aae9ca0afff36deff5200cc2229b84e2692ac9a6253e61d31360d0502f30823e

Sharing

Copy URL Twitter E-mail

General

Target
wajrus.zip
Size 60.3MB
Sample260701-r6rymsat41
SHA256 aae9ca0afff36deff5200cc2229b84e2692ac9a6253e61d31360d0502f30823e
MD5 1647d1e56f1377177f8e6cc95f83cebe
SHA1 e84368f54c5994f75fbab3a38d7939794031aac9
SHA512 7df44f2129f4f9d0ca5ef76fb7019f8784028a79e8037657c5992159ca9fbca0e500a3a1e869d015b2514dd865cee8338ec933ca3d387227fada35f93801169c
SSDEEP 1572864:uDbNsgOOgHdp7Qwna2Shq+NA7kZN7uhY4zYGtZCPQuoCZ1bcCgf:ECswaDhq+2k77uhDf8PuCZ/gf
TLSH
T13ED733349DDDA5D8951EBE97C8B86D0631FE63305EE6E91BB83870143DAE4247B4B032
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  MEIPreload/CPFilters.dll
- Size 862KB
- SHA256 f558343f4693c151f9416b20cded176e1da4e6ebc133eb526d1dd5f5fdf596f0
- MD5 6b9d1597fd7c350d3cc9e86c76a204ce
- SHA1 a1213a4a4b875572f5ff2d4787cea50e3d350eec
- SHA512 9d83e3e9c3e90d363efa61b7803a607982fd74045f5ddb1fcdbf7af70f4901b3dc6e861fe9d88a867d4c53c220423d9ff09feae8c58bc3852ea4b38cc72efff4
- SSDEEP 24576:prij+VQYnP8DzPZSw1kPAxhN+u2L7KOy4:AjAQYnP8hD1BSJn0
- TLSH
  T1A8156B56EAEC81A4C06AD13DE6E69216FBB23C07170646FB42604B5E7F37AF45A3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1
- Target
  MEIPreload/CredProvDataModel.dll
- Size 573KB
- SHA256 5eb2abd74b415c4f0df6a20358045873c437a146427095493790a431606cc8bd
- MD5 28d0ab27c32de0fc9607e9b7d10b9f45
- SHA1 6c23366a148260f2f80838843dcac7755df9590c
- SHA512 6075602149e08f1926944dbbd53125e8e6fe570e35115c0960733a6aa88ea6583740f6277bc546e82e4bd92e3da712461c65594eba991fd69803f6136bed84a2
- SSDEEP 6144:afmrkwZ3nFLN2zAm8LaJ6zki6wn36qKmurFfO+gt+tjdKMvekjH4J4AINe02EGz:wwZnFhesgiNXn36jBfOZ+tjFbjY4c
- TLSH
  T11FC43B1A5BDC43A2D93AD13CC2A34A49F2B278011B7296CB5252421EDF7FBE55E3D360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  MEIPreload/Qt5Core.dll
- Size 5.1MB
- SHA256 4f8dc460162407cfccb1be6ef9cce45c4449de838aeffa3fd33378f01a3f9cc4
- MD5 7d180286e9c071c7bc3a6bc2ace792ac
- SHA1 f5947d69aeaacc8a378721f3750b049cc41dddef
- SHA512 9b30d5dd48e736da770e71622b79da294829621565cfc4d995ca31c8cfbbbe2d577677f4240e0ff2d995deeeb5f894018412596c141e8360dd77bf12596ce167
- SSDEEP 49152:q1AH+7g4QrRpvOK8Bbl+Gy+/LZsxRFNHlZTlJsv6tWKFdu9C/cPk4VHEYI9CV4eO:E5gje5lCjzJsv6tWKFdu9CtvDhgwcY
- TLSH
  T18746AFA17B57857AE5A2D270C8BA632F0539AD124B1385C7D39C370A4A746E23F3B707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  MEIPreload/Qt5Gui.dll
- Size 5.6MB
- SHA256 80016776efea2b2a838c3ffa4c82e5f146baff68c36073c0c34668809d1c4297
- MD5 5b0f3d5b1b29b5e650375093c7afa243
- SHA1 1920cbc98bd46a3a72bcfb45caefcfa2649a92e6
- SHA512 9db9a90ab5a1a768e079cf9b10f1da868ac7dae774e90e139ee047c9c8fb43cc5b3e01ae3724ea74efd64409eeeafbcda4f04da3e86265575a3831a4fc69cc8c
