20d8e60cf72edd7c11b9535c83a2ed534ad154da9eb9990ca38b44fe73de99fd

Sharing

Copy URL Twitter E-mail

General

Target
shaderzonenw.rar
Size 113.0MB
Sample260710-es647acy5q
SHA256 20d8e60cf72edd7c11b9535c83a2ed534ad154da9eb9990ca38b44fe73de99fd
MD5 78209c5caf5083226fbc6e441ae28e60
SHA1 47e766a99436adcb469a5bd1f47f93bbbb9735a0
SHA512 331216da1f1635c655bf67745722edaae5af2941cf2820858149fc6e0dd5fe79b708257fe85d461a0c88e056ae0f1fc59457e914d3ad9141f96027e97b7500c7
SSDEEP 3145728:zRdIdmdSklcRMDH+U5oFX3jfWocbntFNb2YNt/G:Fm8S+c2V5cunbFNt/G
TLSH
T1DA483380EF04C6BAE4207E349999AF9619B6953CF34FB20DD85C4995B730603C977A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  shaderzonenw.exe
- Size 113.0MB
- SHA256 870ae8a2d8e21fdd302ff38a460afbef09d923ab1d4bc4d27941111fed44f9f3
- MD5 5cd87f673c8cf08189174c6f7b1c00c2
- SHA1 eae3a38859e2acbfab3f6f7ac58e72ebad15c8c5
- SHA512 e11a13b81785d9c74bb99dd7480a3d5ee2aaffa12fd4a45303d3842d57c31863284cc6fa01b20b256425918d3c1720c81e3e7a3be51705219d6e61a941e2bf38
- SSDEEP 3145728:JRdIdmdSklcRMDH+U5oFX3jfWocbntFNb2YNt/k:fm8S+c2V5cunbFNt/k
- TLSH
  T184483380EF04C6BAE4207E349999AF9619B6953CF34FB20DD85C4995B730603C977A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  resources/jre/bin/msvcp140.dll
- Size 561KB
- SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
- MD5 72f3d84384e888bf0d38852eb863026b
- SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
- SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
- SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
- TLSH
  T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  resources/jre/bin/net.dll
- Size 96KB
- SHA256 80c85f578afa95e52ad502b05c669030a8f4245e3c289534f1d81ef6bdf97127
- MD5 e3c0833fd8cdaa6e5d48797d7aa8a81b
- SHA1 7e7fd25f5bcf693be0533aaeee1faec194fcffdf
- SHA512 b5ac6a52e385ed33a6ff5d727e8047f61b0bdce038ee42a2065c7d11c8bc5c2339932d6a30a9c885929e42d5c20f53696386d64dea0cb2d6ef37a4448623028a
- SSDEEP 3072:RPSfwd6sn+hIcB/lRXsm+xd3MXf9ESQ19pP+v:R9dnni/lRXspJMv9m9Y
- TLSH
  T15DA35B05635824D5FC77D2BC8586821BD7B3B0B02650839F13A6C66EAFEB7713E19782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  resources/jre/bin/nio.dll
- Size 78KB
- SHA256 aef35f2aa1817fa845f2eddc678e671424fea538fff5bde207789ad9ec8c5faa
- MD5 7835cdaa143f25b24f3cc6ae44a3ea9a
- SHA1 ec0b3ff9a37186ac703c2807d5cc1f9387ca7f1c
- SHA512 cb4a319e24505e4f067e452a0d660844491a13dc91e0939812a05521a008ea364d02e8916841d3e2fd94a965e81c69a8bf5c3cf6074a95682f1ba8986fb52940
- SSDEEP 1536:r0p78LdqTFVd44arFkiZZ32supMTlB47VIv:r0pqIFz4rLZZ36pMTb4+v
- TLSH
  T1ED733AA65364849BE83AB53C429A5747E233FC114510A35F5368CB669F2F2B33E3D782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  resources/jre/bin/prefs.dll
- Size 25KB
- SHA256 ed16fd5dd63d0d35a5b3b8a0decf97232d8fca159ce7625989419145b942745e
- MD5 7d3833f3a2988f7335da918f54460f81
- SHA1 b2f62c290ded668154f1045fb9f99f699cf1b67f
- SHA512 da1ce9bd4672ac6ab8c325f15e1a7b47230719f9083b82f349284890ce1e8af130baf48c5c087fa4bb27e08da2f4b7554259874a0f7eb657dc0c7c0d7213f6ac
- SSDEEP 384:FRD5PEBA0l5W+tlQggYhvlcqWotNyEIYi2mL4/y8RFvIIvZXxRz:P9PEBLl5nenYhaqXyYiDLk5kIv3R
- TLSH
