20d8e60cf72edd7c11b9535c83a2ed534ad154da9eb9990ca38b44fe73de99fd

Sharing

Copy URL Twitter E-mail

General

Target
shaderzonenw.rar
Size 113.0MB
Sample260710-e8epwac16q
SHA256 20d8e60cf72edd7c11b9535c83a2ed534ad154da9eb9990ca38b44fe73de99fd
MD5 78209c5caf5083226fbc6e441ae28e60
SHA1 47e766a99436adcb469a5bd1f47f93bbbb9735a0
SHA512 331216da1f1635c655bf67745722edaae5af2941cf2820858149fc6e0dd5fe79b708257fe85d461a0c88e056ae0f1fc59457e914d3ad9141f96027e97b7500c7
SSDEEP 3145728:zRdIdmdSklcRMDH+U5oFX3jfWocbntFNb2YNt/G:Fm8S+c2V5cunbFNt/G
TLSH
T1DA483380EF04C6BAE4207E349999AF9619B6953CF34FB20DD85C4995B730603C977A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  shaderzonenw.exe
- Size 113.0MB
- SHA256 870ae8a2d8e21fdd302ff38a460afbef09d923ab1d4bc4d27941111fed44f9f3
- MD5 5cd87f673c8cf08189174c6f7b1c00c2
- SHA1 eae3a38859e2acbfab3f6f7ac58e72ebad15c8c5
- SHA512 e11a13b81785d9c74bb99dd7480a3d5ee2aaffa12fd4a45303d3842d57c31863284cc6fa01b20b256425918d3c1720c81e3e7a3be51705219d6e61a941e2bf38
- SSDEEP 3145728:JRdIdmdSklcRMDH+U5oFX3jfWocbntFNb2YNt/k:fm8S+c2V5cunbFNt/k
- TLSH
  T184483380EF04C6BAE4207E349999AF9619B6953CF34FB20DD85C4995B730603C977A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  resources/jre/bin/msvcp140.dll
- Size 561KB
- SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
- MD5 72f3d84384e888bf0d38852eb863026b
- SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
- SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
- SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
- TLSH
  T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  resources/jre/bin/net.dll
- Size 96KB
- SHA256 80c85f578afa95e52ad502b05c669030a8f4245e3c289534f1d81ef6bdf97127
- MD5 e3c0833fd8cdaa6e5d48797d7aa8a81b
- SHA1 7e7fd25f5bcf693be0533aaeee1faec194fcffdf
- SHA512 b5ac6a52e385ed33a6ff5d727e8047f61b0bdce038ee42a2065c7d11c8bc5c2339932d6a30a9c885929e42d5c20f53696386d64dea0cb2d6ef37a4448623028a
- SSDEEP 3072:RPSfwd6sn+hIcB/lRXsm+xd3MXf9ESQ19pP+v:R9dnni/lRXspJMv9m9Y
- TLSH
  T15DA35B05635824D5FC77D2BC8586821BD7B3B0B02650839F13A6C66EAFEB7713E19782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/jre/bin/nio.dll
- Size 78KB
- SHA256 aef35f2aa1817fa845f2eddc678e671424fea538fff5bde207789ad9ec8c5faa
- MD5 7835cdaa143f25b24f3cc6ae44a3ea9a
- SHA1 ec0b3ff9a37186ac703c2807d5cc1f9387ca7f1c
- SHA512 cb4a319e24505e4f067e452a0d660844491a13dc91e0939812a05521a008ea364d02e8916841d3e2fd94a965e81c69a8bf5c3cf6074a95682f1ba8986fb52940
- SSDEEP 1536:r0p78LdqTFVd44arFkiZZ32supMTlB47VIv:r0pqIFz4rLZZ36pMTb4+v
- TLSH
  T1ED733AA65364849BE83AB53C429A5747E233FC114510A35F5368CB669F2F2B33E3D782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/jre/bin/prefs.dll
- Size 25KB
- SHA256 ed16fd5dd63d0d35a5b3b8a0decf97232d8fca159ce7625989419145b942745e
- MD5 7d3833f3a2988f7335da918f54460f81
- SHA1 b2f62c290ded668154f1045fb9f99f699cf1b67f
- SHA512 da1ce9bd4672ac6ab8c325f15e1a7b47230719f9083b82f349284890ce1e8af130baf48c5c087fa4bb27e08da2f4b7554259874a0f7eb657dc0c7c0d7213f6ac
- SSDEEP 384:FRD5PEBA0l5W+tlQggYhvlcqWotNyEIYi2mL4/y8RFvIIvZXxRz:P9PEBLl5nenYhaqXyYiDLk5kIv3R
- TLSH
  T177C27D57CA940CC6ED37093098F64F16E9B3BAA51BA193CB137081191F677823B6C7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/jre/bin/rmi.dll
- Size 20KB
- SHA256 2f69aba2860f53d9bcca46106b7ea37751d99dfefe8c466ad66887cfd8611bfd
- MD5 b1263940255b200821367c8984920d6c
- SHA1 780ffda7d452b1046e323938f420fd7fc706625f
- SHA512 484e791c372c3fa7d59b2a6748f8f84f3c2c816c5f050957505564891a862313730d8d35e44630c5cc5dee8fe9d46bf1d2720487f75d763485b75bd5243fedb8
- SSDEEP 384:6/jEhN6zZ7kwrNyEIYi2mL4/y8RFvIIvZ+pzd:SEhMkw4YiDLk5kIvO
- TLSH
