1a3609e76ee85d9b0f4eb11e79d3dc0d1b401c1c967ad34825120ec267b2374e

Sharing

Copy URL Twitter E-mail

General

Target
WatchBeam.exe
Size 114.2MB
Sample260625-mt4dpabs3r
SHA256 1a3609e76ee85d9b0f4eb11e79d3dc0d1b401c1c967ad34825120ec267b2374e
MD5 3b279e876a17decf181890d830cdb4e7
SHA1 aa013f08245aee55ca33e6ed690dd799d7f4da42
SHA512 fbda6d25d21e4fc74dae7cfdc84f0bd52cdccb2f832322cd8516a650f8b4339545c36014f12e0d6536449ab3e1038b9b576977ea44c4d0dde8e129d6145f422a
SSDEEP 3145728:vGXLQiWU/knF378uO5V3JmLQNdd8Y59d1cBDr7T+b8jdVRSyhDdFv4W:kQl7nFL8uLIkgmv+b8jdPSwL
TLSH
T1364833549712C639FF60F73F5AC2F4F0172A6B37B8A4B007487835D26AB9958C28D762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  WatchBeam.exe
- Size 114.2MB
- SHA256 1a3609e76ee85d9b0f4eb11e79d3dc0d1b401c1c967ad34825120ec267b2374e
- MD5 3b279e876a17decf181890d830cdb4e7
- SHA1 aa013f08245aee55ca33e6ed690dd799d7f4da42
- SHA512 fbda6d25d21e4fc74dae7cfdc84f0bd52cdccb2f832322cd8516a650f8b4339545c36014f12e0d6536449ab3e1038b9b576977ea44c4d0dde8e129d6145f422a
- SSDEEP 3145728:vGXLQiWU/knF378uO5V3JmLQNdd8Y59d1cBDr7T+b8jdVRSyhDdFv4W:kQl7nFL8uLIkgmv+b8jdPSwL
- TLSH
  T1364833549712C639FF60F73F5AC2F4F0172A6B37B8A4B007487835D26AB9958C28D762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/koffi/doc/start.md
- Size 3KB
- SHA256 2624333facf7f80b21c6d422ecc9289dc069577e5f946f468eeecb4fde62205f
- MD5 5e1efbdd7e48a3991e7cc2263096ab3b
- SHA1 628d2739cfcf09ce109f18019d3ceec05ccaf9d6
- SHA512 b707c7d763deab188e2c391abed0b22d4930b5e9dbd82bec5581f6b5a5d02a9be82c7dd6f23c50a83ce99d2a1e1e57be562a83968c826ff5d36547f478ce1a87
- TLSH
  T17961775322708076E4B132D3B54D70F6A337CEB53AA5B954A46E40E03F268DF1073A9A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/koffi/doc/unions.md
- Size 5KB
- SHA256 2adf36a1ce803786036fa7ee9cfd4ceca2f62cd6e0560554ce49315cbc67674d
- MD5 0e0523e1d77692b545c6f1f2a40e5c45
- SHA1 a59b010dd040321d605befae3cf6855938517d9c
- SHA512 aa10ede69ac6715b259a5a8f6dd186f38128baaf04df82c7cb27d7f2e3e4a9dd3382bf03e45d72acc377cf02b6bdcc13dfb582fffd6b49d1ee34dd0634e430ae
- SSDEEP 96:q9RlE6kZPlUpagS/8p8xMC162WM2TvaLETY3S1pyULD7sOke:qnG6kZPlU1SE6+C0v4JibyULD7sOke
- TLSH
  T124B177EE0311F634D4763296830D2763E13380B63596E9987C9DDD70DF1E4AFA1319AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/koffi/index.js
- Size 20KB
- SHA256 39e05b73cec3a65d5841906b97cb8c95055e6fb300271de0c0b5a7f918f2ca80
- MD5 27d630491dbf84b14efa3593ba4e433f
- SHA1 97860f419b310fa7213dcae04a48b2840579a636
- SHA512 9c0e1e25404c16a3679cfc02b11c8ad9b515e067186926df04cc90cab57899dd805e247728a9adb958f4ecb10c11aa1b4a773730832eb9d0aa97e937a8973c0e
- SSDEEP 192:UIcO3oqiuThaiRED6C3Sjzb81dqBV1mttNWG56q5CdrSW527ia3aiqQ26NXWHHqs:zXyj8v1n4Axh/9OG54VaWyQoMaP4PG0i
- TLSH