  T177C27D57CA940CC6ED37093098F64F16E9B3BAA51BA193CB137081191F677823B6C7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  resources/jre/bin/rmi.dll
- Size 20KB
- SHA256 2f69aba2860f53d9bcca46106b7ea37751d99dfefe8c466ad66887cfd8611bfd
- MD5 b1263940255b200821367c8984920d6c
- SHA1 780ffda7d452b1046e323938f420fd7fc706625f
- SHA512 484e791c372c3fa7d59b2a6748f8f84f3c2c816c5f050957505564891a862313730d8d35e44630c5cc5dee8fe9d46bf1d2720487f75d763485b75bd5243fedb8
- SSDEEP 384:6/jEhN6zZ7kwrNyEIYi2mL4/y8RFvIIvZ+pzd:SEhMkw4YiDLk5kIvO
- TLSH
  T1AF928D9B99944C48EE1B4630E4E56E2BE9B6B7512B51D3C73324C0251F523837BAC3ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  resources/jre/bin/rmiregistry.exe
- Size 24KB
- SHA256 74b017bfc1c00124159b37e07cc20da39d37c7e6984dd6f37f342f5e4e6f09cd
- MD5 2e0664abd1d6d6a82f3260ebe8534712
- SHA1 26e36a85fe137ed6129566aa4c0f51b3becfc950
- SHA512 33f6a34db0e60904dabb8afcc98f3c2d76aa2d16fe6f7d20064c10390bef45d737b921769f42772b2001fbc51fe03dbfeddc76b5c28235edee9a06277e7d9b59
- SSDEEP 384:q4jwddYQyFuv5AMNyEIYi2mL4/y8RFvIIvZVFl:q40deFuv5aYiDLk5kIv
- TLSH
  T13CB28E17CE800C96FE5B96B0A8E4671BF9B1B6956ED1C3CB2368C4581F503C03B992DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  resources/jre/bin/server/jvm.dll
- Size 12.1MB
- SHA256 89c64a12328b82bbacdeafd0cbcabf175aeed0581f99fe0f737ddbd962c25fd4
- MD5 9c5f15013d3e9a5947b1c9523aeb3642
- SHA1 64fbc24e59839ab88769412ac46b37adfb793fa3
- SHA512 12e7b0b1da23edcc3134a9167dd1150e53ae91b9636470e67363f9b12d961dbf640ddae99b11772ea0d3b0f5ae52f1f63d5ad90e4c49a45ca1ed9da74c309e2c
- SSDEEP 393216:TySHyrwXSq02pT1OCf01QkKyRHz8f79+PQIaGI5jm90LZcAluFVfxY5s2FoRiIqG:TzWL
- TLSH
  T185D68C1BA37480D4D82BE178CA2F5A0BE7F2B4945374DBDF11A846496F53BE1963E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/jre/bin/splashscreen.dll
- Size 211KB
- SHA256 546e2cb59d6c920dee0ee045c7cd5d8a53ba3f9e77277456434a9df1b270b991
- MD5 cecf510e5ddf7eabd45b393594aae7c1
- SHA1 4dfd50ed9730975abbdcfdb8af752cff0eeb6f7e
- SHA512 827a1862d2e528e3462b0bde24d978be611e25b9a3b1c1738369c2f30967f1bc3328bc5f6fbeb3d555a326df6b832d36de5541440ff5afcc68abd831aee39875
- SSDEEP 6144:EHWPo2vB8iltQICd6N7AULN8Jsb+wPzLbBJe:tQ+QU4sb+6n
- TLSH
  T11C249C46F67018A5DCBB81B8C6E6861FE3F2706A1390C78F579487666F17B203B4D3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  resources/jre/bin/sspi_bridge.dll
- Size 44KB
- SHA256 1a24eab17f3be94f770482b4838b6ca8a6513fed3c4575416d96717704336115
- MD5 e2ea515acbff95126f0a8404c75e96e5
- SHA1 4d4503653796f05f8a12db49bf3e8d074aace73b
- SHA512 90793495c6107c5a857cf1d78714bbc1fd7f294b832d539b7bcdaeb671e3611b3244b58ca8bebfc99e746bd27ee4d21da0dabe65cbb6a1235e07b5b9f0c5469d
- SSDEEP 768:HyFmDYq3JVIvEDdqU3dg8ETmoMDVr/2JEFOP/N2YiDLk5kIv:HDbH+2IM/dB/2OFOP127VIv
- TLSH
  T156139E6627D40085E867C671E8AA572FFBB5B5E23A22C38F0312C67E4FA13413759F49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/jre/bin/sunmscapi.dll
- Size 46KB
- SHA256 aa39dd045cb3405bf415c127110f1bc8f6776e0495a70f5c23579108750d132b
- MD5 cc472f179e85f762a412b14040459e2d
- SHA1 67acc534402f9fd7c3984439e524db9c77695ce7
