f3228ceebef9a3fb82e97c41b93e3dde54eb643703781252683ec463f6f626fa

Sharing

Copy URL Twitter E-mail

General

Target
tor-browser-windows-x86_64-portable-15.0.16.exe
Size 108.3MB
Sample260625-jgzyysav6j
SHA256 f3228ceebef9a3fb82e97c41b93e3dde54eb643703781252683ec463f6f626fa
MD5 f83f5318f5d8c8b44dcbfee84e1def46
SHA1 0e3ca4f8d4861a37ef2d7fcbfeda9e0091bd6eec
SHA512 e72c5cdcce8b68b44116014433477b090fa78425fb16c64a26fc9e700859b1435053631ef49eaa931f45dd6e32cbeda4bcac3c961abcebddab7860c8f92f1c8f
SSDEEP 3145728:MbfG+kWJFUAbl7+os4uxzZGNYqBRDLsU8D1e5LcFRTeGKB:o+UJFUAbNDu/aBRDL18DMiuB
TLSH
T1C14833F75792D0C9D0134878274C5387835F2E18E3E292867F3896B769356E29EFB290
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  tor-browser-windows-x86_64-portable-15.0.16.exe
- Size 108.3MB
- SHA256 f3228ceebef9a3fb82e97c41b93e3dde54eb643703781252683ec463f6f626fa
- MD5 f83f5318f5d8c8b44dcbfee84e1def46
- SHA1 0e3ca4f8d4861a37ef2d7fcbfeda9e0091bd6eec
- SHA512 e72c5cdcce8b68b44116014433477b090fa78425fb16c64a26fc9e700859b1435053631ef49eaa931f45dd6e32cbeda4bcac3c961abcebddab7860c8f92f1c8f
- SSDEEP 3145728:MbfG+kWJFUAbl7+os4uxzZGNYqBRDLsU8D1e5LcFRTeGKB:o+UJFUAbNDu/aBRDL18DMiuB
- TLSH
  T1C14833F75792D0C9D0134878274C5387835F2E18E3E292867F3896B769356E29EFB290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 7KB
- SHA256 b797e5a7de359c0c934cddef8e9d3a78e6d3d68e6ac83d2ddad915770cbace53
- MD5 48125e63f130d69025cd2bbf9f3b0c4b
- SHA1 e3923a75ed00cc53e2f0b3c1843598c7c1ede79f
- SHA512 5b411fc88035eafee2eed3c4e1b8c14fdb09ed09ca275ec1492d7a72dcf9cf55719dc34e63c00ca64162a455339658efc958dd2abb6dfe8a363f2f24ff3bd5be
- SSDEEP 96:BLIwtgI+Wdk6guTxZlx3ojaVgmR6wP3LtrlKVNtEc+InoAhrEoUK3EMbqKh:J89uTvlx4jhaX3Lt/ch4oZ3x
- TLSH
  T1B5F1C70E6AC010BCFD6FC23A8D3A42157BA1F521076568DF269321553EE4FE76E356C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 23KB
- SHA256 4bc489ab81c6f1d7e9cc6c2e8a3157183e7b0ee5199b4c6e8044aa32da2dea1b
- MD5 8213548feab7394279d2712fc12126f5
- SHA1 1ada5c813c36c66789b256da1ccacd9b85a97b4f
- SHA512 3b5f96cca356bbac7a87bd2695e1b95b1c8fb6c3f059e8a9ac11724708c8aaad4f7e3e404a9be1c7354b03414b18123916c2b4772ceb033a91a8c48ee724e2a8
- SSDEEP 384:ecybqzYqKbo39DihgonO/U1j/HCD3Zn/MUcD9RSSvUW6OEY3yW:lybqzfko39D6gUOMhKD3ZnkjRSSJ6O
- TLSH
  T1DAB23C0B3AE5047DE446C13EE6671226F6B27C412B11E4DF2761B13A3E75BF01B39698
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 13KB
- SHA256 7ecc85cfcc4bde6146ed8e0067341b1a56306f94893702ee772bda8725712aeb
- MD5 ff6b5961a43ba8c36434c9e707d4e6a8
- SHA1 f73efb0ad4f4e9f5c716df5168f4168c2cb01ad9
- SHA512 fc1da79bd1725e240f0eb259e2ae7cdd976e33f8c9b64083c9420d9a64aa2bde9251294d8cfeb70e5b93d73517c26594c04c8ebba80d9529235b02d52b0a72b3
