7ccb5d44a7cf172ccbd764f2958b27ca2aeb824e42dc34ae84473c971faac943

Sharing

Copy URL Twitter E-mail

General

Target
Flac.rar
Size 100.0MB
Sample260629-e5cq4set5k
SHA256 7ccb5d44a7cf172ccbd764f2958b27ca2aeb824e42dc34ae84473c971faac943
MD5 04007cd415463f8167165cf63891fb53
SHA1 35d38b0ace209bb0199fcea95bdf8fcef9eeef21
SHA512 0a7c4c049c363063cb5baa3f2bac3b5f339a1077f6eca52f021430c35b0c40cd8965f2649924fc8afa44ae145d7eb3a5cceec38f7ced1eaf8fcf0483d63deed6
SSDEEP 3145728:sjB+ljP/nVdghhrBrdNKIWiKKUQBMzPgeF1L1bapaLvzt:qB+JHnwBBYIWWw37LQpMx
TLSH
T17A38331F6B624F0EC927BA5629D2F4A8D03533B5314F9E4ABBDC216910BC76540BF782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Flac.rar
- Size 100.0MB
- SHA256 7ccb5d44a7cf172ccbd764f2958b27ca2aeb824e42dc34ae84473c971faac943
- MD5 04007cd415463f8167165cf63891fb53
- SHA1 35d38b0ace209bb0199fcea95bdf8fcef9eeef21
- SHA512 0a7c4c049c363063cb5baa3f2bac3b5f339a1077f6eca52f021430c35b0c40cd8965f2649924fc8afa44ae145d7eb3a5cceec38f7ced1eaf8fcf0483d63deed6
- SSDEEP 3145728:sjB+ljP/nVdghhrBrdNKIWiKKUQBMzPgeF1L1bapaLvzt:qB+JHnwBBYIWWw37LQpMx
- TLSH
  T17A38331F6B624F0EC927BA5629D2F4A8D03533B5314F9E4ABBDC216910BC76540BF782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Pro/FL Studio Pro.exe
- Size 3.4MB
- SHA256 a64fb337d19508c45d5c15ac500ce6b68940c09c41da6bd0630706039b9a50d4
- MD5 9afa8a80b99cc3cea0713f2697a54c2a
- SHA1 64be15a26544c9a70b561f964ed93e19a31f9885
- SHA512 57edeb222e9fd5156828bd67e56f9e2285ad9b645a19efec4db5127dee8e3df8d9fde34668b7bf5caffce2805c9ccae02e05b54f34c3c80abc48926ef7935fa3
- SSDEEP 49152:2GhiaRHIGMZto/OgTSi18UWAV5o9WexogABIFvfroYNuGn:2WR18J0MoHu
- TLSH
  T1AEF57C07BEE508E6C09D923188B6569A3B39BC494F3227D32E50B7782F727D06C75B58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  Pro/libEGL.dll
- Size 499KB
- SHA256 6397808c0745f08bc971dcf1eda61deb164d9c372dc6d5dd2fe8eccbdb7fc341
- MD5 2623d37b55bf9369f42d2a5a70ee51b4
- SHA1 78898fb21c20e085c34dfff9822fb05e9831fc77
- SHA512 ed75b7a6845175cd32a5e4fd6e091b41d6eb4f68139ea37d7a4207919d10e722d9508a512be6581114ad28e6411ec9ad1a35818e41aae05baba0e29277f11260
- SSDEEP 6144:ngfx9w55AkgG95e1xnaEjbiKaU3kQaJjkcWcfRYCx9/pt/BCSKxJIUgq9WXA:n15z5kbiokQaVkcWcfuCpCSKxuA
- TLSH
  T1A7B48E16B3D849A9E07AC038CA438547DA7178460B75F6DF02D0E27A2F77BE46A3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Pro/libGLESv2.dll
- Size 6.8MB
- SHA256 dca8d78efd1cc0823c3b044ddc8043035e2e21467705e140a6409d732eb23670
- MD5 155b895c53f0a3aa401f9e4850636fc1
- SHA1 316bb486a4b2eda476e5e9e3eb29814bc115d69d
- SHA512 61c90a3d045895cbc9395b541dc247c312a8338a802b68eb1426aef3572639f0849d4d05459529b900d40445eb3b345564f4a952c15874a9d92ce3c84d339361
