6bb2f677cf18501468f813816578b5c03197c454fe0e11aaa71acfe7dcd71cfb

Sharing

Copy URL Twitter E-mail

General

Target
CustomVR-Setup-3.78.4.exe
Size 114.4MB
Sample260628-cfbreaey5z
SHA256 6bb2f677cf18501468f813816578b5c03197c454fe0e11aaa71acfe7dcd71cfb
MD5 374bf510b13d6b7b0e0ab2bdaf6a435b
SHA1 7f57de90fd8787e89cac14197e7a287abbe4e48e
SHA512 6a60466a4da1228707aa87a89ad539b11c59d2c5aa31cd67fd47086c5658975517cc48f83975b35770a663889f77864b8dfbb623da6d24bf9c4d79025e873d35
SSDEEP 3145728:MYXLQiWn/ynFN88JuS9yjFLY3EppbJNJOO5V3JS:bQlqnFN88JH9yjZ/pbLJq
TLSH
T1E948331124554B3DFB80FA76639E90FA26CCAF05C4B3902B0A33B5E975747C6E6C5A23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  CustomVR-Setup-3.78.4.exe
- Size 114.4MB
- SHA256 6bb2f677cf18501468f813816578b5c03197c454fe0e11aaa71acfe7dcd71cfb
- MD5 374bf510b13d6b7b0e0ab2bdaf6a435b
- SHA1 7f57de90fd8787e89cac14197e7a287abbe4e48e
- SHA512 6a60466a4da1228707aa87a89ad539b11c59d2c5aa31cd67fd47086c5658975517cc48f83975b35770a663889f77864b8dfbb623da6d24bf9c4d79025e873d35
- SSDEEP 3145728:MYXLQiWn/ynFN88JuS9yjFLY3EppbJNJOO5V3JS:bQlqnFN88JH9yjZ/pbLJq
- TLSH
  T1E948331124554B3DFB80FA76639E90FA26CCAF05C4B3902B0A33B5E975747C6E6C5A23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer adware ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/koffi/lib/native/base/unicode_gen.py
- Size 4KB
- SHA256 402e17c0b48c4d79da1234e10e57d7174b9103c376dd43ad9a1e044a9fb39944
- MD5 ac6fce83cb314c3b4795dea5ae6c7f4d
- SHA1 d7204931b2c48734d3088b1fdc6d043745c9d1fd
- SHA512 c99fcf518a86acf4dc7cefd506f92a4e983de9af12f1a454c18dd0b6f856c2b6cd7970e64e1c4c224c0da819c2716a01416b5c339b41d139aa6c6c137fa9cac2
- SSDEEP 96:O2K6bnQmTL4/4wMZE1WV8vizZBzq8OTe4oN+N09i9tKua9VbZSDbbWHbw64bbEAm:cAT6JA8kq8OTe4oNi7FcwiSEAtI
- TLSH
  T136A16521B89A55508B4713284DABE609A32C7A13E3016978FEEC73D42FC4835D7F5B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/cnoke/cnoke.js
- Size 6KB
- SHA256 dfa8d4d5a1e7e4cdd51ac2b656b93e816718d5912dcaa28002bf3d6cb3068b46
- MD5 5c4e1ed34fa6ee4ee79a9673299975f3
- SHA1 a6f3f69943a2eaaa63479c2ba6ec682cfedd9f53
- SHA512 b9fd2426537f9d619744e49beab5717cd7284269c6a259d62c6214e829d6c5983f17f09caa30bd30315222e9497e8a601b14c22cffcf0bf5c08ab70600f19883
- SSDEEP 96:d3GJlhDS8zUMzW19ajxBaZlEOJ6CyB8/gXFodUVtmsRxA:UJlhDSS9m9aWaq6CyK2bs
- TLSH
  T1B9E131052AFF163346272496D5D74814ED3A87BB03487DAE3D6CBEC05F8193180FEA98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery execution antivm
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/cnoke/src/builder.js
- Size 17KB
- SHA256 53a48af14d00256f3f60d6265d8bc637fe1fe50e0cbebb3ecc610bd9cc46b199
- MD5 7f7ee4a61fcd702b9646f19a7a4b1859
- SHA1 d65df0ad2d5d5210fbeb69559e6bb31d1dee4524
- SHA512 3ad6f0d216e5273d4d9e39fbe1a028d662aa5ed3a94e5223f65378ef3cf68b89f780204ac0b1c64a4b4a52679238ad68a112dd24aa4ea676772aade44101ce31