- SSDEEP 49152:FKUDGaBVW3sDAPNaiCZPcSnt8KQ6oOtA/tiG7WwjrAxLXwQ98vd+hc0WM66fL5cQ:wUKssPdOy/tZWnXThVc5tnB6NDrd
- TLSH
  T15B562BD1F18671B3C962D2BB270F623FA076A956C30483C3C6996E9558743FA0F7B906
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  MEIPreload/Qt5Network.dll
- Size 1.0MB
- SHA256 37275f3ea79d15a2792bf21f71f1df825f201cf8b33aa1f94ca93d62d76b216c
- MD5 2e3db1cd1ec59d08706438258e86ea30
- SHA1 bc20b1e40049386e6bea3f448a6852bc879a8821
- SHA512 0c0e0e02ccadc3f2b3f6c8cbf2c162fb73734b0b244c80048968a6fe268450a270a3f92b155daf6268fef246d26ad417e6cec224133fd66e6ffb3a5394b04358
- SSDEEP 24576:Aul0ktv339DOBVXaIFP698DWk7PVmr0qwjb:A8sJVWAcwnH
- TLSH
  T1BD256C92B786C0B2E84481F5455EEB67E53DB1388B0666E3E34C6FE2D151ED21E3F182
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  MEIPreload/Qt5Qml.dll
- Size 2.8MB
- SHA256 e45f26ebbc2b0499e0e90f1666fd13f1bb2bed1073e828d30b6a3a70599d4bc9
- MD5 7cda5037206a57cadd50b5f032876a8e
- SHA1 314b671b27e9602a66396ec37bdd6e70bb180d92
- SHA512 1450a79b017b4809c83c2fc4ef53df926e3a725959b6e378c5a55c853d2151a2ba70272848962931c58596fb4174601e3defedb120fd0a211d57be9d1908ee3e
- SSDEEP 49152:grHpbRcgtgEgnLDYZeQok3e3QiBMKbjcbKYI1YLTFXrwWGw6cTWptNrSdSG779LZ:ARcgOnLDYZeQokwuT5E7NrSdSG779LL9
- TLSH
  T1BBD58D83F2C304FBDC429274589E6B379932B51903659BD3E788FA8EB6316E1593F181
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  MEIPreload/Qt5Quick.dll
- Size 3.3MB
- SHA256 5f246016691ff883243ee9b3c9215eb16b859b12aefc5f4bbd2fbda3911883de
- MD5 07266e7d049ac4499f34ce281f3a50d7
- SHA1 257968090b95fae67f92f82db9cab1f7613d75e3
- SHA512 d7f9ce2fb11de178d6d38a5580c503c21fed6777067b8a8259f9fe35b44047040b705903db4ed3fbac821806cbd5ca1db0f5fcbec68cdc49282dc0e63a3257c3
- SSDEEP 24576:wLAgn4tj+U6JL9iji/2LzruK/bEdKUEAWzeauejEM5OmTi/bIi6+LPt1rt83FCbW:zT1HZEHr7OCsKbKzVZPXMC0FEUO71
- TLSH
  T172F57C54F2D381B2D881A279186ED7239539B0904F0956DBF3787F4A66322F21EFB385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  MEIPreload/Qt5WebEngineCore.dll
- Size 71.6MB
- SHA256 4d8875a7dcda59339a0c2b1e5abbfe8de883fbd2688bdfc3a143e7b2da650975
- MD5 0e17d47d512ed6d3e21e96aff87cd947
- SHA1 5a1a588c43dcd2ef70bd5ad83f26d5eade4aa736
- SHA512 c2a311b84f9caabf212e7d3234e4f28559635928f8dce172ccaa08ad3fdd93b466ddb72712a0f39656d635bbed986df64c0ded94fe94f5f22ba5fe76f6f0a91b
- SSDEEP 1572864:UACDyvsq/kEtCe0P6+6kxwV0S5RbMZDjOCKbV4d/RKi0F+praXG3vj:jforytVV0SmD/dSFGfj
- TLSH
  T144F7BE23B4008039D6A212F2EA7D7F7A56AC9E35033495E797DC1846A7B0CE3673A753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  MEIPreload/Qt5Widgets.dll
- Size 4.3MB
- SHA256 600285754e7eee7239b9d252dbed5c9d2c9c4c432751b8953dcb2e8b45e0408a
