fbd1a700bab9c531f172fa845d9a16bb5d363d18333482a4465a193163b20442

Sharing

Copy URL Twitter E-mail

General

Target
NeuralOS (1).exe
Size 87.2MB
Sample260625-dg8cfahs4q
SHA256 fbd1a700bab9c531f172fa845d9a16bb5d363d18333482a4465a193163b20442
MD5 d6145e91d6a54dd255300c7853752cdf
SHA1 a36dccba50d266ffdc38d97d0d424269965583e6
SHA512 86d8db1eb054386870ec5e1a7792c922e0ccc713a8c6006b24509ca85faf4c864044eda154a60a67b54fd2d6e9e253cdad8d72ae7f42c9cfc946e7c41325b9d6
SSDEEP 1572864:2hqgOwXqMksvoBAPMNQjiSFdyKe3swkJH3Huq0Sc5xWfUjzdY8iHjmX6y47:2hqgO4qMksu4ji4yKe3swmH3H8L3WfUU
TLSH
T1811833E7ECAA066FC6F3DC7C4A80EBF810657B615989B341C05845225FEC7C15A983BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NeuralOS (1).exe
- Size 87.2MB
- SHA256 fbd1a700bab9c531f172fa845d9a16bb5d363d18333482a4465a193163b20442
- MD5 d6145e91d6a54dd255300c7853752cdf
- SHA1 a36dccba50d266ffdc38d97d0d424269965583e6
- SHA512 86d8db1eb054386870ec5e1a7792c922e0ccc713a8c6006b24509ca85faf4c864044eda154a60a67b54fd2d6e9e253cdad8d72ae7f42c9cfc946e7c41325b9d6
- SSDEEP 1572864:2hqgOwXqMksvoBAPMNQjiSFdyKe3swkJH3Huq0Sc5xWfUjzdY8iHjmX6y47:2hqgO4qMksu4ji4yKe3swmH3H8L3WfUU
- TLSH
  T1811833E7ECAA066FC6F3DC7C4A80EBF810657B615989B341C05845225FEC7C15A983BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral4
- Target
  NeuralOS.exe
- Size 221.6MB
- SHA256 2f57fe6ba4d12908aedbaf7aaa2b97d27846b66d2da42c62a39d8467267da52d
- MD5 dc935e57d76038e0c3c55688571760ff
- SHA1 d2266525ac693b1cb953921605880d635b56a55e
- SHA512 2d567cbb6243b8ca5c1e9a086b6b4bd99757b6362b86b8e1276fac577a74332d688232afdc6375f6eb13e8b8a633351e18543ce6c72b6986af7480452d64e609
- SSDEEP 1572864:nWxpsb1ZVbUZNPbMPSD4mJVz+xHbMk8eBpkmHcqdj/AWWceMVqfL5Hn371NMKlaI:CeZV6W86TmPy00p
- TLSH
  T108B88C03F29A41D9C01DD1798B5A9633FEB1B8454B24A3DF2B5447922F66EF82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 34e36e7d0888e8c9653314d375297abf3f027dc179920102b9b8293f79555de4
- MD5 f3036e9973dfbf9ba882aeddde0c1f68
- SHA1 ce6146a6b210ca7935a2c18aafe5b091581f4d9d
- SHA512 621a3fc71944cd6badb50bb88e30e0495d4f2570482c4a089bab2561660f88a1df4a7ba3ce0129d8dc71f439c9320203c7c13b771e59459dccb19dbcf5a4268d
- SSDEEP 196608:ZKkG+l2tvb3nmgD131GYN7aPtAH+R4gQiUiV1gFould/5emO0r:Z5G+lkvb3nV1GYIP+H1gQoV1Ioul3el
- TLSH
  T105473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 93f4c1a211c90978c585815ec652525d749e86ad6b6202c905ac47a85e4f66a1
- MD5 5d0ef421234712d67d4cfe0f9d6aae78
- SHA1 ca08540230e1d4abb8cf99ac2242d020d22f5c90
- SHA512 24f6c76225ceadfa01de89e8c784b58086f399a6a8c2d0ce9f271e6c11402e17849d2e79311661794d4859383fa4a4e88ab3b0ff256a01b4c3db604a4f949a26
- SSDEEP 49152:bv3nwJt5w3heAaTPLO6lNU81IQbx6i1N2fgPvA7lPUaLu2JiaoosxpSS:by5yfa3O6l5PaLu2hoU
- TLSH
