aa3a68e3437710a4520309971852ab57320f4bf87ebef4fa7f10d0260936c34a

Sharing

Copy URL Twitter E-mail

General

Target
Koala.Clash_x64-setup.exe
Size 150.8MB
Sample260627-kkh1aaav3j
SHA256 aa3a68e3437710a4520309971852ab57320f4bf87ebef4fa7f10d0260936c34a
MD5 9386832891ed0a2fcf546a2f99ca2245
SHA1 c33e9ec537cba68d7bd5d21c54e46e30b4d359c0
SHA512 aa6369b988910c99d6a4b6a3cba0c2095136d9bc9d9fa443bc9505bad9fe25c96b5f70f94e75ed33d94a274bc835582b692f08291d5a6b5f63a1df5b9e9ced45
SSDEEP 3145728:HovB8WVTS8ijuGXydNqivPWaPL027Yk+s9t73ZqEQ:IphVIjtydNqivPWqTysX3Zqt
TLSH
T19878334E6389812AF549A8344A3055F04D55FF2A17FCBC429FB6F138E2359CAB9DC1CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Koala.Clash_x64-setup.exe
- Size 150.8MB
- SHA256 aa3a68e3437710a4520309971852ab57320f4bf87ebef4fa7f10d0260936c34a
- MD5 9386832891ed0a2fcf546a2f99ca2245
- SHA1 c33e9ec537cba68d7bd5d21c54e46e30b4d359c0
- SHA512 aa6369b988910c99d6a4b6a3cba0c2095136d9bc9d9fa443bc9505bad9fe25c96b5f70f94e75ed33d94a274bc835582b692f08291d5a6b5f63a1df5b9e9ced45
- SSDEEP 3145728:HovB8WVTS8ijuGXydNqivPWaPL027Yk+s9t73ZqEQ:IphVIjtydNqivPWqTysX3Zqt
- TLSH
  T19878334E6389812AF549A8344A3055F04D55FF2A17FCBC429FB6F138E2359CAB9DC1CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  resources/app.asar.unpacked/node_modules/file-icon-info/dist/FileIconInfo.exe
- Size 9KB
- SHA256 9e65d5a73a8d87b0125d11617ed89fc81c442102554741186609360d1540b04c
- MD5 d2622b328878b9a7007d7a249d27655a
- SHA1 b4a26e869021ebef0f31653dd8f7d355c1d972e4
- SHA512 6f7c069567ef20d09f3ecf49c64e6005a546995a3ee13f7ddf82555e3a19c072b51fa56afaa61b941c99024f9e1c8198aac32fe5065dafb095c8e6fdfe70116b
- SSDEEP 192:WWhuAvrqalHOwBkll+UOavW0jNy/6e3O8nsXt:xn0wBklsUOUnjQiOO5
- TLSH
  T1DC1207089BF0DE2BCD724734ACE74B5A0734D9980A73CF5B3A7C612A7C2439911623B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  resources/app.asar.unpacked/node_modules/file-icon-info/dist/file-icon-info.js
- Size 534B
- SHA256 2e4adf73c78862eab77fe9d5da5008465856b399e1974de6698dce07c3a5d8ef
- MD5 0ac7ea571fab7faa3e3dfeb2bf9c26f8
- SHA1 e74d8f3b1098c485bd446963507df0fb2f74d774
- SHA512 d0d6d9babe421a62ce356edf37e1efeb525c83541bb29b728bebaf0dbf462575e56c974a0c858de504df293390c9ac06102404d7b0299a1eb049489bbfa81cd9
- TLSH
  T1DAF05924452692F182B1ABD89B279561E087903227A5C9E0BB8DC6A52FA070853BDDE3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  resources/app.asar.unpacked/node_modules/file-icon-info/dist/index.js
- Size 177B
- SHA256 3b86a4faaac183730adb849f4ab9fd7f6ee6c441996ecb0a5aadb504d0872cf9
- MD5 dc462f44ceb73e06444a7c05b5eb0a1b
- SHA1 b0a07cbd72600371c98572036f7c652535a8a850
- SHA512 ddd74f22e042912d57382d1805fa39b2c611f5f8a57c5b9317e777c35d0759ee1a8b64cfb4d1dac0d53ca2ff73d15679efd3aadee2098ab6e4f18a2ff01a71ca
- TLSH
  T1CEC012055D5CE0E3575508C49617A091E982D42219B1DE918B698D5AF920449F294426
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  resources/app.asar.unpacked/node_modules/file-icon/file-icon
- Size 271KB
- SHA256 7832fc19b834c8ef797b487cbacabc5247f3a9b76d5bfe6214950f4a940bfd81
- MD5 e778bed54192f70308005668b2f34432
- SHA1 40feb515c5987594aa571da157b1cebcf0f75944
- SHA512 e9742fabcb594ae52940281ef83d65b95c6df57b9fff818aa652ba8d3f9a5b73deff5de71fa5b7ce7fe891607c549a700b3c12472607b6ae5e08da5bcaa4e5b7
- SSDEEP 3072:7sec1f5jiWNNVbdPY+ubfJ2u5FXvy7HjqcldPYduhmJ:7LIf5jiWNDbdPccu5d6jBldPC
- TLSH
  T184445DD3FF6C1D54C22DA278885797488536FA83973087AA7B20C6599DFB2306707BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  resources/app.asar.unpacked/node_modules/file-icon/index.js
- Size 2KB
- SHA256 f287670a3528abd5b1f718b1625196c5d351c581dae66dc1b09526f9fd6cc197
- MD5 b64310ab2cb919b8405586bafa507eb5
- SHA1 aff5f79f1a01e8f74c63ebaf9f6f331b2e45cd21
- SHA512 97f5eb1ea55962a3e02bfb10991e43013c171e46b44eee6f266f15939e84adc0660a4a081959c438f3a98a30083515873f400a55bed7c81cd13aa6f5510ac5e6
- TLSH
  T10351556089F1533286E730E13570692EE136C174BDDAC4A512959FB122C3998F6D663D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  resources/app.asar.unpacked/node_modules/lightningcss-win32-x64-msvc/lightningcss.win32-x64-msvc.node
- Size 9.1MB
- SHA256 83e7e838ef1bbf5454c651103574fec31a1cec0b453b999d1173365cbc6c7841
- MD5 d347b8e5dd6154cfd2886ffb03879752
- SHA1 19e0e82ac44d4ecc76e555421b7d6f5a0291bca9
- SHA512 b281b64bd032db64ab37141bba6e7e3c7b4799efcea1bfdd2283e2b52b85208f08c1c6dd6eab02d7ec9dd6ad64bc5c6959abb55e123e51f6113e89c3df3ccb7c
- SSDEEP 98304:jLL2MeOL9AEwjmeSPmeAmz0OUEr/jDaGPqeAkeZ/ud/p:KXYwCekGWapkrp
- TLSH
  T120A62A06E2B391E9C46DC47193576233FA317C8A8635BAEB4BD04B322F65F906A3D705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  resources/files/7za.exe
- Size 1.2MB
- SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
- MD5 b7b7473472c9806bee3e7ae6c1adda23
- SHA1 2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
- SHA512 544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
- SSDEEP 24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
- TLSH
  T110452A56F6788375D073C0B9C5D2AB9AEE72308517308ACB1246876D3F17BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/files/enableLoopback.exe
- Size 82KB
- SHA256 f0c328376bd5ae0ef3b0eb19ac1f343c24a9abfe7bc1008d3b2f6ef3573d04d1
- MD5 d6d0eeb5a95606ddde1ab29bfb66969e
- SHA1 499937e698e9a62ccc7a5118d132a91c646f556e
- SHA512 dabab25522b53ab10c25e4ad872801957fa59c1067861909d762ed796589523eddbe9cdfa00e8c7b0b411b7a1558bad4f720c3ad43ab81058ffd3215cd13a203
- SSDEEP 768:kREI16zcI2eupxmhm/ljPb0O7/Al25znrShUAEg4CqnZI6qmmlk1QPFLCxf1ml0n:e1HLdwOLFzrShU+wZ9xmlk11fIbW
- TLSH
  T13A8317003BE84266F6FA8B759572E4509B79BD5B48B0E6CD2DD4B49F09F3B408321727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  resources/files/koala-clash-run.exe
- Size 2.0MB
- SHA256 b8339661f7321900ec42283adc63fc0058797d264227c03970b9126af401f292
- MD5 66a2d2cef467b045a4b06507a87f6467
- SHA1 9fd93a28a28675bef1f489e39148c5e3418c0e71
- SHA512 bad7e45b906cc5b8663b4be46d0c00412e324a5063550de0c4afa8d09fd48f4c7801559726881c34163c7a46459731c7ba6752f323ea8b939d3ffafd4e2fa889
- SSDEEP 49152:O4s0ZotcT5rb/TJvO90d7HjmAFd4A64nsfJm7a5g1ebTufWgD1tEhYWodzsi8:2kDddEbmn
- TLSH
  T177A56B47BC9420B6C9EAA232897652A17B30BC990F2137C72B51B3B92F777D41E39354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/files/sparkle-service.exe
- Size 8.4MB
- SHA256 ef06832e42a937d2f41330431e10c380edbbe9736d98933f7ac3d79e530e9a74
- MD5 7b9ec7e83bf127ab8a1938ad5c9fc9ac
- SHA1 7b829a9d6cbbaff15c81fccdaeec1da7a770ba6c
- SHA512 1363ef882e90b1aea76a7387333b8285532a92957cd4ab5c3af418ef38204cf229ec32ffea9dcee0ca2478b76443a949b3837cd2ae806a04030ddf3ec044ecf9
- SSDEEP 49152:4g5rmjdDVNQ08QYG/XvGGU+DKMUkiipWD30acNtW4dIQufZiTjNAW1GBVM+Yel/6:4g9YdYLUtacrrPl5MHapSlxEJ
- TLSH
  T1A0963807FC6515E9C1AED13189639152BBB67C490B2127D72BA0F6386F37BD0AEB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/sidecar/mihomo-alpha.exe
- Size 34.3MB
- SHA256 d5ca84b9fe9ffc043205f0c694a8de3e78dcadced42c1f568b2e14dc63696ff1
- MD5 b338cfb99b43f317cc51d76acc6b38fc
- SHA1 36bd8533501113a1755d847f0898ee3a106064bb
- SHA512 aaf212350de6ba3000b335e0af126c11efd877ee2de6b163430dfc4f42568c9b52b8a0e680d962c0f7d8d586da336226857005c9eefeedb62d04c17b49bc3122
- SSDEEP 196608:WWAfrag/6XxupfFq14wZZhm1rl5bqSyc3r5Zc:WtzH6Sfy4yOrTbqSymy
- TLSH
  T14C775A47F95548E4E5AEC934C5A666237B713C554B3023D72B20F620BF3EBE06ABA314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/sidecar/mihomo.exe
- Size 34.1MB
- SHA256 f519a3f6647642014554d430b267d6aab56cb516edf51fd2fb1f929c2e85cae6
- MD5 84939cafa91b93871f34c3535b4850bf
- SHA1 660c7d0e52f68916601c5b32fb504e517932b640
- SHA512 a07984687cf4f01fb8cb1b522a9aac3c3d059790f5516665cb92ec026cd459cc2b01b0cf06fbb5f4f0db58b60b331350116626f4741f3c2c89c3968e766c95f6
- SSDEEP 196608:Uwucm+qgZUna/RV5kZEbBrzwsJelBJRMw5Zc:U77+qggw5k4rzwsIlBJWiy
- TLSH
  T1AB776B87FC6508E4E5EEC835C9A696137B713C554B2423D71B60FA242F3ABE05ABE350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 176adce81d9f0f1aac302806be3dbb67abda46e13355bb85c4868057c6e3a223
- MD5 6dcbe2dbfb4518198fb8e7fdf3ebd702
- SHA1 c21756460ce7d92b199a262b0e83c1ed1031ae0a
- SHA512 7bb98a743a151411ed851c957cd9e33099437a3c125db5cd6b746c6801b531087349e7f0df8e138055e48e221464a86e4a0af7726b52d8bf3eda0fcce7a9bb98
- SSDEEP 49152:9iV10YJkK1M64Qt+qD9gGh1eAXYEe/ePgnW5EZ+rd6m7U0o+VBvBL3PJPFF1TDDI:wV10Yj/FoGVJbbS4
- TLSH
  T13A463803F28580E9F05DD579875B9632F272B8814B2276DF52A01F192E7BFE0AB39705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  vulkan-1.dll
- Size 900KB
- SHA256 d5acc73241b46dcfd7ea5f970eab9fdc2ac5a3dc737e23d5947980972ed0a2b4
- MD5 5baa82bfee3975f11c8fac875bfc8bf0
- SHA1 1142ea58e43a70c4f79e8c6aab87c4b122b9cdf7
- SHA512 761e187d21dad4aa87b746a1e63143a397b49c20860478c68f94cce5fd5319758440a8ddd3923165a6f9c9512c8161bcdf346279e5200a2fe7484d1ffcaf7f90
- SSDEEP 24576:PsRkqGlxBNI4OBs8lG0mt16Z5WRDYsHm6g3P0zAk7NX:TxlxBNIasG0mX6Z5WRDYsHm6g3P0zAkZ
- TLSH
  T10C154B13A69485A9D57AD034C9D28603C9B174822326B9CF02AC57087F6FFF47B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $R0/Uninstall Koala Clash.exe
- Size 445KB
- SHA256 6b307f9a11a05fe16d3461c9670fb3f04f1eed71d858d8d552e80e181a83f60e
- MD5 3818a4dab3e9dd0b58f582fbe908a262
- SHA1 439025bb1d8bceaa8e4744c9c70603b28e81c55a
- SHA512 05fba9ab5125936671f4114187ce67efbbf05a7e7d5cdc598d60c188a95b8e92f2fce339049c35f89b61760bd0f0ed4df81d55fe23b4adcd8d30613910a954e7
- SSDEEP 6144:a740IEUezPcz/w2kKs8w96GpnSA92UaL2t0EyL+3iaQ:od2kKVw962nhopRK3ZQ
- TLSH
  T1DCA42A4D32C7A29AF8A1D930027460F16656FEA653AE6E427FF0763FD23580138DE95C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral25
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32