  T1AF928D9B99944C48EE1B4630E4E56E2BE9B6B7512B51D3C73324C0251F523837BAC3ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/jre/bin/rmiregistry.exe
- Size 24KB
- SHA256 74b017bfc1c00124159b37e07cc20da39d37c7e6984dd6f37f342f5e4e6f09cd
- MD5 2e0664abd1d6d6a82f3260ebe8534712
- SHA1 26e36a85fe137ed6129566aa4c0f51b3becfc950
- SHA512 33f6a34db0e60904dabb8afcc98f3c2d76aa2d16fe6f7d20064c10390bef45d737b921769f42772b2001fbc51fe03dbfeddc76b5c28235edee9a06277e7d9b59
- SSDEEP 384:q4jwddYQyFuv5AMNyEIYi2mL4/y8RFvIIvZVFl:q40deFuv5aYiDLk5kIv
- TLSH
  T13CB28E17CE800C96FE5B96B0A8E4671BF9B1B6956ED1C3CB2368C4581F503C03B992DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/jre/bin/server/jvm.dll
- Size 12.1MB
- SHA256 89c64a12328b82bbacdeafd0cbcabf175aeed0581f99fe0f737ddbd962c25fd4
- MD5 9c5f15013d3e9a5947b1c9523aeb3642
- SHA1 64fbc24e59839ab88769412ac46b37adfb793fa3
- SHA512 12e7b0b1da23edcc3134a9167dd1150e53ae91b9636470e67363f9b12d961dbf640ddae99b11772ea0d3b0f5ae52f1f63d5ad90e4c49a45ca1ed9da74c309e2c
- SSDEEP 393216:TySHyrwXSq02pT1OCf01QkKyRHz8f79+PQIaGI5jm90LZcAluFVfxY5s2FoRiIqG:TzWL
- TLSH
  T185D68C1BA37480D4D82BE178CA2F5A0BE7F2B4945374DBDF11A846496F53BE1963E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/jre/bin/splashscreen.dll
- Size 211KB
- SHA256 546e2cb59d6c920dee0ee045c7cd5d8a53ba3f9e77277456434a9df1b270b991
- MD5 cecf510e5ddf7eabd45b393594aae7c1
- SHA1 4dfd50ed9730975abbdcfdb8af752cff0eeb6f7e
- SHA512 827a1862d2e528e3462b0bde24d978be611e25b9a3b1c1738369c2f30967f1bc3328bc5f6fbeb3d555a326df6b832d36de5541440ff5afcc68abd831aee39875
- SSDEEP 6144:EHWPo2vB8iltQICd6N7AULN8Jsb+wPzLbBJe:tQ+QU4sb+6n
- TLSH
  T11C249C46F67018A5DCBB81B8C6E6861FE3F2706A1390C78F579487666F17B203B4D3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/jre/bin/sspi_bridge.dll
- Size 44KB
- SHA256 1a24eab17f3be94f770482b4838b6ca8a6513fed3c4575416d96717704336115
- MD5 e2ea515acbff95126f0a8404c75e96e5
- SHA1 4d4503653796f05f8a12db49bf3e8d074aace73b
- SHA512 90793495c6107c5a857cf1d78714bbc1fd7f294b832d539b7bcdaeb671e3611b3244b58ca8bebfc99e746bd27ee4d21da0dabe65cbb6a1235e07b5b9f0c5469d
- SSDEEP 768:HyFmDYq3JVIvEDdqU3dg8ETmoMDVr/2JEFOP/N2YiDLk5kIv:HDbH+2IM/dB/2OFOP127VIv
- TLSH
  T156139E6627D40085E867C671E8AA572FFBB5B5E23A22C38F0312C67E4FA13413759F49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/jre/bin/sunmscapi.dll
- Size 46KB
- SHA256 aa39dd045cb3405bf415c127110f1bc8f6776e0495a70f5c23579108750d132b
- MD5 cc472f179e85f762a412b14040459e2d
- SHA1 67acc534402f9fd7c3984439e524db9c77695ce7
- SHA512 f06531beffd2dfa39526fe67fb76369ef40d478684ed227a8fda274888c7484af3179b95ee33e31d46d22fe33585fa6382b7372722dd6deaf476d5d5ced1959c
- SSDEEP 768:ypcVGjySH1vLUdVmY3RukkJRs0mEZwyI2ixaTOKYiDLk5kIvq:ypcsyS1xk8Rs0mEZwyI9xaTOK7VIv
- TLSH
  T122236A1BC7A008D1FCA3C9B8C02A921BEA72F8865021D78F1355CA199F67B71B73C365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/jre/bin/ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH
  T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  resources/jre/bin/vcruntime140.dll
- Size 117KB
- SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
- MD5 caf9edded91c1f6c0022b278c16679aa
- SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
- SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
- SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
- TLSH
  T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  resources/jre/bin/vcruntime140_1.dll
- Size 48KB
- SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
- MD5 2bd576cbc5cb712935eb1b10e4d312f5
- SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
- SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
- SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
- TLSH
  T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32