592533ac9e635e473d5f458c1bb6ca8f44971ced85393576aaa69ac865159d7d

Sharing

Copy URL Twitter E-mail

General

Target
StreamlabsPluginUpdater-r112.exe
Size 594KB
Sample260708-eevh8sat2x
SHA256 592533ac9e635e473d5f458c1bb6ca8f44971ced85393576aaa69ac865159d7d
MD5 25800808ea3b20c2e0a321b9824ac740
SHA1 329c2d179462894f04dd6190a23629b01b8a9450
SHA512 512e7224d1334067033548b6f11429fc3b582c378692b61e7f9cc8c21522436577ea45c2fd8194d2b16842ffcd1dbe0d97578202bd3de04f7b55a7449cf84ad9
SSDEEP 12288:rfLBjOtVoW96cKsbZgeJLGfImBJvAtAn/erDXxdolLL/xsz0NR6/CQJzN:rfLF0N9DNgg6rqiGvXxdoxLiAN69
TLSH
T130D42310E1E0CDD7FBB2673214B9E86A4FF9510113934B52A7102AB56BE2983735F367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  StreamlabsPluginUpdater-r112.exe
- Size 594KB
- SHA256 592533ac9e635e473d5f458c1bb6ca8f44971ced85393576aaa69ac865159d7d
- MD5 25800808ea3b20c2e0a321b9824ac740
- SHA1 329c2d179462894f04dd6190a23629b01b8a9450
- SHA512 512e7224d1334067033548b6f11429fc3b582c378692b61e7f9cc8c21522436577ea45c2fd8194d2b16842ffcd1dbe0d97578202bd3de04f7b55a7449cf84ad9
- SSDEEP 12288:rfLBjOtVoW96cKsbZgeJLGfImBJvAtAn/erDXxdolLL/xsz0NR6/CQJzN:rfLF0N9DNgg6rqiGvXxdoxLiAN69
- TLSH
  T130D42310E1E0CDD7FBB2673214B9E86A4FF9510113934B52A7102AB56BE2983735F367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence ransomware adware spyware
- Creates new service(s)
  persistence execution
- Stops running service(s)
  defense_evasion execution
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 aab28914794a1cdda4561e9f2af3e006dbed220d9d6bfe049b56d0cb9b783648
- MD5 05f72d6a944e701217ef2eb2cc13e0ee
- SHA1 fac99c39150ae484e4b3e0af2f4be86bb1835dde
- SHA512 c87e783fc169ef01ac0d3ce29fbfbf349a2e22329df9203a1443cc2caebbe7f8282c0754740289ecca534951cb7e574bafef9ccbaa0da7c287109920ec9573eb
- SSDEEP 384:hRy180+1ygVaLfKgcIno1gEBWZwCUKihb:hRy180+HSegEBWyQih
- TLSH
  T185623C46AA2084F1DBA2167034D33E3A67F18E751A2484C247F35D4FAE16317B37A986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH
  T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- MD5 1d8f01a83ddd259bc339902c1d33c8f1
- SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
- TLSH
  T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
- MD5 b4579bc396ace8cafd9e825ff63fe244
- SHA1 32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
- SHA512 3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
- SSDEEP 96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
- TLSH
  T171E1093571C02DF7D08D89743816BD2F43F4D52627BE05A04A7B1AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  BringInstallerTop.exe
- Size 55KB
- SHA256 74318745ba79a5594dfd93eb15f2c588cda0ded17213c058defe026a5a4b0efd
- MD5 e1391eb697db6f142b488b0860394ad3
- SHA1 b4d75d668bfa02fb7ffb3297e3ec0ebbdb468d3b
- SHA512 5e09f0c5ecb062445f9d76b5260656a8a830a33468f3b469d102762ded18bc81d5e4ef6867b17596e04a403edb34fd839ac7f4c93f01c982a487b604d010248d
- SSDEEP 384:Y+u1Vij0smLSUEc5svw9vHNyEIYi2mL4/y8RBdDgspzt:YYdI2vw9kYiDLk5tDBj
- TLSH
  T192436C934B4054A7E53BC13CD4E2532BE5B2B4612751D3CB2265825A0FA33D87EBE2ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  ErrorReport.exe
- Size 407KB
- SHA256 262dbf4e040b40a465e07d8e7365a33bc5ac9e1dbb929af412212d30dffa2a50
- MD5 215142028cec9e6b6378627c21298b26
