65
- SHA512 1ea188380f7caa4cd0401de50ee53188a996f6321add53eff0c70b8dd764491d0fd044ce5191cccb6fdf3978bfad5125d0fd20fad378f8201852df76ba20481b
- SSDEEP 1572864:1uyypNwilZHtXIPfWfskdRAYeownb2UDasyBDwsofI6UYcrHjf+RaMF7zllYtqSb:9GVdq2cfxz4VwFm80
- TLSH
  T1E1888B13E2DA10D9F05DD1B18B9B9233EA72B8464738B6DF265407162F77EE42B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Loads dropped DLL
- Modifies file permissions
  discovery
behavioral3
- Target
  app/d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  app/ffmpeg.dll
- Size 2.7MB
- SHA256 b85523bf90c9530075b2e2be09ad838015aff8deb9d30079d9ebac098018c886
- MD5 9e96ee6c0b109f11da9bbcd0dda6cab8
- SHA1 38a3e23c18e0909d7fcd0ca22904ed2dfe1788fd
- SHA512 467d86c509267d3e667f0789bfc9a522eb26d06eee58706cabad10c8ac452650d198066ea52a847fc69e7b3193414ea5ade9ab16679ee2459d00d0882f331628
- SSDEEP 49152:x9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:PpKNMo8rBYinp/FFJM
- TLSH
  T1B4D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  app/libEGL.dll
- Size 468KB
- SHA256 6e83fb51bb527213ba4feaa837bb08fbdf22c8bf3e2b47c01af96c6a09b48d75
- MD5 6e2e680ba3639e1ffdd4bad59571904d
- SHA1 2a9d5f99f82cc6fe0b90dd4f3e5e8c6109612ea6
- SHA512 de78440cb8ac798c517f91c050b32ca42acfca1a91c88ecbb57852c12fe49965ae0adb1b6c05aa3c1925b7c333037bc1e86a99df340e1176583e1b28aa4fc57a
- SSDEEP 3072:lJk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0F:DbTcZ6+lOP9rmD7QMYYtaFy951wj5ne
- TLSH
  T1D9A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  app/libGLESv2.dll
- Size 7.3MB
- SHA256 177b7a341d468c6cf72697e74904d3530756257a50cc0e4db9413444732dc6fb
- MD5 782c411a308fc8bddc09e6bc178605c4
- SHA1 5a855d2d29ed529e932f0b52f88fee97972fc691
- SHA512 7a7099dfb2f7caeb2aff63e935ae3ef89d1b1b6e6138bcd7a9580024bc66c14f005d3ac5fd17a9e573e4498afb4cddd62b643beff32ee673acaabd6d0551de06
- SSDEEP 98304:fcMpNCjJrmxEc9E73vJ9Q+kVLLZXm3tCTTTTTTNG:fjOJG9E3kZLVCtiTTTTT
- TLSH
  T149768C03F69A40D9D05DD2B5978B8123FA31B8845724B6CF266453243F7BBE0AB3EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  app/resources/app.asar
- Size 30.5MB
- SHA256 303676cf219740cb3cb04f8acad29c143285832b28df3235364ee0e4c5369c63
- MD5 dde8c8c2cb11fc813c51253d18d4b1e0
- SHA1 6d67139372b115421a55842405e4dafe04b0e5c9
- SHA512 61268542fa05c98cb64823f4f3b0bc5ee6ea25ab23d6393e8e88ef7391bf12fae7b1804164ce42374d6630a242f3c07cf2bbb08cf9cfa1fd618b7b378d541c87
- SSDEEP 196608:cDkjg5AnOf9Ml7MbqzzKFOTo8Jywk52h7hv:cDkznOf9Ml7MbMzcOTo8Jy4h5
- TLSH
  T1D067BF7A7761383AC7A352B0CC3F0506E1B8A416511483F6F7BCC6D66AB488866B777C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  app/vk_swiftshader.dll
- Size 5.1MB
- SHA256 87276ebd732e3328dd7f776fac1407ff4518bfe5eb1901d509924175ac63fe38
- MD5 01955599229373ebdb88de32aae77370
- SHA1 331b1c87d635ada50875c8c2837ac9f493ae15d3
- SHA512 5da8438f70da15b1127e0cc5fb7de1a71a5d332308f5253a81fbbcaca2a29f41fe02733a3d32ef5e5809ebb446e0d15c7f2db9d99f7231b8a72dca8ee914b9a4
- SSDEEP 49152:XL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:71w7weOqiFIYBgTE
- TLSH
  T13A363803B2858199F05ED179475BA632F232F8801B76B6DF52A41F192E77FE02B39B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  app/vulkan-1.dll
- Size 932KB
- SHA256 6ba7e6a71369ccf0c99c12af4dbfe19389d4b07f70ad82783bef85c475d5c402
- MD5 3e690abcef04104b9f443e40b7ac715b
- SHA1 32d779f60eb179dab67a08de58eb4dd94165c741
- SHA512 ab07924a5bee92d8e4ab1210edc8ccf7915b37b62cae7b9c66831e9f02d55c0594d7f9bfc9916458c572b4ee8da84e240881fbb2bd91874aa722b2321cbebcfb
- SSDEEP 24576:nkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE7:nku0fwhC96Z5WiDYsH56g3P0zAk7l
- TLSH
  T1A8154C23AA944669D476D034C8C28607CAB178912726B9CF03A81718BF6FFF4777DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10