ed76f841d866a82c26d0f5b59a41ea89deef85d5819f3ba9e7dcb0212c073e0d

Sharing

Copy URL Twitter E-mail

General

Target
ExLoader_Installer.zip
Size 23.7MB
Sample260706-2ablwscw9x
SHA256 ed76f841d866a82c26d0f5b59a41ea89deef85d5819f3ba9e7dcb0212c073e0d
MD5 a2a1f6f0c76f692a721292df8e6f779d
SHA1 d38d053bb541abdc1fbc5531d8c66aeb430b3d32
SHA512 748ce3e79b7c69b6d04360853739ce47823a0aab221ddff5edad50baaa12d048b3f12395d223b72ba9a95c1a9292d6a713cbff89203c862d8f2bc0ce031b0434
SSDEEP 393216:kN6+R5xTUGIk2iG0Y9mpiRwWvPUJ2bQ1GEfruhFIpmEsUX35pt8xtyPHjCQo6Cw8:kN7RFIkYmiwWvC20buTmm+Wxy+QumW5n
TLSH
T1D94733C1DB9160A7CD36A7B3857CB0B2D308229F62F35634859CC3606E4BEA8D615FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ExLoader_Installer.zip
- Size 23.7MB
- SHA256 ed76f841d866a82c26d0f5b59a41ea89deef85d5819f3ba9e7dcb0212c073e0d
- MD5 a2a1f6f0c76f692a721292df8e6f779d
- SHA1 d38d053bb541abdc1fbc5531d8c66aeb430b3d32
- SHA512 748ce3e79b7c69b6d04360853739ce47823a0aab221ddff5edad50baaa12d048b3f12395d223b72ba9a95c1a9292d6a713cbff89203c862d8f2bc0ce031b0434
- SSDEEP 393216:kN6+R5xTUGIk2iG0Y9mpiRwWvPUJ2bQ1GEfruhFIpmEsUX35pt8xtyPHjCQo6Cw8:kN7RFIkYmiwWvC20buTmm+Wxy+QumW5n
- TLSH
  T1D94733C1DB9160A7CD36A7B3857CB0B2D308229F62F35634859CC3606E4BEA8D615FD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  data/flutter_assets/AssetManifest.bin
- Size 9KB
- SHA256 284c6bdfba0a9dc55429768be10e4d924de30fa04a34078a49f02fbbf34d2185
- MD5 c5826add0bd49f55d19b166d2132e529
- SHA1 0f411009c12b469cc5cbd429f454794756c7f7b2
- SHA512 1d2da6d55fbe8b281890895b288dfd9beacbe9ebdee26c8a6042e45b6f66f1af4a2fac96e63cb6561b9e13f74a4fce17c5b186a1ba434a482468e2a515a36ea8
- SSDEEP 96:V5AEnXfm4BuhX1mXIz48ugzXA43lATmwG+e3:V5AEnXbsXsXIz48ugzXnee3
- TLSH
  T10D12705B83A025FFF571702568AA21645A02CE01D1B9EB9FF339941AA1F33E508FBD24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  data/flutter_assets/FontManifest.json
- Size 332B
- SHA256 9e0903a9ceb64e32f7a139a143324252aae77dc58dbefb1f211fe03aa33460db
- MD5 abfb6c8e4501348bbd701d03698e9b3e
- SHA1 242fd377e9edfb075022ceb8e4c7079fc8360c99
- SHA512 52ee71f765f130849464ca9b03bc993894400d8fc8237761f73a32205a811bc86282f0dad99e7635aa450a3a60c8f7bc66ea4ac2886a6be55ead904656a17a89
- TLSH
  T1C7E04F1395007578C778945BE52217551D587388721DC45ED31D1662E1F626430B27A7
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  data/flutter_assets/NOTICES.Z
- Size 113KB
- SHA256 351b1f86747e148dae94022110344200da947349832608c9fc4b42b2f7092ccc
- MD5 0cacec7b255bd24b232a88e3cb7f449c
- SHA1 a1295d2b969318b39c4e50deab56c67f76c3e5aa
- SHA512 f65a1a14bcfcd97baf91e886eb20a2fe25dff4c4904fd8b7f3245287ec18b325e30f5dd58f415c7875e0802c54458c748cafe1f3a50dd9f78751b1afef8108e7
- SSDEEP 1536:3OlJ76y8r3AwXUpv/b2ddq6Otz1qjP8DYrhWuLebNsWuf13EBA0nsASoUUhYa4ce:+DgzvXjdGtYmYBLi6f1P0XYlNwxle
- TLSH
  T135B312C58581377EAB3963CD3AE07529D70C4C4B1A5B4804D0E9DB04A0BB58BEBBE67D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  data/flutter_assets/NativeAssetsManifest.json
- Size 45B
- SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
- MD5 f3a664e105b4f792c6c7fe4e4d22c398
- SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
- SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9
- Target
  data/flutter_assets/resources/audio/AbominationPissed_DE.wav
