13d3e0a229443b643c683de1615456ace7632f4d801b62720a9390ad953f8c80

Sharing

Copy URL Twitter E-mail

General

Target
tor-browser-windows-x86_64-portable-15.0.17 (1).exe
Size 108.2MB
Sample260706-1eptmshs4r
SHA256 13d3e0a229443b643c683de1615456ace7632f4d801b62720a9390ad953f8c80
MD5 8c43c5dde5efcca22e4ecfb0705bcbad
SHA1 681c094ad2121b7c0f41ba9b8ee013aa4cf9d840
SHA512 827e4cc1bdc849f0c80af4115715d28355bbcefaddc7ca5cf98199e74eaf45183ddb64d5e7b7409a9b55c0994065d9c9e8f638e1d8923641f7240b05cf761e13
SSDEEP 3145728:zNhAMDxHpxb1CLQoTlTVAJ0VcBJkXwI7dGoXpyu:phpxb1aQuT60V8NIxl
TLSH
T19F4833A448FA52E8CC8718B5D71533506B762EFAC36C9E830D767BA41D28E5F3A3158C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  tor-browser-windows-x86_64-portable-15.0.17 (1).exe
- Size 108.2MB
- SHA256 13d3e0a229443b643c683de1615456ace7632f4d801b62720a9390ad953f8c80
- MD5 8c43c5dde5efcca22e4ecfb0705bcbad
- SHA1 681c094ad2121b7c0f41ba9b8ee013aa4cf9d840
- SHA512 827e4cc1bdc849f0c80af4115715d28355bbcefaddc7ca5cf98199e74eaf45183ddb64d5e7b7409a9b55c0994065d9c9e8f638e1d8923641f7240b05cf761e13
- SSDEEP 3145728:zNhAMDxHpxb1CLQoTlTVAJ0VcBJkXwI7dGoXpyu:phpxb1aQuT60V8NIxl
- TLSH
  T19F4833A448FA52E8CC8718B5D71533506B762EFAC36C9E830D767BA41D28E5F3A3158C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 7KB
- SHA256 b797e5a7de359c0c934cddef8e9d3a78e6d3d68e6ac83d2ddad915770cbace53
- MD5 48125e63f130d69025cd2bbf9f3b0c4b
- SHA1 e3923a75ed00cc53e2f0b3c1843598c7c1ede79f
- SHA512 5b411fc88035eafee2eed3c4e1b8c14fdb09ed09ca275ec1492d7a72dcf9cf55719dc34e63c00ca64162a455339658efc958dd2abb6dfe8a363f2f24ff3bd5be
- SSDEEP 96:BLIwtgI+Wdk6guTxZlx3ojaVgmR6wP3LtrlKVNtEc+InoAhrEoUK3EMbqKh:J89uTvlx4jhaX3Lt/ch4oZ3x
- TLSH
  T1B5F1C70E6AC010BCFD6FC23A8D3A42157BA1F521076568DF269321553EE4FE76E356C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 23KB
- SHA256 4bc489ab81c6f1d7e9cc6c2e8a3157183e7b0ee5199b4c6e8044aa32da2dea1b
- MD5 8213548feab7394279d2712fc12126f5
- SHA1 1ada5c813c36c66789b256da1ccacd9b85a97b4f
- SHA512 3b5f96cca356bbac7a87bd2695e1b95b1c8fb6c3f059e8a9ac11724708c8aaad4f7e3e404a9be1c7354b03414b18123916c2b4772ceb033a91a8c48ee724e2a8
- SSDEEP 384:ecybqzYqKbo39DihgonO/U1j/HCD3Zn/MUcD9RSSvUW6OEY3yW:lybqzfko39D6gUOMhKD3ZnkjRSSJ6O
- TLSH
  T1DAB23C0B3AE5047DE446C13EE6671226F6B27C412B11E4DF2761B13A3E75BF01B39698
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 13KB
- SHA256 7ecc85cfcc4bde6146ed8e0067341b1a56306f94893702ee772bda8725712aeb
- MD5 ff6b5961a43ba8c36434c9e707d4e6a8
- SHA1 f73efb0ad4f4e9f5c716df5168f4168c2cb01ad9
- SHA512 fc1da79bd1725e240f0eb259e2ae7cdd976e33f8c9b64083c9420d9a64aa2bde9251294d8cfeb70e5b93d73517c26594c04c8ebba80d9529235b02d52b0a72b3
- SSDEEP 192:hVoR5bH/o9gAXCI6KW0fnFdFlCaYQZUhU+Cg8++9KdYI:hVQZ/omAh6uvLFlZX++9Kd3
- TLSH
  T1C252D7132AC100A9FC5BC17B99BB55228ED5F6100B5131DF026662463D72FE57B3D9EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Browser/AccessibleMarshal.dll
- Size 23KB
- SHA256 c7bc60ff05604990cd4d8d11d6ba647d8c45fe78eefa7f8897a054ce7b22a576
- MD5 25398b7b252792db03cafee093840cc0
- SHA1 da55244e46a99bfbb2a9de2f9754c822202fde27
- SHA512 f6f108916364646d6352fb84dbc016004e62cddada4f633f90c62c886d17cf338b05f0dd3cdd22fa4f961048e4a2efa6c6541bb266ef039393a7286970e0f0e3
- SSDEEP 384:sp/0aUbxNaFr/JO4UOA54yvtmMdfjuycDiekYES:E/oUFr/JO4UOmLhj2DF
- TLSH
  T1BCB2B486B741C469D42A81359CA78BB6AA71FD045F6287E733C1333E0D36BD4AF319A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5
- Target
  Browser/TorBrowser/Tor/PluggableTransports/conjure-client.exe
- Size 12.5MB
- SHA256 943073ac504bc19bf9050d2e91507bff998cf1b5e447d9e84411482a565280d8
- MD5 5647c942568890b8de22bf90b53b43c4
- SHA1 8238979b9ee592c17c6f582eff871925d534f0c9
- SHA512 5ed85647334afb49af32fda28213d802779421f60e7aa2406fa507bfcc31a94235e219ebb946ee55b80702524f6a08bbf139b50570a9c9bde6b896212b965b44
- SSDEEP 98304:GWn4mJILa/P2fBQy5sbrDyF7f19n2dTdwyykPD69c+3E1/1zE:G+Fhn2ZQy2DyFj192dayykX/K
- TLSH
  T16DD64A43E8B505E8C5E9D1308A66A2137B717C494F3563D72BA0F7282F36BD0AEB9750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Browser/TorBrowser/Tor/PluggableTransports/lyrebird.exe
- Size 17.1MB
- SHA256 4ca75f4de6cdf36781547b5415b84911576a8c080ef1543107d2942522a4d1e9
- MD5 3c3eb38accbf0fba59cc66bdd3c806bc
- SHA1 ca2643eb00c192a90ad07f6d5d217d67ce34b384
- SHA512 3260cfd7637a3bd7e51a984301696773e6a86dee86127bd7d51305cdc67d8c6882bb9e7d465405703454548541fcdc7841f1580510da2194a5a26a4e29c7708d
- SSDEEP 98304:jhQpqG9+1DktLs7v5oTiETk/6rpyH8Wo3+MdrmWNea9ykh5QqkfxFT/MwJq452/j:jj/1Dkt47vTVH893ddqk9ykcrYVn
- TLSH
  T178076C57E86501E8D1ADD570C5669223BB707C898B3223D72B60F7642F32BD0AFB9760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Browser/TorBrowser/Tor/tor.exe
- Size 9.7MB
- SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
- MD5 93110c343a740fca8e64cfe00472c527
- SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
- SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
- SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
- TLSH
  T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

suricata
- Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
  Network activity triggered a Suricata alert
  suricata
behavioral8
- Target
  chrome/devtools/modules/devtools/client/aboutdebugging/src/components/ProfilerDialog.js
- Size 5KB
- SHA256 5f4297d6d9e77eb776ba8d92361729a14d139171e8b13575ae86c69875e49d8e
- MD5 3ab039b231af10689f09358a1856396b
- SHA1 39e98f86438840b0e8673e13eb93b1f789293329
- SHA512 9b4bf22dc69ad8d6e3cdfd49dae97f1f748487e40b0156d9b3f7813bd826804fc02388d0ff3f1a2fa4b63c65f98402b5cd4d25fed3a6cb59598332dabe36f4ee
- SSDEEP 96:AX5sckIePf4O3QveQrhfJxCrhpec8I6SiJe+656g1Hw6T6STj6J6z6w6r656C68K:AJhaf4O3TavQsc83MjIgpRrS
- TLSH
  T173B1441339FE202663333DA8B2D79941B1120C5B741AA8447DED415CAFD752C56FF2AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  chrome/devtools/modules/devtools/client/aboutdebugging/src/components/RuntimeActions.js
- Size 2KB
- SHA256 9c65a38ef3610c7c1a4c1630af1a1a4cb017ec6b47ecc4ed3c7a78b3e9a5a85f
- MD5 b177b3b62a0c266553f15145c06e0b3d
- SHA1 e1edf0fdc5c5fa15c9d40d7626fffcfaaea6b1df
- SHA512 2dd7f1316a5f21afd2898f934721507bf12021fd246bd3413bd997a47823eae87f8a643e38112ad103814050f7dd0cf4f5a24c233fc990bf47222262876dc1e6
- TLSH
  T1F05132A539E1743502171A91E3A3D881F1A3E8573417B404FEAC80B84FEA0FC12BE7CA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  chrome/devtools/modules/devtools/client/aboutdebugging/src/components/RuntimeInfo.js
- Size 2KB
- SHA256 58a5c947f62629a4b61c8bdf79d80371b78fb009cdfd5d72261ed824e123cb2f
- MD5 16de6b4a02642b301deb9901f543c25e
- SHA1 ffc4a6b8c0f7c3309cf42de65d13e8664147272f
- SHA512 d66388371c39d83596a496231acc176624e5f40a927e88886c44bcc32a04c43869847df0b48afe949e1a60ac65eabe628dad5b55ff9039c5fb1ade73cd2bf575
- TLSH
  T1A151F0597DF19832225317A2D737A5C1F351948B5D26B858FEFC40B40F8E16C8639399
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  chrome/devtools/modules/devtools/client/aboutdebugging/src/components/RuntimePage.js
- Size 10KB
- SHA256 6b1cf1dd7bcac7cd1438f1d2b612cf4cf0eedd4e7abf5d78a319517abd4adc6d
- MD5 1909bf4b3c89b96a6ec35c6b17b6aa8e
- SHA1 e4f600e7987b02acff8088bfcc1096b1e44b57b8
- SHA512 1bbd7e0880b595c5b296166e02ab2ebb2b70f911226eeee4e581c38b51f0def07553304be982db2c3f7475c7ccf2f7ec1e35a3e85c552fea297e86dd2feeec66
- SSDEEP 192:AJI95ts+s32OMLVnJQEKngFvDbMD5CQECXuUO7vZn5C6g5TbT57M5Ra5w855r5qq:8dcVnJCUDMU5lg5TbT57M5Ra5w855r5d
- TLSH
  T1CE3232003BC8746956EEA263DF73CA80D292A44B1C467404FEDE42A80F5B5BC637EB57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  chrome/devtools/modules/devtools/client/aboutdebugging/src/components/ServiceWorkersWarning.js
- Size 1KB
- SHA256 b34dadab55c6723e7428f34663c4e6f2c4d19a3a1439789e498df0038e893ac6
- MD5 aeef6741bf18a60372aaf9680cfd783b
- SHA1 d4f7c33c5ba9a21fb4e13bf34aa48c02d930dfa3
- SHA512 989af3a2171345865cd8dcb1b14f1a26b4e2f869b3a0e3fafe2a1b3dde4ea9fa9f977a645481fa3c2ebe1567dc0c30af7477cf08192003ec354c1f786a685428
- TLSH
  T13431FE5564E2543401390B91F723AE41F083159368577888FEDCC8788FCBEEC173D680
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  chrome/devtools/modules/devtools/client/aboutdebugging/src/components/connect/ConnectPage.js
- Size 8KB
- SHA256 b9193041379617d20e769d79f19be5884c65a1e5f68e593d5b35d4ee8cf38aad
- MD5 8131bebf8803e1f502ffd36578ee3060
- SHA1 4dc8473549efe54d4723345a6bf96383f02d3898
- SHA512 cd291db860a689c66205cb32f9c6c5e94287f0f3938878c8ce4e2d26a09b38cc26da55043321e4572839b0d42cba4334319d5b71d522ba631b7ff869ae1c5f54
- SSDEEP 192:ALIV/MD87JhlWnQASvxhxlqlJa6Fuv5NRfvTatgUApYNO:ADux4uv5N1m6PYNO
- TLSH
  T13A12858565F3601456176071E9277C80F432249FAE6BB88D7FAC41B80F8D6FC4A7AB8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  Browser/d3dcompiler_47.dll
- Size 4.2MB
- SHA256 25ebdf571d4c8dbca43c848a73cea72473da41927064d1399ce5a8c3daa7d0ea
- MD5 387575ba5b0ae81a4ea8229c093b80e1
- SHA1 9d8da7caa1ea143b699316a7c7fa2268a77e0818
- SHA512 a3336c045537b4b27269ceb839994fdd83b6ece07ea52310ce84fec4daaf77918088ed9f026f008fe1f95e89b484bc2b3d2e052e520178c133617d6430a32084
- SSDEEP 49152:mPrVLRxk2ya6PLLZ8h2gGGyCsWTVqiZ/zttPR0Cs8pRAH1LsJaUp7GYRzfd1DXn5:NJlkVTw69XNJhx
- TLSH
  T152167C47B6A440E9C2BBD138CA475713EBB0781413345BEF5590C625AF73BE26A3B728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Browser/defaults/pref/channel-prefs.js
- Size 429B
- SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
- MD5 3d84d108d421f30fb3c5ef2536d2a3eb
- SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
- SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
- TLSH
  T1CAE0A36B1588933B11503A9AF3124481B2165DAD6175CA545018D0646F0BA2165F9FDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  Browser/firefox.exe
- Size 1.7MB
- SHA256 241366fae863e43e7a046b66c820c12771f030b6b4590cf5fb2646a4f44de074
- MD5 50e65c27fcb754cac9974ab64a70e661
- SHA1 b1bbbeb4ece5f5ab29d5eb476d41903554182a86
- SHA512 3e354080da7806e68feffe967ed942bdba7d532475e2e5dbb94c243582aed11a58422a8b949789c9c3f7e01015150903718d4afa523590e222f53f14516bd9ff
- SSDEEP 49152:LKhZgvFKvPv1VV5kHsdA1Cyuha3QXXXXXRXXXXX9wwE:mm98kHsdA23
- TLSH
  T16E857E0FE39502DDDC69D1B1864A5221FD357EB18B90A9CB9B643B212D366F09F3E708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion trojan
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral17
- Target
  Browser/fonts/NotoSansNKo-Regular.ttf
- Size 38KB
- SHA256 c756efb2c40f754107d76fa4e401fc3b8b7edec5cc65db549d3d0236ac6d08a1
- MD5 675a36c0b084fd16c8a0c466da26df2f
- SHA1 08cb816c2d82646eb012477ca9180a9ccbe94f10
- SHA512 685ac3f7e308a1d32f0bae0571378897b2b59a56da8c871d90bd568ccacbfc3d58976f33e6e3dad23e9473c6d7bf38465f257ae8824b6cc57585b769015b8508
- SSDEEP 768:Fzr0MfLbiEt/HoF4ssQiwNgJ3I/R6oBWmQYYY5iH95ETFsQPRzT9xFFrDW/iSD5:RNfL3+F4+gJ26oPQYYY5iH95EB5VFBaV
- TLSH
  T1AA030A03E765DF26D05A4E742339935792B6EC101F93B34FC88A626EE8A65C438717C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  Browser/freebl3.dll