- SSDEEP 384:+Yl7NIcaf/inMPI/s/Cw9MhEtVv9yeDBldPEsxjc:+YlxItKMg/oCw9MhEtVv9yeDBllz5c
- TLSH
  T10B82942642F752232333B4BD6BEB80466AB9C9131309D51C7A4C57912FE097886F3BED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/cnoke/src/index.js
- Size 247B
- SHA256 01cdd6266047bdf69d79c0ea48fdcd830471282eddc0b9c8259558baaff62cd7
- MD5 c3de2b22771386ba46ad88f2affe7693
- SHA1 0475c9895486ff907f8dd75d172a49b664c4cea6
- SHA512 5e4cb238cac5fdf939de3010d2b6ff27d3d56fc5b2e0a688b97803a92a87fcbb9f0ab1071c1880c3861acdebb80d8b6447a7143f286bd35aa228b887714c341b
- TLSH
  T124D05BA3A8B45420484606C4D4F49F36A8A6D4239085A871741C8293115A46405D98CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/cnoke/src/tools.js
- Size 12KB
- SHA256 7b12a3ddc0a7706b7e5cc6155537e9abf3c75c124e5ca38ab58c8dc0b8eea58a
- MD5 b646903f885818c0128a29ea6dc07986
- SHA1 60d3fa059c40cce9704ee6372353058615cde625
- SHA512 b65d3191baecddcc09d6cbbd3f1ef466c1de91424b262faa8ef57169876ecf53f73d3bb2ca43497ad68e56a5599c2ce1d3262d2c90733db7f952d751b7955bb0
- SSDEEP 192:+QH8fL4laPapCfzLDa1xc5j5nxI1nWZyWPuBqmR0ApfBn65bKtvmqdRgDD9j00sP:+YQaH7D1h0A25be/RgDDd00ssRwfgNQN
- TLSH
  T17942744949FA31224323F16ACBDBAC0EA2558447650B8D1CB98CA3D67FC07B9D5E17F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/koffi/src/init.js
- Size 3KB
- SHA256 76c95aba02c0e8b2df4a0580af41c65f5a2fab8dbbc86cc02e6eb177268d0d9b
- MD5 794d621d8cedff7fb5f6cdcb7ec0fbd7
- SHA1 ce812ea504834f075efdca10cd679af37a43f61e
- SHA512 4238ef4f656793ad292c6c167f6f4079db4438321a0c94b78ad18d93f78e8a76186a44583adf8f009e7b8772edcf98c9a61b9f4ad8f29e135076f3d0509a18bc
- TLSH
  T1F781532E23EB90A1AB527368A68B50D556B9C02302145B147D8C9382BFDC47C87F7AB4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
- Size 1KB
- SHA256 3ab8e2ca421a950555b9866396ea9d2632d3a70d5674096a20968fd0458cfd7d
- MD5 364e1e3a2f1d19d03ed006beaf83cb1b
- SHA1 5a508286c137d07b6051b47e4cb0dbbbbc7b6eca
- SHA512 b5afc7a22906607bc2830e64e6b751e1dd3c7f4c441b967f57a7de88ed75c5eca2e5ab3874ec137dac381d868206c1e0579b8b15ac27004d56610bd2b7dfd387
- TLSH
  T132419D24C59E02344323846A6FB7D40254C9B9173AD8EE14FD1CA7852FDA63EB6A1B29
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery execution antivm
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/koffi/vendor/node-addon-api/napi-inl.h
- Size 230KB
- SHA256 797668948d7f2df0ee8fcfe734af5b55942768bc7e15e77196a1f1107bba3635
- MD5 a9252880de2b63d2584a0dfccfbbc837
- SHA1 5b83588083a8824c0905aee4867c576d78473a3a
- SHA512 dfe26b6491340589583e6173dcd253d3521413817eafc4b8a36386da56b726e27fb0fd59671d063ca77ea50902dd80c9bb88215c06248ae1aef1e5d815622939
- SSDEEP 6144:2dPvxWsSKWEkRBa8iOV65+04Ho8mhRFf3j/LtapJiK7wflzb/QNJnThjbdD75kZW:2dP5WsYEkRBa8iOV65+04Ho8mhRFf3jO
- TLSH
  T14A34A61436E5F1012A62E723682A92519E19943B2F3CDF90F1DDB3247F805BEB13A797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32