345250adf0de172a97b6789fddedff6da3a3e5cc9483998a10773cf130b5d900

Sharing

Copy URL Twitter E-mail

General

Target
Somiibo-Setup.exe
Size 248.4MB
Sample260627-rjp6jabs2w
SHA256 345250adf0de172a97b6789fddedff6da3a3e5cc9483998a10773cf130b5d900
MD5 bb8bf77198ac28d4cc074c3ed66acbb0
SHA1 617865a7dca11a8faa58c8439b41a61c44ad2272
SHA512 e3ce4381864a625407f353ad366bd992b31ac7189c1ed0648a4c257f1d27b4e490d42ad4830c800e11b36797f3a4a178e3dda67bd92e72a6c013716aa2f4401b
SSDEEP 6291456:H5tfkv5MRF/AY33un5tfkv5MRF/AaUK7Q3H:3fUMRd+fUMRdZUK7EH
TLSH
T16CC833F8F95524A2D5272FF492D925819CBA9CE1AD20A4CB1F0BB917B333B45C6142F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Somiibo-Setup.exe
- Size 248.4MB
- SHA256 345250adf0de172a97b6789fddedff6da3a3e5cc9483998a10773cf130b5d900
- MD5 bb8bf77198ac28d4cc074c3ed66acbb0
- SHA1 617865a7dca11a8faa58c8439b41a61c44ad2272
- SHA512 e3ce4381864a625407f353ad366bd992b31ac7189c1ed0648a4c257f1d27b4e490d42ad4830c800e11b36797f3a4a178e3dda67bd92e72a6c013716aa2f4401b
- SSDEEP 6291456:H5tfkv5MRF/AY33un5tfkv5MRF/AaUK7Q3H:3fUMRd+fUMRdZUK7EH
- TLSH
  T16CC833F8F95524A2D5272FF492D925819CBA9CE1AD20A4CB1F0BB917B333B45C6142F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence spyware trojan
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/active-win/index.js
- Size 1KB
- SHA256 c4a404129e8696821ff09d5910d8e380c5ec0a41b96cc3800bee5fee3d24f48f
- MD5 b7307fbdc83d443b4cbcc5d66921d964
- SHA1 db73b6c315119ae0bcf2b983df1f2adbba78eb71
- SHA512 bbbbfbe65129a75baa212e2de3b92c64289a17ca18fe1a04335ed772563db269364958e34dd566f954c72de9a42959c54789bb8a3cbadf738d9cfc4e54439313
- TLSH
  T18B3107C0DFFAD66223E637C1708A4F1F91F4D8711A5D827B840082C9FE815A7F161EAA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/active-win/lib/binding/napi-6-win32-unknown-x64/node-active-win.node
- Size 151KB
- SHA256 4558d28161114d07c42de635007d38a4300fc4c6811c28b5436db5e8b2230a95
- MD5 561f6778bc6e2f593ab1fb4dbc619cf8
- SHA1 55cfbfbf532036b0b5914f6a380d13c484726262
- SHA512 ba23391488ce8e6975b2616a98ce3e2be504db4ed466fecbb9ac8d839e17038ef85867f14a0a3af6db14585d3794b0b8ccc2c5bdfe0d80d566f1b5673c79a4ff
- SSDEEP 3072:Q8HyQeVzlieF1O8Mjvx+bRzu4em8+O7fisemRK8Ome5n:QbU8Mjvx+btNY+O76s0n
- TLSH
  T1A9E34B5772A401BFE1AB827888935A02F776B41107909BDF07A0477A2F637D1DE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/active-win/lib/linux.js
- Size 5KB
- SHA256 2c4b5a886a7e71e372985fca75861c8fbfa1e3ec187f6c132f37ef7582df7313
- MD5 81f312e2660388b75c3c9b3567b9af65
- SHA1 4803271bfc519ef8a9fb9aa7b986132b444a939b
- SHA512 15597020a72a298cd77800ed306fadf068b480007e6d12ce7ef5322c3eb55d866a553679897c0786a258b1741e96215466abe68c67a13f8650e4e48d64d6a89d
- SSDEEP 96:zUoA0C/oCnoJNr5n5PIVZgDqd/6LxHYxvMObTO48W9VYR5NV9ChyAxqvcCQBQC4P:zn7CQCoJNr5lIVZ/B6G+4vViNnChjxAH
- TLSH
  T10BB10194EA7E626013F410D1BDBF2303B04EE45036648CE5ED5C5950BACBC93E5EAAE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/active-win/lib/macos.js
- Size 1KB
- SHA256 759808a91e00c92943da4b0e8644d3944649bb3af25544d97d86b8c947fb2962
- MD5 164bdafc9b760eed38db721f7bb616d0
- SHA1 bc451fe3ef6e768f00440c9807f01c83df9c836a
- SHA512 fa1ffa02096f0d476739b2210844240f6d54eb84b33314fd9ba1f1297e3802e9c55085ffb6151885f183ac2b9e45dca0f3a02d517fbc1607ff208cefd834d1a2
- TLSH
  T1FD21AAA293F5577223F321C1AF69BE2B90AEC52034A9D8E5845883C83982493D492AE1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/active-win/lib/windows-binding.js
- Size 350B
- SHA256 ff23087a89e51e106cf10f6e48ba60d325667ca558bc8e75e6d11e9ad5c5b5e5
- MD5 f104f2c91685e373c299bdd5a08c82fa
- SHA1 755f020ed4d5e717fe9ab46021cfac0c3766e686