- SSDEEP 192:hVoR5bH/o9gAXCI6KW0fnFdFlCaYQZUhU+Cg8++9KdYI:hVQZ/omAh6uvLFlZX++9Kd3
- TLSH
  T1C252D7132AC100A9FC5BC17B99BB55228ED5F6100B5131DF026662463D72FE57B3D9EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Browser/AccessibleMarshal.dll
- Size 23KB
- SHA256 7322b21001c40b4e9ac36f3036449476ca661f92e11d9a10a13c893bb070891a
- MD5 c8ed362a4bfd79838cb2e12b13df5060
- SHA1 abdd442cc7104090b5ba274f16662a1d1a3b2a38
- SHA512 ec843470f44cc5bc2176feb445213e072371b39374120046ce8609a480a5b32f395c2eb76680c97be8681b7d71a88c083bf46ae7e561d67ffbe621d77ac43b7b
- SSDEEP 384:sp/0aUbxNaFr/JO4UOA54yvtBMdfjuycDiekYxS:E/oUFr/JO4UOmchj2DF
- TLSH
  T175B2B486B741C469D42A81359CA78BB6AA71FD041F6287E733C1333E0D36BD4AF319A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5
- Target
  bg/DNRPolicy.js
- Size 11KB
- SHA256 c193c78f8824cb740624ce06ceb57f6ec8f691f6625f547adbf38d9d3892043b
- MD5 c252b896a33d4d8dd9f32ea6ed296f28
- SHA1 ab1bd433dcb481a688cfbc8ab1d4c5af3842f032
- SHA512 0a26d46c5fdd8dcc144af10b9988f503a92c9e23045535c30f3b63903f4721f2605940632263fbe4794758c0611ac3a90a799a9d504a5567fb79b52714fa3648
- SSDEEP 192:iSjomLadoFGQDt7KYfibDwpdhVgWMXFjMuZjQywwhaR4aKtSlWiWHVGWTXalLoKN:Zj72oLt+SZVE2whagRuhP
- TLSH
  T14232421A66F66023427770FCD76F4211A430A00BB858ED653F8D83407F9A57A87FAB9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  img/vintage/logo-full.svg
- Size 8KB
- SHA256 a789b5f1f981842d2e259b21dadddedc490ab6a3f7fab05e5c0f698058c0c019
- MD5 144b678a905f0db8de5a1a05f5711cf8
- SHA1 b964ae9dc60e19c492a45d4e64b6752a96f83857
- SHA512 c540aad965b5f1e0b6c4c2b453e483240f4fd47e8a1973f0ddd7ecd16761919dba559567e64099e7e9328924a5ce731aba1a5376412849075ed3e1cfac2ce911
- SSDEEP 192:PknT21pq1Ulh6o5zhaiAIqj96VPBu6hlyh1/qvR2j:8nT21Myr6oJhaiAZJ6V5/+z/IRM
- TLSH
  T19F02A749C3F444EDF9048AB0DAAA69B1F51D60FB2F01449B555CAC248FD3AE4CB67BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7
- Target
  img/vintage/logo.svg
- Size 8KB
- SHA256 af0a886904afb29e74f37492f650ad9165bf8e6db20dc3c9cc960447d7bb3f0c
- MD5 b9e53d366b9a76648bd08a6f94832d50
- SHA1 d1b16511017210b4deb51e2dd3f1c4167e1471b6
- SHA512 56c19c3dec8892b231f1175a090b9508e097e520e895f064c172d0ec024a85c2352388ee9031f6e29c8be75c6e4576acac6c7d3a398e2a14a042aeb0b2702a94
- SSDEEP 192:VkpaiMeH+ZqGOJty3mJb9+Ew1jkEgyz0r:mpaC3EVHu/W0r
- TLSH
  T167029200C7A948FAD12C8145FAD3F504420B39937FD156ABB59C9A75AF6A0C1A3BB7CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  lib/flextabs.js
- Size 1KB
- SHA256 678400c92e6ed9b14445e5431e69538fdb1b5dfb7b7045cfd9a855f0a8ae40c4
- MD5 d0d91309b6a1479287967b68cf5ad95b
- SHA1 87fa652cbf90bbd155580491d1b7acd8b1bb7713
