a554efbf3db4267c4f2c9e1ec9723c912acd64ee2b54be1dc30ca432fd2adf94

Sharing

Copy URL Twitter E-mail

General

Target
Dopamine-3.0.7.exe
Size 119.9MB
Sample260711-yrpy3act21
SHA256 a554efbf3db4267c4f2c9e1ec9723c912acd64ee2b54be1dc30ca432fd2adf94
MD5 ecf15b6817f6752b93838c80beb7fe00
SHA1 fe94db9d0ef5e728d9667dffa435b41f8132229e
SHA512 505f903e339fc0d55c3fd05427b12b401da6b5c0114c65ffe1d8156e2392aab8a13e1cf042b0f7e6470865c2627b0ef8f1904ab376bf5e2f31761c72c50aeb89
SSDEEP 3145728:Og2ASOwsQGUoIO27HEUq3pjhsjBpdJxew6NjH4x7F:OzOCoF272ZjUdJOY/
TLSH
T10A5833B320546816E37365BE7341A3B1998CAB700A65F227FDDE8C033BAB762F954446
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Dopamine-3.0.7.exe
- Size 119.9MB
- SHA256 a554efbf3db4267c4f2c9e1ec9723c912acd64ee2b54be1dc30ca432fd2adf94
- MD5 ecf15b6817f6752b93838c80beb7fe00
- SHA1 fe94db9d0ef5e728d9667dffa435b41f8132229e
- SHA512 505f903e339fc0d55c3fd05427b12b401da6b5c0114c65ffe1d8156e2392aab8a13e1cf042b0f7e6470865c2627b0ef8f1904ab376bf5e2f31761c72c50aeb89
- SSDEEP 3145728:Og2ASOwsQGUoIO27HEUq3pjhsjBpdJxew6NjH4x7F:OzOCoF272ZjUdJOY/
- TLSH
  T10A5833B320546816E37365BE7341A3B1998CAB700A65F227FDDE8C033BAB762F954446
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 118.6MB
- SHA256 af2e123149406ad33eb758ef5814861fba5e1a6badb73405cca4084c6be46b7f
- MD5 02f5e44063d0f2ba5314dcb91d2a810c
- SHA1 d8cb3a38f086e41fbc93768c55b740ef40fcb335
- SHA512 5c9c24202eec9d029acf5d0730e9a142d2cf3a8cb730641ad18ec432d3b1625da55c874191eae4305b5380742e2372ca3023a9535faea06ce0dbb167aafe0e2b
- SSDEEP 3145728:bASOwsQGUoIO27HEUq3pjhsjBpdJxew6NjH4xM:HOCoF272ZjUdJOY+
- TLSH
  T12B5833F32404781BE37766BF73467375698DAB700E05F217ED9A8C027B6A632FA50849
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/src/util/query-macros.cpp
- Size 4KB
- SHA256 0dcf68c3ff527398ebe0a6b874b38aa23b3fb87f285b9701636c3b19282dde8c
- MD5 45ff28d1ab5f73c8bc7f8caec7c10421
- SHA1 2fc19e7f000e09deb9c5c8f2f7bed9cf0259b332
- SHA512 568f9256e04cf400da1a640e45043e83f93cb5fa6604dbf85d9d5e98088a75370b372abb4b7009b096a4cd5cd81d390d3506e82acd5aff6eb80bbba7d060b414
- SSDEEP 48:kLdmms8UOosyen7XDt5B+8v0Dc1+JsSW/dBvv4PMyncFGB28dBaEqp9gg:Adf+ygv+1eMyr28CPzgg
- TLSH
  T11181EC11FEDB345E53AB80356FBD4092A855B9E7F02C10A8B8DD65181B398349CFD2FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/src/util/row-builder.cpp
- Size 1017B
- SHA256 d5b352ac4959a07db22a825019286e085910310d6363c61fbdf037e3f32d56fc
- MD5 a3d85e4964e2c0836c416e6f3aba1bb9
- SHA1 396c35cf298535f38401378ec5ca297a4ab23592
- SHA512 828f7bb6d3878bba480cb6a3f6c6057a2ed1aaf2eb0edec8d2f4e8ba641eefede9ae38a1d70ba59b08aba0c55c94b1f155247af97c2db3c91fff0a33f099d3e8
