e3782fee3da51e158e41b1c569e0682666fa89741e9f04edfce6f3837b8e3d5a

General

Target
installer.exe
Size 2.6MB
Sample260702-1tr8bafv7x
SHA256 e3782fee3da51e158e41b1c569e0682666fa89741e9f04edfce6f3837b8e3d5a
MD5 3a3a651ce99cbf01c584ec293e27b7e8
SHA1 8dc99a19c0e54a9fe587fd3e276028de8764d527
SHA512 ce77a2c66d0c2400aaeb01e1dfa71337416cf098e4fa55a2002060dfa32502e0c9f43adeb22e149cc0b46c978eeb859fec6dda14a5543befe34d7790a024270b
SSDEEP 49152:Z+yLqPurYYuraMClrafbVAYWw4JPt7j4+kMVcLE+CL5GCEBHp91bd:Z+HulmD+tw4J9cMWLExL5GCEddZ
TLSH
T177C533A0F5745660F5978FB0C31A07496BFE8233AF1AAFC357650A0E7B206125DDEB90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  installer.exe
- Size 2.6MB
- SHA256 e3782fee3da51e158e41b1c569e0682666fa89741e9f04edfce6f3837b8e3d5a
- MD5 3a3a651ce99cbf01c584ec293e27b7e8
- SHA1 8dc99a19c0e54a9fe587fd3e276028de8764d527
- SHA512 ce77a2c66d0c2400aaeb01e1dfa71337416cf098e4fa55a2002060dfa32502e0c9f43adeb22e149cc0b46c978eeb859fec6dda14a5543befe34d7790a024270b
- SSDEEP 49152:Z+yLqPurYYuraMClrafbVAYWw4JPt7j4+kMVcLE+CL5GCEBHp91bd:Z+HulmD+tw4J9cMWLExL5GCEddZ
- TLSH
  T177C533A0F5745660F5978FB0C31A07496BFE8233AF1AAFC357650A0E7B206125DDEB90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 32e35e4b97f8df08f07d8879ba2ec963c75707440cfc0275e944a31c946f633f
- MD5 58696f9e1a48139fb1b0ed289a88f386
- SHA1 71ed08169cf00dd00d41d41395fd982ff8e8c5fd
- SHA512 3feac3983c39194d9101c803d69c395c33d8757e6ab746447f0f22ee9d0d8f790bb4f0c6c9f4fe7fae66cd6119c2b456c02ab051ffb62af4d010387998760d33
- SSDEEP 384:3rSQMCOUILnCaSPy/yhJzmGSMRWyOUKiR:3rSQMCOp0yamMRWysiR
- TLSH
  T15C623C16B62084F5CBB2167034D73B3E6BB28F6A1A2848C24BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
- MD5 9ba64ba25b26b3964fe1ca1d331387ee
- SHA1 305e7ef9bec45556fe2de80d0ab107f12a8f4eee
- SHA512 741f72b15f6f138c0fd0ccf799dd031c731e79b54eb417a615a04d53eed72891f92196beb03795fad990c158cd358b460ecb6eefed5fc2ef53400310b2249df4
- SSDEEP 96:ZIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/O3lkCTcaqHCI:+hE+A0+sF6piUFkA6lncviI
- TLSH
  T1DFF1C776F3D20673FAAB427428232F231B2AF521576981A6490316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 32KB
- SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
- MD5 6ebdde247cad8468575f1f2a4d7ae2a2
- SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
- SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
- SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
- TLSH
  T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  voidclient.exe
- Size 10.9MB
- SHA256 fe1ecf93ba392ce84330f5883cdce95c62376f3b320acfb18c865cc2fca3b7e8
- MD5 088a32bc33fb1f0c2fe1e803a15f47d2
- SHA1 f5150949dfb5c169797645e853297707df8897e6
- SHA512 480fdad32be245e0a93346678ad72881105aff5325e70db3391f3d1de5350f4d9f1fabd46904e2a88f799a206a053ed0cbdd3e899a2e65611c015a4887b78099
- SSDEEP 98304:ib6cEIGKNWAzR68qXTrg7LQpAJsf/haD3pi:iGKLz4g9u/oD3c
- TLSH
  T108B6D5257B5A99ACC05BC4B4834B4A76497134CB0B35B9FF4494A2382F7EBF42F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral7