1a5b70ff72f06a5307889cb12d6583551b8cdc2b8d4d9e8a0590e1ed8398203b

Sharing

Copy URL Twitter E-mail

General

Target
Earth-View-Setup.exe
Size 78.1MB
Sample260624-w3vbtaew7z
SHA256 1a5b70ff72f06a5307889cb12d6583551b8cdc2b8d4d9e8a0590e1ed8398203b
MD5 38e821bc679a9ec8e5853aa36cfee57d
SHA1 75385fb9b9730c4f197b9f332647dadd5f14fff6
SHA512 df72a12aebb4220dbbeb16dd3aa25d443110b268ea2153600e8d463cc1a7507f6e3e15b6a2c3749bd97f954986eb9a0f9766b5bbdf1cd97ea8fe2af9a83e5cc8
SSDEEP 1572864:r/2/fjERm/5EUjQoaHc2i0Ul80dTOQcelKwQ4K7K+ehze:rc6oe/oa3UBrcelKjmrhK
TLSH
T1520833043416C4F3D39667727BE57132E05A2C0E2F9908D9A36DB094F7B81FB9076AB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Earth-View-Setup.exe
- Size 78.1MB
- SHA256 1a5b70ff72f06a5307889cb12d6583551b8cdc2b8d4d9e8a0590e1ed8398203b
- MD5 38e821bc679a9ec8e5853aa36cfee57d
- SHA1 75385fb9b9730c4f197b9f332647dadd5f14fff6
- SHA512 df72a12aebb4220dbbeb16dd3aa25d443110b268ea2153600e8d463cc1a7507f6e3e15b6a2c3749bd97f954986eb9a0f9766b5bbdf1cd97ea8fe2af9a83e5cc8
- SSDEEP 1572864:r/2/fjERm/5EUjQoaHc2i0Ul80dTOQcelKwQ4K7K+ehze:rc6oe/oa3UBrcelKjmrhK
- TLSH
  T1520833043416C4F3D39667727BE57132E05A2C0E2F9908D9A36DB094F7B81FB9076AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Earth View.exe
- Size 180.0MB
- SHA256 fbe8f1cd8f02cf3bc54f934d29456b1639e50afc41eca44495b220e95654ba8c
- MD5 8941adb72a6d702f9042fee2d5c0eea1
- SHA1 d87c9c7fdcaa2e6dedfc82e03fcd4c5a23c41177
- SHA512 0a398eac793e34dfa195212058e0122d3f8df45a999a9ea2efb011859cf7a4250a8e76b712b7bcc69718956160e7e6f0d862095f54e4b7096175687c9248fde6
- SSDEEP 1572864:BH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:Gsok+hK7
- TLSH
  T12D988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral11
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH
  T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
- MD5 e3bdb59b37b730647d4a1e44756a730d
- SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
- SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
- SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
- TLSH
  T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
- MD5 c13e55ae6200e74c0b121cbd5c1d323d
- SHA1 098675729109e19a0b6cbedbbf45398265ab6644
- SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
- SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
- TLSH
  T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
- MD5 a3bf08772053b66ec34701037f120736
- SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
- SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
- SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
- TLSH
  T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/app.asar
- Size 50KB
- SHA256 37a77d8c9d7359083d2deadd9329c5220e7d6f1c2477d5f05f48e1e1c3af94e5
- MD5 ba2807424f0f5e2e34560951217266d7
- SHA1 8448ecc68588a0dcc38466e41c0307bbb7f0fb1a
- SHA512 f03d9b10d1135f1a04350d56b00e3d2d85e70d2a1d18f6a40eb797f6e7063aed9ae1a3cfbd50d6279053b9d1633dbda2db909177bc422d66be53ae87923698dd
- SSDEEP 1536:+N1n9ARIykqMyfgNPVyxXJ/qns3/MxzOmq+SgD:wAGykhN+ZusXa
- TLSH
  T163330A46A8F6242243336279760B5601BB26D0037A48DD21FF8CC2645FAD53ED6BBBDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  resources/frontend/assets/index-DMiCm3LA.js
