b50f2a725bec5a139e3bebe5d823af0c25d0a7335adab21b53743c2afdc0b6cb

Sharing

Copy URL Twitter E-mail

General

Target
SETUP.zip
Size 21.9MB
Sample260713-1bl9caaz2s
SHA256 b50f2a725bec5a139e3bebe5d823af0c25d0a7335adab21b53743c2afdc0b6cb
MD5 d8031d7489e07833ca8c4cbc436ce7c8
SHA1 20467c3c230c63ddec1917ea5a4efc3f46d49a7a
SHA512 08f538082c0269f7bca2c52741661b7d29366b4b251c60d4e70fd1c61059f6d546e192e77d6cc52736bcd7f555edc4e1b4b8d8620f02d85f7357ea7fec9fc0ba
SSDEEP 393216:JPJant0N1jQ9K68zkw2UJTcy4BmCoz3ycGprtbbXpNFk6E1oV/Z4ukZ6Y6P1:JPkniN1j/68LzS8nJGpNbpOmV/uukZwt
TLSH
T1B8373312C56A4F55E68C253AC8C78F016205D7E78501CF9F575AE39FBFE2BF08A21892
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Setup.exe
- Size 94KB
- SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
- MD5 eba77a34e9b8aa78fce520d1431fc68b
- SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
- SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
- SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
- TLSH
  T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  d3d10level9.dll
- Size 992KB
- SHA256 7c7772e06afec607f058aa6039c9d4f7801b2c8bf8683a2979ad64730313ea76
- MD5 565499838d3af6a3163a4ced266ebf62
- SHA1 5c6e71afa5bfd22cb8f1f22c087f1dd25ea2a786
- SHA512 0aaaba35903f03bf9f1f7185befa268283e17f37a7fb57e3f4a09fead54afd5744dd5e347213595803222ba8e48af0b56f5a9a4cc1a355dad51af251cfd1947b
- SSDEEP 24576:Pacaljnafvii8DQFsWOS17JbctIFhA5F4WqpM:4afaiGet1FAGAP4Wqe
- TLSH
  T1A625F052E6928472DC5E20B4358D723FB27DC6B2472052C363B55BE8CEF1AC06E35AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  gmp-clearkey/0.1/clearkey.dll
- Size 83KB
- SHA256 4017e12188d48a525cc44d1b67d9d87bb462d63d4eb61b5feaf4a87ada956dfe
- MD5 c7cb498c07774d92fb02f51c2be62c35
- SHA1 433b460e5e6a733dd7709c49417207aaeb4116ab
- SHA512 7259227b9b926371a238800bf7a42e95d38f9142e500f72463c744f5b07ea235bf4156f3d6faf7a21fe4364b8b7209c74a314afd0a73e75beb7a909cc4d91ea6
- SSDEEP 1536:D/b3jGmpai20aFIPgFEUCMVuGrc7l1hJaQGHFn/+lZ+guhJlY2qBqq7P9:zb3rz24UEIVFrcThUQowVuaiq7P9
- TLSH
  T127834A02F50214F4E1CB61BE386E6B368E6F8F855F124EDBCB219CB01E215E25D7899D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4 behavioral5
- Target
  lib/async-http-client-2.12.3.jar
- Size 441KB
- SHA256 107a4ace7a3586f8e8a027c6d7e9933c9ae56eeb1a6df347eed2e7b552e4e5ed
- MD5 334e9ae90fc4db1b16e177f09aa1fe31
- SHA1 6dfc91814cc8b3bc3327246d0e5df36911b9a623
- SHA512 b5152d3e1a01239f2041624815dba80633d1514932d9cf5d3c82d548736f856e057828da36e5bbb77cd826bab409b1501c08245d4bbc7e1ea21b00de91c43a34