- MD5 da70580648a398ab1c5336ee9ec631ca
- SHA1 fa67a8a2d7f7930a45974dcb7a12e56914bf0a57
- SHA512 83d85df1717a5b1dd5b31f5ab33e73d1442027a719af7fdcd20d578598f436d63e7cf58287cbe34dbee8d5b0464a68dfd471d8ec6a95a3168eb8639864a7adfc
- SSDEEP 49152:ypo1FNXS+dh75PMvZZNNt+iIo5uL5Sdbtye6cEu0n:oIPqZZUfwusae6ju0n
- TLSH
  T1BD26AE82F3C240F9D889E1790D5EEB63C575F1098B0992C7A7DCAE4665683E01E7F287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  MEIPreload/avcodec-57.dll
- Size 14.0MB
- SHA256 0be1ab58ef33c40fa092cc56b1730967e77fb5cc3c54f09a0e599b0e658f389c
- MD5 06280e3e5eec9783b4af071e7375f820
- SHA1 380036754e5fc786137ceddba989711e02146d05
- SHA512 9edd0515eff29bcb27cd447d97ae7b02f68e2b06885b8671f7cfca7e90696cd7b100a8520e533f2fc9f70795889a983ddec546a5f9827e36d13e63b762909d5d
- SSDEEP 393216:VD6UzgKtqQKrULr6fB9mG0vPIPOlOn9xW1p3:heoPIPhu
- TLSH
  T17AE6BF12FA529242E9C60076D7FEAF67293C1B38131554F3A398ADF4B970AD27632707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  MEIPreload/opengl32sw.dll
- Size 15.3MB
- SHA256 25ae7577e066fa80519a8f1c314b15cdd22e4a8d3ecd2a36eccc79e40714a91d
- MD5 8b197f55264a44b7b25046f7ba5bd7d2
- SHA1 cef69e168160968e00ffffa136e1af7819e7c0ce
- SHA512 6af2b1b17a7e3460099359a6750221aacb8f9ce0e80b346dbafd2cbd8e579543b980f98e0aeb199e0781a045c9d6a7f2f11c8628f960c13550328487b7fa9154
- SSDEEP 393216:rNkEXgt/UOdyRLjqkmbBDrta60HYUnuedxO0g//NuPyEMO32ovq:rN1QtXdyRLjqNbBDrta60HYUpO0Q/NuZ
- TLSH
  T157F6AE21F641C271F8DA11F296BDBB6B667C9634131A42C3E3D81D65AE207D32B3634B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  ToolsUnlock_v5.6.exe
- Size 2.9MB
- SHA256 1e800572c664d23a3ad9b25c770d195f956e01209622ae2abad1e3a70f92e8a7
- MD5 c6821a6c06622dfc1e0d5615aa35c5e4
- SHA1 632ac20c9bb5e0d323560cdb4db218094be7069f
- SHA512 c8a535ce02d0fe25d51e71724aa5789666c9ae06c3fda8840a67af19896ec909f158d8332ddfa172129fc5e71f4f8f6ce014ffccb21e4e5844e2d400244190d5
- SSDEEP 49152:HQxCkncOGocyIaIpJnDk67yp9jFF+Irt5V:HQxc4IpJDk67W9j7++tX
- TLSH
  T129E59C4B2CE009EAD46A963648B641977B35BC494F7623CB2E94B3783FB27E25C35701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral12
- Target
  locales/ja.pak
- Size 426KB
- SHA256 38e959f5c548a9b139b46f6243f8baf919cc2951bbadb2d55080b86567830348
- MD5 f0e5da5f828351081d7f116196549030
- SHA1 b669e4ab35119bd735a57c749cd3d9bfee941fc9
- SHA512 b03ea27664d89e4c68e5c36697382abe13b477c137290f4bb79d9fce416b1a5301e6ee372fa7becc4b097ea2ff247833427d64cb729d366532f282a0fb9bb56e
- SSDEEP 3072:dfKEgpwclvFk6xowoHYVwomDDrUIC02DVYENnPkwoILgl9NH7UbeCF5OAgHbFE5Z:dfzjchlLCDrUIC02FNLp5IVO
- TLSH
  T198945F6CE3C969369D6193A22C0E36D17606AC5FFCA23A36442DC074BD70BCEE515AF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13
- Target
  locales/lv.pak