- TLSH
  T18F117B53FF6D46CA38F26006B47E0BC68C18562F6AC43ADDBCC8A2125541926C5B8E29
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral8
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  snapshot_blob.bin
- Size 329KB
- SHA256 314def6cccce2e8b6d9f4d4273c1e306a680f7f9e21d5551663c2c2d13ec155d
- MD5 445a6f7cf7080710a11c68c979840875
- SHA1 ffd9210ddc9c4bb1d353e7ffd8cf916551ea93f4
- SHA512 e42c0e9f0be8bb0fa6c21540aaa0c7c34a222b7c53c2fd248dd0a7b0c629c5e29aecee5185a36330d8819a3c5ded19c62f4c0520fadb782f00d716e573f32475
- SSDEEP 3072:jtjRKkOt+xeReIyhOIW8oWi2Q8YZevKUX/xj1RJkx/LnVmr4FIGvqT:pR4t+OU+HpZDCj1QxDVmMFU
- TLSH
  T16974CB06F319C72AC459267E4CF993893234B2CE9F86A21B759943FD38B153D4D22B8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  v8_context_snapshot.bin
- Size 695KB
- SHA256 36476717691fdbdac6440b96c48e94e8938a97b775340b4734622fdbd731dfad
- MD5 5e06f16a1bfd30965a4569b513e10d61
- SHA1 4f48383f7bb502bc2f2fc03fd2bf8e553aee235a
- SHA512 7fce5738219c8e901527393e89f37bf329305cabc0c368b3a1c7cd7d636394db11553560e6318ddde70d7e1a3a79d66d5bc2f76116c51ba7cd8bdfb157a03115
- SSDEEP 6144:rS9cowVafAdRjt+OUjIuZDCj1cvN8bnecHRWSmMFImJpz6nl5Pbp5QCV/xdFzQ6S:LowAAl6vN8HRWSxmQz+bp5QO/xdNS
- TLSH
  T10FE494A2FB1ACF2FC58D267E5DEA86463534B08E5F4BC25B715403BC38B95780E29358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 22a2305e52d6cded30c0606c7cb44e25c1374dbbec08f5da183f91de0b1390a4
- MD5 57ed221051a5124546848d413c7bf534
- SHA1 37fa025e93d7fbeb3a6eeb21660221a35b3bc917
- SHA512 c9ce057dd2f166cf75b2d4a4d8a6ef90376cba15ad182708ba24504cc7ee11f7937feb5414a874df573a1aa7e51c23e257e611300725315a11de6f34fef3fc09
- SSDEEP 49152:ljso2Wp9s18LbsQCgJxAhgK4axTciCuE2aRj6q8U45uqPppkBXqyWwBgVGdWyKQS:ljd2WpM99ZKtA8h8AHwv
- TLSH
  T1E7462703F28680E9F05DD679875BA622F632F8814B2276DF56A01F192E77FE06739704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH
  T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13
- Target
  vulkan-1.dll
- Size 917KB
- SHA256 457ac4472ea01cdc7bf483629eed2118814611c79e39ea69304adb2509fe28ec
- MD5 84ad45974c4d28380280efe0c25137c9
- SHA1 0b6740c39c53fcfcd98c0e82bc3878ff0371d2dc
- SHA512 0c0d7454cdd38146e9ee7bf296bde8fb368e3131a6da9b204bd4b02025de1cf9a44085c5f6741159f39f82284d7dcbb9078389bd9960d9d9da08b3b7ff2b5ceb
- SSDEEP 24576:FgQmQinxRotX321+hvdK2S6Z5WGcSDYsHQDi6g3P0zAk79oOHHe:+N5nfotX32qFKb6Z5WGcSDYsHQDi6g3L
- TLSH
  T1DF155B1396958569D57AD038CDD28607C9B178822326B9CF02A817087F6FFF47B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 b1ba9cde99a30195b7574126efac670bdf2292fc60d7d008acfa9060e3f178b0
