906eb1f1a8d6f5d9b73f4ef418c5287e67ef30642d9083fb7c547b4034831096

Sharing

Copy URL Twitter E-mail

General

Target
SETUP_FILE_(PASS_KEY=9094).zip
Size 39.2MB
Sample260704-hptapsct5x
SHA256 906eb1f1a8d6f5d9b73f4ef418c5287e67ef30642d9083fb7c547b4034831096
MD5 6da6d343a6adc8f554997caeb2ba4e01
SHA1 27f6502c00a8ca938c0a92a6a7c5b0723bcabdbb
SHA512 e9075fed61b9b176f763263aa16d7d389fe07deeec0ad35b400999dc408a432328ad04fcebf3e94ba4e7a24fecd407d52675371c1a90323e4fd7600370c3237f
SSDEEP 786432:zHhs/c3vKdqlVmSmUGrXDjNtHAPldlxr5p6T/143HAiQ:Vs/c/y2qUGrTPHAP9xr35Q
TLSH
T1039733A42D76CF10F2D0D0E5E9FD1A9AC62B02830CAED47CDD4A6D525FE2D774CA4262
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SETUP_FILE_(PASS_KEY=9094).zip
- Size 39.2MB
- SHA256 906eb1f1a8d6f5d9b73f4ef418c5287e67ef30642d9083fb7c547b4034831096
- MD5 6da6d343a6adc8f554997caeb2ba4e01
- SHA1 27f6502c00a8ca938c0a92a6a7c5b0723bcabdbb
- SHA512 e9075fed61b9b176f763263aa16d7d389fe07deeec0ad35b400999dc408a432328ad04fcebf3e94ba4e7a24fecd407d52675371c1a90323e4fd7600370c3237f
- SSDEEP 786432:zHhs/c3vKdqlVmSmUGrXDjNtHAPldlxr5p6T/143HAiQ:Vs/c/y2qUGrTPHAP9xr35Q
- TLSH
  T1039733A42D76CF10F2D0D0E5E9FD1A9AC62B02830CAED47CDD4A6D525FE2D774CA4262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  PASS KEY.png
- Size 7KB
- SHA256 5e0c35885b633c2989a90c441d2192b74c18f1c255508ba62cf7d60ceeed65b3
- MD5 88f22867eeb56f65d89af2c31773831f
- SHA1 f9716dc3dbefed2f239d909d643012ab82331bc2
- SHA512 00482b4888b79d7f823b56dcd08322bc83050ad044f487bd9880169b7d5680bea54b9dab03999c09bbaa751b89b63c6b18c5afe47118e4e05e7990c2f74b08f4
- SSDEEP 96:T466JGU2BMzU+oofkvpLP5xDpvrRg/UojN6L17+hJaQqI0h6tzlj1h/ueFYkNC:T4668F8OTPDVtDojN6LYoI0h6Z/XSkNC
- TLSH
  T12EF10337E3218D81EB5DC520B7975FDFA19A814AF6F2CD02C554222870B0A186FBECD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  𝟎𝐏𝐄𝐍_𝐒𝐄𝐓𝐔𝐏.zip
- Size 39.2MB
- SHA256 4a93f0e0f9625f0a5061f28faa6d98e45e956073f925ec39257d3a8e3300c573
- MD5 5e89eb63a52aa48458b9332521d3e254
- SHA1 c234bd878165e575c441e0a0622e85111d797444
- SHA512 73ec953cb1eb55412c2b60b3b291f9afbcc087f90a0f0ae0697f425762459353ee1d7851829586e34c2a07a82b191c6bda60c48a4441bb0d41f8afc2a19bd5b4
- SSDEEP 786432:SHhs/c3vKdqlVmSmUGrXDjNtHAPldlxr5p6T/143HAi1:Ys/c/y2qUGrTPHAP9xr351
- TLSH
  T1A19733A42D76CF10F2D0D0E5E9FD1A9AC62B02830CAED47CDD4A6D525FE2D774CA4262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  SETUP.zip
- Size 40.2MB
- SHA256 82d1751826ee9b9914ba01955da3f573ea0cd1f90f8a0ed5e4a719a2d0be40d0
- MD5 c6c8e452c2dbbf2a5864bd0668318cfa
- SHA1 0c8ec0920f02820b5d2266e5fd7fe24e76ece4ec
- SHA512 7735caec63b4cbda217b3d0e1a9dbf44876ace96e295aab30151c2e9f183f4767a7f6cc33349737f131c2286fe07b7f489726471fec973e1b8949b46c459e408