- Size 377KB
- SHA256 9fb6cccd66a0cfe9268dd04771a196a5fc738daf1c2d900b62c3f317ae3cd2a3
- MD5 47976c120e8448f074e738f053487d6b
- SHA1 5919af9ff70004f2b9e6b0a71039f2821cffad1c
- SHA512 5df577bb2cfc817ad5d60b954a12f58637c0e6e0d8e32ac1a8d70c3b96ae088e61cd40099382d6483c93db5131d7c3791d8b6708b964cbccd372df5c66947c47
- SSDEEP 6144:/zJpFhhTtVFoHmjYNK4uCAkapCZ5akDyAh9AxlatuM3rc1V3C:NamYE4u3kRZ5uS+V3C
- TLSH
  T1FD842A659EC68FAA4E505DCB7327D122A9CCD740FE03E112ED7D4B2A510F52432B6EE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14
- Target
  locales/ml.pak
- Size 876KB
- SHA256 32a7beddbf9cb89a71d8ae39a4775a6c4d0019b561c118d617b4f641ae19a7a3
- MD5 6f212da5692a21938bb69d2cbd62d225
- SHA1 f9e574372424ebb8afd2a9871526fb28bf0960ed
- SHA512 91cfcd9b8219916ee34e3f0ec3d4a7c33fe5602deeffe4b4001d4cc489158df7a1b34298dacbfcdfda448142cae1fe4ae00c4b89c29a148a119477419f6ecd61
- SSDEEP 12288:LljBbeIc++Ai7VIMASTKMmWcE+xwbbAujgDl25f2VJ35k++m:xlC++5in25fw3j
- TLSH
  T10415BF5BA035CD3B0FD102257B4E2FABCD5B8FE140AF668B5869B2628C59F7D0C99431
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15
- Target
  locales/ms.pak
- Size 326KB
- SHA256 c1d942082af1be8af656bff280e6f21671f0c5536aee15b68670643c8baec8e9
- MD5 d888ecaf12476f1649dabe9004f1545b
- SHA1 01601799d74c315322bb7a090b1aa59b2b783bfe
- SHA512 c5a2311badd33db72bdfaaa9ca598ce38c8c9cb5389907d6ace963cba497ea74e295b7db9f5d2b37b3b15a86a1c89b85f952a0b054efa0491d7e1054209cc447
- SSDEEP 3072:aWN7kZP6QP1Lo3tvvW4xKn20EBiOrr55hOr4F4V2l+5bHV3ju6cvuBS0Sc60T8u5:amIP69v5xm2akr5ne4F435bHVzb0U
- TLSH
  T1E764C5029EDD3118096843D5D2DE6A1B3CDD3333B705AF268DA08FB016AE7A43756F89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral16
- Target
  locales/nl.pak
- Size 330KB
- SHA256 342ba48365b9eaa5cff9034b19568676e2214a16c3f782bcd98a7907e239b357
- MD5 d46b83eb65bc8cc0176813ad343dd95e
- SHA1 37b8d82adb8ab314a0287ec4fb5b084f92353544
- SHA512 1b0035fa4cd5afec64bf79a7ca8b2947cbea5d8db9b6cba7d131f4647f66e6804940ae2f94620609b5d8e87ac472b1496256041df59e54dfbd6e4877c61cd282
- SSDEEP 3072:Iy0Yc4MUiBqTEVpo4UHi4gvYjsCKXBZaK6zuv5OlqmK3OAH8a56Y/lHkB0ja+25h:Iy0B4JYj4gN5cqzxR/ab5eFjb/aEW
- TLSH
  T10874FA07B89E253E59C0B385F6084FBBBF2AD22CC26CEA7D94DDD1351843F5851AD889
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17
- Target
  locales/pl.pak
- Size 365KB
- SHA256 ff304801e07aa026192a97e56483235eb70bfa07d06118886f0762970915787f
- MD5 dd0c46d55aa5d53ef67e00d473d9df3b
- SHA1 4f9de5c0f205b28bcd6f2e0b78a9fbb49778d68f
- SHA512 cc4537ebb836262e567e270ae91f04a51772ca01868f76e17b7363cac643025dbd65ddf4b51a12ceb3a545fd215a1ac14f5756867feb3e7dc3661fffca2944f8
- SSDEEP 6144:Y//1Lsf1ULBgbtiKfbiEPv6CUd7Uv9CmNa1Qh95XC405o7:M1Af1iBytiKfbiEPyCUd7UvImNa1Qh9x
