5f9688d174bb4a6f9252ffdeddf4705db75e6b40eb61fd26aa5edcea1d5d6be4

Sharing

Copy URL Twitter E-mail

General

Target
ZaloSetup-26.6.20.exe
Size 174.6MB
Sample260711-dbllgsax5j
SHA256 5f9688d174bb4a6f9252ffdeddf4705db75e6b40eb61fd26aa5edcea1d5d6be4
MD5 d1b6c63b37add24a394ac69ecfbd1f97
SHA1 a9f27445ed187d3784b25f2444f2612e2c652de9
SHA512 6a24e4cb940bc2bc3db2e0b005aa679b720911f78f816f36fd566f5129a95a2579636be0ae4850f00164e6e7c2cbd67481786e564f24d6a5714238b93fc66de2
SSDEEP 3145728:iuXEHb2Bn0g/AduWD9Rm8Uk0uU5YsEujbPjCqhwOG5BSqWKKQnWDU96jO2FW8:rXE72lroduEVpiYxurnwMqWKKQnWDplt
TLSH
T1BC9833F6435AE10CCA4E42B7C245A2FC32B56D388033D9A20DA8B59D287AFD53D772D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  ZaloSetup-26.6.20.exe
- Size 174.6MB
- SHA256 5f9688d174bb4a6f9252ffdeddf4705db75e6b40eb61fd26aa5edcea1d5d6be4
- MD5 d1b6c63b37add24a394ac69ecfbd1f97
- SHA1 a9f27445ed187d3784b25f2444f2612e2c652de9
- SHA512 6a24e4cb940bc2bc3db2e0b005aa679b720911f78f816f36fd566f5129a95a2579636be0ae4850f00164e6e7c2cbd67481786e564f24d6a5714238b93fc66de2
- SSDEEP 3145728:iuXEHb2Bn0g/AduWD9Rm8Uk0uU5YsEujbPjCqhwOG5BSqWKKQnWDU96jO2FW8:rXE72lroduEVpiYxurnwMqWKKQnWDplt
- TLSH
  T1BC9833F6435AE10CCA4E42B7C245A2FC32B56D388033D9A20DA8B59D287AFD53D772D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 86cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
- MD5 3dd80dff583544514eeb3a5ed851a519
- SHA1 56f7324d9d4230c96d1963e7b3e02b05a6cf5c24
- SHA512 955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d
- SSDEEP 48:S46+/p2TKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mhofjLl:zf2uPbOBtWZBV8jAWiAJCdv2CmwL
- TLSH
  T1ECC19470B3C248B9D491413368A733D36612EE746784500F9F6311AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 101KB
- SHA256 72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae
- MD5 33b4e69e7835e18b9437623367dd1787
- SHA1 53afa03edaf931abdc2d828e5a2c89ad573d926c
- SHA512 ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77
- SSDEEP 1536:Ayy+wx2YAlWrU5OX9crt5c4DBqiC7hk333kbQk:ry+wojIwgNcr1a7WH0b
- TLSH
  T189A31A527174349EE1F5077C176E2373847E1B38AB28A8DB03A249CEC3761E1A0F5B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- MD5 75ed96254fbf894e42058062b4b4f0d1
- SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
- SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
- TLSH
  T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7
- Target
  $PLUGINSDIR/app-32.7z
- Size 173.8MB
- SHA256 e31186c600f46936536088c4f4d29332f96192b8794efde0b7dc2eb488d8062d
- MD5 34b18018e5f5a0390b56630933f0206b
- SHA1 275ba7630255c49697eac7475d3100c7284df774
