3888b82911566353515b2d49abb242147ea612557e444e806748561b56c200d7

Sharing

Copy URL Twitter E-mail

General

Target
Lyra-Music-1.0.13-x64.exe
Size 101.4MB
Sample260628-levybsgs9z
SHA256 3888b82911566353515b2d49abb242147ea612557e444e806748561b56c200d7
MD5 01f60b90dfaad92c8ec2a209ecbf8ac4
SHA1 a92e0ff301907968931a87e10b373b02733891d9
SHA512 2054668e4354f54a451b4a722ec1d95662db9058cf78b588b87c27be9bb3475821215a129da5b15f57cc6189168121e9cce5278552c59f580edfb10eb961a350
SSDEEP 3145728:pRaRIpkPH4wQ0ok3yDbwAUA1VWf8vv5ml:4XAwQ0oRDbw01Vogv5ml
TLSH
T17E38336C3365958DE033C67598C253E978D9AF820C240895BFCB77D89F74086B64A3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lyra-Music-1.0.13-x64.exe
- Size 101.4MB
- SHA256 3888b82911566353515b2d49abb242147ea612557e444e806748561b56c200d7
- MD5 01f60b90dfaad92c8ec2a209ecbf8ac4
- SHA1 a92e0ff301907968931a87e10b373b02733891d9
- SHA512 2054668e4354f54a451b4a722ec1d95662db9058cf78b588b87c27be9bb3475821215a129da5b15f57cc6189168121e9cce5278552c59f580edfb10eb961a350
- SSDEEP 3145728:pRaRIpkPH4wQ0ok3yDbwAUA1VWf8vv5ml:4XAwQ0oRDbw01Vogv5ml
- TLSH
  T17E38336C3365958DE033C67598C253E978D9AF820C240895BFCB77D89F74086B64A3BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/ParserFactory.js
- Size 9KB
- SHA256 d77dfb0574dd34ba3006c6de7e3e95bdd814419452a3c3fefdeb6b62a2353eeb
- MD5 667c2279e7be519c8b0e116dd4a9f6e2
- SHA1 8cb0696d27e583ce4f9b8b9bf7776e5f99161f57
- SHA512 04408bb5a5aa146de0ac4896d50e2f1fd78d7a734e66c37db6ec4a1ce2b69d0789a787af8f1dfcc52b8f2cf3f391d2da5eaa0a756a164d5809adeb020ec6528e
- SSDEEP 192:KRJXF439Pj9fmuT7JVVCykak4R7jl2iFi2EQu75jTzjzGM:YXF6PdH+8q5T
- TLSH
  T17512AEB96CF76010831A579C8E2FD8D5A9AA6D137408CCEABCCDD664FF4458685A31F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/aiff/AiffParser.js
- Size 4KB
- SHA256 eff45bf540c318c870cfccb1ed87ff40777335aad308a9bb8e1ac151f96101ef
- MD5 ebc9126ede1b66b592e4bdc001c098d3
- SHA1 7fe2888187b4dd13b08a561e6b3e4c0171a18e52
- SHA512 df54436c132bfb357c7bb89b236fb01ded3623fcc1ff082800321613ced9bd225db1a07d14947b323441992a1d0bbf76df423e1e71e20f744f9f27dc6e682725
- SSDEEP 96:KEvV1IxgOptGO17FZERybGyiWvXz1nU561uZR49t/zIjnQPU/yOniDlHdjUxe:KM1IeQR17FWRybGyi0z1UmuZKr8joU/w
- TLSH
  T148A1259C67EF3025510224C59EBEA8822635B11B3457EC043F4DC6D2AF498AB9957BF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/aiff/AiffTagMap.js
- Size 521B
- SHA256 c669ccc7a957be4bfd792e9ec8df33e2b24fb3efb692f1cc44838ac4ad7741d1
- MD5 8ce37a67763b453a78508d80ec137cf5
- SHA1 c02e6eb417cb3a4ed6d2bac59de75a0a6b44197d
- SHA512 6050cd6274a0df10e1dc2c50a56f5565c756ac32f7d8608dad62953cf21b2d0b8db35a330149faafb426bec4803af028c5499805f88b520b05e46ceed8dc5509
- TLSH
  T1FBF059BDD4FBF7B813590CCD4416E1532941A93F9A04287532EF476E0E1B88C036255D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/aiff/AiffToken.js
- Size 1KB
- SHA256 74c9ac218abb0a5130d86e2d43d4560b50194d8623bb52ca3a8a9fc4508d46ee
- MD5 fe98df2d404136f193b5595b55354f31
- SHA1 60ca90964660b737ff1ce0becf0b0c8f41039123
- SHA512 90fd8a8b180b446d2652f3b4f4b84b65a33144b7b914f2d3e3ab51b6412bda0401d84baf71ce3b7810a8f3b1be04890573fd7eb98f33e812e842fd982cfd35d3
- TLSH
  T18C31BC180DB610609A1270EC4F5770087AB4B483752A8994FF2CBBD06F9516CBAF77F8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/apev2/APEv2Parser.js
- Size 7KB
- SHA256 7b2bc88b2459342d8b3e3d385a89b38202a6363643792ee1669555f874cc28ec
- MD5 319c59cc08fd28d60a3b9ea163c2c9c9
- SHA1 1449c6262e2f20aab0828517f8fd2a5bdefa6902