- Size 241KB
- SHA256 391cfe87e8065339142df67e675e586a6bdb24aa1d2e558dbe16033fe93814e9
- MD5 79fb23ffca5a38de3db4f73d20dc322c
- SHA1 13e1fde89d29ad352f2f69d97015cbed27c353df
- SHA512 45663eaa06fdec580cbd0f2206169d1a1b237d4aff029c563e1173af3c254b6761308aa361dd7721f6dcad98d831daed13b1227dcd60f8b9093377fda86fee20
- SSDEEP 3072:RHuB0Z4p+1YsLAw0GQgEMTMOpSanYwWFH/VlE1ped8qq4feIXYHYdM4ifQxTqDDF:7+HwMfPEKd8qq4feIXY4dM4XxTqDDdv
- TLSH
  T131346C497052767DE26B49E5A0BF920CB32E2A15F40FC490F07D8C2D2A26546E27BFDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/frontend/assets/react-DRItWuJ2.js
- Size 658B
- SHA256 c09baca260deaa088a5a32cc5121e6e4c514661c2fa2920151dbd9c12ca61971
- MD5 bc204e1012377092d488df47dd3d8683
- SHA1 2755c1b8a96a2dbdb21bde112e96af52f4f610d2
- SHA512 59e1884cd32d6f073299b5280497166b7f941e765407921192c986344c51656920a1eb460becc94f84fc76307bea65437940ff259e6b198d16a68378f88b1c2e
- TLSH
  T1C601234420D9A270CCBBCCD5443A1411F5163419359BA9F0EB784F6F72520CA8FA7F1A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24 behavioral25
- Target
  resources/frontend/assets/react-three-C5HAzRwY.js
- Size 295KB
- SHA256 9c549967d0ed861deb91abc5efd05845f574f36e59dc7b0af98b67d9333ae1d3
- MD5 682fa55f2ab654adcfad15c675a36051
- SHA1 546ad1e6646cb6915a0ad1fcea64d85d28b3c4dc
- SHA512 968e615985c363f334cf88dc19fd64cbb20a6a7ca5e2e4973b6f94c759470d0d4a0d3929b7e8348fde95607773908f736effee2e4f170b5fcaf0b04b23d9db96
- SSDEEP 6144:WhcVAD4dzpvycVXVZnqh2p4f8FFRHox1xv:WRqDnTp4fWFRHox1xv
- TLSH
  T125542CE831AAB651ABA345F5006F1517723D2913680C8460B215FEEE7BF500991BFFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/frontend/assets/three-2ZpncXEy.js
- Size 672KB
- SHA256 cdf96c9a668a4801ae8feb16b46ac193526f6cbd86a2187078dae4a28efabad2
- MD5 9bb7cd41318a8138b1f04968b5597416
- SHA1 9af9c9ad5fea3ec2b9cc8df257121ba1613cec8b
- SHA512 16d4ca8903937e4da14e22df5b631332878a1c3270ac06ed5de747c07b9af68505b0cd1f8134980e4d36c4395c23d075bc53987c82ee28ff027eeb997fbdbcc4
- SSDEEP 12288:oJbg34qycJe1JVhym9plDAmhOqwdot+5NlWjgiwpWO5rshMp:oJs3xycJe1JVhycplDAmhOqwdot+5Nl3
- TLSH
  T1C4E46DE0B3B420578A53D4D794760442E32974973805C9ACBA1C6CDB7CA285A72FFFB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/frontend/index.html
- Size 641B
- SHA256 5438770b28256650f10180ef7a4592d1639b6324f16e64b10af14db760067546
- MD5 168788f100efcd9f814ec692ee083b57
- SHA1 273d7d40e04e6b91c8a202afa1f74b3ca256786c
- SHA512 c86c5f0901e9970bb4976bd0d174dca52be6d6a5513986f2a084dd8b354b61d6dec5777c31a589c9e005e045cf7c2374b3badede3d9d005637b53cb79d784648
- TLSH
  T1E3F0F91464E08C0A02302F197DC1F458EED7F74B4149AE94B1E6A0BE1F91B82CED7879
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral30 behavioral31
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 409a0fa76f055a87ae70434414586d144502beb25fa3004866ee70abd9a8547e
- MD5 5633d5211bfbbbd2b0493fcbd492f5fa
- SHA1 9ad2466751880fa0acc1dc6af2693d975dd9e307
- SHA512 8eb5ab1ddb1dc42eb323a163af6b4521acea5194909ed39933710bf3fecec5f50f070c20df57a89f4528076fbddb0fa0c27de3faa7b4a249637be00ec3bf396d
- SSDEEP 49152:YaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+B:762naMskwtEMaQPJnymh
- TLSH
  T1AB463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32