- SHA512 67848d36715c05d121ce4350dc02ccaf77daf0a85f2e6005cab44787b8ae3b53262535e293f3cb2d414f0218c20fd8088c0190186c4a65b610a3903d8b9876e8
- SSDEEP 3145728:+uXEHb2Bn0g/AduWD9Rm8Uk0uU5YsEujbPjCqhwOG5BSqWKKQnWDU96jO2FWg:vXE72lroduEVpiYxurnwMqWKKQnWDplL
- TLSH
  T1279833A7425E210DCB4C50F6C385E2CC33E96568C05369E30DFD99E1389EAE52E793E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Zalo-26.6.20/msvcp120.dll
- Size 441KB
- SHA256 e7fdfd82cf8c26034aa7a00c2e18bb9a736b926d2c0e6630f9909c418b4d6c55
- MD5 07e554c4d14076f9f3fb2eb75e1e1a5e
- SHA1 1d900271ea9905a730736f624c9c2431b717e908
- SHA512 4b20a3913ab4921cc01618702fd80ea60eda578a1432f067cee2cfeb8cda6964ea2da33a387b115539d5b792935d0db843920b06b45313bddd02758f4638d492
- SSDEEP 12288:TZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77X:9/8wVwHZFTwFOOos3Ooc8DHkC2e77X
- TLSH
  T18DA44B237B864CF2D19E53B231C9532557FAFC6441B1F343ABEEE1692FA5282E123611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  Zalo-26.6.20/msvcr120.dll
- Size 945KB
- SHA256 1de7a693185d215d2bf8ab3e9023fe8669ac83e15ba1159fb3de2c56e0fdf7b6
- MD5 0d81cd2f55db641c9b3c4127905cfae4
- SHA1 9eb7f14cfb3bfbe9bb9867340c3505d1a723ba61
- SHA512 1b109fc8966e85e53c136064eb654c0f4094382f14be9819b541b5ff81b207d2e77ffee9604976860f1f29bef4b0504e1a9bbb66a5afaa26e391d5a034b81370
- SSDEEP 12288:pBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJu:3mFyjLF847eiWWcoGZVOIxh/WxIAIbs
- TLSH
  T1EB25BE12B982C0B2C57202B1152DE77219BFBA71443598B7BBD98F0E1DB45C0FB67A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  Zalo-26.6.20/plugins/capture/D3Dcompiler_47.dll
- Size 3.3MB
- SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
- MD5 c5b362bce86bb0ad3149c4540201331d
- SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
- SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
- SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
- TLSH
  T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Zalo-26.6.20/plugins/capture/Qt5Core.dll
- Size 4.9MB
- SHA256 39abff2f61549f8ba27bfea5f862f750fa7a63bf73b3d757f47c6e868bcb83be
- MD5 7e65e6a61b235193bc37baa09f5ff1f5
- SHA1 2468ef97e326c441d0dda928ee9444700b60e1d3
- SHA512 530d56935a6105b279e5d13f12d1f4f069bd377738d0b0890c7d5cfbe480112d0a37d04545bf7b58d8f551cca447e16dbe1d2de4bc7f80a4b022a12fbb4eaa8b
- SSDEEP 98304:PZxRd4/kK+n9pnXQTJsv6tWKFdu9ChvC74:P74cwJsv6tWKFdu9ChK7
- TLSH
  T121368DA1BB9B8176E5A682718C7B532F0025EC120B5185CBA39C361D99B17F17F3B70B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  Zalo-26.6.20/plugins/capture/Qt5Gui.dll
- Size 5.1MB
- SHA256 4a929696d6489ff89b0a38c9bbfaeeaef30f60a9cd0b81f20125161d766190a2
- MD5 f0feb1e3a439e0db88bdd0bb1667226b
- SHA1 604b584493d16a1d6d0d8aefd10ac18af5cd9225