- SHA512 3e0035ca144410cc9d20ab380706be6a34f06cee9ec0ae2de72fcaa1bca3e5d42d8d70afb4fcd6f9814c38c4df9a92c9e7b7e1a6da7d10ad55df8f0d0226393a
- SSDEEP 192:KNN08RO/+aKubiC/R5UBDK7yinsaGBxNYKPWBIkoWT/dQoyiuNhWIMW75:hVF9sv6IP8dQVh/MW75
- TLSH
  T122F153557AEB34200063789A9FEB9D015078D2373905C9493F4CC3D7BF8A796DDA3A68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/apev2/APEv2TagMapper.js
- Size 2KB
- SHA256 9a1914ffeafcffd08a3142a38ea1248dae5d9ad9f9f4f2332017aec782f61c0c
- MD5 b1f7a3b994d292ee229bbd9043b3ed88
- SHA1 43cbff234570e7ff3aca268530267e1dbafdcede
- SHA512 aa2665272a15b8ec31ededf930d783bc0c517cecd4012ea422feec848ab600cdb61b966861a7e91007c2f84881dc0c0634701561f4a998bfde21b648071fff2b
- TLSH
  T1A55135F798EF5F195A50771D512FA99334890553AF06BAACFBB6022C1F0EC1C4875A48
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/apev2/APEv2Token.js
- Size 5KB
- SHA256 a8316089b0bfff639fb3446c996b9f36cfe76618595bfe52ee4b0b1665d6d46d
- MD5 9e561e9250ac7eaa56cc52a9678d643e
- SHA1 6982d78158cbe08ae93f2e33ab8e02707e73265d
- SHA512 ab323a242ac10c03a924aae37c7337b98bcf44c77081c5318f641db1fdb8aef076e20c8317bba2c4082332e022899778eb618365b56b57b49ce53c0cb7da0635
- SSDEEP 96:KEmjiBMYtcbqVWKyvaVTGJlUtqlTRwiNiXlBRsxEQ2sUjAFkWrr4GroDNLwK:KzjG30qVfSBTJfb6jzWrEGroBL/
- TLSH
  T1A3B1FE13246101B52703618E4F9EE24B3B0884535D98C4A4FE5D77BA2F1EA2ADBB77CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/asf/AsfObject.js
- Size 14KB
- SHA256 f017a9889c925e3b9a43b5f2fdeb511191c44372bf3c01871eab69cd75099274
- MD5 c6b970db9cb978399a966af7f62e7474
- SHA1 c2c354b20f455a5243ef6fe1fa9a17d9278f7116
- SHA512 7f107f216767a3bc0f400219da9c659f68a4e505f950f01e6e10a1595a9593d0351ef343e949d4b1931375bc31f611459ae2b0584abbfb7f9d7c7dc62b89b272
- SSDEEP 192:QDalxiWFm2pOpxp+pjpKpwhfIM13pmBZwo8HDBRywqQy07mEOwuLySdBw+0rhqKq:ZRqb6dOq3ZHUO/BNAKFw
- TLSH
  T1DD62520969B2A1B0865370DE5B9B8A09EC20B0077908F4A07FDCEFE15F4D556CEB7B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/asf/AsfParser.js
- Size 6KB
- SHA256 fa494c76d8935b33a18d7fb6149b18a1aeeff97fc4f0576200995d274c3f252e
- MD5 020d582f378ad58b07469af68cf28a6e
- SHA1 f6be15b41882f2afa84708f3dbd22a83dfba76df
- SHA512 57f1a615fba94ec2cdf193056e36049f484a16171985f22ed447ed4b83ddc05d7136e232aa7d538994058d013c4c960808abfb1611c8b617394dba9865ce44d1
- SSDEEP 96:KE+tc+Knb0BHJRiTDRCy3SA+Z/5r4mt+JXdFTDOC7+WtlC:KVQQpRifUy3v+ZxLt+BdFTDOq+WtE
- TLSH
  T14EE10C48837BE4A1852344E0CF275CC0E558B1079456F4993FCCEBD78F4A6DF8866AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/asf/AsfTagMapper.js
- Size 3KB
- SHA256 b560c744c726cb8fe8afdfde4eee9ac02f954b14ac59fb9a1dc99704e0d94fdd
- MD5 d1e3818f895f7a1fc5f5eefaa0e52934
- SHA1 4c0b21ca5eb933e2be61e245f68e1182ccd0aac9
- SHA512 16f0bb68a771fbee8d8d68274ecdf16d5ccec3256ed238267d30cc67f25f832fd26e5ae40fbcfacd9a50c224a6cb0985a129fc02b065239f7c63e4bfb7cb4df8
- TLSH
  T10C6150F954A77B26032AA34F491E658260454303EF0576AC76DE022C1FCF2DDD2B013B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/music-metadata/lib/asf/AsfUtil.js
- Size 1KB
- SHA256 fd0562a7ce8603fa2735121bf55592b8645139396d5a7c43599ff28fae5c8e00
- MD5 8dfd7a9c5eea18b8372fd22373b99bff
- SHA1 316015c514a85849081d2a25759d9ffdf798455f
- SHA512 826272f926ad0831829f2488e0161b0b7d7e47530a5fc5a430cf75b9478adc3f16efe9abd5f8ddd11a8d09d615135042f022b21d3db97280b487b792989be197
- TLSH
  T1A221F65C24F1A07196929C8FCC16C106BE3595130766AD247C1EEF212F2E5AECE7722B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32