5800ab8d951273d64c3d7843dc0b499a144bed21ebcd9e01e1110dd4e8be2d0d

Sharing

Copy URL Twitter E-mail

General

Target
UnionCrax.Direct.Setup.2.7.3.exe
Size 108.2MB
Sample260705-lpc59sbv4y
SHA256 5800ab8d951273d64c3d7843dc0b499a144bed21ebcd9e01e1110dd4e8be2d0d
MD5 f44c81f0f2d3fedd91e17f0b019ed670
SHA1 c7fce7e6e5d1ed6295949e6caf8bc2507ba3213a
SHA512 987caabd891589917ddff840bf9a94a7389c368836be0803ed686db8ac73c89421af9f809da995ef86731d5767bdb61eaab40ac86cab50ed43ff37d6c0e73a97
SSDEEP 1572864:1r2/fjE1pY8eK1Rkbf2YVivcsM7VmNhzRw5UCD5EUjQoaHc2i0Ul80dTOQcelKwL:1oERxcsMBghie/oa3UBrcelKjfI
TLSH
T15E483308741484F2E356A7767BF5B033A5172A0A2B6A08C4E36D7095F9BD0EBD0764BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  UnionCrax.Direct.Setup.2.7.3.exe
- Size 108.2MB
- SHA256 5800ab8d951273d64c3d7843dc0b499a144bed21ebcd9e01e1110dd4e8be2d0d
- MD5 f44c81f0f2d3fedd91e17f0b019ed670
- SHA1 c7fce7e6e5d1ed6295949e6caf8bc2507ba3213a
- SHA512 987caabd891589917ddff840bf9a94a7389c368836be0803ed686db8ac73c89421af9f809da995ef86731d5767bdb61eaab40ac86cab50ed43ff37d6c0e73a97
- SSDEEP 1572864:1r2/fjE1pY8eK1Rkbf2YVivcsM7VmNhzRw5UCD5EUjQoaHc2i0Ul80dTOQcelKwL:1oERxcsMBghie/oa3UBrcelKjfI
- TLSH
  T15E483308741484F2E356A7767BF5B033A5172A0A2B6A08C4E36D7095F9BD0EBD0764BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/SDL2.dll
- Size 1.6MB
- SHA256 85cc7fd5ccc36b2120ce8cec484a6d5cb09b35563d2f18856b0dbb84f21f3404
- MD5 1ece37a8889db2994b8701f1ccd58d99
- SHA1 008c3531a1b9b5585a2284567f2ca78f9ef8cc4d
- SHA512 1cd2038d91ff39f2e48ac719dffc7013483bdfe8ac5d6c85eb784ee9559a25871a3b1c8075c75ac110ef51b093f1303dd5a5c0092e570bc0d151461080ea5486
- SSDEEP 24576:Qz/SjOPr4yBPARgQne5BIEmz1l3dknUqfPI+6Cmmpd75+8ZhzpR4e8Y:uSCPr4yB5QyIEKltCUQ76Cmmpd7CBY
- TLSH
  T1DF759D0FB3E605A8CD2740B9C697B61BD675B8082BC467CF265407E92E33BE1167E760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/assets/bin/aria2/linux-x64/aria2c
- Size 13.4MB
- SHA256 80e577dc58348b96da46dd12d326bc99794b5021be395a3e890f2d67c8790c22
- MD5 3a62509bec435189ba8e2a4654722298
- SHA1 b927d1dc807e49e2c91310c134c80f02614118d8
- SHA512 1fe1bb7bdeecce65c17d31459cf75bf852576e9022eb9c51114bd1bea8095b0a44acc03970cae2da80b44c4c0b80faa1da82ecf10a083ec5710995a7b44b5825
- SSDEEP 98304:VSoBAUZLb1+FlkDo8pNdjz0P2BQWxql6rd5mEoQ6tSBk73SGd:VSoVlTLeLlcXmEa37
- TLSH
  T17EE64CB27671D06DD04BC1F43A8F95E3ED08B47003A52457279ABE263F29D600FAD6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app.asar.unpacked/assets/bin/aria2/win32-x64/aria2c.exe
- Size 7.7MB
- SHA256 34f6eaf2c6c50bfe98ec6ec9a0ecca38b63e8c8aa94d3e7e5fa06a57ff7705c4
- MD5 292a9e42aae96060fea204fdeceea32f
- SHA1 67a7cd53916aa134a4550df7b2621af70948283f
- SHA512 545f84a14cc62017ec68f59064b5d61dad7985c483b16ea7a2fb934c8f28a53115672ded5b9d8239a3cdadb8292d98ebd821638257510cee72b608f917b25905
- SSDEEP 98304:N/uPsJHBo3qkBKKKWgnxT7klqdCKql398e/oIjgACdAM9FF+kl9+HPBOf5vl820d:tX9Bo3qkexTlejgH44vl8Ng20ZM
- TLSH
  T1C1863A17E2A310ECC66BC170876BA773B631F8691530AE7F7558DB341F21E601A6EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/electron/native/build/Release/uc_overlay_native.node
- Size 216KB
- SHA256 31262120fe5ca1a760062820340224e14c773f164b6ca22ac48f8f57dded2024
- MD5 2343df1a891120708dbdb808ff011aa4
- SHA1 91740612a36b50837a146cb174f412a6527d8638
- SHA512 07aaf8a59b7bf2269a07b10dbcc38ae93daa51f9fc063fe664349673dc1a82c39efc2a4aef718c9bfd1fada272f22fd27767f052bc10215a352ea26d3f58605e
- SSDEEP 3072:zeM9Gvz1OuhzuJtTdL7s3Sugus1UjFNK/QY0K5pVkl8GyJHQdBnx7K:M5z+dnsTts1O4QPUzaN
- TLSH
  T14A246C1BA7A105B9DE778139CE938D41E672780143A0E6DF475006B6AF6F7E09A3E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/7x.sh
- Size 235B
- SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
- MD5 8a65a1ab93601ddecb93af2a310dd68b
- SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
- SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
- TLSH
  T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral18 behavioral19 behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
- MD5 9fe8a485038be54d687ad7dd9dff80d3
- SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
- SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
- TLSH
  T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm/7za
- Size 983KB
- SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
- MD5 601642dc448c3b398e92ec0d19e447a1
- SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
- SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
- SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
- TLSH
  T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral24
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm64/7za
- Size 1.1MB
- SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
- MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
- SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
- SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
- SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
- TLSH
  T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/ia32/7za
- Size 1.6MB
- SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
- MD5 dba8ad5c0f1a27e9e387817df9ceebbd
- SHA1 33b7ae00c218a250c30588fa134dc9946665147b
- SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
- SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
- TLSH
  T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/7za
- Size 1.4MB
- SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
- MD5 6a2e4039a2f56265369f22ecb1a19fd5
- SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
- SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
- SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
- TLSH
  T146657C43F9B6547DCE9AC775821E9232F678F44906309F37B284EB302A52E60DF69B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
- Size 266B
- SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
- MD5 08025b57ddf3df9bc3e2844d86e4135f
- SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
- SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
- TLSH
  T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32