  T13292845E4AF720629323B178D36FA0457671C4835509DE087D8C9391AFC80F99AF6BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/koffi/indirect.js
- Size 18KB
- SHA256 375321335528e603091398dea286361aa8ca045ce7f76bf99dce7c92b768cbfa
- MD5 e3ee4b489cd98fc34ce0c43a614c5a2d
- SHA1 390f96d087ffb0a0daac0fe899e9423d175f8ef9
- SHA512 1cbd7a7e98b03c45fcdc59a125150a4419d38cc2bd8dbd9535e9514d31f75ae6bb89c2aadc76f36d14e7b345d465208cdf5822890d008aef078b35426e2964d6
- SSDEEP 192:UIcO3oqiuThaiRED6C3Sjzb81dqBV1mttNWG56q5CdrSW527ia3aiqQ26NXWHHqW:zXyj8v1n4Axh/9OG54VaWyQVM1wi
- TLSH
  T16782825E4AFB20628323B17D975BA4457261C047160ADE083D8C9385BFC85BD9AF67FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/koffi/lib/native/base/crc_gen.py
- Size 2KB
- SHA256 605109bcb12c06748b022bb1a7948fe5e4c6376bc87b21d232fca9b1d9a241ec
- MD5 62d1c2ffddb8ccf2e4f93bbba7b0981e
- SHA1 88aacce8c861f8ca80e827e21e067cecceb97bac
- SHA512 f67c8a6a171eeebfccc8f17cecdf6ba22611a9f11791fd11d83a00abddabf47af0e071b38236ea80d15bbe91415b784a8f69f4c6a71f1f7b0fbae9117b87d498
- TLSH
  T1914121A29CC466005B0390BC5DEDC922962CB7538A41BDB1BB5D96C71F42A39C3DEC8D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/koffi/lib/native/base/mimetypes_gen.py
- Size 1KB
- SHA256 18e93987189889bed91f06b27ea80e16241ddb59f32409dae160cc54356f6236
- MD5 85a2e0c36f3190b9a50686d74bddfa77
- SHA1 5ea551de263b757d5d384952963fbd4aaedb1aea
- SHA512 e6cc5ce254dac6a43b02880bfa7c2065f466d06ae3988d857ab524466289db4deee1e3e4e17a3c6e8608af225fa1a6261bbe8871f3546625fa2fb76a5c0a1bf9
- TLSH
  T1E84110201CCCA6506B93D17ECEAED601F3153C1B31547830B8ED89A43F80628C1EF898
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/koffi/lib/native/base/unicode_gen.py
- Size 4KB
- SHA256 402e17c0b48c4d79da1234e10e57d7174b9103c376dd43ad9a1e044a9fb39944
- MD5 ac6fce83cb314c3b4795dea5ae6c7f4d
- SHA1 d7204931b2c48734d3088b1fdc6d043745c9d1fd
- SHA512 c99fcf518a86acf4dc7cefd506f92a4e983de9af12f1a454c18dd0b6f856c2b6cd7970e64e1c4c224c0da819c2716a01416b5c339b41d139aa6c6c137fa9cac2
- SSDEEP 96:O2K6bnQmTL4/4wMZE1WV8vizZBzq8OTe4oN+N09i9tKua9VbZSDbbWHbw64bbEAm:cAT6JA8kq8OTe4oNi7FcwiSEAtI
- TLSH
  T136A16521B89A55508B4713284DABE609A32C7A13E3016978FEEC73D42FC4835D7F5B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/cnoke/cnoke.js
- Size 6KB
- SHA256 dfa8d4d5a1e7e4cdd51ac2b656b93e816718d5912dcaa28002bf3d6cb3068b46
- MD5 5c4e1ed34fa6ee4ee79a9673299975f3
- SHA1 a6f3f69943a2eaaa63479c2ba6ec682cfedd9f53
- SHA512 b9fd2426537f9d619744e49beab5717cd7284269c6a259d62c6214e829d6c5983f17f09caa30bd30315222e9497e8a601b14c22cffcf0bf5c08ab70600f19883
- SSDEEP 96:d3GJlhDS8zUMzW19ajxBaZlEOJ6CyB8/gXFodUVtmsRxA:UJlhDSS9m9aWaq6CyK2bs
- TLSH
  T1B9E131052AFF163346272496D5D74814ED3A87BB03487DAE3D6CBEC05F8193180FEA98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery execution antivm
behavioral31 behavioral32