- SHA512 e9686c31bb3d96e99210f34c3817f1af3f05a629c9f8969bf0e71ddc91a2e5f5d237259677cf1f2af85033432f3f30f4196e8da573e0219b639a2566f8a7dfda
- TLSH
  T1E3E0DFB067A23320B6F092C7D6516503188BC9B0331310C5C85CE8F225A70C82AD2895
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/active-win/lib/windows.js
- Size 276B
- SHA256 22b011bf468e076e4d741783c68a0c4ff8b28ac99c5b80198eddc773128f8cbd
- MD5 2e2013b4e2e13f50d07c9e299b0f70ad
- SHA1 0ee40eb968fd10c8514db6962169d7d35ae367aa
- SHA512 e523439bb3714ec95a1fb5904cb6749af817175f8d8815292d711d15d347bcdba0cbda2eed4b8aaeead8487cdf58d0d1dd672586204d593679e3f79956d3ed9e
- TLSH
  T1F0D012F71E34119127F976C0E29F431218C0C4A2230599521D2CE5E5FE869935986CD2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/active-win/main
- Size 222KB
- SHA256 0ecc5a41402bfc08282120f452a33efc91fc3622a85d911222bfb35cced05099
- MD5 92f28c367b320fab501f48cc38dd5ffa
- SHA1 aace496496cc9c169d39f62a57708f07631c11e4
- SHA512 9263f135523670865c89894614a5cd87c75fb03b2bcc24a4847efaaec3240c163f5e92f7eeeed34d3bd20b563369903a84806a5469acf574aac5e7a0ffc2cedc
- SSDEEP 3072:myWgx8dU/ykTzvlwzTgY4JjfrmYTp0yvrgUDWIv:myWi8qakTzvSfgY4JfaYXDgU6k
- TLSH
  T111244D53B3282697C12E9278898BE3145473FE90AB12935AB724D1586F7F7706903ECF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral23
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  swiftshader/libEGL.dll
- Size 364KB
- SHA256 8c957a5f40d7f599669fe405d509b7704f3e340523c809e3a8e07fb020260936
- MD5 f17ee1861233dcd67775479085624751
- SHA1 2df7ab4b1d7de537ef37eba78f78462a48aec022
- SHA512 18acfb074a0f2fc0c27016b467ae20cfb01bb4ca171d84fe0904a59e26fbb90e261d77e54f2796b0583f0b186b1f1320c35077bac3ce92f1bba675593aac9ce9
- SSDEEP 6144:k4vgaNrFwjONtiVw4LVxz3jbIHupKDdheV+FE+liISsI4:k4vgcrWONtiVxQupKJhN
- TLSH
  T14184AF11B540C036D85E3138342CE7791A7EA6A11F1A8ECBDB984EAD5F701D09939BBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  swiftshader/libGLESv2.dll
- Size 2.7MB
- SHA256 0218b2996474e55d41bcd36104059f19d424b1873afd57860e5c54ccb62d3fbd
- MD5 3fad3cd4ea9ba738b505863117a1b577
- SHA1 4f62c120766d73f95a161b59afc332e02c70785b
- SHA512 0defa571aa33ee0fe08400e88858e98abab778b7a797f83f8eafba2e0ae0a19ed60d7905e2f572564eb79c282b0ff25e3d2e9856e472fb9a82bd5a2bd161e034
- SSDEEP 49152:eLhTCDM0nHASAZNT0fIHmM6Scy2kZsOD9h0tdTXustbXc+Z6DSrQ9dF+N3WVDLvW:iTCDMV+gX3/Z1JSb
- TLSH
  T164D59E02A12290BDE42A53F376189F39BD7447840B764ADBC7985DD4AFA42F0267F12F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  vk_swiftshader.dll
- Size 3.8MB
- SHA256 00d696416a33e7f4698f85b35e1f516340b71f8fe6d8d180f080e435d041d803
- MD5 168301042b2fb855d13be47728cf35eb
- SHA1 71237ef9639ddce9d403e06c134850a921892ec5
- SHA512 4530469f931eca2c5095bb9252be2ef829c97ecd9232414dadce9669bc4d4d109e83031d6e7b049bc0133f1e6bb4b1122ab54a6ef70ff73723a648435978af27
- SSDEEP 49152:WOzU7TubRexXiL+i34UD80vXI6sZLAt6NC5UpHWkmYIYqu3Zq9kbHWicFSBqCzLG:WAUUKivD8Ep894oS1GrBD3M
- TLSH
  T11F068C01B601807CE44B23B3602DAF38AFB187855B774EDBE7582D945E306E15ABF25E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  vulkan-1.dll
- Size 625KB
- SHA256 f5aa3b88ed88bda3c7dc361e836cbf9f848b941f78e0a51d449e76dceff72744
- MD5 28bd75ddb960c5719e6852c15e1f2a64
- SHA1 45767331b6b70ab76849cceda15a96a8e4b48586
- SHA512 65cd9259237d6398362b59ace95847a5f5412f0a7a8051ad82ce49994d1427069fa6474cbcf85757747df4f9be4c8db9da23b2eddaa10c4dd64e7487c3c48e95
- SSDEEP 12288:7aVMRz3jmXRLQ1RtGt5Rp9CR3mv7v2QUsKrSuKMeEutbBhnj:uVgzzmmm7v31QE5h
- TLSH
  T16BD48E04AC90C4B3D61B22367518F735572EA7116B748DDF5BA86E6C4F302D06A3A3AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32