- SSDEEP 98304:Z/4bGKn5Ot8E8LQIpKeZJD4ZoLS1ckAC/67:FluPZUWS/i7
- TLSH
  T162667C03F29681C9C01DD274976B8623F635BC850728B6DF269457212FBAFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Pro/microsoft_shell_integration.dll
- Size 449KB
- SHA256 d1fc28030b6e9974cfd71a3bd6fab0d5e3f31b375573f0d10ff957ac4146ef00
- MD5 775a61324343c32907ca4fcc3b980e19
- SHA1 573b39ad61639257448a1e4908c5ab1f3d0ecd0f
- SHA512 793b20a0e450760aae0a740d49695552846597a1e4ff5f733aa20e1bd686c439471da069f58ac3fb2b3f677a5ef0fb75730e9cee4538d264b773690465b6f992
- SSDEEP 6144:unFPvNtCHUcKTmUAh9dPQ0w7lWYHE35zmxIlD40RLtMFN:unFPvXOKiVY7lWYHE3RmxIlD/+N
- TLSH
  T151A48C05B7E448A9E076C138CA538546EB717C960B71E2DF03A0E2692F77BE45B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Pro/mip_core.dll
- Size 5.2MB
- SHA256 b91132b09bccc01df0d0a168691bb9e3720d7a5c0f69f1fd838ea6f87cceab0d
- MD5 0622b767e9e89eb0edba095d3219d660
- SHA1 6af7744dfa8af85bc2d54954f1586e968dd2a3ec
- SHA512 2e0562acfd3faf7e102cc1380df05efba88fe29f95333cbaf1cca44b44a4070ea0bd056ec6ab7ece86b921a35ce5b50708c68a3a9f427ec35349d9c0e412591c
- SSDEEP 49152:DuBYH146Mvl8bR+WM7ZvaL4Zrzi8n8sJsRrlurPuTtuGKc7mhT5Ci6uBtiLVja3c:/14lLfzhuTJytXiYjGPwaWu
- TLSH
  T12D467C57B7A800ACD4BBD27D8A4B8507E7B2B806573197DF02A0577A1F67BE15A3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Pro/mip_protection_sdk.dll
- Size 2.4MB
- SHA256 3e46c961339de0359adc33e27aeaba932fb609304bc764aa0fa49b7d11dcfd78
- MD5 17ac1c062c43f00b3ebe5bb15f866a5e
- SHA1 9f8f3001e81b4d64a1833e071782f22caf44d7ba
- SHA512 6a57422a0f6e0cfdc18b1a57b3153d4b2179c8a79125e9547ffe7158356dbd580bd664d0336a3e33a95d39343b0216b49a794c8506670109876e58bce750b51b
- SSDEEP 49152:OxFDqq8uX+lXcW9vDbslAbjE/rHnULSv+F6i8a3isHp:r1Wmp
- TLSH
  T182C53C477A554099C1EBD2B99B1BC943F234744A0334BAEF039097572EDBBA0AFB9311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Pro/msedge_elf.dll
- Size 4.6MB
- SHA256 20150099f08f29714d52137f6d2b9e9799bc031c4f7228912772643d2e634bc3
- MD5 ea68c6ee94337a94f8a3d461f1d67917
- SHA1 5e058eeb6f47f8a0053ca453db506482ea590021
- SHA512 b54651c5d58b7bda94d89ca328bc4f9130ef5ebcb04cea721cbf4a32d3c24eb7173a3ad3dbbec5695a8ad3b5ae7471456681d03941bf0155bac35dbd09863722
- SSDEEP 49152:3FG9S61PDnfxmn2i6TYTcNVoWc5mpJ9QTj2rTGCVOxZzZwY9mJWuoowUzdtYgdZv:Turyf9iTAPEnwc39tRVye
- TLSH
  T1AD264A43F25211B9C44EC8B4CF2E552297643C8A4BF193FF25E83AE11A75AC97739B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Pro/msedge_wer.dll
- Size 115KB
- SHA256 6d5ccc1720656ece210fb98641a4002409d0b9900d3cd9fec911b526a97aac43
- MD5 be1d7da17218e3d786bb45fe8453b85c
