0b0119bd3f98b2b09128184e2d324741ad01beeb7f0aed116054fa026843332f

Sharing

Copy URL Twitter E-mail

General

Target
ACMR-Launcher-Setup-1.1.3.exe
Size 102.4MB
Sample260702-gcvsbsav2n
SHA256 0b0119bd3f98b2b09128184e2d324741ad01beeb7f0aed116054fa026843332f
MD5 34ae0bcc1d921a27a0a171278233c0f7
SHA1 29eb995347dc22aa997a30cda0551d480637fc87
SHA512 4c67ac78fab494721a2965ba30169d23ff2280c097d6a84a6857b1f4185e2443a8a50bc75dc98bb35706697547a5d2acebdad3368559d19518c140b34a40e092
SSDEEP 3145728:znXL4i8EOxLwJERRgmBpoL9dSsroCmLOKvH0M0G:X4bE8LBcSoJ9ETBwG
TLSH
T1B83833D783B68B1BC1C023B15991FB7595928FC2FBB8D24392D5BC737DBDA8856240A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ACMR-Launcher-Setup-1.1.3.exe
- Size 102.4MB
- SHA256 0b0119bd3f98b2b09128184e2d324741ad01beeb7f0aed116054fa026843332f
- MD5 34ae0bcc1d921a27a0a171278233c0f7
- SHA1 29eb995347dc22aa997a30cda0551d480637fc87
- SHA512 4c67ac78fab494721a2965ba30169d23ff2280c097d6a84a6857b1f4185e2443a8a50bc75dc98bb35706697547a5d2acebdad3368559d19518c140b34a40e092
- SSDEEP 3145728:znXL4i8EOxLwJERRgmBpoL9dSsroCmLOKvH0M0G:X4bE8LBcSoJ9ETBwG
- TLSH
  T1B83833D783B68B1BC1C023B15991FB7595928FC2FBB8D24392D5BC737DBDA8856240A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 101.3MB
- SHA256 3fbfc8b92bd1a038103629a2effaf62b834622cbf0c85099724ed0a83c79a8df
- MD5 4135e4d4ff8644d52a6f834505068060
- SHA1 2c5a3246b2a38df2a8a852c0b424e363308b9d8d
- SHA512 d81937910561af1314f48c2adf4473d70da42d5e6d2e90625b6521c1e8619108923c1bab264b1c6896ba1d96246da2a16b7a4c55f6dbed698c6c94d363eff890
- SSDEEP 3145728:NXL4i8EOxLwJERRgmBpoL9dSsroCmLOKvH0M0B:R4bE8LBcSoJ9ETBwB
- TLSH
  T1AB3833D7C6FE8B1EE6C422B269C6585255C2EF03DFB8909306ED8C72B54E48C53252F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
- MD5 750913d55e87def9108e55728ba67d00
- SHA1 a5944bc170d1f6c3223195c043134566471dae1d
- SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
- SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
- TLSH
  T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
- MD5 d476c19d21b3c2861f08c1c82fffddcb
- SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
- SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
- SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral9
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
- MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
- SHA1 18ff020331534d21f24d922d4da3c253668e44d8
- SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
- TLSH
  T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  resources/runtime-assets/Bypass/eac bypasser fixed by larp/ac_bridge.js
- Size 156KB
- SHA256 54378d82aba4a803caefd627204cfb281d443e9cea6cdbe0246df0ed7864a54f
- MD5 25b32b71b8c4de8329ee3534f9d4ead3
- SHA1 0d287c6a630f1291d3b66b79514340c9002dfde8
- SHA512 49ec949249336757f50301caddf1596eb5be07ccd8f98ce42107af9780619bdad1156d9b01aa531a95194922b14a82ea11181992aa48b99e12af11a8864e4165
- SSDEEP 3072:5C9Y6pvzKrcrcKgWAN9D+17Y6XpjALgO+nduY+phMW8CwVIai5ItKCjO5EMW2SV1:5UDpvzKrcrRmN0pY0pjtO+ndudheCwPB
- TLSH
  T1CDF3844929E7D261813AF72C7B46D008F63A822361419694BCFCC3749FB792196B5FF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/runtime-assets/Bypass/eac bypasser fixed by larp/bypass.js
