3f43f233af3ce965b1dd6a20d1aedeb5bb408079311cc449e44dcc29719acb5d

Sharing

Copy URL Twitter E-mail

General

Target
3f43f233af3ce965b1dd6a20d1aedeb5bb408079311cc449e44dcc29719acb5d
Size 77.6MB
Sample260706-jzy5daby3v
SHA256 3f43f233af3ce965b1dd6a20d1aedeb5bb408079311cc449e44dcc29719acb5d
MD5 91edce1ef5d3129ee4c6d3dca315e051
SHA1 62330ab8df12c1d66b24711437224973ee7e0b5a
SHA512 e9a39360da473b3e1dd21278cb7a443d86ae086d34370e3b814834c2a9f0f2144fb58eb7b09af2db610c3c2d501ece093892a9e7dda881d9b87a3b6231d2baed
SSDEEP 1572864:HLdk6IvY3YAs+KkjeDwd3KAoSSiMdbIKy8bo9gfceyY0MI27:H26Iw39sBwIAjdM1w8qgfXxNI27
TLSH
T13C08335862AACD3BF5C6CBB3877D0741652F86E4A229C07F3A7544F5E244CFAE788409
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  3f43f233af3ce965b1dd6a20d1aedeb5bb408079311cc449e44dcc29719acb5d
- Size 77.6MB
- SHA256 3f43f233af3ce965b1dd6a20d1aedeb5bb408079311cc449e44dcc29719acb5d
- MD5 91edce1ef5d3129ee4c6d3dca315e051
- SHA1 62330ab8df12c1d66b24711437224973ee7e0b5a
- SHA512 e9a39360da473b3e1dd21278cb7a443d86ae086d34370e3b814834c2a9f0f2144fb58eb7b09af2db610c3c2d501ece093892a9e7dda881d9b87a3b6231d2baed
- SSDEEP 1572864:HLdk6IvY3YAs+KkjeDwd3KAoSSiMdbIKy8bo9gfceyY0MI27:H26Iw39sBwIAjdM1w8qgfXxNI27
- TLSH
  T13C08335862AACD3BF5C6CBB3877D0741652F86E4A229C07F3A7544F5E244CFAE788409
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  First.exe
- Size 168.1MB
- SHA256 4f8c853895df4be4be883bc2925d6697f8caed33b1b9d55226f0f37ff1f9b153
- MD5 5ad06686810a5fa53ec751d05c1df1fe
- SHA1 9dd49a78542aaa9b30e42c2234b0d433bf8f8761
- SHA512 fc2f415e1edc924c96866158e2611d00802e5cf50605d60dfb2949175cc15242e11bf022aee2d9d348bb37d3f3f7022ce20b7137654e7f66e8bdd40f42a1e5e9
- SSDEEP 1572864:UgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:Yg/geeFXzGa9Fz
- TLSH
  T1A1887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral7 behavioral8
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- TLSH
  T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
- MD5 8f3d89744ae11b0925faf4b64890d0d7
- SHA1 6a8f744be1f76e9ad28287d969d8d24f5f1e7623
- SHA512 250c06e70276c08d3d8a63744af6c570b6288e1d8fed8deed915c79bf0a80c3cd0a7e64c55a16fcbc50ccbcbc9910b26f87983ceeea8ed28a75c1b8ec22db53f
- SSDEEP 49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
- TLSH
  T138D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
- MD5 f1fe23058e7eece1de389a0c882bc1ad
- SHA1 e83b15d2bbcb6fb2867651a2a9797ed3b6827947
- SHA512 d7d51fcb05542fa81e871dd9f1dd960c363107d1c25311dcbf81e440d1275054c121a788def8dbae47c129e95fd990042e2d39e6ef2bdfb253a114146eb33973
- SSDEEP 3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
- TLSH
  T1A1A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
- MD5 76141455cd2705897d38e9785117e405
- SHA1 ee091646b6273bf006cfcd84fd54384b0a9d0e0f
- SHA512 551b79aaffdc469448477aa72554458235f118559eecc567c232599a4193b2639c14eafacad533485089af58701aeabee690b43f36e41342f928d4973efc02e1
- SSDEEP 98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
- TLSH
  T1F9767B03F29A40D9D05DD2B59B4B8123FA31B8855724B6DF266413253F7BBE0AB3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- TLSH
