0dfdc6ca2abd297670fc50ed541af007b82280459520bc2995e13345d9280386

Sharing

Copy URL Twitter E-mail

General

Target
Verdent-2.5.6-Windows-x64.exe
Size 168.8MB
Sample260629-trwpdsa18n
SHA256 0dfdc6ca2abd297670fc50ed541af007b82280459520bc2995e13345d9280386
MD5 69e23073276da9ee65928133229a2c07
SHA1 6a47d3374c3eb80a34455d83caca6706b7b4c5ec
SHA512 3084ddc886d39e545ea5712e63768523f5a944e0355687dff100091cadef691a9919adaefdfa8a74ea2d3060c46cd83299aead0a12d57bb9ba68d35d5e650028
SSDEEP 3145728:sU/SsFtSRihi1OIAT/nVm1ZqZnKNL2ynuIlaxQGZZP7MyIn7Ut+gyT:1asLSRWi1ORm1ZMnKVgQkZDMyIDd
TLSH
T1818833155631609BC831BBF6492286F164382E9B36035D268CF5F7F3FE896096CD8BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Verdent-2.5.6-Windows-x64.exe
- Size 168.8MB
- SHA256 0dfdc6ca2abd297670fc50ed541af007b82280459520bc2995e13345d9280386
- MD5 69e23073276da9ee65928133229a2c07
- SHA1 6a47d3374c3eb80a34455d83caca6706b7b4c5ec
- SHA512 3084ddc886d39e545ea5712e63768523f5a944e0355687dff100091cadef691a9919adaefdfa8a74ea2d3060c46cd83299aead0a12d57bb9ba68d35d5e650028
- SSDEEP 3145728:sU/SsFtSRihi1OIAT/nVm1ZqZnKNL2ynuIlaxQGZZP7MyIn7Ut+gyT:1asLSRWi1ORm1ZMnKVgQkZDMyIDd
- TLSH
  T1818833155631609BC831BBF6492286F164382E9B36035D268CF5F7F3FE896096CD8BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 14.4MB
- SHA256 f9c475876b01bb4d654b8f630f11219cc96198efe91d7f2602a97f0f3c86c3cb
- MD5 bfb383dedf6aaeab3061c79362a85ff6
- SHA1 e536a576ae468795949e3a124b7038d0a9c96510
- SHA512 963a3f806237ca758361cefd5b836e51743d7b4c350b75286d8387a20040f9ea05fef0d8b83ab6f35e312309d96f33ae3c1cbb1eea99b6b9c28c6d5e7c212476
- SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDGKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwBeXEn8mb
- TLSH
  T170E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  Verdent.exe
- Size 201.2MB
- SHA256 4c719c737088a4ce4ed23e3d4da339233a58ccb11c2b49f85d99dddfdb8771eb
- MD5 22236547bebceec6f840b7e1db53de95
- SHA1 a7515fb76a5736ecd2df37aa2a0dbb187a000f79
- SHA512 1725a9807655e7dc171124128300aada2c9cb1cdbf56ae70990d9e35253ba6e1903885addf212debfd57e3e51ee07ed738e69ac2ea4ba7a298c27e62f25233eb
- SSDEEP 1572864:FbUVhYUjh6wz+fFrKvABpG4j/2JcXrmp1R24UpFoUKZk8Gssd1xrKgKw+SV7hk/8:6PkV1kg
- TLSH
  T1A4A88C03E29641D9E05DD1759B4A9633FE71B8094728A7CF2B9407922F77EE82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 161d56a891244800209c79a4f784aa8e7a595d30e4a48143d3d67a70934004e1
- MD5 92b99f074e758b5a2311c11b07f3fde1
- SHA1 1314a58fe004aa3569eb837a68e1455ae5ed8418
- SHA512 d23917119ad8d822e1746e5eeda4eac9e6adc917a102c7240ade551cebd415dc2be15eab9d963ab4132b9f9e4af601657223a67e6275d4a53ce12d4e724db683
- SSDEEP 196608:s+kiCf+BWW8fUA4BejnQI180uNJSf4iIJwEMWRsKRvU:s+kNf+BWWyUA4Qjnw6+RsKRv
- TLSH
  T1144729122246D49CF059C878C3678626CA6C34E73FA779EBC0B461252B7BEBC5B39135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/dugite/git/usr/etc/profile.d/gawk.sh
- Size 757B
- SHA256 70621a3b586d3d523b020e76977633b444a70013ba50e1ea901a3a07a676f15f
- MD5 bfc054c0862d0fad98ca641b951c7061
- SHA1 e69dfc5c1b719471f65c11b88325b80ae7e373e7
- SHA512 f0d929c5357efffe092309c5e37db07449441ced50391b099b99aade4a211bec4d5c4b57f3e442647bcd8f2132b070f85d2c0799163353c610f8320cde96ea44
- TLSH
  T100014FCE04D94FC0D51165C9BE0C82AE6B3963B55C64FE1E7369780F83172676879137
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/dugite/git/usr/lib/ssh/ssh-keysign.exe
- Size 443KB
- SHA256 78104e8e0e0af57517405ce2cc4745be0f178b5e5a4159a98bc3327151cbacf7
- MD5 42d3e301824253c48b4d333616d7682f
- SHA1 7327251e363bfe21f77c112cceb91158e1f6704e
- SHA512 d217ab3db3aa8d3346cd5fc9466841a317de831912e22216049669300e6e6049a85b6a433d1b7e703fab1f847b00249280e2fb44389b9d30cb7a6a346ff29fe5