- Size 244KB
- SHA256 5c3b6b0af419e70cad02e645c7500d86e34a50d4425ae55fdb2297bc25709389
- MD5 e20b72ea0dfdd8a4f4a5552db015e8a3
- SHA1 ea44f88106f1ca646af6a46b550a3d5f45e5cad0
- SHA512 e0683fab25bf53400a330599bb67cea27a7a260643dae08b4579924fc3174eb5b1a2fbeeb350df3a12e9b8e98644ce2c9bc90d26be7f45ceeae6c4050357285e
- SSDEEP 6144:ZIuEJTkBjWmNCmpmp9PzEAf24K792ppLgYbutqUOCQh:ZIuEtGKeCbPz1f2X7sXgYbuMes
- TLSH
  T1C034135055075D376D6AA31FB022072B808A9A48C48676D5E371B54FDD880DFA8FFE3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/runtime-assets/Bypass/eac bypasser fixed by larp/bypass.py
- Size 7KB
- SHA256 2f5f761ddcd95b95bff7eda45893580e1890634fb2542953372bb1e13e8ae8b5
- MD5 28a0aaf07bde2d1a648b8440a51b2d9a
- SHA1 06a70268ee5eaf61817a964bfb84570753cdee6c
- SHA512 9fd2721b8ca3337d729322dcd2d6438135ca3bad9485715dd534208ce734f1acb5d44dac7ca0035ebc14d970b2bbd66b432768955eba897ac10e2ec05fd1af93
- SSDEEP 192:ABYkvHuGEE/Q9/QNlYiOs/LmM/VlH/Q9BoD3C/UXQxuBO/V9193uNubig4y+P:AGk27beNlYivmo49BoD3LXQwBO/V919a
- TLSH
  T124F134B17C296A283272C91EC947C061EA69BBD371B9391AF0DC74D02FFC45486A1DF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  resources/runtime-assets/Bypass/eac bypasser fixed by larp/quest.ts
- Size 20KB
- SHA256 dd4c5878031ffa9da96f637d461eee3dd9bdcf6f8d2b87103d08fd0fd4076e51
- MD5 4afffea17554197dbe451f47a45d8da5
- SHA1 d96c9a57d6156a7ba6bf4aa1a4528355ce453bc9
- SHA512 c6e4997e145e061435c596dd1cc5b5c3b71b08c0288211ef4027293d0ebcbb4855c4972867a452b7188d61cc1af7a722217ade0ab5dccebada00635b91316905
- SSDEEP 384:162QlibRlO5KtftFXyrSXcrRcrDgMzd2XpOvAsfiT80vcPE/d83rYQDv4xPPRC9H:Es52QHU80vceAlHjLhxkwD3UB6iWV
- TLSH
  T1EC922D05386564628CA392409EDB530CA51216477EA4F8E5FF9C86F40F8E01F9B7E7BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  resources/runtime-assets/Quest Servers/ac_bridge.js
- Size 156KB
- SHA256 d7eff61658ab08864de456f9fff16db999bb88ea1f74c54e47e8d0ffc5e92725
- MD5 b9fdd9292cb0a30540e19e9d776d51be
- SHA1 b8cfed325db2eb17b1447e4e83a297afb929bca1
- SHA512 035692040f4ddf2fa2c71167bc3733e66af666ae117a3973db5669688442e63bb0f42e5d09b005f76d5203974859223ac89b22063a6b616e76d7ede11327ccf2
- SSDEEP 3072:5CKXv8pvzKrcrcKgWAN9D+17Y6XpjALgO+nduY+phMW8CwVIai5ItKCjO5EMW2SH:5xv8pvzKrcrRmN0pY0pjtO+ndudheCw5
- TLSH
  T120F3844929E7D261813AF72C7B46D008F63A822361419694BCFCC3749FB792196B5FF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/runtime-assets/Quest Servers/nophoton.ts
- Size 21KB
- SHA256 80b1f5b54ef3e01d2f4b30592231b8861ff8d3a2af77aaa9fcdc1ad25a5f13f4
- MD5 ebf0758f4a3a1354967f46fbc6e41ae8
- SHA1 2f8540d0d5bd26044d0c6f36c7ba31c3fe77045e
- SHA512 fe0b417de456acf1b35ffcfa72dbd891fa4bee93cbec29629d811bc2b10e93129abb4eaaa18283d6653adaeb67bfb774621638dbc34ef4feb2edecaf3550876c
- SSDEEP 384:tddE50LVxqPuDbAU6d1uXiruWru5wzu+/tYMQgOvu7/KeP7/QTWKvnDOPUuu0Cwa:rxypFgPw/KebS9fM+uxt0aDNF9w
- TLSH
  T17EA26047781964528CB292908ED6430CF613175F7EA0C5E7FEBC86F40FB10589A5EBBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/runtime-assets/Quest Servers/questservers.bat
- Size 56B
- SHA256 03a29a06e70934513b417bc8513d1522d7b8103fa1620e27f5619474cb72e3a6
- MD5 8da9d7d5ccc35221b824decac32f68a0
