5457d8e364e67982d276481fddfba6ca806803a56f7010789aaf794a3ddf7ace

Sharing

Copy URL Twitter E-mail

General

Target
Install Negative Lab Pro v3.1.1.exe
Size 970.6MB
Sample260628-x6yzvads6k
SHA256 5457d8e364e67982d276481fddfba6ca806803a56f7010789aaf794a3ddf7ace
MD5 ba9f6ffa14a6cc7e55eb3fb71a042fca
SHA1 94be51ede677b3256c072867cafedbcaa237bb76
SHA512 3fde45327e09fa07b55f65d3ae2c6fabf10e299d9ff17a93165ba235f9fc67a03ed9b19849618b34591787adf424d4a1f180b03317a592c7691d5a683342ed0c
SSDEEP 25165824:FA3IvOmxzPAwd0aiRq1hdjGrCa0ruVE1NGKUBIg2qomogzWyxt71fUTEknv:Fjzyxt71fUTEknv
TLSH
T11CB933432A9FB59462092C4EBE975F6B70D0F2DB45F26C9293A38DFC60F7574CA20429
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Install Negative Lab Pro v3.1.1.exe
- Size 970.6MB
- SHA256 5457d8e364e67982d276481fddfba6ca806803a56f7010789aaf794a3ddf7ace
- MD5 ba9f6ffa14a6cc7e55eb3fb71a042fca
- SHA1 94be51ede677b3256c072867cafedbcaa237bb76
- SHA512 3fde45327e09fa07b55f65d3ae2c6fabf10e299d9ff17a93165ba235f9fc67a03ed9b19849618b34591787adf424d4a1f180b03317a592c7691d5a683342ed0c
- SSDEEP 25165824:FA3IvOmxzPAwd0aiRq1hdjGrCa0ruVE1NGKUBIg2qomogzWyxt71fUTEknv:Fjzyxt71fUTEknv
- TLSH
  T11CB933432A9FB59462092C4EBE975F6B70D0F2DB45F26C9293A38DFC60F7574CA20429
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/Geotag.pm
- Size 56KB
- SHA256 bf4815d362004deee30f7bd0dcb0c76b90f9f2c4e5006dd5ec3a004cd74ed5d4
- MD5 f285c29b6aece8a6564490da7ad204b6
- SHA1 88cfcc88186f9dde5af0cf14f64ddf231bb0647e
- SHA512 c5012a684e1cee3e3cb846ec246cc9843014663afa1211917a522dcf415b6ee9e6b87992040f88cef7492ce5da241acf0e8992490675553986b00f9a77e66c8e
- SSDEEP 768:0pEQKOpoNpkAcDO5+T/LcXpDGy+c6WHpUCUlPBwARK6zcEqPLR+0xXBi:+EQxpoCK5+T/Lc8Np1qc0xxi
- TLSH
  T16F43E8523DD312355253F02A9BCE5858EB2EC1A757C8DE2878AC81C83F41978E7BD7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/HtmlDump.pm
- Size 32KB
- SHA256 6adb977d8e71bf1b90c82a277829e1dc3ed58ce485e70cfdf6899339166bc25a
- MD5 1c7addb640624b1f09882a0fd315f864
- SHA1 bf8a1fc573a012270d056d17dd1631eeaf98bafc
- SHA512 7568febebfbf956bf3a895aea9d00e1ce110571d0fb99d9e85fcf015bac70ae34c5a4ab457ec23c439fcfc2eeb20ed858e5d356cc34f4c0db74a797fe70ae03f
- SSDEEP 768:X8juNmQp5oKDzgQtMwTjHVVsut7S5Ij8u4EfYZIjrsG:MjuNmQp5oKDAwXHrsU7S5yZV
- TLSH
  T1F7E2D61A7DE3016694A3E42A5BC9A214F77AC0836208CD247CAC81C46F95F39D5FDBDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/ID3.pm
- Size 52KB
- SHA256 e38aefcb7ff853495a245e174205620dbb5372cd01cc66e6911a674b6a43da0e
- MD5 245027b83f92dc72a17b7821586afcbc
- SHA1 822dd562c36c1af037f33ac985f6ecc09de35ff6
- SHA512 730d1ec7827c0a9821a497331898c40fd436cdda8115bab5b54f29e4ca885c2de64c5ecac0ff70c541902ef6fcc3a316708b159b79798864ab29005b828e3e8c
- SSDEEP 1536:H/UFOwwrUI/laNrdBDtyo111Xs0IxqJayHM:yOwwrUI/lWDtyd0IMJayHM
- TLSH
  T1D73395361DE345646252E02437DE6802EBA9A1C70E94B923BD9CB1882F0DE3CD6FD759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/IPTC.pm
- Size 39KB
- SHA256 c95fd30b92dd2eaabd5438226144fe24f345a4016516bc5290ae093e9d4289a5
- MD5 915c88ad94b95ab8dbc39d1c7447e93f
- SHA1 34230ca92aa8a517b6a548035cb06094f983963c