- SSDEEP 786432:kTeAoLLBEpUT/vlmOhIrT1IrKJWuiJXXFLcJ:kyAoL9EiT/lIrTQWEqJ
- TLSH
  T1009733AC70F5B85EF5E0427BC6C52CF6DB3CA440D79A3D9B8D2081567E8310E5BBA861
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  BvWinFsp.dll
- Size 697KB
- SHA256 1a1414eab446493807b09a2e08ba806fb3fc91b5c1294af22c2b27f79ec3304c
- MD5 1e1a7988a711e9e53badd8d43a35e7fb
- SHA1 28cb2238afac182145cf74f17333c1030a0009d5
- SHA512 6d145039653c58d3377f739b0beae1c801d74430796017d3f67e79ba6ae64edecbce4f221837b83708b8d4c2df1b131e03cde3457d73fda8e143b6ebddfe1179
- SSDEEP 12288:nr0KJjKEQxJdSaC6SWO8beax65WGaUelZaEUpJf8zIb3uzXf9Ua:ngKpKEQxJcaC6SLl1o8Em/b3uzXfL
- TLSH
  T17DE4F192F785C7B5F1E3047EA9BD4FB21E3F2C344B2558DB5AA4292457706E2BA38301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  Scripts/Annual Sales.csx
- Size 1KB
- SHA256 d57d68d033b825e4351027630a48c706fd36f207a86c6d842599982c371b12d1
- MD5 740ea53e1c884ca48dae092ee19ad12a
- SHA1 3c0ce70e17e9bfdb79ce3aa5d57c1d455c371c38
- SHA512 1d47fde8a5fdce84d206d93177adacab3bf59310f54f1ac7d1ff135cb6e55a33d594c835de732448dcb8ca827264e571f4bd95c0b1b1932e73971eef23b96ad4
- TLSH
  T18D11E72CFAAE68E38630B1590833E0087AB5812C72B241A5715CFA171F844AEA781CF9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  Scripts/Customers Geographical Distribution.csx
- Size 1KB
- SHA256 2694b23f5f6a3a069b3b5359308b37a0af592f73e1fa80cb9153358f6a5f0cc4
- MD5 f4bf0da47e2792161832a122c1d01102
- SHA1 f69db663ddd20c3d5f758af2c8141245ddf88b23
- SHA512 6d7c362d196b6caf627fc3474004c1afbf11ac1d9ac9894f2509ff06ced51dcae7d41d8428ec428cc2a63f103064a26c0fc5eca4e552af52ff8296dfaafb33b1
- TLSH
  T10F41642CA2742A3B6DB32960AF2C4D49E9D2C21435459B0A78DCD2363B3C13CB5F5615
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  Scripts/DevExpress.XtraBars.v24.1.dll
- Size 6.7MB
- SHA256 bab7b5942077c56dfb40c470fc622fd1c64060590d831d7620efaeaaf0be3d36
- MD5 8f5eb699e675952c8a3d59c192f01dfa
- SHA1 5a9e7f7f7017114f575e76d66e4366f27d43a135
- SHA512 ff64fdd031c0e089dee470d34f6ec388f00a2b22a735bead3b469f2ad690bb83223aa4e1905be26e3b771c128d98d00b46a49a9a6989edb13995dc0fa6e5ef2e
- SSDEEP 196608:p9+2Ntz64j+vbWAOfraPnWAOfraPGWAOfraPg:6vbWAOfraPnWAOfraPGWAOfraPg
- TLSH
  T13F666B02676C9F3FC5AE023AB061165907F0D88A63D6EFA77645F4797CD27220E5323A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Scripts/DevExpress.XtraCharts.v24.1.Extensions.dll
- Size 40KB
- SHA256 95bbf3668a51689db3b2b697fdf1bac197290cfd161908af4ae83199c370d944
- MD5 8b18069e509132f2fd440a9137faa0e5
- SHA1 4566bf79df5584f449f55c4837b6e815612afa24