- Size 941KB
- SHA256 b273569349e13da771557f3d844dfb315cd5e659f04e867a2cd6a221ad7acd57
- MD5 7b390dea8b04e78d369175d06cebca7b
- SHA1 4590a8ae61968af490034047fd35ee649c0ef8c5
- SHA512 7191a837fd28098fd9b841a07f504ec691908119443f3bec282f361a4a6878348bba6e8fb92f15e19f7f2e01915760a8aed02dc50ea37aaf6d2fd1bfec145e27
- SSDEEP 24576:QK3KNVkpVPQ7+oBl/fUUxvfZMqvwkq6+h0:N3ompS7+oBlNMqYkS
- TLSH
  T1B7254A43E6A252D8D1EACDBD064AF563B911B80E4B3634E75BC55B1239B0BE07238F47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Browser/gkcodecs.dll
- Size 8.8MB
- SHA256 37138754f0e3664b6333d66a740381893d213cbeeb5b7d4572de12af147b8411
- MD5 be694b0d36259fb959107bb4f64cc68b
- SHA1 f1c4f2873f079c4ab0d495e1e3d9c8e608b3a0ad
- SHA512 9605a65f3c6bec38fe1fbba740e4c3929fb83da85a59e803253e8135a65c2cb4a2cf46dd9ad24f5d42bd034646a594082c07af3ceff760f6b811ff8c9454a81e
- SSDEEP 98304:9Ll0fF2fvaYQ86PFP+KxOn9y1Oyf+KzHD2tPTSYHqT7gy7piZ:95AFYaYP6oSXhyGYHqT7gy7
- TLSH
  T1D7967D8EF26351B8C51BCC74427EAA22BD18385E83155AF727D956343BB2BC06B39F14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Browser/lgpllibs.dll
- Size 344KB
- SHA256 550ab64ff0d6a8009b53b986e56f57ada23e52bc715f17a4e4745d7ef4999798
- MD5 e302d87a00ed395defe21edc85a54fb4
- SHA1 aad21fd4afb45c865bcfa6e05445b56e29aaa7bb
- SHA512 4b2e94b9e98273cc1d0b7ef3bcc1af86353d3094748fb7a337e9a8db8a4e9359ce665917f1f0bcd6ec6b5b12ceb427d5bad1ce31fe345b73a1a549bbc610c3c5
- SSDEEP 6144:hymb9XEzTpXVtf6ARArqIOkV2uXzv8dHlDmk2zH2RhzBuW:cmBEfpXVwARgOA+
- TLSH
  T1E9745A42E9840879E87BA53892ABD719CB7A3C8407A59DCB07A067117F2FFD422FD750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Browser/libEGL.dll
- Size 208KB
- SHA256 87931659133959c4348bccf6feeefe4fed02d34706824fbba410e5ff7eef309f
- MD5 099ef104d2835af053449f5be8795e3f
- SHA1 fd932aa94ba4ec2ed6f1f893fe5c8dc2df29fda1
- SHA512 e29897dbf4738201ffb473a4a65b4a99d52118ea635ce5c39efd75dc83bfabf86620b2e620deb70d023691719807f5a88c87dede550017af58b25dceec06c270
- SSDEEP 3072:0DRJ5RGkTb2AN5wTnumxGZzmDtoFdUnD6Co91phITbiED:CRJ7GkTbTMumxG9ooFdUDNAphITbiE
- TLSH
  T13F243A63A189463AEC2BE138D35BE215DE73B8A50395A0DF036093217F5FBD4A67DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Browser/libGLESv2.dll
- Size 5.2MB
- SHA256 8d6e6c7f26c94d6a3b63967d370a70bdd9101c916f89e5cc66e81bf439ec52c5
- MD5 61a2119831a17c5c5d3ea47e49b8dea6
- SHA1 3a336d7d3ad5732824d023ef04e8e0ab362b72d1
- SHA512 9ae9b59f8bda66f30992c157f9c6b4a603e458f02c6c5d1160738db8aa152e8c1690b16c28c7cfab62b2d5510ce36cf3cac521bbeabf600b2a5380c41a11f7b4
- SSDEEP 49152:RfxNwCzhakA6SQTzfisuVY6TA4a57m+KKyl1AP7CFJVkg51qxY0VYldyNKDrNg23:mWM494W57A182BX
- TLSH
  T10F467C07F29251EDC42DD275C74BA222F631BC895724BACF266497202F61BD07F7AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Browser/mozavcodec.dll