- SHA512 09651a68f9c7c4874803c0536d50bbc539631611cd2a36e4a9295e1a9e7ad261a0e532f9b76085a20b108ada0336ff9933ee15864a296e335156ae00f8598647
- SSDEEP 768:a87fQUlr0UtR+JxavH/kU0cGkGZDwXQiv5M610EsDCLczQuPVi:yUjv/kU0zy5MipLczQudi
- TLSH
  T1C403CD3A0CF140689153E0761B5E6505FA6A60EB4EE9BF23B99DB1483F0DE3C42BD719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/MWG.pm
- Size 30KB
- SHA256 27a7802d01f22de9261611f775b291001a64f57e810b7443c18dd1f12f828561
- MD5 ea31dda4e3c1961e025534106ea851b6
- SHA1 c8d3fe1091f73cbb7e2486e25344600ac07a51a7
- SHA512 859e2aa31028f091c5205166fd21e060581a0e7d4b0692bf3dadd15435be2979174caf086ed757b4ad7159adc091eb75d4ab9f64b6a9fa2d803e3ff711594b36
- SSDEEP 768:rWaozXRTkgoi3qUjhjzjojVs9CPVnHYZD8yaIlKumBi:CaUXRTkgoZUjhjzjojVs9CPVnHYGyZii
- TLSH
  T1D3D265175DE256A80A63D0673A4F9006F628A98B4D5E7A26FC6D600C1F1DD7CC2FF394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/PDF.pm
- Size 88KB
- SHA256 093a8d2134740f6c9ecd7f7e138416d97427ff87be5b943d2444cd1e473e60c0
- MD5 301a40cd46bfb128cfbb0a505aa6a46c
- SHA1 a30290afd3714a153b39dddf0277c31920bd9ce8
- SHA512 4e0df41d1aaf21705abd709453fb2c619c74683815307fa29a27011a5c1418864daf41c6fa3f11d16bcab22a00bb08574a77ef915741e66784adfced94ad8fec
- SSDEEP 1536:Rq7HyEY2jLMmXahDYF3PP1RYqpcNd/x+Ei:RE5/XDFH1RYqpcNFwEi
- TLSH
  T16193B4492DE3992592A3E03517DFD101EB2A90970348BB10798CD1C86F06F78D6FE7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/QuickTimeStream.pl
- Size 71KB
- SHA256 9c1a65990e55be3cc566a7d4091a97bf84ddbb3bc157a262265d7e4b8e935f2e
- MD5 f31685f5782281e08c0999459c244383
- SHA1 c414ffdd722264715dfc910a77ef0aae09d45a29
- SHA512 150bfb8ce6eee47f1d1370a871b7e8290428378ef3efdf1b68c16a6f0830d4558d86b2bbf7661df50d7f8be6222f72b08a2556659c72e00d7cff6e7b78e18fdc
- SSDEEP 1536:BeaXemIj42BWJHkrNgzq2NjIAJLMjOqQV+8zzKl8qExoM:BeaFIDBQHkrNgzq2NjIAJLMjOqG+8zea
- TLSH
  T13173A7023DE75019F163E1351BCDE402DB6A61C31AD8DA91B98E72C4AF05F38D6BC79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/Shift.pl
- Size 23KB
- SHA256 a7ebc5ec69b3a4be01b661f4b55a2fe917f8116514dd7c05ec01289a29462606
- MD5 f397757cccbd42cda59455e85555aae3
- SHA1 2defc006f43dd685ef8039ac6757148f3a3536fb
- SHA512 fd97b918ffad93a2d3c660f215c8251ea0d6541a4c534a91da523f72a9dadd7c887476f047ce625d5096eae6d0ec53c0588e41f945441e9e40c5e1708f44a571
- SSDEEP 384:36FJ+IuEPJyiuNt9rsnaKO7SawCDiMh+g9bDnc94ne0eV6QI0X7ekXWvE:qiIuEPJyiuNt9rsaK+1wC2y+g5Dw0eVR
- TLSH
  T151B296126E8310287673D12157C97599F7B9C067B24B9B98388D41C82F82DB8D2BF7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/TagInfoXML.pm
- Size 32KB
- SHA256 a62af73602273b2da9059e131b486959d1d6cf2d806c15dedf5b3eb355e2f889
- MD5 bc1280e02f570fc5658d2799a9e05651
- SHA1 cc40c9bbab3f3c35fca04c6711811287a4490115
- SHA512 a75b3ae9fc8b16cabc478702990dfdaf14820c0cb00c12dede5e0db3d8cb79467eca4ee029ad2e50515a4f95bc63fe2d3768766f8723a330e93c199aee6ccb17
- SSDEEP 768:2itmnET+drKLKRoF7ee6w3wRY7wAAEvlaL:XV6rKLK7e6w3X8AvG
- TLSH
  T189E294127FD35564665BE0362FC9A004EF2B89834605FE21BA8C4181AF46E78E5FDBDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/Validate.pm
- Size 27KB
- SHA256 95be621d16770c339977521e9a06ddf95bd28bd8ed17c0ac4a19a840cd0d7b89
- MD5 567b6f36a1a5dff330bc333a27a7f426