- SHA512 d14c17d9078799981332f3e5f564f00d81f273530e72c474f0107ec5d58784085b2f2b34d49074d894e13869b5b0009e6e9efd279cde2a5aa075f7f058869854
- SSDEEP 768:ZZHmlvlJFlSH+5jfpP0+uymqwTUA8g7qBUHsZi4Yi+DI2ENM:ZZHmlvlflS0b0qwwMfHUi47+kPM
- TLSH
  T173135D31A7684F35CA9F4E7AB4D1561143B1D5029992D3921FC2A2FB0B93B814F522FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Scripts/DevExpress.XtraCharts.v24.1.dll
- Size 5.2MB
- SHA256 f331e0a2efb8b219e4b66c1b5d2e23ee540add1543802be95d6bb0a0ec86e42d
- MD5 887556aa2a4c002a8213054b03af6710
- SHA1 b67090c86ea3102fcbdf24c3df8e86b18d201b3a
- SHA512 e46c04d01169e0a73a130cd23d556507d094b41cd5333340a018a7f3da74d3da7cb031d434a345d2da415d1946b6a3da65abb65323fe206cd4ba545ea5715d42
- SSDEEP 49152:+nVO+fTJS+KJUanEMcEDp5k+B23zpeb5QCZe36geyCn0lKm+fq:Z+L5Ki5mwlKm+fq
- TLSH
  T14C463BA5E7E85B5DE0BF0B7194321212A6B1F8879BA2C34F3355607D2D22F518E23736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Scripts/Montly Sales.csx
- Size 3KB
- SHA256 a79f72d5ed3c2da9587b9b71385b3594c2908006b60072fd8c41b4ab81c5fae1
- MD5 834c5dbd91500efa7bd1b9dd1498bec1
- SHA1 2fef095d99b6aab20a7603571fb85362a62da05e
- SHA512 b3ba51229b056c03f6c1cea23752ac4e4d6d7cad771db37635c6d6cf2487e3c8f7e133a6a6dca39a717888559ec7a2af41ff3bc056a252f91552b9974bc82e95
- TLSH
  T184511E21E8582093C5761138E1F3CAADEABB03B6713755F4B84CDA212FB4864D574DBB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  Scripts/Order License.csx
- Size 1KB
- SHA256 06e0a63b741caf598fc2d8dcc49e12ead8e9feee9ff6ba35ae4c0b339bd510ca
- MD5 5fe91241c7b080f7578474d04adbf08c
- SHA1 ebffeeec5160d8624ad13c29de952ea9c9fa224d
- SHA512 b86450c4ce8a51471ca092ecf30ea738d039a87c964c44c1226b8f29ee278cbaf409cf11cbd96cec81fd40097a03d29370c4da586c6e3fb77c53796e001935e0
- TLSH
  T1A321FD43B80E11633DF341B82E4B498EF8A6521A8C6C4691B86DC6166F7402D7BE4A38
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12
- Target
  Scripts/Sales Comparison.csx
- Size 2KB
- SHA256 4c9de9483ac2e7465060e3f0e490f804451ae4112877042d7f6869b21c26bd3b
- MD5 a5204d800d9564379a60cd3e1f452e9b
- SHA1 4fb49fa65c67276d252cdf996c4ae3244c6804c9
- SHA512 e62320cf1f24d8bca596dc6d3c085917c92f21ee4131eea73e73be3670d5878256e0b7f87b1007f0dd6b29bfa8d5914abe06affd6a5827df828ba0ecef56261d
- TLSH
  T17F510D3AB3F9549E57362454AF23631D69E083A86ADD8561345EEE4E38C4CEB030DBF4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  Scripts/Sold Licenses.csx
- Size 1KB
- SHA256 145d857afd4b46b09923571c48753b94796dc1118ff7a3e06a818c260afb7706
- MD5 90a41b24a8367e4e0cd7491adf80399b
- SHA1 b5bf59dc1daa668591e4f8672c39393ec85f5af5
- SHA512 0ee9b4618081f4a93cc9a6b6d83bb7d97bc9cfd5fd7b3ac51d7e78b7ccdc8dbafaf9f86ccffabe3fc2b546de53246a0599012f8f7161a46d48f6d5c06913559e