- Size 4.1MB
- SHA256 5e816c436a57736a640437541303041c30c504e80ae1f849b924491c481d571a
- MD5 c035a933d7ed6bffabe072dad3cab398
- SHA1 a5acdd0256400a363ebfc04251f095e5616750a0
- SHA512 9d674a892e74d13f0674810d4eddea452d0aa96a03db6e867dc4c13bbb71e2d0ba7e3811d91cba4f683a4e0b6efbfe4a5d5a2c95fb86a2efebcffb153139e857
- SSDEEP 49152:JXKFgZ0DZGcsyk2CXsHYhNHQkYDL2Mr0K3/vQCGoWkmvcLsAJsyMeX77UXVJdatz:JyI0DZGcHJ/4/oB7/X8JdlanoDl+WOc
- TLSH
  T17916AE4EF1E351D8C40B89F4937BAB26B924345CD70479F7178696247AA2BC06F3AF48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Browser/mozavutil.dll
- Size 591KB
- SHA256 b37e067301d28338d057faaff9a214592e5e9d51e94d2ff66ca7a9b311390d58
- MD5 defb7ca25040eb555f3ca9d8e5921a82
- SHA1 b9f2445d1fb294e20de0e52d3cc0766f50806c21
- SHA512 c06c8f8a9b60f72ba8f11c71e30b0b8d61d04113550aab8fda0b8c596954d7b5f3ee56a1accab11080683d654ec1ab19e64cf71d81bb33d659d281e0f44a0cf6
- SSDEEP 6144:ilF6e8MAbA840H7+ibmAI6ksFY6VAUWV83Mo0gYbuzhXSQsdhV5HB5HXzIJ2xCO:jVbT40Xml6Io0JKiQCXzIJ2xl
- TLSH
  T100D46C06E2C2146EC4068575839B5A14F2327443DB95BAEF23A246392F24BD17E7FF36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Browser/mozglue.dll
- Size 975KB
- SHA256 de4a5fdf5cc1a516b578e2936337e6adaeae203f5ff5a78f44303ec6799c9b52
- MD5 36ece5d01108f5b17ded2a36d4376a6f
- SHA1 95a0837343bf248fa1c8de64dd4be386b8f80738
- SHA512 39256ed23ba35bce496b843f9921cffb119148b358198432b72968026067d7184a00fd7e4281f71942fef8208b7bded8d6848b3be4bade6239fcdbe3c7ed3fea
- SSDEEP 24576:Mhww5heJx1ZdoDZalUaEKnB4G5F8RRBWzQFZzzzzz62:kww5hef1iZalUaHf5F8RRMEFZzzzzzj
- TLSH
  T1BB258D07E29640EDD82AD2B8935BA232F971FC451B24B9DF069097212F75FE0673EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Browser/nmhproxy.exe
- Size 794KB
- SHA256 e895fad7bfd1f351109a42ff8355e3fc2683a532dc6cefb9d2e00fadd16e56e8
- MD5 9b2bdc68827e3ad84d927b1ac636eeb7
- SHA1 dd5aa1c91f3e8cc270fcbd78521b6fc9e2db5a75
- SHA512 6ae4446b771a5470d6c61e5e78fecc9cfc8381c3ad6bdaf970761927bc1231ac3d3d7ba5aa1542fb2bcbfbb42e12b3bc6f5c275092928ecdc715b50eda06432e
- SSDEEP 12288:qTV6XlpytVVb9vNgP8BlCzjMXI8thE/N:qR6X7yy8BoMXFt
- TLSH
  T1BA057D12E68A90ACD95DC075934B96327932B8CE07306AFF22E46B353D56ED26F3D704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Browser/nss3.dll
- Size 2.6MB
- SHA256 5d57885a87137322b7177c1658574632159699786dd5c6e83a46de760d18aa12
- MD5 1198aba23ac22fe6b1dd50322a6a073f
- SHA1 83e0e808100fe1c4f04eb034e75dd3b219ada592
- SHA512 531f44a2558f2d5ea9b9f5caf1c4cfbf5e94dd5c4ee40b6bad474af6cb3826985a42f988eeecd7df0f7977ac9ed6d977e0b4c8645ebc48738fb8c6169300d147
- SSDEEP 49152:oyVU5jBgkDG32f477R3GdjTjuFmi50ArjdNtrnStrMiaHslHmSWlK+saOXhhhhhM:oyui3HoeV50U9K+s/hhhhhhhhhhhhhhL