  T1C0E59E03F6D251EDD029C03497ABA213F271780A4F205AEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  libEGL.dll
- Size 467KB
- SHA256 630401e4e008b80c4bfca28cf01b02e371698e855aa132a7a31f6248c0a5c32f
- MD5 04f48321f798b648d2012d05df785c41
- SHA1 b4a8c3cb50fe663dbf74a0ba0160339f2d54b5aa
- SHA512 94c06b38f48d90d025fe2dcc670ccec4eec38fbf58dbdd8f4dfc1d2c77761d812d560d7e720c93160ab2b837a5191707ffd79bb556d490365565dfa750644983
- SSDEEP 12288:66/vCrog5QZ9yJNe8DcQir3YB9ANZMBg:66/vCrovjLA94Mm
- TLSH
  T1C9A48D15B3E948A9E07BC1388A538643EB75B4520B61F6DF02A0D2793F77BE45A7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 e9c1b0055ddd591fd33fa9a30a9adb262490f998b3c343b8225e14996aecbf77
- MD5 b60f635dbbdaa84199fb6e00131686c9
- SHA1 1f2e0f81d00f1e5cd9059130dbccb0feb966ffe7
- SHA512 3f7b105d93bcdab0243bdc36a17709944ab1af1f0fce3a1f14dbdc367e458891183ef5cd4bfebdd5e64279a0746f594ed02fb9f67c633a5b7fa44c67f095867f
- SSDEEP 98304:q28+0qrgWEefZGd0Txn5XUTMSEyGEEEE:u+0qcYfLctr
- TLSH
  T1D3866B03F69681D9C05DD278876BA223FA30B8550724B6CF2AA457152F6AFF0EB3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  resources/app.asar
- Size 17KB
- SHA256 2f03b80de41565bd259ddbd51c8d4ca7d1ecae12709de16c00eb643c32f87f90
- MD5 731bdfb5186e4842ae7494b3a2b2c77c
- SHA1 5d210a47d6c7d149e7e77beb3f139b96d1a46698
- SHA512 26815919304fa32df3db123d997d1f7270d690396f6cdcb423892202881a910cbd0ecf6c4e4ecd47ca3d8adc700db120cf902c0de926b1e4b1aba5118de4c854
- SSDEEP 384:8BjoEcV1v1hmeIjL1OU4B/fxW84MGjKm8V011XSe:uaNInE94MfnJe
- TLSH
  T1A68275D1DC636CB65DB70B984FA5468DFF6081035D5683287AE8A7CE2FB0CA4C59B18C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 7251ad75403775b327643d38a4de09a0eec3442e02ee946d48f50d8900afccd9
- MD5 baddffa8d9df7964df97b2a1fb195f06
- SHA1 3a7a17498fa99351be2b0484e9f208882d7324d9
- SHA512 a20b4071e2be6c90a2a5f3154edf02bb545e312771108a9cfb81b7a8e88e3d46feb5f47af1ce9228f0a3702cb7be077cc591fea3e85c8df308c5d3043212d3c2
- SSDEEP 49152:fvMQibTIlI/EyGhcIDlpcSJ13DFDUgcD2Qn9agdGgkkDCqBK2WgPM+2HryKAoxw:fvMQCkgUrr+2yso8FX1+
- TLSH
  T1B0464903F68681D9C06DD6798B5FA623F672F8800B2276DF56A00F192E65FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  vulkan-1.dll
- Size 904KB
- SHA256 7258023684cea51fa08bdf3f06a24dc6ab91f48b361707f345ebbc7b29579122
- MD5 fbf1377da78b4bab7de68ea8b1e02f81
- SHA1 979efa962e66f1b56813ed6f94e6e8a3fa9ee196
- SHA512 fa478cb01597cd738dbb625ce1697621f18c9559f6ba5cbaa0242c57e426eeb698a09f6a4734539d818eb37d6555ab66b47161a1054fee40028677eb307f7d8a
- SSDEEP 24576:AGq7F7pknIiAXUMKzUjvg6Z5WzcxDYsHkDE6g3P0zAk76oOH0Yr:TGF9kIiZAjvg6Z5WzcxDYsHkDE6g3P0c
- TLSH
  T140157D23DA548B69D67AC074D8D18A0789F074851322BACF07B817147F6AFF42B7DB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16