- MD5 90bf71ad0690b1018114e70fbf90bd21
- SHA1 46387646f3006ce230e6d8635d63a608bdd41b6b
- SHA512 8bfa46c56419bf806169fe6d86c0edb28452891fa1626c95379983520d00cf6388d10568b699cc7908eb9434adce4042e704400476bdcaadeb9eb9e3ab6cf0b0
- SSDEEP 192:M+V3h4oOZ+xeL7MHC7xMzVZ5jim6Dv+84tm+558G14qdd6f5j+r2ovViOQnj+skm:cZ+c7Mi7KZV5QvH4/0Q4qffrdvggU
- TLSH
  T1C4E3E6C4B5E24861E7B38B70AFDDBC94C8203E1D6A074EBD512A74296FFA781390546F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  $R0/Uninstall Dopamine.exe
- Size 345KB
- SHA256 e80c296f63d0ca778e4196f29ede111600b722515f874ee21c464f0bae1f3c9b
- MD5 a4932d212b874714a2a84ee36a36ed30
- SHA1 1137edf08e0ff61715c5868efcf6dcc162ad9c9d
- SHA512 76cf9a7548b8096637024dbc5e784511134555430d07c2c5d1937cb1a2be10b2fab0f949c0ff5631821f54878928770abe2c9fcec18aff40195eac9e0412d513
- SSDEEP 6144:5740IZCTjeN7dEWbOkeExyPNj1WGVTk9eYUUa8T2t0EyL+yaG:xuRs7McNZCLRKJG
- TLSH
  T171748D30E7BEC8A1E5E344B40F11D9F1D864BA2CD076956571FF1B260AF7B8628AE143
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral19
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 b1ba9cde99a30195b7574126efac670bdf2292fc60d7d008acfa9060e3f178b0
- MD5 90bf71ad0690b1018114e70fbf90bd21
- SHA1 46387646f3006ce230e6d8635d63a608bdd41b6b
- SHA512 8bfa46c56419bf806169fe6d86c0edb28452891fa1626c95379983520d00cf6388d10568b699cc7908eb9434adce4042e704400476bdcaadeb9eb9e3ab6cf0b0
- SSDEEP 192:M+V3h4oOZ+xeL7MHC7xMzVZ5jim6Dv+84tm+558G14qdd6f5j+r2ovViOQnj+skm:cZ+c7Mi7KZV5QvH4/0Q4qffrdvggU
- TLSH
  T1C4E3E6C4B5E24861E7B38B70AFDDBC94C8203E1D6A074EBD512A74296FFA781390546F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  resources/flac.ico
- Size 422KB
- SHA256 b99d2810325acaf103ae27bf72a312ec0dd495821b023bd14b754d23a3a2afa4
- MD5 f174b8164ee5e10c13436b9c1d8cba0e
- SHA1 ccc00c16fbeb1b01c154ba747b2c0399b8b17aa0
- SHA512 c41730b93876c2152255278923938f8166e07c410949086ee3abd61d15b13f0f4b5119a62a62e982825594b0007b5d861cd27c49526abe33afaa56168317bc83
- SSDEEP 3072:y8Jo5TmG4nVNxzESAbJlXYW/OLVeFtNWfJh7bGU/vAt2qcztdnsyxoXDtxLc+1bW:x07Ouuzrd6wekd8aMlWbaAajbC
- TLSH
  T1B594C830AAABC46DE4F744F55E36C9B0E095F97CC0B96468B1FF2A2542B7B42189F107
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27
- Target
  resources/m4a.ico
- Size 422KB
- SHA256 4fc86549439b611a97e964a9c6fd9671686f1676ccf7edf2988c37971bab3242
- MD5 99674701c88b90715baa13d4687d0ed2
- SHA1 230c8fdb9775d662623bde8d3d5200440ed3496c
- SHA512 e228480c95922021341d33d9a4b02648852ed86bcad10d33ca7bd7daaba6e851a82bb94b3764dedce38c3637ad2d2b8ea3f04b5dbaf85c2dd9bc24669236a12e
