641ae0ac2321e65cc75014caa6b7d26a3562253320ae9615a835026e0e0c52c3

Sharing

Copy URL Twitter E-mail

General

Target
Setup (1).zip
Size 11.9MB
Sample260625-e6ayxahv3j
SHA256 641ae0ac2321e65cc75014caa6b7d26a3562253320ae9615a835026e0e0c52c3
MD5 b51084a5cccbcb8d2a1d146586ff909f
SHA1 cf41e1b81784f7feb12e6b02f2adce34cdcae495
SHA512 1566220ff8f6216a18dde1ed89456d73ddc0e279ec8e411dbd6eabae25415c22cbf3c3ab352a17d2361e9f01767e6ef16da0fc7837a99da700aa3c29e7acb1f4
SSDEEP 196608:cqkFsp4efIhl/htXh2rQ10l8TYm23ouFB3jB/f4mGdETuTbyD8wSElXRMXy9lev3:c7FsrfIThVh2k1aNrB/ARn3UlX8MleSu
TLSH
T1A0C633495CDAFD0B8E8F1BCFBC692619BD49E1D131BF41EF4A42E85E2D520353B8421A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Launcher.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Qt5Core.dll
- Size 4.5MB
- SHA256 7ab15d298cdd7185f2cceae2613715c54a54861fa788bb2de3d152eceb484288
- MD5 b4f2c1be9ac448fdbb6833b0fba3bb75
- SHA1 e34496261619f6dc70efd08b0f3c9c73b3dfee50
- SHA512 be478f77214590ffe6360ee4b9e3c20e45d5281973cfbd502674dbdfb5afe62ec9b0ae06418f4523dd73fa4573d92c52100cf5c3b730ae1bc8ff3f34d8e1860f
- SSDEEP 98304:0dS/SBS/PayG3fVkp9PJsv6tWKFdu9CPDB:/wfVUPJsv6tWKFdu9CPN
- TLSH
  T185267D93E79781B2FA82827648EBD22B0576AD1547019AD7F34C3A0B98716E13D3F14F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2 behavioral3
- Target
  Setup.exe
- Size 1.2MB
- SHA256 dd2fb463fd8857ce858b96a6b2ec88ebbc2fd724b82a591f69576614f8c81e5b
- MD5 de786e27c860ef6f357ef831417ef3e3
- SHA1 c5a157801a7bda0cc1a9cc3545f52e5b0e893e82
- SHA512 7aabc052a971faa54e4da5d62b6d4ef37eb5e9f1d842698d4836dc0dfd1f3d66dee858ab5edad85e83ab2208449227357fbd7934c124e2d69faa36cf289da234
- SSDEEP 24576:7yOaX5HT9gFGconk2dHdnc2UiSjCne7ZzqWMaTUdSLc3eSJ2Q9Lb:7yOaXAF0n5cvNvlqaTASL+eSJ2E
- TLSH
  T17845DF03BF50D546D18A2E7489B4C7F92320FC499A65934B34EABE1BBDDE2C39D122C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4 behavioral5
- Target
  bin/Setup 2.exe
- Size 2.6MB
- SHA256 8137dc05cab10a6aaa7439ded02363e9850f954e4fd2d030b688a01fb9f613ff
- MD5 533cd56a673ea9e371a2797fa5277743
- SHA1 09bafed599fece84c8bae1897e45a72253eafd18
- SHA512 f4e9fc7980d1e8d28a84d1fedfef1a78be003b6b516efcabf60515d7ab459eb1d68df659180c0117d12a949407a6870e972a22c49accf9362e9548def38064aa
- SSDEEP 49152:e2I6bU1A18+nYOfTwfpOlMRnMisUMlT87:e2T0ym8MRnMTW
- TLSH
  T1C2D56C07FCE159F6C0AAA23189629192BB71BC442F3127D72E90B7792F727D09D35B18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral6 behavioral7
- Target
  mpclient.dll
- Size 3.8MB
- SHA256 401fa3c82b2b7705753063bc7ea3e752b4bf4939736ea6d5949456a0e0407f64
- MD5 e46aca74f19eb406c442e5d28edbdaea
- SHA1 ab69678a9c1ab8f7e0994fa1a8ca5213f08bb5e4
- SHA512 8c60a6f1fe3ffce9d4f303249e542a3293916af53edd7c60b46a95b25b1f590d1480937dd1b8f052ebe09be561ef934764cd6dccb888915d45bbacc337bd86bb
- SSDEEP 49152:RxM9PTMKJyspg1uwxLBYaEqxQbX++yaQTqDTbCC:RWQlxAyQbOY623CC
- TLSH
  T11006AE07EFA148B9C497A23188A256817B3CBC491B263BD72F9077762F763C06D36764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral8 behavioral9
- Target
  msvcr120.dll
- Size 948KB
- SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
- MD5 034ccadc1c073e4216e9466b720f9849
- SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
- SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
- SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
- TLSH
  T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral11
- Target
  opengl32sw.dll
- Size 14.5MB
- SHA256 23f04ba936568e9a7c9dce7a6beb52c9be7eb13b734cd390c99e7546cbe1973d
- MD5 3bd5aea364326cdfa667651a93e7a4c9
- SHA1 f33b4a83e038363c1a4df919e6f6e0e41dba9334
- SHA512 7bd4e742b4d683b79de54eaf7d8b215252212921b8a53d1fbfc8e51ce43505c003da62fd126663bc04bbc65b8f77b85232c78ea6ecba8a4e425c28c0e9c80dc3
- SSDEEP 393216:00Rly5ZnSHLe1tvwDTtwJuefdrX780dNYbg4A358TjGNrS1aKbBICZBSJLGWIGC2:NRlyP71tvwDTtwJuefdrX780dNYbg4Az
- TLSH
  T100E66D21FD418271FEC500B7E5FD7F6A596C8A28032F52E3A39C1C95AE606D32B75287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13