- SHA1 a767dbbbdd063c7122d50e93e0a769489d48b0c4
- SHA512 cd6f0fd0e45e0025446ad5736a6486f7a0cbc8a3caf1102e376979256ed3a377d2a5e74fa32824c7df38171ffa1cb3742076de053b12f1569245a7e1776f84c0
- SSDEEP 3072:k7RSOBa1Trm0O31k0IeYIycAtpFrpqpqpvIwT2UczzYafHPBA:iRSAsv4k0IeY3hIfYh
- TLSH
  T1B8C36A5763B900BBE177863885634E45EB76F8118720ABEF03A0425A1F637D19E3EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Pro/mspdf.dll
- Size 18.4MB
- SHA256 52c9c7b146d5d747e113b4b35cb4c703162f2d985ea242ec4291db54f7377bf5
- MD5 b0785c4d57214a791643ba9d59549cf8
- SHA1 35fa9f69941fce1d1a29aee164bc956f82b87aaf
- SHA512 bd568668ea2b5ed5a93504de2091ad845d4a27c28deb330752d9392d30d149b313a6f59cc133d0777483099b71300ad11916da8514dd8081decbdc09e7855961
- SSDEEP 98304:yK20/CdTySbSI8/tkyTQQv/45Ok16RMBQjhWOvPy/UO0JV6xEnwjql1UntpC4X0I:yOTTQQv/45OkMK/7Y6x9bX
- TLSH
  T1C6176D06BB9A49EDC04CC874934B86535E20B8CB0B75E5EF45C962192F7ABF85F3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Pro/msvcp140.dll
- Size 550KB
- SHA256 f23ec08cd51a0377de3d5e15265f28696e3602270df6f9057ace13a26d9a48bc
- MD5 ce4433a1b66d6e3f123d4853ab31b79d
- SHA1 1c5d64e4f7147928835e7b3260d81cf448a651a0
- SHA512 5d933333a69ae1f12ab1aeab822caf5f975a685464d782f8b582b92e84a331ccc80258dd3251016f73561dd3cbb0872b5d781b2d30dba96451ff5da388fd483b
- SSDEEP 12288:K0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7h:K0p1F/IiQEKZm+jWodEENh
- TLSH
  T1C7C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Pro/msvcp140_codecvt_ids.dll
- Size 40KB
- SHA256 3ad45d2800f13e5bedeb1e0fddfcd40c392622bb8649c4321992d097941518de
- MD5 74e1f207b7097f6a35cb073e948fca20
- SHA1 f8d00e910218659f08301761bbf4703e29958109
- SHA512 b68dde42ca484a498a9f7b56090dc6d73960cdc0dc75e47c334883a780b6747d32204733a719292c2d38be1b6b8b27485f0f2dd8c332ece40a4f070b99741fc2
- SSDEEP 768:2wA1mjzzGgU9IX+09zo8AjCf9zcfFJq09zoL:2wA1SzzG3e+czopjozM8czoL
- TLSH
  T1B8137DDADA788083EEDB5DB082A8DE877C3CA3C70A5095A71362F1540D537C5EB3426E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Pro/oneauth.dll
- Size 5.7MB
- SHA256 adf8a824a06c62fe92efb03ea07423e182609017f44e6a1ecc965a63e4513bd9
- MD5 c2de63ecf27c2c67943dde631298eca2
- SHA1 0f9d0309ebde88c473abd5498f2900461fe1107b
- SHA512 5467496f65cf578ae26c3b314d42378cc6a76bef435ac306dde5b5918f8ed08b2857f3720a5ce243345ae40a05bd7002214401df6de39d2aa02db526827a99fd
- SSDEEP 49152:YIphIXwBuXtFtLQQqB76mf8oR6L9BW0JOBKSTaCYgzyTMbKfujWZZmEDxP3AmT5f:Yo8o0/FQ0Mc9Aua6/3LLgtkt
- TLSH
  T112564B017ACBE598C0DAC47056438513AE507CDB0B39E9FF01E1F15A3FBAAB45FA5229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Pro/oneds.dll
- Size 3.2MB