- TLSH
  T1F031345CED6502E4C8B4619CAC6A080FAB7212506676E1E7F59DC42132658ECD7D0F3D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  Setu.exe
- Size 100KB
- SHA256 bc1893c4977c92d72baa4d381be2398770b5318ac21b58de0b559eda9c941885
- MD5 d1563f2218ce7e739e4ed009c5aa066a
- SHA1 56f541256111c2c568db1cfca8d20e3a32314963
- SHA512 bb826b5cca192c1909a72e4e77c064ee4825ed868c25af7ac67d4883487b784e4dc9ed453e189a375d035ad8db9d9d07d29f6ecb119f5a2329d1b2c4392d9698
- SSDEEP 1536:pHeCIxHHWMpdPa5wiE21M8kJIGFvb1Cw7/c4s+yKfm2f9yfIYFu:p+BwMpdCq/IM8uIGfp/c4sqbt
- TLSH
  T146A3E641E62DBDCDE108D4314A75D4F25E24EC722684A59FA7F37F4628312D3FA1A83A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral15
- Target
  e_sqlite3.dll
- Size 1.2MB
- SHA256 ee41cedac2d2833c4c87512919fb9491aa93935ac9c6291fb55f298070dd775d
- MD5 205ecc6a1b3bf5c7542c66539c599cbf
- SHA1 4a92477c08ebed8ffae3c7940f6f8d41f0d71e6d
- SHA512 ebc4ef5fc48baf570732456575af86ae3a8ca030d0c9e39b1247992fcaca23348573e22f35a0bb54da1a46a79dc531072b7bec9a7f36347351bcd3bd5ee0531c
- SSDEEP 24576:UBYxofSecbS9XQg1oPjeDU+PbDIjgTZpCS+Lez82ZUCm99lkrK5TY91w:UBYeXug4cXIjA82y5TY9y
- TLSH
  T187457C93F980C035F6D701B2C3FA1EF56E291258173918D781956CE89A209E3B77EB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  python315.dll
- Size 831.8MB
- SHA256 38e8b6a1844e10d677a40b67183575f6bc2cb3e10ed779a537d148c3e12f8c3b
- MD5 5924eed7cce886b956a1718aba2d1e35
- SHA1 48fb99e68ba308d31f7e60c50b147002d0e3686f
- SHA512 4ea3c1e8eff71751c840025a5b08439814d673dab923caf725ca14c7982726014b649febad2c59eef1b8c8c929fc6e76f8415127c44b4d0180692721281710be
- SSDEEP 393216:ZDJeQivwm4RV33EAq37BS87hro3FZCiZ/GSPxW21r55gp/N0:ZDmv433EfnrATCiAyxW0
- TLSH
  T167999D237245816FC46A753980638AD498F66F226732BCFB36AD34188F731C05EFE656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  runtimes/win-arm/native/Microsoft.Data.SqlClient.SNI.dll
- Size 373KB
- SHA256 8bfa7bb0abf2cd25b09fc28839c7265f66f29c5d9ce8ded61c27500c471a2056
- MD5 cfb42f41917bee60d65696857454280e
- SHA1 ad46e0f8739c341b785655c90f6f0f7fa894e189
- SHA512 6ff23614fd490a81ce3dfab3fcfd276fa12e9efbdef8fe362203dcfa6f8d99d49de3a151bc4988636d075d7ba2d641fa753fbb3c12ef24c8d51f7f0affc382a0
- SSDEEP 6144:pR7/5wAQ+IwC7JB3m6PQhlfJx7BPY+RA9eV2r:PD5wAJIwC7JB3V2FVPje9eVc
- TLSH
  T14484AD69FEDC2B36D6DE0E3474BA81DC7B29BE352F60515A325500FD2CA39818D34B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  runtimes/win-arm/native/e_sqlite3.dll
- Size 1.1MB
- SHA256 6098739e729776b9a221e4266fd9b43fb8b04013fd2dff23b617d3202eafae38
- MD5 b3d162b1b8d90a662b1aeebceb37823e
- SHA1 a8577c057f01e2f9c9b60bfff3db7b33789a427f