- SHA512 11c5306eb864ea81619d046be7d6aba6bb2be69f5cc2a9641efc683c8cbb7517806d88f627f651d2fc55487dd5b17bb30d7aca774a2678a5d77ef405eecb0e06
- SSDEEP 49152:I8hM0C7gcPoRWxLxcPCCZlk152Y76Z4/8pc01fftYKdPtdaB1zNdPTgEFcnu/Y:IFo48Pm2bp0PTgl4
- TLSH
  T143362ADDB1527173CDA292BE270F263FD1B6A966C30483C3C558AA9858703FA0F7B945
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  Zalo-26.6.20/plugins/capture/Qt5Multimedia.dll
- Size 563KB
- SHA256 84f81df20bdd9aaf59d8215aadf8736b79dd20b38d29015ecf65f626b31720e2
- MD5 a93c51a67842c63059a752096c374159
- SHA1 64ff44abfd9ad2e7b69b3cb5fd34eb421d34fe0f
- SHA512 ecebd375a310ee6c2e725307258ba040c08ab276f86cf38eaefeaed6e3bfec1c0d1d31f2a630e8a24f11a456a4e9f9dd4a8c21ed27087de56e6b3569aab1fef6
- SSDEEP 12288:Vvi5uor786DeYBsC/YjWT/YkTb9Dg/Ya1g/YfHG6/YlvsJRd5:Vvi+liBvw
- TLSH
  T103C42971B691C3B3E4D491B9288D8A239536F0504B1287C3F709BF9FAAE5BD16D3E241
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  Zalo-26.6.20/plugins/capture/Qt5Network.dll
- Size 1019KB
- SHA256 e1fc05f875185b9c7a60288ce8a79b2d059e3c5842f4c72d3579e94684bba5ca
- MD5 af24067f697405e621a876ef5b075fe2
- SHA1 92dee1976abdba405e957c8fd337a37b7ad2a68b
- SHA512 91c0afd8d3023b959ddad2b31ea842fed9f9e57e5680aafe1469199aa76f9195aee8f0e570fd7891fd3df3959a9f0750a8d03a05797efa8ce0f92fecb5b3126a
- SSDEEP 24576:wtdENvE0UskG6mT3nFs8bhcr+TPf3ucccck0giX2:DNvE0UcNvH3agim
- TLSH
  T193254AA1F35340B2E59882F54D4DBB3BC53DB1254B0636D3A31C9FD6D2A26E21E3E186
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  Zalo-26.6.20/plugins/capture/Qt5Sql.dll
- Size 153KB
- SHA256 ce79e29ae0fe62fd17d6cdb307cef05b61a31cc1a4af63a4803230945756e6f2
- MD5 cf7969cd0345805fd9b50aabe1b9c828
- SHA1 ff4e73eb49a3b424c80bcb87279f7bbac3da61a0
- SHA512 39eefb84d954036451186e338a3bebc4e531f816682857b2ad81bf463eae9bd3a946aec130239f69082c55bf175d0b719619fe835def759a8a777720d41b4d6e
- SSDEEP 3072:8VFbx9t7DgJMe13oGabHRPPOzF50/QBnGXQh/:8h9BgJNNghOZ50/QBnGXQB
- TLSH
  T120E31781B7B245B2D493DAB8484A756ADA3FF6850F6687D3D31FC951082C6E33C3A172
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  Zalo-26.6.20/plugins/capture/Qt5Svg.dll
- Size 258KB
- SHA256 a82e2801d252de8f32e0e2ad4f5d9656f484eeb1c693977ac8e09987a669f110
- MD5 01bcb6a12297fbbc503d96832cb289ba
- SHA1 025f2efb58b4ca43b38b7cae5f1e221836e7e270
- SHA512 6e002951c619926c7eedc5d3f71215c7047b231d30a3802cd61b5dbdc64c52cae63fcf7e659737bf0c669e58bab8e4908b2ccb18dcf88283e0917247e5dc4d6f
- SSDEEP 6144:Bw+++i/SNFzslkaT09F9kY7lvc5HxrqYJOxQUy8DvG14eIDIiO8PGJ0b3urQ3MHH:tq/SNFzdaT09F9k+vsxrzQa
- TLSH
  T1CC443962B2420E67D44AD378184F3A17A93FA046037C87EB97D9BC3958673F15EBA341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  Zalo-26.6.20/plugins/capture/Qt5Widgets.dll