- SHA1 92ab3963c5c6921f5bd752453709605ee3af92ec
- SHA512 d6f43630370630c0d376e6a5d45f78d7a9d2f72adf4902366400cc4c6d71a5065306962283da796d04eb4660550805c1c49697bb267453537f2fbcb10c028266
- SSDEEP 384:k2sbIYLJlUSGL5rhPfOhAal2efFwgdjAfAnPAOBnAc3xoAwzVEcM1YLc2PMZlsLQ:QI6lULLEIa7xcwf5F
- TLSH
  T159C26F190EA20665D243D02922E49C04DBE4C8B75AA89D17B5CC74C47F6AE3CCAFEB5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WriteCanonRaw.pl
- Size 24KB
- SHA256 5825af3b26af1a55aa71af9c40f87c5e45dc25f2057dc9b6d2b30dc9b3dfa19d
- MD5 4444db9c0be91cf612338233729ee767
- SHA1 1aaa5437aaef794fcaa6402d4eaac0b4d6d4cee4
- SHA512 7f5e805e4c709162e6377b9e1fa70c8a0d9336c8b6d3d7c3658d29abc59266fad6846b0138527b366cd93fc99f0213b6b3f95d743b8002c145ca488d1360ebcb
- SSDEEP 384:H6KpAzWvOy0BL+FmObMG2B5Ap9s9pd0zeQmF1:H65RF7OYJ55pd06QE1
- TLSH
  T1DCB2B5113E93A1B4A267C0292BD59405DB6E9893054DEA68FA8C50C43F06F79D9FE3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WriteExif.pl
- Size 129KB
- SHA256 6d04a1177c3aed5f10670ddbea1016749b8e79fd00db642d29aaed8f7e698cb7
- MD5 13c3b07cdff8bee0bf6205c55e483711
- SHA1 ff6476168db047d155ef2de2057894ea7177d537
- SHA512 0c9ab38731a1b5792158127a5b4759ffc32cd96963a537413fa86b59648d98e7341d6aa080bad074360e2c37e65f74401b7868fb43005361d25fb5c5274b97c9
- SSDEEP 768:8acUYgq5nSznvnI0YoAmIyjBN0JhLoAEhfNC/6EC7vMixHDU/Py+vQRk5t41DNK6:NASzvLjX7Z7vQy+vQS4rKSIbUWSA6
- TLSH
  T14ED3A5063E9751A59097E0391BC9D806EF26D0634288DA24FC8C92D03F56F78E9FE7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WriteIPTC.pl
- Size 29KB
- SHA256 588f13f487f9d5c6c80bc07c283cd8e42139fc9379ebbb1de02b255391d05bf6
- MD5 cf3ed634d0192a3016241c13c177d94a
- SHA1 532eca89f34ef2509d6c31404b8f8fa279ecd08d
- SHA512 ef50d596cc1d169eb8784b7940e1d7630f11f968afa7b09ba4729cabbbf6b0f15058b9c72af5ee6f43305e684f6b7c64909e088999d262bf74ceb315aa417399
- SSDEEP 768:5nPVwAOAieKns13VcTP7OujTZjHIWLwkn:5niRAlyqawQ
- TLSH
  T133D2A4053FD380B5A6A3E12617CA9448EB2AA0675349DE65789C42C47F02FBCC6FD798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WritePDF.pl
- Size 28KB
- SHA256 ec4f3080690c6eb8b669c09f6224cc208772e6dcb7324abf8826655d576a608a
- MD5 1316c5d7ab9675e6eea5af892dd81dfa
- SHA1 85705034f5ce439f4c53dbeed87f77fcede25bca
- SHA512 2b9321e8df1dca92b7fa012149300a82f7f92b7149ecf3a53742bb06f55ab081aa8f91c075b59a239677aceaec25ec73f648c24c6a13f2d254ff882ee4a4c9a5
- SSDEEP 384:5yA6lXw6eDlxan/hdhc+zT5Lrr1M0vYdTN07Bt2Kz2XU7zx5sVUkMBHihSbp:5clXw6evan/h7tLrr1v7tlz2O5ahSbp
- TLSH
  T1F6D283052DD3D6956AA3E07D5BCAD440EB6980578249EF54B88CA0C06F85F3CC5FEB8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WritePNG.pl
- Size 15KB
- SHA256 2cd7a1de1651bab12a92bc0d74489504695a90ca02f6dda9f7825cd4d8fa29f0
- MD5 cd1b3c553db68ae3d24113a88e488c8e
- SHA1 23ca99e924641279928764f04b15a691d52ada6b
- SHA512 82ab8f6ab536573cd5a082dcd2182cff735dfdb731ae29bdfb7a14a348ab6e640776b644c67d800fef08485e60341b53ecabd950be5d9cdfe9183b8d22d5bcc6
- SSDEEP 384:/mbD1W86enOtS6teLekw/benLnt1vOL4VPXCt/sjmS4TEoTsCf:/mV6eNCeKPTenLzratk74TEcsCf
- TLSH
  T1B17295627ED754A4D263E8355BDAE804DB98E197221CAB28BC0C41D42F05739CBFCBD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32