- SHA512 fad3585515a1e73e5379423586e9ea9e5f0e49e4a79ede68af160b5cf7b64b21e57c5643d86d4be3188474ecf665a2d6f6a911ff66907a616d3d8e76c97cab7a
- SSDEEP 24576:+po2Ihnr451XchrBTDxKjTJy7cR4bnyc:u7In0CdTDsjdQb
- TLSH
  T16D45CF83CFD9B751C58D22FDB413E1CA4FD8FE2630B9E4195B3A90B97927810CA72619
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  runtimes/win-arm64/native/Microsoft.Data.SqlClient.SNI.dll
- Size 480KB
- SHA256 2740424b9217b5fb95f76f658e3f5b0d8a8b511608f21e89e7e871a97d0c333a
- MD5 cfac33a1c499aa6003d6cf32e6875451
- SHA1 2629ae704c1c6bf33ceff4eaa44866e6a4d29005
- SHA512 bb94f2498ff550f8cf02018586c198835da065bba3df1e1306cdc0c653d326ccd0fd7c15286044a09c62824ff8ed4233bdc0bc1d551d440dc0e0db7e3d4b38fe
- SSDEEP 12288:qtaTA72UZeG1CEgbIh+ITMQ1TDQhSPGh8+MdEb2bIBm:Ct72UNX+ODQhZ89bIBm
- TLSH
  T140A46DA57B8FA5AAD2D15B3CDC2B0A10347A7AAC4F34C1CB3282114DC95EBD4C9A1773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  runtimes/win-arm64/native/e_sqlite3.dll
- Size 1.4MB
- SHA256 a56e35d6abac40a657e0445be007f6479b16b4f0566ca7b0b9a3e0794e87a969
- MD5 bf92c764a6037ac02d29f5a09a6ad939
- SHA1 24e8d09c68878dc199ba9b6a4cb79140e9ab07b2
- SHA512 1827106f4c88a2dc1fac8625447ec293c420e3a503dd95c4bbeca8041682105c49a9aee1a9788561e1c9512103e6d878c5b7f51eaba02b5966248781a31152be
- SSDEEP 24576:zpLxnqb281WFm8Mwc/1VjI21ZDSlVgCa4/2e:7nqdUMwc/7jBrDSlex
- TLSH
  T160658D52FA0E6C52E7C7E3BCDF968F60301FB574802588A6A153418CEC95FD4D6F62A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  runtimes/win-arm64/native/sni.dll
- Size 170KB
- SHA256 ef18458c4dcb93f6b4eac07e1589cf3450bf878f2dd623f5d34f6a0f1b16e57a
- MD5 167136d7a81bcc85acf4930aa7ac835f
- SHA1 1e70240cc820796e78d77b1219291eee2fb6dbe0
- SHA512 2c084142e09ae1b850f8550a55142fbbf996f3dfb122bbcad4fffc11a6fdc5417d623683f383c4ac4a35e46ea0d441d82588231093f179ff4601cc598a1c8896
- SSDEEP 3072:qr+JSpYKCkNH8TTTwSLTVgK1Th33HwfkoN:q6ZoHgPwSLSKhHZoN
- TLSH
  T1270419456EDC6842E1E2EB34D9A64F61613FB6B4CB36460EB132437D9DA77E0CE60212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  runtimes/win-x64/native/Microsoft.Data.SqlClient.SNI.dll
- Size 493KB
- SHA256 57adb08fde97d32a68d30c37e5c68b8cdd19b52eb4100043dffd16acdc1495de
- MD5 b542298fba40c470eb1c566718dd4171
- SHA1 6080b8dd8ac857571b11c9545ef760a8b7f229d6
- SHA512 f1b2b5e19afbba89c937a0d27981da6f14c69deba05a4656eaaebc23a25db657ab896e4d55edaa0f90fd799d898ff0003c4782be1ae7eee97569cc131ca71f29
- SSDEEP 6144:/w5F6ysRXGXoZ0v/SqPhsXpgWo8E4UYGV2Es0v8BENMsNIm:Y5UhR0v/SqJsi8E4UYA5sqt
- TLSH
  T1E7B44B38BEA152F8D03FF67488B75941FE7079801279929F46E489A50F7E7B0653EB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  runtimes/win-x64/native/e_sqlite3.dll
