58a569becf384e45331c0d1e5092141e21f52ce7cdd6037a04667e8f86bd2a86

Sharing

General

Target
DECODER.Setup.exe
Size 122.3MB
Sample260711-ym94facs8v
SHA256 58a569becf384e45331c0d1e5092141e21f52ce7cdd6037a04667e8f86bd2a86
MD5 904571513c3e206c0c2dd33b5efd06e6
SHA1 a73d4a4c385d79255e8337a3b49627b7abe289bf
SHA512 c95ee953ac28a9f9c749f1e8a9f23dd6cd66802781d0ad2e74a13e097eda497309d046e6dbd2ba42d612823ee6ba32ea876e1e058ea2dbddf5d301c158c83993
SSDEEP 3145728:ZY1rtGNh+uQfPcsk3DPd50OvR+XXBLQN8Gc0GFZQLEogi:SrKh+uQncTDFOrXXBASKEoB
TLSH
T1985833272074C80BC9292DFF9C4266F47191390717CAD12E5AAB3CB8E5D652EFF84687
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DECODER.Setup.exe
- Size 122.3MB
- SHA256 58a569becf384e45331c0d1e5092141e21f52ce7cdd6037a04667e8f86bd2a86
- MD5 904571513c3e206c0c2dd33b5efd06e6
- SHA1 a73d4a4c385d79255e8337a3b49627b7abe289bf
- SHA512 c95ee953ac28a9f9c749f1e8a9f23dd6cd66802781d0ad2e74a13e097eda497309d046e6dbd2ba42d612823ee6ba32ea876e1e058ea2dbddf5d301c158c83993
- SSDEEP 3145728:ZY1rtGNh+uQfPcsk3DPd50OvR+XXBLQN8Gc0GFZQLEogi:SrKh+uQncTDFOrXXBASKEoB
- TLSH
  T1985833272074C80BC9292DFF9C4266F47191390717CAD12E5AAB3CB8E5D652EFF84687
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  DECODER.exe
- Size 201.2MB
- SHA256 3f613be95970d4694d86882aacbc3c30e41019d82b997ab06cd7dbc41316a7be
- MD5 993607eb9cdd809629a4a12731f5cbbd
- SHA1 79f281977befdffc86fba268cf850710e713b521
- SHA512 228c2779965a5280ff5ab38708282ac6f948fa52a56fee234a7c707dcbd4f66ef398ca3365377f1fc13221e8ed10ba3fa94774bc8003fee722b1cb8edcd54310
- SSDEEP 1572864:ulnEBcEs3gPGV17hWFUt/D1aVBpVKbtrtTwSpj4qrQPybwboRCpQ4ts2J9OOHOSZ:QVEIRHkWu
- TLSH
  T188A88C13E29601D9E05DD1B5574A9633FEB1B80A4724B2DF2B9407522F77EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/7x.sh
- Size 235B
- SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
- MD5 8a65a1ab93601ddecb93af2a310dd68b
- SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
- SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
- TLSH
  T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral12 behavioral13 behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
- MD5 9fe8a485038be54d687ad7dd9dff80d3
- SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
- SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
- TLSH
  T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm/7za
- Size 983KB
- SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
- MD5 601642dc448c3b398e92ec0d19e447a1
- SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
- SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
- SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
- TLSH
  T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm64/7za
- Size 1.1MB
- SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
- MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
- SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
- SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
- SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
- TLSH
  T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/ia32/7za
- Size 1.6MB
- SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
- MD5 dba8ad5c0f1a27e9e387817df9ceebbd
- SHA1 33b7ae00c218a250c30588fa134dc9946665147b
- SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
- SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
- TLSH
  T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/7za
- Size 1.4MB
- SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
- MD5 6a2e4039a2f56265369f22ecb1a19fd5
- SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
- SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
- SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
- TLSH
  T146657C43F9B6547DCE9AC775821E9232F678F44906309F37B284EB302A52E60DF69B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
- Size 266B
- SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
- MD5 08025b57ddf3df9bc3e2844d86e4135f
- SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
- SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
- TLSH
  T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/do-build.sh
- Size 646B
- SHA256 4304f90e9b9266cccf357b212c6a8ea3b0816b68c39a4d4691d638c9e2f07286
- MD5 2f48a9c98543108edadedcbf4d45b4ae
- SHA1 a7b0bafdfb070e0cc6fdfa2977648b8d07593f5e
- SHA512 cd17c759b1e7800260eb70befd37c273c78b34c44280290d60d406efe0a174cb34a727bc2cf42e8fb80bb65924ac405175bff69f34c115527ebc573a6a430b42
- TLSH
  T1D8F02380C864B031D5C8CE0373B69B28BC2658858FE8F95CDDA90CB8C104952B71ABCE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

antivm bootkit credential_access defense_evasion discovery execution persistence privilege_escalation
- Modifies initial root filesystem image
  Overwrites initrd/ initramfs image in the /boot mountpoint.
  bootkit
- Modifies kernel boot image
  Overwrites kernel image in the /boot mountpoint.
  bootkit
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Modifies PAM framework files
  Modifies Linux PAM framework files, possibly to intercept credentials.
  persistence credential_access defense_evasion
- Modifies Polkit authorization policy
  Modifies rule/ action files in Polkit, possibly to grant additional privileges.
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
- Write file to user bin folder
  persistence
- Writes file to system bin folder
- Modifies Bash startup script
  persistence
behavioral29 behavioral30 behavioral31 behavioral32