- SHA512 be4f9d2e4a1a9bac4c19e9e96ed9c1579db895a7db776c13744d28038bf53e6e83fc742066d18e418307a6e9e7499096b105770c5de95aad6124e092b9ec1e1e
- TLSH
  T1D13199263AE230769023B19DA7CF3860B32450E7D5418E28B94DD74DCFA2A950DF46FE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  lib/he.js
- Size 94KB
- SHA256 ed6c0839b2888a2a69e4dab9c156b20e597b4377dcb273d58552f206271f3322
- MD5 77302d844ddceaebd89b0fbb6fc00717
- SHA1 eca70048441be36e363204261bc8e2ba7b66e39d
- SHA512 a86828bfa05c1c2e8a5de132aef3e58f17a7a7c0c248ab2c61df28034ef326e977fac6879d02d13c2d040d9f069890fc1cd7f235f7cc8147a0211da83c3c709d
- SSDEEP 1536:DUPNWOZNfPRxpGeAAAfVOcG9fTsh2KrGHTozm6O0htvQDO5:ElPuxVOjIaHTJ6vh+S
- TLSH
  T127930C493FF489F3125418BBE836C28FE8DD5007A54DD124DF7AA627E90533A6DBE068
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  nscl/common/AddressMatcherWithDNS.js
- Size 6KB
- SHA256 27b9b7c6df100036a43b4f36102ef43363d8309b1054eada45622fea1581e347
- MD5 7a81c43023195131f1bf7087b0775943
- SHA1 d98e29dd742a232f81017a74719b26d067bf59bf
- SHA512 bcbc77289057e9a69e29a866af217ec13cf39b977964bdfb4b634b4588450424e58e152eddd450c266efddcd140712cdaf0d397414f4b0c2d33e170db1be1521
- SSDEEP 192:J6J3BnatfQva8GER1yaTQjr9SEB+QeQVqsjajQRiwQjC:J6Jkth8GF9fEsjV
- TLSH
  T142E12E8C5AE76065A36371780FDF2009B2B5D907809DEE5EB84CA1D07F80938C5BAEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  Browser/TorBrowser/Tor/PluggableTransports/conjure-client.exe
- Size 12.5MB
- SHA256 943073ac504bc19bf9050d2e91507bff998cf1b5e447d9e84411482a565280d8
- MD5 5647c942568890b8de22bf90b53b43c4
- SHA1 8238979b9ee592c17c6f582eff871925d534f0c9
- SHA512 5ed85647334afb49af32fda28213d802779421f60e7aa2406fa507bfcc31a94235e219ebb946ee55b80702524f6a08bbf139b50570a9c9bde6b896212b965b44
- SSDEEP 98304:GWn4mJILa/P2fBQy5sbrDyF7f19n2dTdwyykPD69c+3E1/1zE:G+Fhn2ZQy2DyFj192dayykX/K
- TLSH
  T16DD64A43E8B505E8C5E9D1308A66A2137B717C494F3563D72BA0F7282F36BD0AEB9750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Browser/TorBrowser/Tor/PluggableTransports/lyrebird.exe
- Size 17.1MB
- SHA256 4ca75f4de6cdf36781547b5415b84911576a8c080ef1543107d2942522a4d1e9
- MD5 3c3eb38accbf0fba59cc66bdd3c806bc
- SHA1 ca2643eb00c192a90ad07f6d5d217d67ce34b384
- SHA512 3260cfd7637a3bd7e51a984301696773e6a86dee86127bd7d51305cdc67d8c6882bb9e7d465405703454548541fcdc7841f1580510da2194a5a26a4e29c7708d
- SSDEEP 98304:jhQpqG9+1DktLs7v5oTiETk/6rpyH8Wo3+MdrmWNea9ykh5QqkfxFT/MwJq452/j:jj/1Dkt47vTVH893ddqk9ykcrYVn
- TLSH
  T178076C57E86501E8D1ADD570C5669223BB707C898B3223D72B60F7642F32BD0AFB9760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Browser/TorBrowser/Tor/tor.exe
- Size 9.7MB
- SHA256 3480b027e2eeda0b6bfaf2f28bde7f3f7038ecf4de3c3862ee9536d1d8451537
- MD5 89d0fd7e7a196e90ceb2e1be53da684f