- Size 131KB
- SHA256 c87cb5c9c64b5798769af14563e268080ed82c7c8a1958f6fa1c1b5e7f10d2e2
- MD5 b287fcc8278972ff72b8e46b481c4ab7
- SHA1 71a91ebbcfb6debe7673a0b59079c5e90cb2ede3
- SHA512 746f5d9232a06b5a415391dcc191902c7ec12465a22551342823da5880a16e9b9cb44da7052638fd0f5a2211ba8b97be6d835f5931bf34eb4fb1b96c6c529c40
- SSDEEP 3072:vqmfGrs2QiZVhikBP8KKFgkrpuWle4iscIhSj/S7U5lip9/VrhCL:8w2/fSJrkWw4ivPzSYLE/bCL
- TLSH
  T1D7D3E112EA830A44D5B30735DEC028505EDAFE4CBC69666F701BCE90B353378E9657B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  data/flutter_assets/resources/audio/AbominationPissed_EN.wav
- Size 80KB
- SHA256 3939fcaa3b0efd6d601da475abea862d9f7c078643f1063df51c83609cf47a6f
- MD5 04de7b1fd5d0fce157b378ebede59df1
- SHA1 97709ff9bef57080569f04f99efec6098cba3bc1
- SHA512 31dcee1e7f1da84853bc8e41c108b1856020ea8da09bf2dd75b2902223f96540e148be9daa2e802358a5d78296ca5c90fa68c8f34f0a52b610f9bad446fff728
- SSDEEP 1536:S14LKwKeetzn+sXGAxqcMN5fU0gB35ZIlRMjzVG+G894hDL0MZxvpKi:7LK6wznrvMcMNgxoMXVG+39+PVPh
- TLSH
  T1AA83E193F451D7500833C9225D467C004F9BFE9FADA72A1BB507EE80F163351BA766A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  data/flutter_assets/resources/audio/AbominationPissed_RU.wav
- Size 156KB
- SHA256 d5f7ea66bb3bc77de30b0b450b37dbac1dfa2f30b8108fce9ac2752ce9ad2838
- MD5 5c4c79ff61bc28f30fc6b2a221975b98
- SHA1 82bbdd2bf6c5bb2941788c0ea594c0185c6a17b5
- SHA512 d2fe68b06c3852111cb03ac6b55cdccc6cf232aed1170eeb4709493e6b1e87a2b8b2c30223e502dacafb3a2d0b07b62a595086336cc42e63b83e8443244b5954
- SSDEEP 3072:0JvNZioDD5SvL/addGwHBdlNB4HQB+iyl3lIl7ka56mAzM/LBqH4C7iaC9e4pb0U:0JVZR5STaewHBvNBQQYJ2l7H56PzM/VF
- TLSH
  T12DF30212F4438308D53FE336ADA158E40AED749EFE91266F708ECEA67243350B927B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  data/flutter_assets/resources/audio/Csgo_hover.wav
- Size 133KB
- SHA256 aaa3f0f824d04ce5e93d1da17873d3aeb3c4d3a8fee25b7006851e4089bfadfc
- MD5 8d6e22bde35607fe3801e02fdb12b022
- SHA1 9bfc38b58bca7b17e48a864ca2e0b312c86b146e
- SHA512 5623151380eb43a2191c639c940473114e47a579dd65970934ade8965ffe76e4b7018fa008e6412db91fcce6bc89aad9e3a4358e824f5caf0021ea58ab19c49b
- SSDEEP 3072:fK3m1UDeeoncYepLphHTWrUASR0Sx3X1uuTMquPYzBRKgNK5NsA:8Aeo1wrixSR0SxHQu4q8OBRqDb
- TLSH
  T1EFD3B093FAF408B0E86A65776E1204828F233597EF81614D71CDC929FFD32668AD7706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  data/flutter_assets/resources/audio/Csgo_press.wav
- Size 99KB
- SHA256 880cc2be6f458bf853dba78caf06bd2b97bc4b06fea141599db74e95bbd59528
- MD5 5cf6f422f37b61b16f732e177c4a67ce
- SHA1 3e227d262159caefd259921cdb888872ffeb8989
- SHA512 b05219e87e9117195b3fb17a1075f4ef0c126de333618f1b87ef75813f3c6db40647ec53777d101bf1fafec99e275a8e9d048aeab5715b16e0ae2ec2f1293d1a
- SSDEEP 1536:03g6O6sFvcKvm59Oawo31MnTocfrH+hr31DlzqVZ3Nk82dlk:03g6OOKO59/31MTocfrGthqVZW8oe
- TLSH
  T1B0A3D2A45BBC26A2F01F23226E4538413BD1219274E7287D799F5AB83BFF3C16176907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  data/flutter_assets/resources/audio/Fortnite_hover.wav
- Size 137KB
- SHA256 3e3abb7e29d38fa4b0261ac78427633e8bf6ddf3708de5a45bbdddc2a9f4aa6b
- MD5 b66b7d55b6eeb2ff344a1af41e42a27f
- SHA1 fa6d73d1a35e6098748997cd8c259b4df00d1f9f