- SHA1 7771b1ad564defd2bc046426045a7bbc343d2bba
- SHA512 d6aae7bc5f63fec0fab1fe25ba180b6f58e51c8b770348dac127d44f75ca9fb76f6b1ec5832df19550a2f770e7eba6fd2d98213f12e3965b51aad683ade198e2
- TLSH
  T13B9002009A29A938161A05321F5F01DAF5C93325E8DC5B44D9523EC17009A9972C9664
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral18
- Target
  resources/runtime-assets/support/frida-il2cpp-bridge.js
- Size 152KB
- SHA256 e6658b3ebf95cc0b94b6f520e07845f6c574a784860e481e0be0f0868e8a41ec
- MD5 2373a10656806dd7d19bb8f061703049
- SHA1 7606b5a7b015bb70cbfbd0f3f1812a014ae3700d
- SHA512 000a7a125405678e4e105c19960766b3dcf391ec254c7a961cce1abadbd4b84ead6eb6725f11124057c4d2647837f08b902f999a3294f781ef497c7d7069af8a
- SSDEEP 3072:xCf1EpvzOY0mQrYrFQxAqXAaQdczvQg47SFOokQpg3FwiwgpB0lINK6jx5E3Fy+X:xyapvzOY0mjqxtVQ2zv147SkoHgWiwSo
- TLSH
  T193E3744929F7C262812BF42C2B4BD048F23995036159DEA47CECC364DF9A931A6F67F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 7251ad75403775b327643d38a4de09a0eec3442e02ee946d48f50d8900afccd9
- MD5 baddffa8d9df7964df97b2a1fb195f06
- SHA1 3a7a17498fa99351be2b0484e9f208882d7324d9
- SHA512 a20b4071e2be6c90a2a5f3154edf02bb545e312771108a9cfb81b7a8e88e3d46feb5f47af1ce9228f0a3702cb7be077cc591fea3e85c8df308c5d3043212d3c2
- SSDEEP 49152:fvMQibTIlI/EyGhcIDlpcSJ13DFDUgcD2Qn9agdGgkkDCqBK2WgPM+2HryKAoxw:fvMQCkgUrr+2yso8FX1+
- TLSH
  T1B0464903F68681D9C06DD6798B5FA623F672F8800B2276DF56A00F192E65FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  vulkan-1.dll
- Size 904KB
- SHA256 7258023684cea51fa08bdf3f06a24dc6ab91f48b361707f345ebbc7b29579122
- MD5 fbf1377da78b4bab7de68ea8b1e02f81
- SHA1 979efa962e66f1b56813ed6f94e6e8a3fa9ee196
- SHA512 fa478cb01597cd738dbb625ce1697621f18c9559f6ba5cbaa0242c57e426eeb698a09f6a4734539d818eb37d6555ab66b47161a1054fee40028677eb307f7d8a
- SSDEEP 24576:AGq7F7pknIiAXUMKzUjvg6Z5WzcxDYsHkDE6g3P0zAk76oOH0Yr:TGF9kIiZAjvg6Z5WzcxDYsHkDE6g3P0c
- TLSH
  T140157D23DA548B69D67AC074D8D18A0789F074851322BACF07B817147F6AFF42B7DB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 2079f7a3eba60e0d9ee827a7208aa052a71b384873b641de5e299aeb8e733109
- MD5 52ff52eee3b944b862c11c268a02c196
- SHA1 8d041966e6fba10aa5e10ce5dc1dc5175f11b2fe
- SHA512 2861ae5a06f8413810947c08994f4c0da54a1acee8c4df72cd8b03a9503b26e5512809f8d70fd584239b04a651e7329a701bf7ddcee2dec2c2e14d05ae74f220
- SSDEEP 48:EWQsvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvW:ER4N4S/992/zDmrkVIe1ULo2K
- TLSH
  T105E3BFF256769258E29113445BB4394CEABF7F8A1A209893DE72FE56DAFF134448C00F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $R0/Uninstall ACMR Launcher.exe
- Size 517KB
- SHA256 295a82ea51e4bfeba5b4e0d24b3c2bc3937a77d6102554d4199ddaaeb0a093d2
- MD5 76816ef7116be311086e729e0a37e08d
- SHA1 203e4e791e839f04bd51bdfb28fe2b87b3c8762b
- SHA512 3e515a88fc707621dcee30ffabbc9637c20002fd11cf2653c1068e2c51c52aa65c1c4cf72fdbeac180700559c3b008d6af51dbc26b4c481d1863ac083cdf6758
- SSDEEP 6144:c740IlT0XZ/If+sODPrXphy93EpIkmLf4qyN8vDVunqC+DpzMN22Ua8T2t0EyL+I:ebJIf+PDPr7/TmD1VunqZV4HCLRKJC
- TLSH
  T18AB45BE943608927C022E7B849A0FB78952A4FC4F6A7C743E2D2BDA77DF9BC51C64450
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral26
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32