- SSDEEP 6144:zLrFMjci8SFvBAupOmLbL960A6A+q9Q7uNSqR5smgcaVWpreRTnx09sTMoP:zvFMjOeBAukmnL9/NKQ7GN5svIeOsYoP
- TLSH
  T149A4AF86A9889139D943B631C093D461F52CD8CCDCF7A0AF7A98115DD8709C28BEFBD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  lib/async-http-client-netty-utils-2.12.3.jar
- Size 9KB
- SHA256 e0bb76bbca0c85c68cab25dbed7989b00db5da8627cf69258f398d7d89bc9067
- MD5 5e0d471baa6e7e4f9bd85220d1abbea0
- SHA1 ad99d8622931ed31367d0fef7fa17eb62e033fb3
- SHA512 f97efebb82bc6102eacaa3393d56f02fa7369638c5b54b426c54cc60138b4d9fb04705f2513fb377e8a7b5661d59f4cf8664deb50ef1c728a132ed68fddffbe1
- SSDEEP 192:nm9ItnpG2qbqgAEqpF3QaOs4ubyXFuLUAcLf:nxtg28RqpFgaOeSfLf
- TLSH
  T171225DA5A944917DD65BB635C381E432E73059C44EFBF04B6A14388D0620E81CBFEDCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  lib/auto-common-1.2.jar
- Size 108KB
- SHA256 326d674b411ea67505273f9ade5311c15bca50644b5211a6c309c9aee590a20a
- MD5 74582e027c5f288915918ebfa7a66484
- SHA1 ca270191fd7d2a7297da7c8f29184206df10c67d
- SHA512 53bf3fb34bb45366083b82224a51e8f3aaaa33cd5bc5fb55a9f73df146d41c5a05a5a94635b4638231b6d574c670885dba30756d2ab3a59bb788bdef42ea9fa9
- SSDEEP 1536:zlP4oGUcqCuBShsm24tWp+hOMFTgq36vY/d0dfZM7dG8f8d/HC+UnnoPUHPjjoxa:zuLUjEsVo1dug/dXQVUnnocvgWD5v
- TLSH
  T173B3C09B30CD5C37E767C833A43DB80E781A0ED8DCE5B55210A8A58674B7D984BC6F98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  lib/auto-service-1.0.1.jar
- Size 12KB
- SHA256 88d469a5392dc2a292dfa20432591a584c29fae417cfd88b72620f35ec795acf
- MD5 cc3dff3b12311d8c8aae5afb0a00204f
- SHA1 c9779f7372192a96c957a3df1faeeabd07881085
- SHA512 890f34502ce0a50f98d5d940d30759a70eee192b8fc08923cd16b014f01f1e5d9c3e66153f8b3a844d41c0f6c7c2a60b4718906ac6d0c8415d643fdb39be8f5a
- SSDEEP 192:Wwd8weWLxDQuGP53FV34IwBqVYbtVivaXC3PE911IP+HI1JY16SGDH8G71zGP12n:zDdC+I2sYbt8vaXpcJrL31/
- TLSH
  T16C427C1660C045FAF5BA56726B31607234F8159FC00C33369BA8690D7BADE4D1E3A8CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  lib/auto-service-annotations-1.0.1.jar
- Size 3KB
- SHA256 c7bec54b7b5588b5967e870341091c5691181d954cf2039f1bf0a6eeb837473b
- MD5 61f0b581d16c470cd9e7d595be8568ff
- SHA1 ac86dacc0eb9285ea9d42eee6aad8629ca3a7432
- SHA512 33fd334783daa34e1dbb8132810ba19c2818d6f8a9a478e6b3f7a7cf018c16cd10d2f9cda3303ad99f897c6819d3a311b07c9a32f4f2b5efe139fe6942e7d814
- TLSH
  T1F76144F3A6C9057CD69DC332DB61681630DD2879C06E325212E9F10A797DD5C19A54CE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  lib/checker-qual-3.12.0.jar
- Size 203KB
- SHA256 ff10785ac2a357ec5de9c293cb982a2cbb605c0309ea4cc1cb9b9bc6dbe7f3cb