- TLSH
  T1B3C58D13F29610EDC42AC2B5974B5632F9B2B4054B246AEF52A0CB353FA1FD06B3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Browser/plugin-container.exe
- Size 1.0MB
- SHA256 8f2a77a68c455e9d696aee7dbb7058a21133a376900c134e2e571b3cdf9e3d30
- MD5 d3168f5846d22c19c1e9e16960a0fda8
- SHA1 9721b14bd788d4f60f335f4e244f3ac82b89c94a
- SHA512 bf210d0a6812538d24d3479090aacdcd4f0f1fe4f6f674714d3e93a137c39ca90809bb68cc37d20c26c3d902ff46f805cd0d3284cd7bcf919db211a50bf5e476
- SSDEEP 24576:LX7isELq7+S2gZTbBJV2jKZ2VJPBhhhhhphhhhhS:z7isoS2gZTbBJV2m6Thhhhhphhhhh
- TLSH
  T184358D17E39642ECD86EE1B54346A331FE30B8454B64B9CF4B90A3212E65EE86F3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Browser/softokn3.dll
- Size 281KB
- SHA256 5d2941bec7c077e2060378059c703dc3bd9cd713ed66c4cd3d62b840bad78f2d
- MD5 319e4712a2351a73662cd2a4ec8723a2
- SHA1 9dcf606671c03cd18f47a1ca985a089af6a00bf8
- SHA512 60f746ebd7771e0cf24fd32346ba2ddb5b89533f6d7f76934a0fbd41e9c67cd8c74ce4d3599e4c3a3c84b7325486fdc085fd5285293b806d57a6f276a9ba37a4
- SSDEEP 3072:Iwt47NWXxdpLRAoH6vtEqlKqJv0sIzUuMJnm5lJeep1cMjaW8+CNCOCTC8CyC0q+:IfNWjJ6TKEvw3p1cUa0Yz+xn6CF9
- TLSH
  T1A1542913F3C2A1E9D808C1B5A24B5733B5B7B8104724AACF93649B253EA4BD47B3D794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Browser/updater.exe
- Size 502KB
- SHA256 13e0b8bda487429046606ddcfac4e7e0944c36bec654f184c49b6281c5bafa93
- MD5 3f464cd7221c8d3484d1a609e4d472f9
- SHA1 10348beac6f5275bae62183cb01310fd25fb869e
- SHA512 9bca52d965b5933add52a31166640054eee544c57a73e01f0dbf8af4323a74e8de2da04c404a210beffaa4b40bcabded4b68273c82c1925dedb91d3a56a96a6f
- SSDEEP 6144:5hdWWJWnPbsDD/mofOK92XoNhBJc6FmjC1lBJUo5Ut0hfd6HlEE9z5VJQ4+Jg3PK:5ssDqoWY2X4hBBmjwUtyJAdGy2
- TLSH
  T144B46C17E68408F8FC2AE139974AD212E971F8A90790F4DF036453256EB6AE45F3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Browser/xul.dll
- Size 154.8MB
- SHA256 2e1779269469ce0b9dc39cde291bb27973cd27e9c2aba7971fdc1800763747d6
- MD5 8f7beafadbe9a56174d382a5d5efd76a
- SHA1 604135d7d6d9d1e6fbb28872208ac94cac2894e3
- SHA512 462c834c55ec0c2c64ff34897f070a4105b4dddc85c883eae6d87d93421c02851232f7a17c2efbd8efb10c98b4a513584de8c9ea1bd808572199f842f058d47b
- SSDEEP 786432:N9f/X8lZhU6vnKTm5xitGTz9z/MPSh5PIwFjo9rgTdwrd/vs2wsDG3wvSACG:TnslZhUYKTWxi4aPSVRTdwrd/PY
- TLSH
  T175785B03E2A240DDD47AD2758B965733FA71BC494B346ADF269047222F71BE0AB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Checks system information in the registry

Event Triggered Execution: Component Object Model Hijacking

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

Executes dropped EXE

Checks whether UAC is enabled

Checks system information in the registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32