  T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- TLSH
  T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/classic-level/binding.js
- Size 54B
- SHA256 4e02fde8f9c61fef6fc42d64744b150de29a578dd7b6343d9dc2654c68d61843
- MD5 5592afbf198fe53d9640fceae506ad91
- SHA1 f6dc07d408612af023f29d9a89e4d4316cc313a0
- SHA512 3cae4007e91816ae95323c907800e4fa5dc5dbf25bfc43abd4e84b3dc1c45daf5d5610c3bf8c24cae4001ca1042f984dc787e99daf6c5f89725a28913f43968a
- TLSH
  T19390027A1991BE522249C143F174466654E1C5A10480401AC15547D652459445952995
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/classic-level/build/Release/classic_level.node
- Size 522KB
- SHA256 9e5a6b1520d9b11ab733666d1da248ddafe3b95ebca153dc300e5d9b2b5138b9
- MD5 e5aa404622a3c0fa39f141c00aaf7591
- SHA1 af13b2505c46ee4d2e2cfdb2633ea58e219c43ae
- SHA512 465e489ae8f75cfab0f720ce880f40e83a2db24b8f85b6f4dc81f6f0d3920a4b486907fe7f22253cb368e9109976083a439a1781e2b1c7b6d207b186d8c6ac77
- SSDEEP 6144:7UaY9nhdUyOwSMP5swfqwS+zYwW3SuKDeihC8aaiJvyyXwacexxHG:OnhJOwSc5sYzS+EWRD9hCnTvyLace
- TLSH
  T1F4B46C29A6B807A9F1B7D67C89674D02FA7238820760DADF07E047765F177E04A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/classic-level/chained-batch.js
- Size 700B
- SHA256 ff2b05581a50483573963d0c9f76f1688fb46a9a97449cc07f9c04c8bee1eb77
- MD5 79d3555505b6c950368d46a7ebe27ad7
- SHA1 2c3ed61924f1de22202f4735b5e16e9929c42dc1
- SHA512 afea4bd2a326ab689cc8b46a21f4f654075de3899a5be6f4beb8bb97d0a1f6f8f033c795aa3b665aa471d67dcc7e5beaefe35f8e2f53e8df071870cfb96cb55a
- TLSH
  T10A01703231F29940A3D32D9BC78D1404A577C077EB0D8BB635ED535485C443854F44F4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/classic-level/deps/leveldb/leveldb-1.20/build_detect_platform
- Size 8KB
- SHA256 2ef00646363c66676faaea740fdddf845eb935e421813893251a4274c35d27cb
- MD5 3021cc5b1c3d933bdb00788bf5300774
- SHA1 7cbc10024c233b38e2dbecf662195412372d1ffc
- SHA512 b0a00cc576b8b79b5406fc7af0ab59ce84cbd60646f522f3d3db7f18637a3a2b7cc4d74367bf61f3ed304a944489ddfd5b3acdbb69335c78101fcc9ebdfbfdde
- SSDEEP 96:e6FS5141sR55rdhe7ZLVCB7jvlijCpb/5QykD9imU7aID4j8lDaMjjgA3aCn1zfu:T7NVCBEDceIuIe8OCzWl2inkQAlQb
- TLSH
  T16A022093232416EB2ACD173C3E5E2782A6028A6F112B141EB97C93D5BF21F497077766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29 behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/classic-level/index.js
- Size 4KB
- SHA256 89422efa8536cbd5829237a26d0ded4a2d76680e9ce88b492695218dab42b4ee
- MD5 dcf0a9a7aac453b5ebb3f6f17e92c681
- SHA1 b2daeadaed17d33b481907dfe4676765d05c174e
- SHA512 25298b3f6bedef925e60bae3f0e15051e30090063909d6f2d76c5293408fdf679dbe27fb771f28275e19956bfb5650e5315f1bcf6994d6621746a9ecc30138c1
- SSDEEP 96:msfEm3dOeZxaiIPIf/InICIhgRKIDVBoVqQD9cBoVqhy9faWi75ctGIORwFmBJa5:msMm3dOeZxaiIPI3InICIhUKIDVa35cQ
- TLSH
  T15EA10EA47AE2510117C735A294AFD509B13AC27F345C0AA17DAC03E0AF9013DE6F7AF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Looks up external IP address via web service

Looks up external IP address via web service

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32