- SHA256 af48988967bae769f3031f0d9fabc5ff7bdda72e8224050190a16988de21e611
- MD5 d2fd39d1eeb4f74da30d0e4a0c4a701c
- SHA1 0efaf97c0a7f477e4d9502b9ed168691c57eac78
- SHA512 8cdfd1cd1104fb34902ad1f15770fbdd21fca07b94658f21d37d7b55e7ec0c0ea6f35ae483d76e08fe6b760fec64e5030232b4eb63662376a4b2d7785d4503df
- SSDEEP 49152:oeqnNyCB3ocUrGaXdWycnZT+S2cKrVRzTMyBf4MVOZtDc:zq4XM7VcZRfceOZBc
- TLSH
  T1B1F56B03FA5641B9C08AC174C7678733AA713C8A4F74A6EF06A856153F7ABE05B3D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Pro/onnxruntime.dll
- Size 3.1MB
- SHA256 1f11ded7a52be5994c8944ce4bd44d82e0a63c955688aa8e727cf22a9c65a42e
- MD5 f17a75200adbc2ee4ed315d7cedadc66
- SHA1 2cd0cb4e486ba2955f87d2faa3897d31ba15f6b5
- SHA512 488241130a49b82e988bac83932334305c2bbe5b5fb73a1cc0ac03811d577f78bde287695702b208bed5d9c2b1708c41ccbe984fa777110ee9569ec72f95be74
- SSDEEP 49152:89dUKzyhC/ni1yzbArKqzr/fpSILTSPtBgwZ4iruMF/cH9nmoh9kXpw9XpzwYMNg:VgBm
- TLSH
  T154E5AE2AA3E802E8C07FD179CA4B8A17EBB27449C3705AD703F185552F6BBE0567E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Pro/onramp.dll
- Size 457KB
- SHA256 eec93ba0b1117a912873f7bfc14d3036fa29f271d165c32a5bea95c3de771e07
- MD5 31fc305e4a030ced08b569b832e87ade
- SHA1 6c685bed65faa2b8bb4c9ff016c12cf0f371f565
- SHA512 fea0ff1ce0db9294718c46af610fae55e59afa2e1014268d9a399d26279c3495b7934cafa4c4a8704d025e378ce7fe1a5dc88902c35849bfb921dc32566b8637
- SSDEEP 6144:OrsZeXqDVPrg10lHXTGbdwS1DpVZk4xDcGNegh6td6f:OrsZeXK8IXKwS1DpVZkac8eghAc
- TLSH
  T1A8A48E05B7E448A9E076D1388A538947EB717C960B61F6DF03E0E2792F77BE45A3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Pro/optimization_guide_internal.dll
- Size 17.7MB
- SHA256 608239e89a43fc482cbdd283c42069671478534c0fded508d780dac603ac1611
- MD5 d31f5e7d0e950514c860430c5ccb8f43
- SHA1 d51cdf30bfc673e66a76953b2ba0de3b9555d1ab
- SHA512 294e511ebc65ff40cd28c88b8793afea01e69255c72c3b9312131ecc3c74474822c856625abf3ab4a80d5d74697f94dd1030675f740afd4125f97a0133ce8a1b
- SSDEEP 196608:U2mEIQDREt+AbmuTDILo12nvjUs5q9Z5j4Mc:6BbpPC/nvjUs0j4Mc
- TLSH
  T1BE174913E2A641D8C05AD1B9475A9233FA617C494734B2DF0B81BB122FB5FE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Pro/prefs_enclave_x64.dll
- Size 113KB
- SHA256 27ef7b33f09808b3f1b23a5d1f3bb057e5774104619b23b0908b620d074a41e6
- MD5 6284d259ba392db0e45ba4446a735863
- SHA1 71d484a0afd3b25996000566d24941d18ff458d3
- SHA512 3a1211577a933cb8d2136017fd0e6da4aeb6d76ae895172370e88088eff5b23e446d25cf9027e9a83ae3097e47f5e2d6c1ced636c09445f56078b2a2cf9146da
- SSDEEP 1536:2hk95BP9K5dv0EzEd1GP4ufY8OZjknvooLqF1Pm1Yzgizh:2i95BOMEgHY8mwoLqF1PmaPd
- TLSH