- SHA512 f06531beffd2dfa39526fe67fb76369ef40d478684ed227a8fda274888c7484af3179b95ee33e31d46d22fe33585fa6382b7372722dd6deaf476d5d5ced1959c
- SSDEEP 768:ypcVGjySH1vLUdVmY3RukkJRs0mEZwyI2ixaTOKYiDLk5kIvq:ypcsyS1xk8Rs0mEZwyI9xaTOK7VIv
- TLSH
  T122236A1BC7A008D1FCA3C9B8C02A921BEA72F8865021D78F1355CA199F67B71B73C365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/jre/bin/ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH
  T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/jre/bin/vcruntime140.dll
- Size 117KB
- SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
- MD5 caf9edded91c1f6c0022b278c16679aa
- SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
- SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
- SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
- TLSH
  T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/jre/bin/vcruntime140_1.dll
- Size 48KB
- SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
- MD5 2bd576cbc5cb712935eb1b10e4d312f5
- SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
- SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
- SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
- TLSH
  T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/jre/bin/verify.dll
- Size 53KB
- SHA256 4fc4990f37b3967d33523e540438e2f1cd64784c1d587f369fe230ca7639aca8
- MD5 792d3ee599a85f9a7fffc606c58f67b1
- SHA1 c77a550f4600314d4b952e7b1fdd008afa4d19ba
- SHA512 8c55e5baa269699b6b090dda43bc4b271c906aa57c0bff35d95488900ac18da4476103b2cd44ac873a21bda19969a6a71b88e9e1cf5d875f4c13ed0c633ec6c8
- SSDEEP 768:yHCLyeM3rBXI38xzmjNSbYpviCCu+pXr5KZ6WR2DOPyD1JHYiDLk5kIv6n:SCU7O38d3bIRCu+Z5QyD+yBJH7VIvo
- TLSH
  T1DA335B5792640076E483C238C663BEEBDBF1F4451B0083CB525487DD3F97BA0AB557AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/jre/bin/w2k_lsa_auth.dll
- Size 30KB
- SHA256 2f79fc30b71c0c29a42797c7cc634f6d06da443009c2f522baa177143669e7f8
- MD5 026080328ad123dfcbb0cfd0c6347f11
- SHA1 ae023d6e5fb24cfc11663b61d8ee8a2e514f7afa
- SHA512 5632f4f4b7214cd5c70ff76d800edfa146e94622ac3a72da9818bba1ca53667f85292abe5d75734a1de27d1dfebe88533e6d9db6643bb0fca44338ea452c0c5d
- SSDEEP 768:Boq/jwJs/tR6I3gNoZTU3iUOHkbGGGGNET7T7T7T7lWa/I+/mPVYiDLk5kIv2fca:XMJsVR6I3gNoZTU3iUOHkbGGGGNET7TW
- TLSH
  T14BE27D9BC6D01498F8379D38E4B2640BE3727A573770C3CF5790803A9FB63517A29296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/jre/bin/windowsaccessbridge-64.dll
- Size 71KB
- SHA256 22c23b64989a6a8cd1873d01aeadb9a0065e665ceb26328d68b47580c0dcccd1
- MD5 62e3eb44cf422a81d0ae48859fd76ec1
- SHA1 497f7d957ecf41179e2fd7de59f6307cdc34075f
- SHA512 b2d73fa7fb23fbafb0299f5f4c3e7cffec5f14d0a531f14043df5dad99db59c6c88c7907d33ef66b94c9630374e2bb103ecf86fb3a7cfccb7f7ae47ea4136c0d
- SSDEEP 768:AAOSmuGy3/MQ5L0XgW66vof3UtzM8TFfUquYiDLk5kIv:lOlXy355L0XggUUto8TFfUqu7VIv
- TLSH
  T1E9632B53F29420F2C22E817D9CB14124AEF97BBC5633474BDA7FA11B8B92152563E732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/jre/bin/zip.dll
- Size 85KB
- SHA256 d4b544165c60f20dd092155c43d36dacb1f84364cb8c9da2d784b99f56127a71
- MD5 c4c6f2983a3b9a41c7dad7e917bfbc49
- SHA1 6c936cdda5546f25fba5b16b95a46c63e7141521
