d539c4a7e57d1f90d5d8c117352539fb7e6ced0bec2659210fac459a1c88535c

Sharing

Copy URL Twitter E-mail

General

Target
Moon Dev Code App Setup 1.0.0.exe
Size 88.3MB
Sample260712-shdlsacs2l
SHA256 d539c4a7e57d1f90d5d8c117352539fb7e6ced0bec2659210fac459a1c88535c
MD5 525159aee921a3cf3394710ad5875348
SHA1 2af7395c579a2587895eacb4aa86bdf2fa9741e3
SHA512 c35b299326d6511554653bab011a457fd977dc534d4680ed12d812b2984c65a752ad6d478713f97e39d1f277c5dbee8af83f9c5b1df6fad41614c6b9753c1614
SSDEEP 1572864:BRKLNOOz4RyfyR4FZdx8S5Q6iwWTgu5Up+iETvGYOMcHD5a1ayQL57C5aN7yZKWG:BRKPzNasZT5QyjGUEilDXD5MQC5aN2XG
TLSH
T18F1833234F49F8C1E5112F75BC839C24146B2940B53C80862A9A996FB364A937F9FFD7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Moon Dev Code App Setup 1.0.0.exe
- Size 88.3MB
- SHA256 d539c4a7e57d1f90d5d8c117352539fb7e6ced0bec2659210fac459a1c88535c
- MD5 525159aee921a3cf3394710ad5875348
- SHA1 2af7395c579a2587895eacb4aa86bdf2fa9741e3
- SHA512 c35b299326d6511554653bab011a457fd977dc534d4680ed12d812b2984c65a752ad6d478713f97e39d1f277c5dbee8af83f9c5b1df6fad41614c6b9753c1614
- SSDEEP 1572864:BRKLNOOz4RyfyR4FZdx8S5Q6iwWTgu5Up+iETvGYOMcHD5a1ayQL57C5aN7yZKWG:BRKPzNasZT5QyjGUEilDXD5MQC5aN2XG
- TLSH
  T18F1833234F49F8C1E5112F75BC839C24146B2940B53C80862A9A996FB364A937F9FFD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/node-pty/build/Release/spawn-helper
- Size 49KB
- SHA256 762b944c66bf1f4b2b3a450bbed1f16b5b178cfb07a625267511657eb40d29c0
- MD5 bdea7c5ac9b226abdb727196e2eee3af
- SHA1 5f0eb3c728cf57e71114cfbca4cfeb679ed13967
- SHA512 188f6f2d8b8aa472d8ce1d0262ecdf74738abe500d44c5d447eaabaf6bc25628a29c79ef957554b19bb994e16f79723194a2fe264c6babd863e9eeeaebd1d28b
- SSDEEP 48:gJDE63Dt2wD3DSeQLTjE8HxiWClWiTb9p9L9Rco0f:MDxa/Ebs+fdPco
- TLSH
  T10C335023AB5D55D2C06CAF38D1D70B562A37F0E28F8E023B4761C66E6ED5385E852D0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/configure
- Size 6KB
- SHA256 bd3954a56e5cfc66249978db90d949781c9cfa828e3f52ee51772ea47db3c877
- MD5 e92b476d9e9e90a944dcb5bf4097432b
- SHA1 0ef0337fead9fa820f88d142d13c40317793dfb9
- SHA512 a8b859557261c8c6f10b080bcfbf734f27fded43565a20ef0c65fbd3506d02bd152c8e7e636eb319862d61029c2f3f50afa3ff8c29cdec419ab5b656436ec7e7
- SSDEEP 96:asYQHWSopZmGTNCDRypubvD/HntyYRjmTY3qdDCKBZjmVzlBPnQv16:yQHWSxmNCdbyTY6kKBZjmVzlBf
- TLSH
  T19ED1B61B210C03F5194200A4CE4F71FAA2158DBF36512C6E785FE2A9AFC19D6D5FBAD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13 behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/ConinMode.ps1
- Size 3KB
- SHA256 9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034
- MD5 dec84b4f7859e44892e0750c83fd693d
- SHA1 6f88920515398ca40a09ec06dd2e2a61d2c60583
- SHA512 759c6f7c79a6754190848d311ed263e708c1ac791684586228aee63560c8134c310d4433c365d6543b261ffbde7777da63cc69269e22d58d2464ccc6e51ec067