- MD5 ab1ae0e2f2f63601597a5a96fca8a54f
- SHA1 d5692f0526415fcc6de94bb5bfbd3afd9dd3b3e5
- SHA512 ff20c424e130c31c30b4f4f5b4374f8f98f94ddae2b123f3c213f147be6b3de57854ee5651b02dd97d352c1c1df2a8bfeef73d5307a71372f46a6002eab24d78
- SSDEEP 1536:cPx0Q6OOKmhpkxW1VuattcLwwxleKp9iDiW9UAmNPnZALgqcGnv1FzhS6VlVrIFV:1Kw1VHttLK4KBW9rkPnaLgVGvfYwVYrH
- TLSH
  T1F914937EEDFC40A9D03381B0A0834463B8641A4AB781681F3EF067579CFAD859657BDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  lib/commons-codec-1.11.jar
- Size 327KB
- SHA256 e599d5318e97aa48f42136a2927e6dfa4e8881dff0e6c8e3109ddbbff51d7b7d
- MD5 567159b1ae257a43e1391a8f59d24cfe
- SHA1 3acb4705652e16236558f0f4f2192cc33c3bd189
- SHA512 d9586162b257386b5871e7e9ae255a38014a9efaeef5148de5e40a3b0200364dad8516bddd554352aa2e5337bec2cc11df88c76c4fdde96a40f3421aa60650d7
- SSDEEP 6144:tzFs9WAXxUzCSoLxr6/bCmJrXPXkCS4RGRm1ZdtDdJb2DKCG:tzO9IzcB6/br7cORGRmrrbOtG
- TLSH
  T18464AF69F4D54540F3485174A2F6BCBA7C3EAB498187B5CA0AACB3834AF5C154F839EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  lib/commons-compress-1.21.jar
- Size 994KB
- SHA256 6aecfd5459728a595601cfa07258d131972ffc39b492eb48bdd596577a2f244a
- MD5 2a713d10331bc4e13459a3dc0463f16f
- SHA1 4ec95b60d4e86b5c95a0e919cb172a0af98011ef
- SHA512 c92d9a12547aab475e057955ad815fdfe92ff44c78383fa5af54b089f1bff5525126ef6aef93334f3bfc22e2fef4ad0d969f69384e978a83a55f011a53e7e471
- SSDEEP 24576:mPwNPO6rAjFdeOn7WdYj4G5g31ru5EOLeEw:mYN2BjeOn7WBG5g8yWw
- TLSH
  T1AC25D030FD860851F93312395A76BC9F747A8F88E74B32D9B6EC760383A5C855A936C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  lib/commons-exec-1.3.jar
- Size 53KB
- SHA256 cb49812dc1bfb0ea4f20f398bcae1a88c6406e213e67f7524fb10d4f8ad9347b
- MD5 8bb8fa2edfd60d5c7ed6bf9923d14aa8
- SHA1 8dfb9facd0830a27b1b5f29f84593f0aeee7773b
- SHA512 1543fb3d06491a25dabfdb889808942ed31a403ee349d59fd1c7a850b74fc826e8847ccfc9eefda111f126fe38298083cae5968c1f447d6d81005ea06449c3be
- SSDEEP 768:kVrR5u5OC0l7YbYjR+zqwsGH1t5sTdqKqsOxsTgOJECh1UuyuFMJTS0mvJqNZUg:kVR5u5B0xYGRUsAuOOTgSP8osTqZg
- TLSH
  T19C33AE25DA95603BF34B40726296B2B8003F4743E98711EEB8FCE61BA585C164F97FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  lib/commons-io-2.15.1.jar
- Size 489KB
- SHA256 a58af12ee1b68cfd2ebb0c27caef164f084381a00ec81a48cc275fd7ea54e154
- MD5 84351f7991a0e6722f00e96a4ccc376f
- SHA1 f11560da189ab563a5c8e351941415430e9304ea
- SHA512 e9adaeed2d715ac0ae44de056ba165a743a92acbeb9871b535f7e58e0b3bc4fba276495b50429be195098a559f3adb7294048479754a0ee4d397da2efda5f81c