  T13DB36A46B26442B7E66BD175C5D31E0AEB74B4848370A3CF07A94A950F23BD09F3E399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Pro/telclient.dll
- Size 3.8MB
- SHA256 1c7ed563eb7a9385f2d6cbd4330ab9ec6cd9afac4dd8b6699408dce9f6686ac2
- MD5 72a851749f03221e668c335d84a31038
- SHA1 97ee67ba4827cb63f498c8e887818ec9c9514f75
- SHA512 9e6f871c2cbb27d8a56915af3b016b22557fc6cd710d65938ed9a703ce2835c0e3c9ae007c657ba57c4d7f369c003b7550d31fbece2f7f319ef3d6a1fbeb575b
- SSDEEP 49152:bBGDNi/dn6X3Hoeib4wDH0pWqx+Uo4Ok+QjDi46tpI5GMU4tgfjsoIIIQDN/5h:EcEoY0k+8yIBtwb5
- TLSH
  T154067C03F19901EAC09ED1799B5B8222FEA1BC454B35B2DF0A9477121E7AFE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Pro/vccorlib140.dll
- Size 352KB
- SHA256 d30739d16049c3c9fc4fa2ba81321c19c5348c3141ca9b633f64fffe9a8b3d83
- MD5 b1b39ae8463b46d9d73757015828c023
- SHA1 983a4290963a646ec690a0352b404b89a20d8759
- SHA512 df5123ccee949361a0c90384b102094b48bc2f25ee491b000de52f35c96a8e1010de98f34fc77ddd1ef098da835df72456c7891aaea7e08c6f062c6f34315c46
- SSDEEP 6144:1vo2BrDTiplPlXpd0x8GsiUcOIOYFjLux11Go7HbcQ6WMQbyH2KNRpYpQrA:1hI+klbwTQmYQrA
- TLSH
  T17674E5677A9C4CC3CD35A0794A978309E3B279520751E3CB1294470E9E3B7E8AC3B679
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Pro/vconcrt140.dll
- Size 324KB
- SHA256 5344e1f74334cce06b8cd14a901e27d29a1708c786fb7ad3281a00044205a051
- MD5 ae936484d159ba103c3b9b4a3c9d8d19
- SHA1 db719198108130aa109964ea6cd544f912735a53
- SHA512 d108b816f85c758b5dda1a22e761f607428e4a0e54f46a9e33b6fdd67c27dd4151a75091510eb8091924ed703dcba26db2f6bb5c74b5fd58e104ed42d8e05637
- SSDEEP 6144:lpxc5oSb/fSpwaxspxI6CLwaVInWzgFYxNxKYSF:lPc5oSDfStI7qz3lPE
- TLSH
  T16C643A8A76580CE6EA67D039C693C50BE6F3B9452352C3CB1364938E5F677D0D83A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Pro/vcruntime140.dll
- Size 130KB
- SHA256 dc23dd3073c98bb60f7e4843d09343652bbddffacd804c3d2349517c40f853db
- MD5 347228e92a621d42c192b4ecd17d1142
- SHA1 ee2bb8e14bbd22651ad7fb4b2a414d5a69ef5c74
- SHA512 0a9177223fb167ce58bbb4f04c184b9952e01e7a88f37d84ca9a17c0d415393ae691722f27ce760322dfe0ffa2797af15a5416ec4608f8eb45db094dd42dec2b
- SSDEEP 1536:Q9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lCg3ezqzN/yLzX:AyA+3EOfmpcGSdOecbeQ6NxC3+ZsL
- TLSH
  T11BD38B8272B802FBC56BD170C292DE27FB76B64287605BDB07EA86610F637D06D3C245
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Pro/vcruntime140_1.dll
- Size 56KB
- SHA256 694fa85723c3852fe7344d1721525a375bba8ed5a17fc97235b3fe9fb51809fe
- MD5 885047f5928b9b94d404339b76f9e38c
- SHA1 1d407cf7ac66e8416f1d0be7a32240d0bee38c20
- SHA512 93b333e3a8839c7e2b091d2a2b7579a509621db2f1bffde2b246a4101ebd698378e578ebc3780826c6b1b5fa1b7f3330f567566f24de8ac865c7945605850ee9