- Size 4.3MB
- SHA256 312e2cc0fe7d1bf73ddde246f1105a83f12dc7923a9b02bd4e2614888752e6cf
- MD5 d79a36292b269607871afc815d61592e
- SHA1 8c3cbd375250da73d5e60879b8344a531ca95aa9
- SHA512 6af78640b8887a2dafb2adfdb47c57b4d4d979cdb1bfc1de603d5e50a6375cb719ac040cd4816e0cbe03c3fea33e80448d403280f3e6610fe420ff88a3c436be
- SSDEEP 49152:IuMQMs4X3mJ/yBBjWQ7PpweuH0+7KuG/8iP3z4oWmmFlu:IJ5BWpjiu71mm2
- TLSH
  T1DB269E52B2C143F4C895E1754C1EEB63C4B9B3054B1662DBA39CEE52A92D2E01F7B3C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  Zalo-26.6.20/plugins/capture/Qt5WinExtras.dll
- Size 434KB
- SHA256 2311e36fb36d7ff6d099601f920ce4e7b1753d0e1d7d5fde7e8ad962bef4da89
- MD5 7783e55ec8c7c6949d477c7d87190ec6
- SHA1 58b7360e6230f8f80a2ef22db0cdc6d043d46ca3
- SHA512 7a802d1f5d804eb40e7d36754716f72bb5258e7e500f1621151f7f4e65128a2f70bd86ef2f3f21a6a1e9f7f3e7c1bafda93b853d1b0affa69ea6feb828d3ce9e
- SSDEEP 6144:u/0Atmj/g9BsNe8rZ15dO+P4kriNKgJhAwSDWatKPF/jv188r5vb708wiv:u0zs9SNe8115tgDxJrat008wi
- TLSH
  T1F594A6792AE9E268EC5C31B81E44D75C838E96E0C705D5E7DEF51C83A3868E9063713E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  Zalo-26.6.20/plugins/capture/Qt5Xml.dll
- Size 144KB
- SHA256 fd640a9ce98c4aacb3c40e4715df03661de80aff19e4433a4017bd34cc3c0d1a
- MD5 7dcb70bdd84ac2fbbe011d4d5cbed00a
- SHA1 2d017e7cd660044ff8b9d176f0a2a916873ce8f1
- SHA512 d06c57e310aa283b202e331ca34ef34ea2a555a6bb7008526081ee74554a4b6461358a2214df8653e452585eba1e748cea36cc5a70bdf4f7d593b57dcb06432c
- SSDEEP 3072:kdwqnGvnz02TLSw4ejSwx5DkXNqi4ZSZL15e3w/mcsweXSpAXUAKSSSSSSSSXSL1:GwqnGvnz02TLSw4ejSw/C+ZSZ55e3w/q
- TLSH
  T1EFE318F2B26543A2F17392B51C1F6A2EEA7FF81C136506D3D31D6D6308386E12A37256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  Zalo-26.6.20/plugins/capture/Zalo.exe
- Size 578KB
- SHA256 649155f7861718184b7fdac58c4eb2ec3e60773455bd8e0402329adfed8d51a9
- MD5 a450bb90cc6c5efc0a8ee35b3a8adf3a
- SHA1 9301ea7415488aaa64bc8d2bdb6fb342a8705ec0
- SHA512 6fc70d693351c428a13ecfefac43d97a23c2d40f8a16ddf1cb629245519bf653c8c3bc3533e76e10a92545f9722175a58b3efbc31469668dc451070b1b4bac15
- SSDEEP 12288:t8QZNweaCj+RWahdDSFmIayHENa8I/fqjAxP05K4MMMMMMf8XRD4Yqx4B4i:WQlj+RWahdDSFmIayHENa8I/ijAxsc4M
- TLSH
  T1A7C439B2B719C83FE6631736594582FE4036ED200F79A1C3BA947A5D8830FD2793791A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  Zalo-26.6.20/plugins/capture/ZaloCall.exe
- Size 18.7MB
- SHA256 88c1d8c39ccbc436ce55d4129f3b43e2ebaa08f5df1e7cdc2873d192d502aa1d
- MD5 03e96a555246b7e0763b410d03813789
- SHA1 43d9bde15abbbb30681690117b15cc70f5b28cf9
- SHA512 d5df770128f7e957433b1ddbe623d6c292e67d09a02e2de041d74de6a382c1c26a3f2fe2aa4a350db41cb7a86d5b0aa38687b0dc2152012199b66d863fac8908