- SSDEEP 3072:y8Jo5TmG4nVNk46+6qbJlXYW/OCE6etNWfJh7bGU/vAx3HZKo2xnsyxoXDtxLuQd:mb/Vuu9rd6weZs78aMlWbaAajbC
- TLSH
  T13394C830ABABC46DE4F744F55E36D9B0A095F57CC0B9A468B1FF2A2542B7B81189F007
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral28
- Target
  resources/mp3.ico
- Size 422KB
- SHA256 6d0af258b5bcfc21d8280ffe53229b87e5699df80c69f18b3c6ef75929dcea5e
- MD5 af0d2472a1bb88198dfc809aa12ef76c
- SHA1 b213a829e758dcf47255c90b86511e9b3c2f9491
- SHA512 0bb567590cf127d0b74184616d2395063386a413bd7bfff38076522eab29b7d3a7979168e08a28cf5880cd788b982088edb183ce68b6c8f48689c7db309ead2d
- SSDEEP 3072:y8Jo5TmG4nVN7Cj17qbJlXYW/OfrgltNWfJh7bGU/vABvwO61yxnsyxo7f7seVID:IMXGTuu5rd6we/b8aMlWbaAajbC
- TLSH
  T1A194C830ABABC46DE4F744F55E36C9B0E095E57CC0B99468B1FF2A2542B7B82189F107
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29
- Target
  resources/ogg.ico
- Size 422KB
- SHA256 38b039ca207f16b22747cc3a407b6846cadeb9dc89151910fd6dcc3b5c07705d
- MD5 b76ccead06da132f5c35aeaace36c411
- SHA1 a6c5a6595b32dc764067c82785190cb69a012e77
- SHA512 c5a06f21fb229b4eeb50d3577e49559d414daf2edbd4b0aed4f0f318e146bf5d105041202bd54691be27cdbe16b4f091bc619b38c07c0683c53b3792cf01e600
- SSDEEP 3072:y8Jo5TmG4nVNECmzfqbJlXYW/OAUEztNWfJh7bGU/vA91fokJCxnsyxoXDtxLIQQ:4yTbuuvrd6wePB8aMlWbaAajbC
- TLSH
  T12194C930ABABC46DE4F744F55E36C9B0E095E97CC0B99468B1FF2A2542B7B81189F047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral30
- Target
  resources/opus.ico
- Size 422KB
- SHA256 89d827a27be1c1c39bf66b2e419f29a0684954181f084f3ff4b804ced4c098fb
- MD5 9025287743261e4890bc754d300b8469
- SHA1 74618e23636e66dd5230575b38bfcc87a7788573
- SHA512 65300540f224eed333127fac3ba469fdd0dfcd0467a61844dc135d3c6d7ad4be7a853d7e7a1a3586b12bae0fc6ea415366066ae1684925aaa26b8bbeba1d107c
- SSDEEP 3072:y8Jo5TmG4nVNWGrbbJlXYW/OHGusR/NWfJh7bGU/vA0jnYQfnsyxo7f7seVvik34:SjG/6gFuusrd6weOJVL8aMlWbaAajbC
- TLSH
  T18D94C730ABABC46DE4F744F55E36D9B0E095E53CC0B9A468B0FF2A2542B7782189F147
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31
- Target
  resources/wav.ico
- Size 422KB
- SHA256 85453b55502888970e0b5dd38a5f82e3da62a9f988adc3be3fece8e7e6c95a15
- MD5 9b9849b353638fac2e0ec44ed8ba4f5e
- SHA1 23eb9107bde2a6a416f572eadd364b6f88833dd2
- SHA512 cdb88bcaee361dadf7f3dd1917a77f0078791a16885ecb3f156443441a39f4bb6d7349a2a67bacbf0cc1663b0c62b4b87ca28218de7d0d885dd72b36a07cc71e
- SSDEEP 3072:y8Jo5TmG4nVNSFRY+bJlXYW/OE0xctNWfJh7bGU/vA4F39HK8nsyxoXDtxLJ2pas:dsOJuurrd6weez8aMlWbaAajbC
- TLSH
  T16294B730ABABC869E4F744F55E36C9B0E095F97CC0B59468B1FF2A2542B7782189F107
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32