- SSDEEP 768:bezSkbhNfI4fWLZyS/dPWx/gU9T7N9z7RVng9zo/80X9ze:gYZyuPWx/3vvz7kzgDze
- TLSH
  T170438DD2937C4082E99B987081EADE47BD39B7C2176092DB1BA5E54C1E537C0E73832E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Pro/vffmpeg.dll
- Size 2.9MB
- SHA256 2709ac9a18ec0aaefeab7e096db7cb7c06f7f87e1026d84b15579e2631662a25
- MD5 094ca551121772f22ffa0640ac658796
- SHA1 c657f698c435f2b7fa3662f66f9fca6ff0eb321c
- SHA512 f019ee2f6b334bbc972020dc91f1c138405b76c49ead9dffc15554ae5f204401c61780dfdb007cdce4866f699e22f5915556ccf4306df6c32b4feae52651988f
- SSDEEP 49152:RoZr/c81IQbx6i1N28c18oSh9aLuS6FnFizu6vIGqB9OG+CJtcjA5m:RoZr0iaLu/ivvO9bD
- TLSH
  T17CE59E02F6D251EDD019C03497ABE213F271780A4F205AEF17A05A253F66FE86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Pro/vk_swiftshader.dll
- Size 4.5MB
- SHA256 80076b31d9e428ad8cdc4eb75d9859c0436e5cd3f93082332791c5f534ec6f3c
- MD5 79d26c0eaa513d6b5cb2fd3564a0e5d0
- SHA1 f8b505c4f0004f450626e71e54df2695fdace686
- SHA512 f88890bc5d4009ad277c77a8485dd1b93b66595e4165f5d5d3d4f3e8d1067abb5523fd909c44121af051e1c68a52e4f02890eda723cfd0c692485445d0ffebba
- SSDEEP 49152:j8qhACTtTS8yMn8AQ+ithc+r+DwiF284LMBarUti8cbFcs3c5xLQrkfotDiVORQZ:RACT8RMAdxgwKBn
- TLSH
  T12A263803F18A80D9C05DD5B98B5E9633B232F8810B72B6EF16945F162E76FE0672D709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Pro/vulkan-1.dll
- Size 915KB
- SHA256 d576750ec1d2a864026e5aea4c01052c8822332afc0fd38dd56aac23d4a46e2f
- MD5 a9a461621948900ebb742582cab78d26
- SHA1 a9bac3da6fdb43afac19cba8212d079925abd2bb
- SHA512 1d8da1db82e511a9f4b05c573155e4d79455d364b03c9cc1beaa7012ab635e8c7f0891ff95a183c08b5aa5f8ea337d50f7e8d1d0e8ae866cf4d236c5d8eac3ea
- SSDEEP 24576:c4dkRMLU1CQFeyGrth3hGnhKSgyK6Z5WzcxDYsHkDE6g3P0zAk76oOH1Wa:VdkRMLULey4ShKSa6Z5WzcxDYsHkDE6p
- TLSH
  T179156D13DAA48A6AD6768034D9D18A078AF07481132375CF13B857187F6EFF46B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Pro/wdag.dll
- Size 247KB
- SHA256 caae5ca7fbb703ad62cfe7bb7d599b8d51819e3f18b1eb590be1ae9d73f33639
- MD5 aa8572cca87277d2ae17776cb3d77029
- SHA1 6854d794fdc87ace3582b9781660ea49bd165453
- SHA512 588eb87914b88620f43455eb1c3bfba61829ce4b29c1773c7bcef8b35d3cf61ce4fe197dc38d9265e937766dda30ffe758dcd034be5dcf13c508b2714ea08b32
- SSDEEP 6144:ZNKRTMtitsr7e6oM/NYMfSmTEFiC0gfjiE:ZNKRTMwtsr7LoM/NYMf2Fx2E
- TLSH
  T187345B067AD88CA9E866D4748743C582EB3138D60F66F1EF02E0612D1FBF7E85E79215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Pro/webview2_integration.dll
- Size 30KB
- SHA256 479dd831f1e233525cce9a0f5c1ad99025f58dd17bada263fd0b67e2dbfe6c0a