- TLSH
  T15F845C0E56E59A0E4EA008D6F2E71F7CACDCC848F119D39FE05F8126615B19EC9BE5C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral18
- Target
  locales/ro.pak
- Size 358KB
- SHA256 413b09bc15e2fb199e1a2e39042d866a983d8c4de523ad3b5bbbb3e2f630daf5
- MD5 44410fd3308fd26ac98c1cbc064c2bbb
- SHA1 e350c1a6ceec1a344a31cafc577ffd76e4ef35d4
- SHA512 4b94bfd4625c0fe1d87e794336280adcecab7974a16e3136385bffe95f5b9e30af46ccf0f4eff019a87079b693316a387e5bb17aecb7c645b381ee88de40cbdc
- SSDEEP 6144:grAT+HWf+Q8TOB0wCFGjxzLD5CG6A2e/xpuxoM:lEWf+5TOzCFGjxzLD5B/xTM
- TLSH
  T1C0743C13A1C85A972E514272B72634D3E98E105DF641E28DA4EEC97810CD9DBC63EECF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19
- Target
  locales/ru.pak
- Size 576KB
- SHA256 5eea7417362435f895ca70a687ec8bcb20dcc382d95afde41be13122468f474b
- MD5 8afc2b7beb9aa5eae4d86998f0d2c352
- SHA1 bbf40d821590179d1c68100597908fa270769832
- SHA512 58c1c265ad4e0c9e61b78b0e98855a23b6fc01326478886154a502549d9590978155ef7ee5055557bb9ddc886e5a675b08001e681079709a45b8ca542e581884
- SSDEEP 12288:vdgqMoTzqXxWvNswQeXN2hSO3j/bDzvDJvcm/eQ/XHUhIw1aghLDhkCakWT1A+cr:vOtM45BS
- TLSH
  T13FC48661669E64DE1101F01BDD08BE0D3CEB45FE3FABA36219642D7E35F2024C63E65A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral20
- Target
  locales/sk.pak
- Size 369KB
- SHA256 1e8e7df2b76c592e8c1cf80f448b16a4ce9ed8eaf63322b566b8758e93fb7bda
- MD5 2eacca449fea50357186f8f6381832fc
- SHA1 1f0aa94c4cb1e2aa741b3b8696e317c10f78d091
- SHA512 18ce09664037fe9830c3db0ed343c40b799d35ff8a5ac7363081b66284f3fe56aa21a07f0019a193e487aad937854d296384a20a1fce8894e752eb88811e1896
- SSDEEP 6144:cRJa1/Lvv6DoNz3NCieJi4y5yLnaQs5UxDGF2w2:cKdvv3NCilh5yLnaQsmxJ
- TLSH
  T135844C7FDBE6180E8F8D0249EFEA7210FDBE4690894EB4A5D44E324724E36ED8974D44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21
- Target
  locales/sl.pak
- Size 352KB
- SHA256 d21f69465feae6b8c22eb370757ad8ce98bf095af9d6f61ef4a89d498e16195d
- MD5 be4657726070e66d5f938f7a64730e0f
- SHA1 c1af198afbd942e9b94809dd568407ef68472f09
- SHA512 de48486b4f6f96b73eaed3ead9acafe88cdf6d7ec6c456da9ab7e2d83ed5a6537a5326fdf016bfb2c1dab11f7044fcc58b73bbe01ecde4ffa36dd1650aaa6c5f
- SSDEEP 6144:LgguDtEkfjxXXfennbTNjdfn9Yupm4ocjxPbPJpfu8drvf+kGX55CuGINi/fz8wR:LlctEC5LupZok854Ui/fz8Kq6
- TLSH
  T1F9743D757BA75E0E0D9AB2CBFEA602107FDC045CE241E2A1FC4F33695016A3827BD599
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22
- Target
  locales/sr.pak
- Size 545KB
- SHA256 24dbbd06242bc69a8f2e8533b9e27137b997efa5c5909e9875b44aebe3f6b05f
- MD5 3ac04710f6702c10617bd012d28cb377
- SHA1 cf0d1954c1e958ef6efba6766426f7d7dc84867f
- SHA512 72e8d1631dc962ca5c89e186911b9ffb749450314df5cb29702536b8e445b0b41d6a4952fb6e1b8fc1997aedef69b1911ee666e93de87ae260e8260ef6b89bb7