- SHA1 fb987ef811a824edbf8d7e386fc37dc458e0c06a
- SHA512 f923abb2e0bfefb19baaf3e7aa70f34f34d76ddbcefc92260c96f1532bef293f6b7384ea088f001fb6d44cca9b27bc2b244989d77ef1aa7468302fe756dee118
- SSDEEP 98304:NRDp7z5b5yPQg5xNcTMFA1wy5yptckHtP1tcFwwErjKoN9uQ/1j+l:zDp7zN5byPH51tcCOQ9j
- TLSH
  T14CA62957F27710DDC5BAC17892177223F9A13C8C81346B6B599097A22B70B68AF3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14
- Target
  Browser/d3dcompiler_47.dll
- Size 4.2MB
- SHA256 25ebdf571d4c8dbca43c848a73cea72473da41927064d1399ce5a8c3daa7d0ea
- MD5 387575ba5b0ae81a4ea8229c093b80e1
- SHA1 9d8da7caa1ea143b699316a7c7fa2268a77e0818
- SHA512 a3336c045537b4b27269ceb839994fdd83b6ece07ea52310ce84fec4daaf77918088ed9f026f008fe1f95e89b484bc2b3d2e052e520178c133617d6430a32084
- SSDEEP 49152:mPrVLRxk2ya6PLLZ8h2gGGyCsWTVqiZ/zttPR0Cs8pRAH1LsJaUp7GYRzfd1DXn5:NJlkVTw69XNJhx
- TLSH
  T152167C47B6A440E9C2BBD138CA475713EBB0781413345BEF5590C625AF73BE26A3B728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Browser/defaults/pref/channel-prefs.js
- Size 429B
- SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
- MD5 3d84d108d421f30fb3c5ef2536d2a3eb
- SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
- SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
- TLSH
  T1CAE0A36B1588933B11503A9AF3124481B2165DAD6175CA545018D0646F0BA2165F9FDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  Browser/firefox.exe
- Size 1.7MB
- SHA256 735a81ec47a3d0fef5269d720b952499472774c96ae0bee8c9e926b246e57526
- MD5 31a45e23f2b88c80607757bac44467e7
- SHA1 d89772fa54fbffeb225014744ffdb67d1dfb051e
- SHA512 0b5466b0129c87f7609f7d3a5288bc0278bbf6273aca5e1aff0f6b083ec8c6cf04aaf11ec5a4f6528502f44322dd630aa32d335086be2163a42b1a78213947f4
- SSDEEP 49152:LKhZgvFKvPv1VV5kHsdA1Cyuha8QXXXXXRXXXXXpwwE:mm98kHsdA2U
- TLSH
  T103857E0FE39502DDDC69D1B1864A5221FD357EB18B90A9CB9B643B212D366F09F3E708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion trojan
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral17
- Target
  Browser/fonts/NotoSansNKo-Regular.ttf
- Size 38KB
- SHA256 c756efb2c40f754107d76fa4e401fc3b8b7edec5cc65db549d3d0236ac6d08a1
- MD5 675a36c0b084fd16c8a0c466da26df2f
- SHA1 08cb816c2d82646eb012477ca9180a9ccbe94f10
- SHA512 685ac3f7e308a1d32f0bae0571378897b2b59a56da8c871d90bd568ccacbfc3d58976f33e6e3dad23e9473c6d7bf38465f257ae8824b6cc57585b769015b8508
- SSDEEP 768:Fzr0MfLbiEt/HoF4ssQiwNgJ3I/R6oBWmQYYY5iH95ETFsQPRzT9xFFrDW/iSD5:RNfL3+F4+gJ26oPQYYY5iH95EB5VFBaV
- TLSH
  T1AA030A03E765DF26D05A4E742339935792B6EC101F93B34FC88A626EE8A65C438717C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  Browser/freebl3.dll
- Size 941KB
- SHA256 20d48f299e86853b8e41fbb6527c21ae4025219459a13c394397847b83bc51af