- SHA512 3bbde1d2426cc02fc2f034ff9276a23f2060a385b4fb4f6e17ff1b91b6ce904e807e9151c61b9133de3f5218a4dfdd8d0cdece9c2c165186acb92abe51f4b97d
- SSDEEP 768:z5qzevj5RnMNTYWg34Jx2jxsF3HvOOLB2UImSw/5JPYLe5UlihX6xvDxgx1fLz4m:zAz+RnEa34T2loPRdnp4lUGxI
- TLSH
  T1DED319967AF292ECEE4963B21E46E9421F217442E9C1895FB0BECD4F3F20B1551CB139
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  data/flutter_assets/resources/audio/Fortnite_press.wav
- Size 111KB
- SHA256 e0ecb5e92f1e13de05850d1f3894a54988e5f2c7eeded390f9040d2845aa4404
- MD5 17112a672b04374113400b1c3c6a014e
- SHA1 5214a72c0527fa73d25ce810f759cba05739b34a
- SHA512 e319aa4852835b3d039dd63db981f197bdce301710a20fe7719b7fcacad152067f5033a846f0b556385b6f84364e66af5edbd4a6f39fa2d751ed0437e314dc6b
- SSDEEP 3072:ofD2+DE780NFf3KTuRHMlgPspFerJpchpgat:Z+I82Ff6TOkXu0Z
- TLSH
  T103B37DA77AF196EDE80962721E46D9815F263502FDC0898BB0FDCD4F7F30AA905CB125
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  data/flutter_assets/resources/audio/Standard_hover.wav
- Size 36KB
- SHA256 46d6ccfff99264aac49bf4545b0ceb9cca2a9ee5a60d13b7017161e481440189
- MD5 be6cc8afdd2ca2870982a0933cd9c8b6
- SHA1 e3d9f678ecec58223e2d60636cbdcaf1b5d6d01c
- SHA512 b58b789db7e6d65be7e5963387f7a8e095a2fd73d43400a6ed3c186babb880e541effa1f6265d4f89b8ebb7ebcff080dca656862cb19a5cdb67a5197c9fe6888
- SSDEEP 768:yOaGEXZJgoB21WI0hVI1DfKy48/Z2ybz+9:yOVEbgByhVINU
- TLSH
  T19DF21CA2F4D09912DC4CB9365C77EA614B323953EFA11A0470CCFE156FD32968B87A27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  data/flutter_assets/resources/audio/Standard_press.wav
- Size 64KB
- SHA256 fe7e148d5b80eaf49eb7564233b87679e53fa4e68371aa347f18c1886a99bff9
- MD5 f9a86f1da07c3dea7445f34ae4f793f3
- SHA1 17e4f9d7d5ce2b209b513a3b1a6745adcd898d98
- SHA512 2052873fba1482616e7be708f6328d708bc095b327416bae6c83679ef4e5f829e8d4667292868fb7ad8fbea52a54d069ef6a52f8ae603d9fabffab4c51336c84
- SSDEEP 768:KKeoQaXRJsFTfQOhgiIzqkUS/K5u6sov/GEs1YyKNXf763lQniApC2ySz+9:Ao5sxukhvDs1vKVj63Ae
- TLSH
  T12953AE92E9F352A8E41462722D96BC441E123ACFDDC10A67305DDD17BFF15920ECB2D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  data/flutter_assets/resources/audio/Steam_hover.wav
- Size 55KB
- SHA256 5f53f2d8499d27dd906587a6d0aad05d5c387ca2fc1c12f26c76aaefa690c7d6
- MD5 2d9be331ac50c9a82af0ffc0678bd575
- SHA1 c455196af8db5823ce8f6735ea4a4f70a595a2ca
- SHA512 645210077b7110661982a76484915f6f6e63267de472db86a89e5ac8d65a790a01df8bfe807e8d309c3609ab009c1fb1e221799223c648465d22763e7ba00bbf
- SSDEEP 768:TBlMhyvnjSIr/fqtrcdDcPY4gspSp4xsbJg4y87H4PNBRpFwLJJX2K3DfLRN4MHP:ohyPjTfwCDcPYIptxsG/f3Fqv2O/
- TLSH
  T1CB438C57BAF5262DE48473762A862A014D23118395E22D88B0FFCE5EBF745238DC752F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  data/flutter_assets/resources/audio/Steam_press.wav
- Size 170KB
- SHA256 e7c36644507ee52d11ad20e17a165bcb4bb7efb14c573cd29921088c03777241
- MD5 f8eab8f1b49b806f490f8716a8208190
- SHA1 d5e7401f403733c071347616a2c0a069f74be52e
- SHA512 71a75f1e5fe3204caa70adc9d8c8a96155dfbe0b131afcc4bcd55908048ae314b81a84b54be21a1f99321e89cc4c77042bd0d0ad4033988af8d0042060631d31
- SSDEEP 3072:MMbqqHdE7++/ieS7egbwyo5RCRYQkMpHfBEp3ZDJgy7iFM/DhHK02vN:MMbfHdEK+/E7pg3xMpHfiHJfmFMtvk
- TLSH
  T13204AE02B2A95329E1CC1E321C4589C11FB5B54EEE81997AB1BDC643FBA14235ECFE1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32