- Size 1.6MB
- SHA256 dccbabb2bc7e7d4302c44d9ce41b70721a7d0914fa4d289e2f340d39766ad102
- MD5 d93fc939cf4c875fc065c37e771da367
- SHA1 5a035170e758c13913a41cc427de556485c5ef5d
- SHA512 e442dc97c14522e675067a85589698b657b43aeff91bbd75efc2db8fd7bbd0c5939dece270eb0fc4c108113b1246ce7268f8f38fd63c754f364d19dec40551e2
- SSDEEP 49152:KFpe/1CmBo+xp1cXQDd7H7GZjAkjDOnDuQ+7X:7JhcXQD1GZjAkjixi
- TLSH
  T1BA758D47A7B900ACD8A7C27885179707D7F170051764ABEB55A08AA92F23FF61F7A330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  runtimes/win-x64/native/sni.dll
- Size 156KB
- SHA256 68705c4ef9ab818f2956a78e05f3fefce501a1448793b073b46110beb49b47d6
- MD5 7f1799b65b98450a19e4d049e9d3e70d
- SHA1 ec80c5a33374423a9e986c383a36a97da70a3584
- SHA512 8d67297c5cded487c88fcaad5a36e80926dad8f1863e38f397751056f51258ac7b5a9e5c09c01bba7a224f38fb2ee719586faf0ba81516e05a19649eb09e7b78
- SSDEEP 3072:zGaHqhU3X+sWqpyojzXVgO/U9SS2PCKPZteYlbLUrHeUJcJnWMROkIvNHc:znHSK+svytSS2PzbeYlbLk0n+Hc
- TLSH
  T196F35B167BB840B6E5B69234C5A74A56FB72B8511F3183CF03A9836D1F237D1AE39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  runtimes/win-x86/native/Microsoft.Data.SqlClient.SNI.dll
- Size 404KB
- SHA256 06ef300bf9f164019abd930f03064e2e380ce9ba25ffdde35c64c6b54daaccb5
- MD5 a09f8fc602d5e5e66ccb4d27437bcc6f
- SHA1 5e443df355a5ffdf5195613edd5d7854e0f2eba6
- SHA512 e33e646f00b3ce994b071e9c6d94e7d6b42eb6180e4b8c753cd27024492e5336628b28edb7149f3a7d69e5cc5abc0e2fb3c6ad0ec25fca04445f43800fc8433a
- SSDEEP 12288:wfcjl0FEgFrywNFYGtGN5Ziy2JYCbBhYJ4E:wfcjl0BywNFYGtGN5Zd2J9bTm4E
- TLSH
  T142945A75FC804037FA7A25B5B1656EE1947CBD208E37588BE7EC0586BE329C1B635B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  runtimes/win-x86/native/e_sqlite3.dll
- Size 1.2MB
- SHA256 f80d5f5de3f7a82e684229028b946f6efa1682d27ec960ef18518542fd12a407
- MD5 6fc560f5084a8b7fb99840a6fd356170
- SHA1 20d995c43cc5d163df5e622e894c04cda45165bd
- SHA512 b43222804c82f094951d01a38046c8b2f441e11d9074f55165d1b1ab1799165f7b8b095c9768b7e27723e009d1f31e364d5683c95f86930a15e5e3cf6bfa99da
- SSDEEP 24576:YQkYN8p0eW1+PjPJ8XLSq6BKTqzBdZardT1ciWQtLRU0e6KXTeIJ:YQ1L1MPK9tqVkFAJJXTZJ
- TLSH
  T1B9559E23F945C011F4E902B293FE1BF55E395228573A48E756D05DA89E20AE3773EB0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  runtimes/win-x86/native/sni.dll
- Size 133KB
- SHA256 1446d6b26da49a5a9f366972f89f4e236f916955f31ddc38ebb96217c1cace9c
- MD5 c62a83f20bc23aeface70ec13003c4c5
- SHA1 35553cfcdcbeccdc49710e68aec495c16880f0bd
- SHA512 4dda44fd5b538f5da9e8cb46a3ab1bdc14b43425b9a61249eccc925d986af7b8b3548db9490238f14807909ecf479415117141ddb344119438a59f97e894ea37