- SSDEEP 196608:ATsR4yR4Avo2CO+m6Ab7UskrYRrj86cs48qpqjk+OMpN9Fa4pi3tlndlKmzuIBDe:zcsS7p4kwP9M3p5u2e
- TLSH
  T1AE17C0A2E543D07AF58104B14DBC7A67A77C6D35072883D3E19C7F2AAC359D61B32E82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  Zalo-26.6.20/plugins/capture/ZaloCap.exe
- Size 1022KB
- SHA256 797fcd13b976aa25deebcfa323557466938932565f35ae76c38622179ef45d36
- MD5 1d3714eb426a7c004a33a847672684b5
- SHA1 bd3ab76df1e900c2241223969259d7e54ed59657
- SHA512 2e403731ea99c98c9148ba155e930cc768d08481905091edf434200f4f4ffe9457cc705be3f89aa7eca6b76fffbda31d456878c4b0dba57e6f6d1d2cd88eedb0
- SSDEEP 12288:6fbQn88shYV/RfB92ragJ+tI4MMMMMMf8XRDq1QNHQ/luq/V4S4f:6sn888YVv+jJb4MMMMMMf8XBaVD4S4f
- TLSH
  T180253A726718F03EC16EA2F30D2492FA44249D91DBB069C3A2C87B5E15F1ED25E3794E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  Zalo-26.6.20/plugins/capture/ZaviMeet.exe
- Size 18.9MB
- SHA256 7e1a730132831fbeb6c74a6f7a27f13e4e7d3e93b5abf0514052d0d6a0692b24
- MD5 1b9f43490ac5f545027f7a0528c50d73
- SHA1 15941911bdb84cc2f24365842125192ce3ea0303
- SHA512 f4cc67e7c591156cb0229b177361dc2e5ae13f7e836c016635f5b7485af10d5410b2b7422a4c41f6619240c368db6921ebadecfe5549e8d028c04d61301f691e
- SSDEEP 196608:TehBA+BASnQO62GeC2NcMDPLdzOcwPGKnxb3f16LsAYrPD3WJpz6p1Z+Auiy:SNcMzmOK51xnPjW61Ry
- TLSH
  T16117BF92E643D276F54140B14D7C7ABF672C6D28076447E3A28C7E3BAE359C61B32E42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  Zalo-26.6.20/plugins/capture/audio/qtaudio_wasapi.dll
- Size 79KB
- SHA256 996b45aaeea970417e85dff3165f48e59a4577be013881a6b3089cb647186d5d
- MD5 76403dd400fe6ca65a2ae8ee32f1b1fa
- SHA1 61c230eab794569edd5502234772c0e0cafe3aee
- SHA512 670a9d2778e2a5c05aa18ab7b431127ec416da91ad9f0e098a3d08f2cf9417e6382f7e715f19dc6ec343f2ad9c71a85eaf77cd74c32949ba6adcf2d29ee4bc38
- SSDEEP 1536:wSn9YJpv0gePGXCjAXfv/PM/uUZiXNmwNejIxApIvOov6D68SO3xTeE+lislqYzj:BvgePWPVcYOk5NnoWgVzm/sOvNrDO+t3
- TLSH
  T17F8319E3B5E485F5C4836076348297F7A72E3630CFE499C77B97EE4220268C595B290E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  Zalo-26.6.20/plugins/capture/audio/qtaudio_windows.dll
- Size 46KB
- SHA256 359d2a6623d9f6ffe5338d0a5e42649d7988231db117233b8ef9ac06fd3f2dfa
- MD5 c98d93fe6b938c025f67e15ad4b2f103
- SHA1 8f66b0cba32f7608a273b1290fd505df538dd9cf
- SHA512 ede34be038ab7b6cbdffdf03677a05f522e63ddc131d67254241c5f0e2fdebac639d72440def75033b225a17779d7e12195df795486f1b63e6643874b137d0bc
- SSDEEP 768:1/ByR8RIYNJ++YXT10nlbOpqgBegs1Go+cU13GKeD23G5s3HnsrOAg5:1APE+90nlbmqgB7o+R2KI22sHnsrw
- TLSH