- SSDEEP 12288:E58KhBmHZyNxDz8dLK/2DmNH1Z7I8JHDK8S3ti3:E57RcdW/2Dml7I8pDK32
- TLSH
  T1E3B4D021F5C40022F6AB4437747B659A72729749CE872ACF14EEDA07E873D489B83F94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  lib/commons-lang3-3.12.0.jar
- Size 573KB
- SHA256 d919d904486c037f8d193412da0c92e22a9fa24230b9d67a57855c5c31c7e94e
- MD5 19fe50567358922bdad277959ea69545
- SHA1 c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e
- SHA512 fbdbc0943cb3498b0148e86a39b773f97c8e6013740f72dbc727faeabea402073e2cc8c4d68198e5fc6b08a13b7700236292e99d4785f2c9989f2e5fac11fd81
- SSDEEP 12288:+ckjxCcwZ/O05RmbNxmLhmckii9z2B19dCk:ACcEOqENQEvUBlF
- TLSH
  T12CC4D120A9C61815FA37903841E3389A24BBCFD8E587B0DF39ECB74358B6E0646776D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  lib/commons-text-1.10.0.jar
- Size 232KB
- SHA256 770cd903fa7b604d1f7ef7ba17f84108667294b2b478be8ed1af3bffb4ae0018
- MD5 4afc9bfa2d31dbf7330c98fcc954b892
- SHA1 3363381aef8cef2dbc1023b3e3a9433b08b64e01
- SHA512 afd836a1094449e0a791fee67363666c47b6d24acff353a5089b837b332c0f4af89565c354682521e37062d20e6b52d70c77bb4f24cca9b9532c274fc708a831
- SSDEEP 3072:hhBAcOAiOVb6OS9xiwbIzK5yMvKsV3kH1cgpID3YP0i+vJ7u7T5ABt1hsschZy9Z:9OAiiPSC/r8z3vgpVZ+hqdAfchE9UK
- TLSH
  T18234C03991D60135F32782306BA22997B43E5B9CD1A7ACDD35EDD383C86CF456A8B384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  lib/error_prone_annotations-2.11.0.jar
- Size 15KB
- SHA256 721cb91842b46fa056847d104d5225c8b8e1e8b62263b993051e1e5a0137b7ec
- MD5 656ad66261b7e7ea472ed0ffeea773ea
- SHA1 c5a0ace696d3f8b1c1d8cc036d8c03cc0cbe6b69
- SHA512 defcaf30b7def5071243f3982d0d81c47c05b1a95c4d6143b3af86451e97c212c8d620d7220784e541fe8ee95f7fc59452fa6392fa37dac2d5705bfaf06105ba
- SSDEEP 384:S5WioSmMYQXbEnU+FOULB5b6fhPPcIafi6NJb/O5fVlmRO8api6Do7sXuq4we9t7:vxSxRO/6DTIN7
- TLSH
  T10572F8D7B158AD7FF81B96337060841B783CD8E4BE2F3A866AB4054154A0E4B1F86B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  lib/failsafe-3.3.1.jar
- Size 140KB
- SHA256 af90a069c56918d9ddbef7bbd5ef5a25c1eb8bef459ae1ee89c1db21cd5f6bf5
- MD5 a16b9f66f4009f924e2118e296ec927a
- SHA1 cca46c10dd22fb0beb7e0c1e468604430355a4ab
- SHA512 fffcbd84b95656c302b4be7ba7bffbf686323bf7af265c2b85bedc72695843067b1a804ab1bbecad0f2732ebf46562c3266f0ed970517b64d93a1a67535b7cd9
- SSDEEP 3072:7+sy3ATTK8/lb5YvVfswHqhJzwPjjFbgk:83Y+QvUsCkzoh
- TLSH
  T1FAE3AEB46BDF9325D9339D3E80413607B9E3338E604A5A4611FD02125EEA1BD7E3DB4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Reads user/profile data of local email clients

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32