- SSDEEP 12288:SCEUgxUsGILXI1KUukkHeTiP5VyB/qU37mXih/k/N:hFOQp8VP5F
- TLSH
  T118C467B19B9E64DB0501F41BD808BE493DAF41FE3FAB975215201DBD34E20B847B929E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23
- Target
  locales/sv.pak
- Size 322KB
- SHA256 cfb538b5d70f730adcc8c2f5eea687fda741aaf32b270bfe8d13324c9a494641
- MD5 452ee4616d0a2610d5bed989f566b5f7
- SHA1 55094a0ff72e1693394a12a131ae56f143e249a6
- SHA512 e8c38a9e0e12785aef4378744e47757cf4f7ab429de4b53c84754d9d2102310e65ce9f3daa9ac0df1f2e203856fabb8dd59457c82330616a34874cccccee759f
- SSDEEP 3072:P6ldnfRAdNu+POSIVlaZe36HtKEsds6BKxXliP38H9ALXBxQxCp0JSOavJ5YPvHu:ydnZ0Nuds6BKx1IE9ALXBxcSOiJ58Fbs
- TLSH
  T156642B428A20F536FB72530DB908115F4ADDE15CE2E2958DB8D9883DEE8BD9405FF24B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24
- Target
  locales/sw.pak
- Size 333KB
- SHA256 0998842a61f7b0380891df8bade0e6f18169c2af9c99ca7ac960245c94fed8f4
- MD5 5d2d304cb9c3c9f29448a64ca2fb45e7
- SHA1 1aa938a7a846bdf00099f63c50fc30bbb2a60db2
- SHA512 e9ccb210b5a92c1ac32935f8dc5cb9eade461c951218b1fc4b799a4611ef2d1cabd732c3ab94f63159ab4617bc5c5e7d5020712a0d33d8f211cd59b525596560
- SSDEEP 6144:CPisgRZ+Ad772LhQ8V2F5JIDWz2at+UjtsHw5G:qHdt8F5T2M2
- TLSH
  T10974F96298B1D0195732618503DDFF331BDCEC9C292728A36A46BF4F218F58C57ABE49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25
- Target
  locales/ta.pak
- Size 856KB
- SHA256 4b7683e700916763eacec5087ca04008ce9daa221ff92ac2c9ef729d81616d2e
- MD5 310ace7c20f2a7cfdb203eb519088a55
- SHA1 5f156e19d2d0d3c454bd00dda0478e1890c8feab
- SHA512 f760eded12d935cbbbada0c3c28956887fdbe3493378858fa74418eff43ce68b2785746a7a1da192121b82762fd3e881a87b9b3fa252fa359eec7a8204a13bcd
- SSDEEP 3072:f/DYkZjcqQ50fqdZ0DRswl5QAqtRJGgK2:fbzZj+50Sd8Rswl5qtRJGgK2
- TLSH
  T1B9151BCE923EEE890F93288F0319536912986155C47BE3A67C766E1298ECC5DCF3427D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26
- Target
  locales/te.pak
- Size 799KB
- SHA256 2d7ed140e98f5dc27244b074653578d26f1be69f6716c20356fbc1d56524ca47
- MD5 8853f87c0b74e5087ddabfef17cf9974
- SHA1 c82cddf6c899d031fdef0be33d9e3c4f6e226791
- SHA512 dc8d6a659d106a0ab6e9b3cf5aa35616d12f6bfe6b41a4084b5c2e6090426afb4be1ae59fa29889be116841adba9254b03ecb328bfb70c9d4e67cf6e90a5b455
- SSDEEP 12288:w/O3G2hjWpnRbILVtBC4IJ/BP3p1FfeklNv30c6LxH4g1QRxyfxl45spX05Oq9Gm:uOuEYz5NR
- TLSH
  T13D05A1023A6AD310DBE70277352CF66C49681B4261D6732C1EAFA357EB87D7E0843676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27
- Target
  locales/th.pak
- Size 669KB
- SHA256 8ddf5c638adfd96f75d74e6b91ba123b98e3f2884858b74c5e3c08752c2dc30d
- MD5 a2e9bbc67243cca1d3aeaf7d8d346052
- SHA1 6b3b9307ef8971f6b3f4b51e3fa2caee78874ea8
