3f2168b7e5bbadad39882ab98bf6bea5bd4b7167b6948eb21747ade1b1688137

Sharing

Copy URL Twitter E-mail

General

Target
Keymate_1.2.0_x64-setup.exe
Size 25.6MB
Sample260710-gxt2jafv7y
SHA256 3f2168b7e5bbadad39882ab98bf6bea5bd4b7167b6948eb21747ade1b1688137
MD5 ed562439ee894286436371df8234e66f
SHA1 3fa5b00ec2818ba7d2863dd5bd0094d86232d94b
SHA512 6c25c7e5e4aa372c606fa2f69230ff46bd5ab87cfac7d67d030e0fff29c0da64552b898ff5ce51273f7ebe61164f76b77f28b777fc01406e35a508d0b604e966
SSDEEP 393216:txuU1bLnV35hLkgakEqpYi0iB1wLwgfXcZES5cmboHdBbcrl/fzGgM8ZDtiIfe3B:tPnJ5BaLUwL3XHS2Wo0DfPiqeR
TLSH
T16E47335FC62E6CB6CE25667A2FEA43B4F3165F279A0877CE17FE45086497008BF26050
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Keymate_1.2.0_x64-setup.exe
- Size 25.6MB
- SHA256 3f2168b7e5bbadad39882ab98bf6bea5bd4b7167b6948eb21747ade1b1688137
- MD5 ed562439ee894286436371df8234e66f
- SHA1 3fa5b00ec2818ba7d2863dd5bd0094d86232d94b
- SHA512 6c25c7e5e4aa372c606fa2f69230ff46bd5ab87cfac7d67d030e0fff29c0da64552b898ff5ce51273f7ebe61164f76b77f28b777fc01406e35a508d0b604e966
- SSDEEP 393216:txuU1bLnV35hLkgakEqpYi0iB1wLwgfXcZES5cmboHdBbcrl/fzGgM8ZDtiIfe3B:tPnJ5BaLUwL3XHS2Wo0DfPiqeR
- TLSH
  T16E47335FC62E6CB6CE25667A2FEA43B4F3165F279A0877CE17FE45086497008BF26050
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 73c49019991e9cf301e1942ae570e6c2918a4aba75bd233b5a1356b8d514026e
- MD5 567b3fdc8790325346626fbdd552c46c
- SHA1 c88f6efc05ecd08e9b496f33631a25f2841d5a6e
- SHA512 89e38e29202c23c73b88435cec267f5c0eee7f11bd32daa5e68b3c6d29c9396fbf963716212ff39917fa7e4565eb3d66321b31d93f6b450cb4287b05ff5de0ee
- SSDEEP 49152:uiiGT3Ds8j1fukXjNWnlD6KerDpLRqDQODloWt:jiiRfukZWerDp9SDt
- TLSH
  T1CB75232676E04035F0B71A3086F096B22D7EBE710B711DAF13517A2E1F70992E6357AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral11 behavioral12
- Target
  bundled-plugins/com.keymate.ccusage/dist/index.js
- Size 487KB
- SHA256 0c3d4ad2c063fca650d14dbad2f6afa41c2485eb18ef15ddf08589fb1d32d991
- MD5 cafb458ed42a4ab92517ed08380240ec
- SHA1 3ee9ce76a36db9ebdfc35ceb6a535f2918dc82e0
- SHA512 28a4ebb57f18f2b38ec0ed701871888c6ff91ae726cdd7628da00c330ad92b173f85f368036be21540151c6750a4247d08a8f3bd5e2958168d257027d2b1d8be
- SSDEEP 6144:lBIC/7NEojnf8L8PdD+wk1i3havsRjRiN:lBIq7NEojnf34woi3havIjRiN
- TLSH
  T1BEB4C8AC6C632562CA63A1796F2F54A1373688032D0CFC547A4D8254DF9920996FFFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  bundled-plugins/com.keymate.discord/dist/index.js
- Size 479KB
- SHA256 6fed47dc3571d5cf6bfb55a4fefdb60ba24fa796d12d8d573cbea9ffcbe25416
- MD5 b3e250a6b0b4d13735fecbf4126c65b4
- SHA1 85f3e9390ca87e5f952413dd4e52e27883786fa0
- SHA512 b2b7e248c8dffb498fe50d26c22f537047914a5441419c081282e085b61f1abbc100c6b055e0bab5009fe6a14fc9ebbfc2852f7bceee8b6ec69eb16a56a09ce9
- SSDEEP 6144:lP+Y/7rQojnf8L8LdD+wkPi3nUv9jwXh/DOpe3tVDRce8c3oc4:lP+k7rQojnf3kwai3nUv9jwXL37Zc
- TLSH
  T1B3A4EAAC6C632562C663A179AF2F94A1373698032D0CEC54364D8254DFA4249D6FFFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  bundled-plugins/com.keymate.obs/dist/index.js
- Size 465KB
- SHA256 7dc062fbad2c1760d54dd75a6964484621f6e8f78ba019ecf1f0ad4a28bcc78e
- MD5 def40e4fd7aa01af2d6d65aa8386e30d
- SHA1 a8fcadd89f38ebbd50ead3353a38e09a90476bd7
- SHA512 42c56e6c8337497c451116254865ac523ee087242f173f62371a10dd8f60d05f516bf2580447c66fac3313eb2fcec972138b7da090f87932f14ae3c4581e9278
- SSDEEP 6144:lJIC/77Qojnf8L8PdD+wk1i3hUvqjwXgxlN5E:lJIq77Qojnf34woi3hUvqjwXeN+
- TLSH
  T169A4C9AC6C632562CA63A1796F2F54A1373698032D0CEC543A4D8254DFA4249D6FFFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  keymate-desktop.exe
- Size 42.5MB
- SHA256 b630b16cba9432c386212a2947e8a00636fc3e5bb0bf60c5ac51a4b6d3664ec3
- MD5 2f8fb48ecf6e588012a823bec28444d5
- SHA1 80326a0a766b08a8d3f1ee2c9adbe8f88e70211d
- SHA512 eed1d09eecbfe151b96bfcdc20b9a894dfe904d904251581c49ba1b140d911c691bec9fbb29179d8ef7c6c2fa041c6fbf9869c96d4aa8c9eb40307c6ce313b44
- SSDEEP 786432:S6DVkpmzyRfPoVei7bjCLvGcDQkiUISekSjnak6w:S6DVkpmzyRXoQi7bjalMxfna
- TLSH
  T1EDA78B257B9A996DC09AC474834B8A725E7130CB0B35B9FF448496383F69BF42F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral19 behavioral20