cde44481848004511d41ceecf272da72a8d840b4efdbf4aedabb4d89f7140d21

Sharing

Copy URL Twitter E-mail

General

Target
Krush.exe
Size 78.1MB
Sample260708-mj7claet71
SHA256 cde44481848004511d41ceecf272da72a8d840b4efdbf4aedabb4d89f7140d21
MD5 8bd221e1a94ec07453176915c61948a5
SHA1 a63c6f77ca25d42de5ae633ee2ffd145516bb6ba
SHA512 16e79f3b571062391498bff78921887318189d41f60c8c5dcf301e865f61adb9a62354d0cff033ca316df393a7662875a93bc67a8382080aae60c6dcdd8584f2
SSDEEP 1572864:paa8pPK1eSIxHu5PJ3UNqOJr5bYoJAOeO72y908brtTwb/YKzRj7F7Y7:paTPKjz5PJENprZYoJAOW8br9uFju7
TLSH
T107083353B5A89C8AD306B4BBF728588140F51ED614E2D2BD9FD8100C6BB79B279CC36D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Krush.exe
- Size 78.1MB
- SHA256 cde44481848004511d41ceecf272da72a8d840b4efdbf4aedabb4d89f7140d21
- MD5 8bd221e1a94ec07453176915c61948a5
- SHA1 a63c6f77ca25d42de5ae633ee2ffd145516bb6ba
- SHA512 16e79f3b571062391498bff78921887318189d41f60c8c5dcf301e865f61adb9a62354d0cff033ca316df393a7662875a93bc67a8382080aae60c6dcdd8584f2
- SSDEEP 1572864:paa8pPK1eSIxHu5PJ3UNqOJr5bYoJAOeO72y908brtTwb/YKzRj7F7Y7:paTPKjz5PJENprZYoJAOW8br9uFju7
- TLSH
  T107083353B5A89C8AD306B4BBF728588140F51ED614E2D2BD9FD8100C6BB79B279CC36D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution spyware stealer adware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  EAC.exe
- Size 201.4MB
- SHA256 c92a99fd9784ba77fb4f2d389a4f4be350e7c52a5293f530c55e0423ac13ba19
- MD5 1bd45a9d53350769527e1c4ecac9830b
- SHA1 1b34ba46b05c7bcd96841ddd0f6a8df079b8c9d5
- SHA512 795df3efd99c6d09d8124c65078f6814af37ddf8b3eecc20adaf93f1fafc08da4f50f32110b94a1ea556289457dd50a34321341c34144719119fff8d6a2dacfc
- SSDEEP 1572864:jjO3d+HTPc9eDaxayId+tUcbGxq+TA5htqiQNvF1rtVxa5XLmgYtVHbI5op/cObb:POISeEyNRqVOb/ZUmLg
- TLSH
  T122A88C13E29641D9E05DD175874A9733FE72B8094B28A2DF2B5407522F77EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral7
- Target
  LICENSES.chromium.html
- Size 14.5MB
- SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
- MD5 b5e57572cfb5efa08f55f46772a42ded
- SHA1 51db84dada057af72e2fb8acca3ee4436e4bd3ed
- SHA512 288bcbf48f928866a0d2910fe57cfbc040f23b533bbdf4ef6fa43631edf6035d689ea41643b3afe833cb7476ecb2fbb932f137f3734df8462898c4837f6096eb
- SSDEEP 24576:6eBHJjZ6vobjZ6Mt3jK6DCHwR2auHxKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61J:6er8aeUSn8mMRx5
- TLSH
  T184E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral8 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 0d21de0f4497f126b9aad67c57b045225185c70aad2308a25db01d6086e4d5a7
- MD5 fb6c1c85f451d6896853a6019bd9c68b