- MD5 48220f3a434dfbee8dfbad3c66f0823f
- SHA1 cc9c7d96e124221375cd1fb358c0f158efea0bfb
- SHA512 f601614ba0381cf079b0437100f83419e68c7c348e0cb657434119cdda8c2dba7b963cd12889f7c553bce161bc280e80e610cd50cd5549c76599b8219094e8d9
- SSDEEP 24576:QK3KNVkpVPQ7+oBl/fUUxvfZMqvwkq6+h0:N3ompS7+oBlNMqYkS
- TLSH
  T149254A43E6A252D8D1EACDBD064AF563B911B80E4B3634E75BC55B1239B0BE07238F47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Browser/gkcodecs.dll
- Size 8.8MB
- SHA256 8cc275694a7800a61846e2f18a1b53bbe55e47e2d82c404f34f2d0cdadda7ed2
- MD5 c64a075141bec97c0445abed1eb5b8a9
- SHA1 d60d2bb4f27506829f416ffd64b1c6d0d70407d8
- SHA512 64322e04eb85505872c5c6733acb97023e971ab2aad57414722d2da6287b284ac5c9049f578ede8a9724c38456f2fc7ea71a00126be2f54ed0a5ee8c4c44b821
- SSDEEP 98304:9Ll0fF2fvaYQ86PFP+KxOn9y1Oyf+KzHD2tPTSYHqT7gy7piZ:95AFYaYP6oSXhyGYHqT7gy7
- TLSH
  T16A967D8EF26351B8C51BCC74427EAA22BD18385E83155AF727D956343BB2BC06B39F14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Browser/lgpllibs.dll
- Size 344KB
- SHA256 ee8cceb1944cce5037ac6ef5642a7e3eea1fcaf4fd192522da8c07dc1db75a2b
- MD5 1167a1a7e49d2f327dbdc13991e4c41e
- SHA1 3fe514cae8cceff4d59f91f5075ee6e85693e4a0
- SHA512 752af9bf48efc0f84247b10957485293cb408ee05f7df3b1dc9c5f3d892b5b4feccea1f814582cb03ae315b7c812609ec832c480490e97725ca42d3f2a34faec
- SSDEEP 6144:hymb9XEzTpXVtf6ARArqIOkV2uXzv8dHlDmk2zH2RhzBuc:cmBEfpXVwARgOAE
- TLSH
  T170745A42E9840879E87BA53892ABD719CB7A3C8407A59DCB07A067117F2FFD422FD750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Browser/libEGL.dll
- Size 208KB
- SHA256 87931659133959c4348bccf6feeefe4fed02d34706824fbba410e5ff7eef309f
- MD5 099ef104d2835af053449f5be8795e3f
- SHA1 fd932aa94ba4ec2ed6f1f893fe5c8dc2df29fda1
- SHA512 e29897dbf4738201ffb473a4a65b4a99d52118ea635ce5c39efd75dc83bfabf86620b2e620deb70d023691719807f5a88c87dede550017af58b25dceec06c270
- SSDEEP 3072:0DRJ5RGkTb2AN5wTnumxGZzmDtoFdUnD6Co91phITbiED:CRJ7GkTbTMumxG9ooFdUDNAphITbiE
- TLSH
  T13F243A63A189463AEC2BE138D35BE215DE73B8A50395A0DF036093217F5FBD4A67DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Browser/libGLESv2.dll
- Size 5.2MB
- SHA256 8d6e6c7f26c94d6a3b63967d370a70bdd9101c916f89e5cc66e81bf439ec52c5
- MD5 61a2119831a17c5c5d3ea47e49b8dea6
- SHA1 3a336d7d3ad5732824d023ef04e8e0ab362b72d1
- SHA512 9ae9b59f8bda66f30992c157f9c6b4a603e458f02c6c5d1160738db8aa152e8c1690b16c28c7cfab62b2d5510ce36cf3cac521bbeabf600b2a5380c41a11f7b4
- SSDEEP 49152:RfxNwCzhakA6SQTzfisuVY6TA4a57m+KKyl1AP7CFJVkg51qxY0VYldyNKDrNg23:mWM494W57A182BX
- TLSH
  T10F467C07F29251EDC42DD275C74BA222F631BC895724BACF266497202F61BD07F7AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Browser/mozavcodec.dll