- SHA512 4f9a53a181032a5bb1b053fcc0dc85d23720a6b7397d8faa264a089457a06d8fee631fc4bc794ea25bade082c5c658954c039126908c64e3dc9fb43d0d386cca
- SSDEEP 12288:JzJ5JQVA3PRsz8jOLOhc5UrlwLRflZj80QX3y8u7b3AS7Kle9dKnNA9Ff09XAyF6:VJ5Jst5X
- TLSH
  T1CCE45BB33647D9D479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral28
- Target
  locales/tr.pak
- Size 342KB
- SHA256 2c62130efbae6e7dc46463f6b0a98395a230ddf58398bc5426efe8b29e75a620
- MD5 8dd14e85bb0fbef6582f63bc77506a82
- SHA1 f03e5d206eecbe36ee71ff18970ff5c92f3c4461
- SHA512 c0930244c379ba7c54260c491d807235cb47110384c075e13b0fb3dcf66192501a59ff9f13683dc3315a3aab1fa35205fe237f24d9a349643eb7f238ce4a11e1
- SSDEEP 6144:H6WzsaHblkL7fWUrD4x4yeCge5x+QGeRaEUwiB4Gx:HvzsaHSL78+3s5M
- TLSH
  T1B074FA8178EF381CCBB9278BD2E50626F99F07A6B331E446DA169636775634303F660C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29
- Target
  locales/uk.pak
- Size 575KB
- SHA256 72a0aa468b65f33a4ed5685502b092bc4f1be70116c42593773c57f3998dc1e6
- MD5 06a08c563832649b4cfc2e80fbc4a920
- SHA1 18b60a7a5b6142a9e2766da3c183c784206cb339
- SHA512 107eaa71698a7448af477fa5d16ff2a9e7098a127492215c204d304af171d93d459bd6b455cd6c0ad8dac1d46066ec180c7a99431d0f3fa8343a9a0120e4864e
- SSDEEP 12288:fnTCnLpeiMNZcN8z/Yk5CB3IjUUETLNiXE7q/6z+4uL2u7i:4U9z5o
- TLSH
  T1BAC499A1AA9D54DF0105F05BE94C7A0D7DA740FE3FA7871625A43DBF29F20248A3C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral30
- Target
  locales/vi.pak
- Size 406KB
- SHA256 a0163b00ad0771cac614a9ff25b3d5e4b99d055a5806bcb5acb907c08f91f8ca
- MD5 d80b4705828386d719b22391de4a5ab1
- SHA1 a3090200c52a6874df6ef33ee65c4878e4221700
- SHA512 f9f62e46d369484bebfe88c5199a94e9e5eec7814683a369015e698b714a3dc252d6076ada81ad10376fc9c507b9b4f5d029bc5c62648943c7259397bc60318f
- SSDEEP 12288:bLtu3UBesleVN3J0gJTS+6E+QPlf5PmuHrD2zi9xSPQ1PkFb:bcEBescVN3J0gJW+Nv55dHAi9xSPQ1Pu
- TLSH
  T1DC94851217E0702680AC553ED5CD540E6FCAE42FF7808FE17FE4297976221A56F21BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31
- Target
  locales/zh-TW.pak
- Size 294KB
- SHA256 ccf5a6fa53ad308c9d13cec738cf9e839e8f57949126a94dc04d450a0a75aa06
- MD5 47cbf25324032feeead1427201fb266a
- SHA1 b9f5725751def5611b7ee2dab3d6fff43a9f2cb5
- SHA512 5b5b49b4509394d71410a0c6cc3cc6a40110f6d5cf027b251ee4a66484f57be06f810f62f18b796bd1c7040a2f839aa4c6be7f0c1b9032f58a1e087d1a71e41b
- SSDEEP 3072:b3KAQ67tw9/zKM31or5nKtw6VmcOU21DqMOtQvMwPC/9TlVXnS4tBSrOs50nhdmc:bg6W9Zqr59+2TMwPGY45s5aEI/9yI+Ts
- TLSH
  T176547D6519FBDEEE0901F884B3C9523B7C8A342CED377A37FC4918D91E76E045A9114A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Suspicious use of NtCreateProcessExOtherParentProcess

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32