- SSDEEP 3072:H3SGhrfrdqCn3bctzdGRX18u5e++dowahamD5/f+vHPoW:H3SGhbBqCnmzERyiepSUm9moW
- TLSH
  T155D36C0179A48032E1F7163E057AA952657B7AB08F705ACF3BB04AED29743D1AB31373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  x64/Babel Blue.zip
- Size 173KB
- SHA256 ec49580378ba302d7232c0f4cbde453f8eae2a2a24d5aac8c1cfd9927a7a7c1d
- MD5 2b92968e535b6933b2193f8c4a7dbe96
- SHA1 6575ad148e71a3cf0c291269472b5ac5961d7b76
- SHA512 5b81131acf3f13737f50d5640820293ed8f59cf764a88da88044a840d0eced8ec6b414c493eb659506804b2438702913f27ca225fb7c235d9b537bb83b3cfdaa
- SSDEEP 3072:cEjDtiOWnGxTxW0gQUBjko5JXUTv6vnrZ8O29APZx+g6A+I47l/ITaC:LDttWejgRBj8v6vc9685i
- TLSH
  T1D804CF17E8B57423D247E232B061C66FB459034F5A49922BFF4C8C94AC837E99B4A74F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  x64/Babel Dark.zip
- Size 173KB
- SHA256 c567c5920823fe931bc4895e8de4dea515e21984472a0125fb0ca4c76d20f88b
- MD5 d59779332bc4914c441a69e7d4cf7a6e
- SHA1 80092c516283a70a2b0249e358e6c1f48ea0d375
- SHA512 6e2b5bc7cd55f5d403e6e69b529b38a11ed74488dfd58361db7182a866d5be21eb788733c89add63d6432b829b8278a49df3f5b40534e4f05e25348080463610
- SSDEEP 3072:cEjEWvaTDHC5uAQjgE6777WXUlv6IPlB2oz0o4CYTepcizuf8A+c4bVu:LEWiv31gd777dv6IdBTQoOLm4
- TLSH
  T15B04CF23E9B47423C54BE272F061CAAEB145034B5944A31BFB5C8C85AC977F99A4A70F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  x64/Babel Light.zip
- Size 174KB
- SHA256 b9774af7fc0e50a22f58837849bafbcae4b911f9723abf2d099a4baa75f9d1b6
- MD5 09e9c6171c7379e476a091623f50c211
- SHA1 8a8b44bcfe6361f590775590dfc78da580aac1de
- SHA512 33956fa1fd51f19d8168b82227edf827a3009b55c70faa65453f3550b4512e7bd0b3ba2fa02250021d73e808d2f7d10422181f1cc53ff117f308fbc308a7c4b5
- SSDEEP 3072:zZ99IcJsiVYyIxe/QRVRJcMVbcQW1oJChx1MrgLc1UXztb7H4AYqmyxZ:zZ9Ccx2xhRqM3FCv1Mco1UDZHBY6
- TLSH
  T14004DF27E9B57893D5479272F021CA5FB25A034B1686A35BFB1CDC406C877E84B4A38F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  x64/Babel.zip
- Size 173KB
- SHA256 e5204b5d1ca73357afc0c9ebbe1afacf2b01d0836d86ddc0278f2b4585144da1
- MD5 bd153cafb60744c54cf5d57fb821dcd9
- SHA1 b8500769757e179b26ed144cf967ff997ef5a8b9
- SHA512 5ad852652d3567fd6a316aa43869bd45897167afc9623b940273e5897e5e299b930871286e8487a92b503f04ba59865669c0965f64cce6d991dc327f619fa8f0
- SSDEEP 3072:cEjcWGTPWo52b+ybdFsUXUBv6y+4iP4fqo9hqBxSA+2vb7H4d3u:LcWGx5nybzCv6yBVhe/HH
- TLSH
  T1F604CF17E9B87823D546A672F051C6AFB599034F5A44932BFB0C9C54AC833E89B4E70F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Badlisted process makes network request

Reads user/profile data of local email clients

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32