- MD5 59a526aba1c359df59967e59bf5f69fa
- SHA1 5b1f969aae69cf74397f6c62d4d7dfa1455bff1b
- SHA512 b50de34f76c3926c5c2b4e678a3c6aa0447847d0f138d3af99e63cfee8bb7573ed8aa80f11cdcc17fb010d801f514f7d94cf6cd6cc7867f943e9733b963461a9
- SSDEEP 384:j85pJe4VRr5/h80+lSeLlqjJcFAz3tbDqlNW+RyWfaZ2y4GlNlIKki+R9zBGf:jSq0+l/GJPDZDkL7qQ9z8
- TLSH
  T1ECD26C9AEBBC4182E9D5E67884319E17F831F3410B2197DF5352922C0E73BE4AE38755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Pro/wns_push_client.dll
- Size 545KB
- SHA256 db4fa83a0154447ef4ac03899f511d6df08bd82409340ac30dc6624f9477b032
- MD5 917e435ea4da64700d922b568e18b95f
- SHA1 a0b8917220715dff6e72f848bae4ca469629beca
- SHA512 cf643ad89c66c1528f4cc8975f92b8b4ae9f2583f95184e6fd2e78f649cc0a1cb6da9d1cbe53ce1e1c61377c55dd8419a9522b3a131afecbcf1563dcc9dbfea2
- SSDEEP 12288:GR9Mwy4yvbgJfsFCoWhG5TPEaSiRwaPjDLV:GkwubgJfsFCoQG5TPLSk
- TLSH
  T156C42912BAC946A4D056D0748687C592BE7278CA0F75E2EF41A1F23C3FB6AF81F39154
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Pro/xchrome_wer.dll
- Size 115KB
- SHA256 62c426bf55911b226b9a46c3b6ddcb58d8ad853fdd43a4f12d44750e31a5ce2d
- MD5 37a3059ff58213cc1fd854096d0d7e76
- SHA1 6e130c3c5b123e79c1ba588d19d1a8f6d90f298d
- SHA512 de9ec1368dc9eebc8866ded25a250392159ca20391eae334a7b8f3959345d4ad7beff34e5b1f188e5d2410d20946afde1096a981cf17f4fb69df88d58f96cab0
- SSDEEP 3072:snLR29KNnTNX3ZEng0j4RV4eWAtpFrpqpqpvIwT25k2hdW:sLR2aZZf0j4RVznMu
- TLSH
  T1ACB34A5763E900BBE5B7863884634F06EB72B8124761ABEF03A4421A1F637D15E3DB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Pro/xd3dcompiler_47.dll
- Size 4.5MB
- SHA256 464ac23f4a5e5d92a9e99f92641f3a0c5e8326b378a45140dd9f880686b9d1e9
- MD5 fe8b95e5941a2112c16858945f952d8f
- SHA1 72325b2fe4e1a6d3a3f7b623843eeb61c9162300
- SHA512 9d4a00e30c15af6fe0cf6a9b2d4671c7f826c4b2b048442d0b889302ce06410c4b4d4760f19eaf3c6ddeaaff31738dd8f0461d422c180bd64389658f7c5c5220
- SSDEEP 49152:h6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/B:hUdeqt737jFm5w5
- TLSH
  T109268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Pro/xdual_engine_adapter_x64.dll
- Size 5.1MB
- SHA256 d5ec2ca6c7c116f57f45b3a80a99664b68f02be305d8d41427f4af877421011f
- MD5 28a22c699f09dba495f45c6ad3f2ed82
- SHA1 461337b7cba23c02a856e426abac1b7c6b9d3691
- SHA512 964dab1d13df07b4f0e69517779d5ed71f682e72651e2b6fec268ddf9fcf2cc02e18d6cd2d003d442191821338f0797114632e28a7c90871b513aef1b9079af6
- SSDEEP 49152:9IrYTlptJDw/NIbupGgQ4HZBlubdkD3TvvOuXuGv2MfvfkMNODsgXmcCxOJm4wwL:5rIl8cFNF7Rknrz64Z
- TLSH
  T1BD365B53F29611B9C00ED9B88B2F5632A5647C4A4B31A3EF0AE936210F75BD85F3DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32