- SHA1 ef044d1ed21b526a4cc2ab4170a890d3414f1f23
- SHA512 141146f9613c29737dc5554054041fca65903db4d94a5d0aa030604bbca60de230aadc5adbfc9facf5dc6b3e87947e21ce051961cf6a261f54299e77c73a70d1
- SSDEEP 6144:V9hV1oqMZHuAx9Q2+MIF+283DkWQDUpNdOWsxHp6pR1z46Vt:Vt2+MHdOWsOpRt1Vt
- TLSH
  T1B6945A1B9612649BE326803FB9FA1D5CEC22FC5C039149CB1EA7B9E81D1FAD857F4211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  RunAs.exe
- Size 66KB
- SHA256 10f06a86384ac6373fd10f4f9e90523b5f550de617be40f6fbee27891949b78a
- MD5 19eb258585c09e48704c2ccbb86bc668
- SHA1 c532d57286dff3935002a306bb8925801a5882a1
- SHA512 d03d45b99b250bc2c9fb059466673dcdd01741ea59468285fc3271aade2a9de640e1e97b6d09e35a8b5490b58196d9df1e44b6c4286abd4d39d1fd08a0d9027a
- SSDEEP 768:AE/KprRffnIqSVXgs4jzen151aWYiDLk5tD00X:r/aBvEXgs4jzen13j7MD3
- TLSH
  T128636B47578850B7C037D17CD6825216FA33B0160361A7CF126A93894FA77D86EBE3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery privilege_escalation adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  StreamlabsPluginDownloader.exe
- Size 97KB
- SHA256 e8db4a4baca1feaebd96db088ce12ea37b2ab396c18c3f608f16c66539ff2e8a
- MD5 49e512046fce08be4f3074b0ff0dcc4e
- SHA1 49d35b7e619e294af4acec2d8450efd547060006
- SHA512 43ebef57fcb043532d0af69f4e198d3e5b8f778cc8fd88c0efbcb57ad082280215614c3dc59773e68eabc5ed37c8c06f7138dd83e4a0c22f310dd7c8151b627e
- SSDEEP 3072:xfi3k+oWDBDh1du7sHyvB5HvUnr2q70+n6XLWlNek68:xfL+oqxmBNvUnr2B+OLket8
- TLSH
  T197A3E101D660C873DAB34330387977679FF6612517E09B8703245E287EA3781E65F3A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  $PLUGINSDIR/INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
- MD5 40d7eca32b2f4d29db98715dd45bfac5
- SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
- SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
- SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
- TLSH
  T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH
  T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- MD5 1d8f01a83ddd259bc339902c1d33c8f1
- SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
- TLSH
  T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  sl-browser-service.exe
- Size 636KB
- SHA256 60ae9b59f83fd0d098262d755a3aff50820d438556418d8dee76fac760cf6f05
- MD5 ac8bde56a2a8afb3d822c79baecd78c2
- SHA1 4081f908c6719824454e74c7cd62cec0c20b5fac
- SHA512 ea27a977ce2e67cd3bbbefc8d8c180e669651731f42c89bb84085b08e63772586d5cec225aeaa3b0fc91b07b0bb6d072293d5bc109a17f9bb05766c6fa2c5683
- SSDEEP 6144:YR54cvxSyu4pOXSWV6rvpLK1oqMZHuAx9AuDFFs2I3rkWQ03paDbb+PWQmV58yb0:oNA4OXSTDVDbb+w58/R8Rj2
- TLSH
  T1B4D49E2A57851068E177C27DCED74A52EBB37C0803A19BDB02E186E91E6BFDC4B39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  zlib.dll
- Size 109KB
- SHA256 3cc058a9780411b3de37f6f9c171ca1a1aff52f62603fb4f86957243c6093294
- MD5 96b37b193e37fb6e50ff04312ab5d635
- SHA1 1fd1062a38a34db5b70ab62356f986627cd8091f
- SHA512 c90c2d85201d4aa11a653aa8074760835ff728e01d7fff39187926c08269d0516e9034293cc826e86581e31c9ed9992d45e93763ec73f912353d07cb9e9c1ad4
- SSDEEP 1536:5i8H5NZy/Pp+N8shx+gS6GvXP8oa6yfyqRVD5jU9Rn6dhTTcIOTIOaQa9:4aNZEB3w+LXBqRVDtU9h2HS1aQa9
- TLSH
  T105B38E9ABAA361A9C5B6C07046E78776FE21781016705FEB2188D7B42F12D903F587FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28