- Size 4.1MB
- SHA256 fb6ef7079feb4f399caf94163e254c5bd37a9bb563d829384b15ae73b188d1cb
- MD5 77ecfe3833084812dff5c88fe32cb0a3
- SHA1 749a65a964e573981932531a4dfe7112584f1a1f
- SHA512 54f213e7542722d4d248f5ec624a31c1786540022e859cd16e72d3533ef7cf173611593327c6ef88e8d2b78d8eb7b0b893a0516c95c990dfb063c7ce5978cf99
- SSDEEP 49152:JXKFgZ0DZGcsyk2CXsHYhNHQkYDL2Mr0K3/vQCGoWkmvcLsAJsyMeX77UXVJdat:JyI0DZGcHJ/4/oB7/X8JdlanoDl+WOc
- TLSH
  T14E16AE4EF1E351D8C40B89F4937BAB26B924345CD70479F7178696247AA2BC06F3AF48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Browser/mozavutil.dll
- Size 591KB
- SHA256 b2842d2027c45ede965cd7a667c1a6e9cbf613617b3e316a319918cbd2456a73
- MD5 885a9134938272bcc945a6fe164d75c4
- SHA1 1ef6e5ed3ab277d5b9ab83f371657b9c4630af62
- SHA512 646bd71fa57ca5e2daeb364aa732870b1ecbdbb4b85f43630fac169c972b817d1e05c03fae2d3aeeeeb17ca122702a9b8ed7524d885845ff777ebd23f007c06c
- SSDEEP 6144:ilF6e8MAbA840H7+ibmAI6ksFY6VAUWV83Mo0gYbuzhXSQsdhV5HB5HXzIJbxCO:jVbT40Xml6Io0JKiQCXzIJbxl
- TLSH
  T10CD46C06E2C2146EC4068575839B5A14F2327443DB95BAEF23A246392F24BD17E7FF36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Browser/mozglue.dll
- Size 975KB
- SHA256 5f4296e395dd0f0c2b5c674e418761d952d4ee118616634ec5678e4c801e35a8
- MD5 e79d1e9eb5ce20c078472ce360b2729e
- SHA1 801dddc6e45f7d8db3ebc8e0f840cd2bb30cf107
- SHA512 845c745dd3b64a89b6e25b24a16f0bf44ece785e18e413b82e968d42545044738503c2a5366d235d3341af0ae231cde4d926f8f32ac735247fda71498229ab51
- SSDEEP 24576:Mhww5heJx1ZdoDZalUaEKnB4G5F8RRBWzQFZzzzzz82:kww5hef1iZalUaHf5F8RRMEFZzzzzzR
- TLSH
  T163258D07E29640EDD82AD2B8935BA232F971FC451B24B9DF069097212F75FE0673EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Browser/nmhproxy.exe
- Size 794KB
- SHA256 f2bda8c8db216b33cec88cd1b24158d230e6b79113221dce2614e00195220dd5
- MD5 1dd297c55c63ec9280767acda2a8ffd9
- SHA1 7da99a22a092a4ecaa94db7c5faad30f058ddb5c
- SHA512 a6d026df9b7d810ec1be82fcef5f05c0c02f59cb83040c536e88876601411131f3d133f05f5ff95960a001373624f041d90101e40dc1c8bf1a0a4e3d54abd90a
- SSDEEP 12288:qTV6XlpytVVb9vNgP8BlCzjMXI8thE/N:qR6X7yy8BoMXFt
- TLSH
  T11A057D12E68A90ACD95DC075934B96327932B8CE07306AFF22E46B353D56ED26F3D704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Browser/nss3.dll
- Size 2.6MB
- SHA256 a9f5d36c78bd6118c9df8b137bebade5efbb156bc6fd620a8ba31075d746c22a
- MD5 26eb6aaf3be358ff9907fcf861ac97c2
- SHA1 080b35495ddf4163d5cbd9df8c650aa0a7a59cbd
- SHA512 04477901a51d263274b891d1f853346ffe5df881e6f9c633c6c6ea112ff8efcbc4bdb2e58c0e609e2de59ce191e8be16b0985e9e972c750d856c0766998a38ab
- SSDEEP 49152:oyVU5jBgkDG32f477R3GdjTjuFmi50ArjdNtrnStrMiaHslHmSWlK+saOXhhhhhM:oyui3HoeV50U9K+s/hhhhhhhhhhhhhhL