- TLSH
  T1DB617072B75ED26542761EB8B5C68484F915E82B30A46420B2BC84EE6F3C330D1FAC69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/IdentifyConsoleWindow.ps1
- Size 1KB
- SHA256 890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60
- MD5 d0568512a8b58a101d43c7c961ad50d0
- SHA1 66654847c09efaf9edef7d74fdded9716db5e0f6
- SHA512 ebb7f760416ce47629b6ac790ebe9d8e1c2173d21efe24cdf556ec9c031f961263809d9401a049410c6fe510495a4aa8bcb732f5beda12da2e5011e8abb5e184
- TLSH
  T12741FD617EC1E2B401B191329EE39759F10A046B6570292074FDD219FF345A7C9FEDC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/build32.sh
- Size 213B
- SHA256 5c8716398c7022a15fc261febf420959c87bf4800927b10a4ced17650fb47c7c
- MD5 7005dcb00b1ebb3529c3a9747d5e3a07
- SHA1 c74f162b0d3b223bf4c95f18684e82e5ab2e857d
- SHA512 19bd8bc1996434fc0ae487361805a643fe98bfad9a5b89ffad3fab9bc67b1def59838f40d70d661ddd1856177e6ee671ae17ff473bf782fe7998b91f5c2013a9
- TLSH
  T17BD0C7D3455B50D40992490570E47312894754AE3A663898D4F1751477794C3313A222
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral20 behavioral21 behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/build64.sh
- Size 217B
- SHA256 a572a4c32531ecdc6f7f446b4ad3d1ee4d7486336b50f513dd761846e1dd5e04
- MD5 26cac551f461daff66593733c6934e54
- SHA1 890472463796548c28ef9f48edbcb70c28187295
- SHA512 350f29226845735b8cd56d887fbe928abd853bdba934b3204878aac7000a12660b1ae058361a5fd6cbbfe2a8fecf28e40a7daa5575a9ba7fa166b05a383518bf
- TLSH
  T1B1D0C7D3455790E509D2440670E43317894B506D3A663D98E4F17524777A687713A222
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral24 behavioral25 behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/color-test.sh
- Size 5KB
- SHA256 3901b23dea4ca7ef4a2a9a057905b138378dc93dc5c45c8929a4655d64522fec
- MD5 2643af1d624ea203e58db1f5d5e232f1
- SHA1 39b29ddd9b0b163b38e65ce27c2a832add41127b
- SHA512 62fb29ed5a489883527b629409bd1ee847f1b6865ba560e522f4c1e18769e6c678c7e9156b7c671c9de5f705aaa31dc16eccddc969dcc479d9bec3821fda8eca
- SSDEEP 96:v1Ywmu9VDxSSVbahRsJ6NhJGj1Z/norSKcKasnKW7MRXYAfWQ7vQ2P2LW:v1BmuB+S/ESKTv72XtfWQ7XuLW
- TLSH
  T18AC12F9BE2C8137A549F887C35CBA53C7B1EB1214E221A1CB85F50D8178F57990B8A7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29 behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/ship/build-pty4j-libpty.bat
- Size 1KB
- SHA256 569581fbbad4e458b4c3e4759ed31586c2d252995e6bae06e104d48df22c5133
- MD5 c5def6f362cbf26a30e33dbbebb29755
- SHA1 2d77b39572009a145eb2259b10f098b147daf3d9
- SHA512 0bec43edf7f4414544077ec962a730fec4400cff35e76d131fc974e41d3d0603fd3643584cd69f4621acee399579d4ae206728bbc0af735152dc501f1b06855c
- TLSH
  T17A214936520A1FD3F2021FA5DF24B56AE73A862255ED512D301D814C7B27F8A3099E57
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32