- SHA1 8bf561af8b2e139726971a063ba01bf5f6584c49
- SHA512 07686e6a16a5bc71738536298b306e3a193315fc54713894e544c09f5612b72c996b4bec8895c5ab536dbc532659f6c576eeca9a799ae654cbd5ec8062ba8dc3
- SSDEEP 49152:BsKpBOHzkKJhXq/5QkwjyuwKVmQb9Vvdx5j3CXPTZnxEHzhl96Rc/6BOOPxwmetu:Bsfwl/5QRyozDCXPTZnxEHzhl96Rc/6b
- TLSH
  T11AE59E02F6D650DDD029D57097AB9313F631340A4F205AEF2A804A253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 492KB
- SHA256 dfd53ccbfce55510f2afdb52703037452370eb5bdf33143829a8b06253015625
- MD5 57bc15efd99e4459efc44584d9ab227b
- SHA1 cea68bcd7533d1645d1316708fe6f5b3fca08a75
- SHA512 16296efd6ebb4338c30a859af994775d51a0b888b4662345f698fa849818c9b5b51a2f52032b75af07f95aef6ab30ed5625de59fbab4b7432545f28963ce9296
- SSDEEP 6144:WKfJzspvplL6HFFneUk5uEJds+Bwmedeh3xc5WedvIe+zzKx/H:F+pvDY2UkBdseedetxc5W6vIe+U
- TLSH
  T195B49E15B3E845A9E07AC5388A434603DB76B8560B65FADF03E093792F37BE45B3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 b348ceedd275843cbe344a29dd8550b18e5d433abff695cdf5658470c1e71c67
- MD5 358cfe0d819a8bb0651e3ce274fc667d
- SHA1 41968bfec59f21a1509379b52149b0973874f673
- SHA512 48a3a1856efd9bfd1995d5be30a2fc3c9c722aec5fdd646c2822a0348ea873460645666923b94722e254679fca5df8b93334734f7bca195229148a7c22bca7fa
- SSDEEP 98304:R9sNg++Z3KDUJEiqGZxGtBmhbqxQ0BRHTSeX2cXqwa2h:X1KDEI4c37eW2Tw
- TLSH
  T19F868B03F69640D9C05DE2B897579227FB34B8450734B2CF2A9457252F67BE0AB3EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 c753107d8827525306b83d3c35da988b0954caebc4ab806d4ca6f27b7a0d8bdf
- MD5 c2c4f00a3c333cf3adb925450781f4f5
- SHA1 53188a91f51db0d2f727a5ad8df0f49c65fb7887
- SHA512 6c7c3af14cca712a6ae578193a7ee6bc3bc66d2fcd8a1bff21a0a36324149aae364e6928323c0fb45943460fee216777f321cbb7b36e10f6083598d8f26d0dc5
- SSDEEP 49152:anydgpxuaL++kI1sj+CaAnxQ/J2NBbFckI3TKUqVMo6OFLfediIqXSbhcKBlc1x6:aydgpSX5O2h1+zJ12e
- TLSH
  T14F462703F28680E9F05DD679875BA622F631FC814B2276DF56A01F192E77BE06739B04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  vulkan-1.dll
- Size 917KB
- SHA256 40e39b8cd62c3292f7c5ad6a2d863f6e3bd3d2c0b1b3a2a0e4d41a61d2a8f758
- MD5 191d4f97be05c52720f41b6d75c45c82
- SHA1 66677c339dc93f3f184be05d0c00cf3b9e80a941
- SHA512 9f13c89c4a07b7b2aa5a94ced747b7ba75d464d8969fbcbdc4c64fa9478c192d3a659f7b50df0591051ce34b51de5cddea911f6cb7806a1c05b68cc53af9a31a
- SSDEEP 24576:MKQWGPJTps7zeRlp2MOi88y6Z5WGcSDYsHQDi6g3P0zAk79oOHHW:h9aJts7zeR5b88y6Z5WGcSDYsHQDi6gu
- TLSH
  T102155B1396958569D57AD038CDD28607C9B174822322BACF02A857087F6FFF47B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19