- TLSH
  T114C58D13F29610EDC42AC2B5974B5632F9B2B4054B246AEF52A0CB353FA1FD06B3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Browser/plugin-container.exe
- Size 1.0MB
- SHA256 18c993547baa5aa0f54aac18be2453227e848a60b928eeaa1d8ae8e899aafe52
- MD5 e9095f06435e84e69e3cc1ca60d894a6
- SHA1 91e6a40736aa05c84b9e70433c4804d8ecbe6057
- SHA512 1a6a35efee438d5acd9d5151359b2fea98d6df9a00c984755e648d84b785bf35fdca156bbc9adcde6761c307d3e6be4037087564b70fd7e0d1e2e8740efc03f6
- SSDEEP 24576:LX7isELq7+S2gZTbBJV2jKZ2VJPBhhhhhphhhhho:z7isoS2gZTbBJV2m6Thhhhhphhhhh
- TLSH
  T145358D17E39642ECD86EE1B54346A331FE30B8454B64B9CF4B90A3212E65EE86F3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Browser/softokn3.dll
- Size 281KB
- SHA256 a520ba3f3e310b7890161235ceaabbecb28ffba04d4b3146cc92cbb6b0b97368
- MD5 6a169c879a73850c0f362c4abdcd42ca
- SHA1 6e7e7d075fbcc5d4db1bebdea75b0b4870c3f4dd
- SHA512 335c7ac6bb48498246b99d9c680b01d41f1023d0101f3537d811288c8069e3e661a90af744d83cbdd46bf5c5f4bf1a32a51d4529a2518876898894b049382e89
- SSDEEP 3072:Iwt47NWXxdpLRAoH6vtEqlKqJv0sIzUuMJnm5lJeep1cMjaW8+CNCOCTC8CyC0qF:IfNWjJ6TKEvw3p1cUa0Yz+xnHCF9
- TLSH
  T18B542913F3C2A1E9D808C1B5A24B5733B5B7B8104724AACF93649B253EA4BD47B3D794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Browser/updater.exe
- Size 502KB
- SHA256 327cb92964d5e8b9d01929806b84f7ebab849921e168ac1e07b7f998a9d52bb7
- MD5 f9188382af864f6f3d6bf5610f094dfe
- SHA1 3799f91db032fca54a847f6b8b5b52bfbd369a4b
- SHA512 b6559a04af2b2d2b7557a98e0b6babe4350a657a81d2ab7f93b1a1cecb74e74d3eae925c9045b80880611d3a6a61009ef029b46e08a53dfdc208fd677327d065
- SSDEEP 6144:5hdWWJWnPbsDD/mofOK92XoNhBJc6FmjC1lBmUo5Ut0hfd6HlEE9z5VJQY+Jg3Ph:5ssDqoWY2X4hBBmjdUtqJAdGyd
- TLSH
  T104B46C17E68408F8FC2AE139974AD212E971F8A90790F4DF036453256EB6AE45F3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Browser/xul.dll
- Size 154.8MB
- SHA256 1b98d692c4cb5e6c70fcf34fc3e81ee89e7fd93ab20ce8659253a6bd14208319
- MD5 5c4e340731feb7d8451d17535a942d3e
- SHA1 89598357a4e0d55cea4754ca36ae099c9ee379e8
- SHA512 1dad6a93cac3be475f909634b57b6c390698bb1414c40f86e64d611ed6f262c90274baf2c546f5c940e3469575ef93a46e8eba394f9c8b0ffa4cf415b0b88d0e
- SSDEEP 786432:N9f/X8lZhU6vnKTm5xitGTz9z/MPSh5PIwFjo9rgTdwrd/vs2wsDGxwvyACG:TnslZhUYKTWxi4aPSVRTdwrd/B4
- TLSH
  T19B785B03E2A240DDD47AD2758B965733FA71BC494B346ADF269047222F71BE0AB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Checks system information in the registry

Event Triggered Execution: Component Object Model Hijacking

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Checks whether UAC is enabled

Checks system information in the registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32