- SHA512 501ec4d27e35be543f430a6cfe27da6f33dd3006b7bcd582f3b26d66065120cbd079a25f2f187ee625228e8c02507de416f598fd453f60dd94d8752d2beb922e
- SSDEEP 1536:yFXvKtAnZ4qAvZ9cRR0K2cIOxwaFVJ07VIv:6XvKtAnZLAMb04xwah0+v
- TLSH
  T16C838D559AA05155DEFB85B0C9F34B2FD3BAB04152A0478F6398839A2F532613F4C3FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  resources/jre/lib/jrt-fs.jar
- Size 107KB
- SHA256 1bae44b654108c760ebd83510a33cb24625849e7979f7d3ec0d5c0d51872ac23
- MD5 50bde18d8b064e9678e6a253e46df51d
- SHA1 7d4718b4a491975b5862d67bfbfe7e26de0c1613
- SHA512 51772ccf7cffa5249ca28e0ac15b58bfa4efb1b331d461fd9a26cfb6230fba884f70b8a4fdf630c3a29d8ccd2abef024429ffc9e7b29fe82646d5f8b24c0b645
- SSDEEP 3072:omAm1r0JH6zF5UnsT3bWH6moz2ODYJkhJYkTqR0Z:oN+ruG5UuxrjD4kp+R0Z
- TLSH
  T17BB3D17BAED18621F133C2B0E480C21E693E54EA91DED21B4174C08996F3ED64F79BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  shaderzone.exe
- Size 168.6MB
- SHA256 20d8ad2c722c7f95c4660233d01b3aa29ff4d8b208ea94bea5ee1817a847a7b5
- MD5 35f1ff18688b46215aa93ee2a01ae34f
- SHA1 d2a50ad71fea5a793bbaf57d455396042e76aca4
- SHA512 4dc8fad68b3a8b02e0eb7a4e10bbf668f4aea68634bde8745daadad4ae3695e15cd8cacdcc56680ff87eeabab4f7a7579bbdbbe36431f2dbc8e2f0ba160b75b7
- SSDEEP 1572864:POhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:jgmeNxNNZxqV
- TLSH
  T1B2887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral23
- Target
  vk_swiftshader.dll
- Size 5.0MB
- SHA256 680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc
- MD5 583b1d71cd7b847ba02d734c508cd92f
- SHA1 d63966aeafa951d51967620c606e9b97399699c4
- SHA512 cbb0659ccac9344ed9bb151443a30c106711fa1b15234e6f1225ef28a679c6b3f0a24a6ca1d9baff46155c39ff4e08e3ac96e1da32d665be9a5728956012f193
- SSDEEP 49152:yO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyD:yLftMUSogaEm5hZdIOlEbRaB3YI7
- TLSH
  T10E363813B2858199F05DD5794B5BA632F632F8801B72B6DF52A00F192E37FE06B39B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  vulkan-1.dll
- Size 925KB
- SHA256 d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2
- MD5 47af18d68dc7cf271f0a92707f783f64
- SHA1 64594e92a1cd7042cf6367b1843abed210db3d78
- SHA512 2e8fefeccc25e5fcb448fd874f99b8d1466a8148ffe80e1f6ac2105d18bb93e529681ff0ba38e515f52ed4df9ac091fee0782afe5e093fd83c3045a60409fc10
- SSDEEP 24576:Ty+lCO+5ia/1DW6pb9MLtX6Z5WdDYsH26g3P0zAk7o34:TymVqXpbId6Z5WdDYsH26g3P0zAk7oo
- TLSH
  T171156D139A94456AD476D034C8C28607CAB178921726B9CF03685B087F6FFF4777EB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $R0/Uninstall shaderzone.exe
- Size 135KB
- SHA256 85c5e7cd065b37eadcf3fe04350f23181458629325258aadbb68a13761aa98e1
- MD5 549b68bac98a8555362899fdbb5d78ee
- SHA1 169b5f7e9fcaf9e248bdbba419cc900a59fac249
- SHA512 69ad3336fcda25851d840fe8d704b25b3ed26f5be1e23c751bbb74a0e352df09bd5230ce8b95d971be09424da464808b8f7eaf395a573eb9e023ce04ccd02533
- SSDEEP 3072:In77v00hEoDEtaulceAPTvl4Z6aH2tvhOEA1RJCir86SrSrv6Ia3C:I740I1mPTvlw6s2t0EyL+yay
- TLSH
  T197D3E011B7A0C467E9B60B714AB593EB2EB1F52128284F5337C1271E3DA2B91EE1D361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral28
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32