  T148235B11B64282F3C4AD01F4344A97AB923EF9604BE4D5D3AFA7AF1D19317E2B635306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  Zalo-26.6.20/plugins/capture/bearer/qgenericbearer.dll
- Size 37KB
- SHA256 9f072c4a4d5955a97c2e5ff66e9a386a9250c8d8cb1af824ffdb55b41ca6bf82
- MD5 e6c3c922512b3d85c51ecd5704198fca
- SHA1 90dfe3c344afb962c509aa69a27fe601c0a52e68
- SHA512 9e32e7c346d3a89839fcea6bab97fffcc42827d2022197294b1c61c68b180aa563b559c179ec1710f75c1af9a98d2306f5f407a750fc2bdde159dcfcfd4b2ecc
- SSDEEP 768:O5ho/Y6uDN46xLqE95MDT1Lgas1Sz2gGw3vOAbiJb6T+9:O5ho/ipzxLqF1Lgas1Tzw3vOAbiJK+
- TLSH
  T171034A11736B05F3D25E5374659A525F803DF6214BD382D7EF4B2BAA09A27E0FA3D202
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  Zalo-26.6.20/plugins/capture/iconengines/qsvgicon.dll
- Size 28KB
- SHA256 3e63a67578902e21663b718cfe8ec5fb5b3c9210d6c5b0063254dafbdf46348a
- MD5 94fba3dd8db1a4a5ee17562c9bced409
- SHA1 43fd96bbb65548b052f52c50088709469e06831d
- SHA512 b2c7fefb6d30998f88f1ff71943aaf85cbf55f6157c745be5b4a56339a3f7980b642f50ce37c2121b24ec749d0aac47eaed842a4dd87bf171bb037634150d743
- SSDEEP 384:m3lTaaOoFMSIh5jyopQGI7J9jCnSlfWLtBJhaesP2hn1gsMdxdTnxVQBAL2tqOU5:m3lTaa6/6GI7HjgJhaVey7rVjjL4Y7
- TLSH
  T173D20AE1625511E3F2565370385DAF27883EF73017D1D2C3DB1B696E286A2F2BD3420A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6
- MD5 3d366250fcf8b755fce575c75f8c79e4
- SHA1 2ebac7df78154738d41aac8e27d7a0e482845c57
- SHA512 67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094
- SSDEEP 96:cjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNG3m+s:9bogRtJzTlNR8qD85uGgmkNP
- TLSH
  T10DD109BC36C10CF3D54E46743E22381753FEE4761B7542A18B972AD61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 391KB
- SHA256 66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b
- MD5 c6a070b3e68b292bb0efc9b26e85e9cc
- SHA1 5a922b96eda6595a68fd0a9051236162ff2e2ada
- SHA512 8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8
- SSDEEP 6144:KI4T3K6gRPI8G1W3ODli+GIuuu8M1CkJagSdJFCAvgw7nv0Yy6ptK:KBK6gU1YsI+GIuEbgagS7FCyp7cD6po
- TLSH
  T1D0848E12BA90C036C66F1231BD18F7A621FE76B0692CD65BB39C5B5F1FB04C1A718A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  Uninstall Zalo.exe
- Size 520KB
- SHA256 39e336627acaf551d92ea9f48d39915014dc912497de38b2c36a58711122c7b2
- MD5 ed65e8dac77c25ebe7f26bd84001ac0a
- SHA1 e64536369d61d125c2b8cf3362afa3b91eb53209
- SHA512 82f9e6baae3cca81a5d84ae8c25ed296236611fa5072a7b2aa413e9fb72aeed9d3a8d057b6b89a884751626205b6b856b444070952e1e86a428de54a1c70e407
- SSDEEP 3072:qa77v0JhE4Dy6LtauKr3tnLb2OvnE0bTxG8o4EX5Si8UUKAsd6j5Ya3D4s6s:qw4JQ6x2/LnbxGJX5Si8Udgj5YaT4Ds
- TLSH
  T168B46AF263D2C25DE4B30B731A2690FD167ABD312875E6466E10B71F6A72FC27427122
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32