- SSDEEP 12288:ePFEGknEGmOGUs9hGSytIXe9vifVkLypl+PH12ewVNfhN9mx:yFEGkn5mOGUs9MJ64vifVkLypAPH12en
- TLSH
  T1AEA47B17A29364EDD57BC234879BAB72F8B2B8142630BE6F1610CB351F10E54633E75A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/dugite/git/usr/lib/ssh/ssh-pkcs11-helper.exe
- Size 352KB
- SHA256 9a4fb59acbb393fb0a9208f58fd2740130d870e0bb74dc2cb07cceb1c7d2420e
- MD5 b2f0657d13b743a144f54d0eb3cac6da
- SHA1 a0f39561dd9b63abac4a4dba25b735f6bf6d4cab
- SHA512 585b0a31784061ab742e57f6385255d93332cc172fbf20884a4a3eb4dfa7f470089043ef85f613dc46d88aa10b273573f9825f0371c6cc690c8acfa19dbb6a30
- SSDEEP 6144:YcpoePdzk8Yv1H9mury6JiBT4RRsr0z5TXFQDfpL9dDb2O7fcCnDtIHg0XBPfRrT:rtdo5v1H9mury6sB0zsgzBXFQjpnOPfR
- TLSH
  T164747D17E68360EDC47BC23497EBA772F4B2B45826307D2E1758CB351F11E24632DA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/dugite/git/usr/lib/ssh/ssh-sk-helper.exe
- Size 347KB
- SHA256 f9fb84a74e330b3627721fbd4518a0eeb3821430bb454dd406c880ebd78d3edd
- MD5 73b4088ebd1049a2df75f3089797ccb0
- SHA1 c3ac445505b3b8805d1e1b6ad4337d18b0c94e7f
- SHA512 d390b2fe50946f0fff0081f728fbb33bb6a91565f93d079dd84a1e975a8ebff06fb7d52b1c40a0f06c6d386f098cd0dde6da7b03e9673ea4af4a3c132170e623
- SSDEEP 6144:nyouxRHwIbP8LtkVOVPndoG7zhoe4MspAOpqDb2O7fcCnDtIut5RSRe7IoCWSerq:nyouxtFbP85kVOdnCG7zhX4MspAL37Iz
- TLSH
  T114747D17E69360EDC0B6C23997FB6732B4B2F4996A30BD1F1658CB350F10D24632EA95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/dugite/git/usr/libexec/getprocaddr32.exe
- Size 264KB
- SHA256 522b97306e5cec8454dfed63cfa0257e086a43a57956e93d7065501c150554dd
- MD5 13bc0275193265cad61eb7566a923dc5
- SHA1 9a29e418ce258bff375f2d2d8da2295bc161408e
- SHA512 414cc90eb86d489764d1590435fac9c4d6e19c891ae0bf5e57a22cbe1e5f1d59cfd763ad87899ef97c5a632b66cafb6ff3fd4249a1df6541eadff5cc0ea0e25a
- SSDEEP 3072:3eUOUVu3nvb/fTcsT32ij2pBKAbyPYcggnRZebO58/F7Q:3eUI/bXA+bjSKNP1nRq5/F7Q
- TLSH
  T10D446BC7FF9AADD7D605463E8CEF835E2638B3D517864B13692C72341A176E1AC86203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/dugite/git/usr/libexec/getprocaddr64.exe
- Size 276KB
- SHA256 771e0364765ac131440048661d57ed44d5c1b8f6cec745a2064b5d2b3a8c9928
- MD5 9031b2a2d76c936af5743811e83fd492
- SHA1 755b27711bc4eb8791aa1fae20fa700319d72320
- SHA512 0dfcccbb2933550f0c28184484922e2a6a351fb325c4ac4f5778d9bcb3b881fa76952445a984d890969309ded5fb96606d7458cc741067440408ec850d7d59e6
- SSDEEP 3072:j3/v99cDg0r8k1Igs9WkL0w+K87O1qPZg6QSa1tQsGM9eruiWFEx0iVNBJ//7a:bv9/k3EQw+2TmfuNCNBJ//7a
- TLSH
  T1E0547DC5BBD9ACDBC605463589EB43392338F6C057874B271D28B3351E23AE0AE87657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/dugite/script/clean.js
- Size 166B
- SHA256 eb41faba89044a69ec074fb47e2de00071f0041c88482d182e13192ce0f2d63e
- MD5 0eac2ca4cb9a4709a7637c8b00d8a428
- SHA1 cd0c7808044989f4038a972b2f0410b129147bd3
- SHA512 264e7972d7de17fc7b24385f207a3a1e2b8ea753ccaf8f1ba4fa39b4a113403f1e00495d4d88e3b4775e8f45fa329d2ba9797c1dfa3038642d7aa59d6b4786f2
- TLSH
  T170C08CD30BC0B23E7120D0B89A7011BB34E6C85A2414A9A4C07C02B67186BE88E338E9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/dugite/script/config.js
- Size 1KB
- SHA256 ef348af99ad14e657d349e61679df06a32a25f9d2a8eca2d0d3ff4d198f70b06
- MD5 46cd1a340ec4520ca97c9a1e30985fa4
- SHA1 68ebff84dc72de3da55a6c2f89e31bc25ecc2c25
- SHA512 0d6724eba59c7e6ae9653a3093ea860908f47d6c32a01d6ae768cec5b0f71238bb3d2adc06f2441a1b57bcd92236d27cfc3a97878d01399a15312cbfd33f6cc5
- TLSH
  T17431028702F91537828217B1D68B50152C16EAE33B1294CCF49CBB555BA2D30D5B3CED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32