232c91dd976bb6b18f7838e4bb2c1c07f3e9d4d58180a3533b065ba17cae4694

Sharing

Copy URL Twitter E-mail

General

Target
Persistence.zip
Size 60.6MB
Sample260713-2ln2csb19x
SHA256 232c91dd976bb6b18f7838e4bb2c1c07f3e9d4d58180a3533b065ba17cae4694
MD5 3f9ce0e5daa1553a8a9c1241ce259d5f
SHA1 8c965e5ca313b2d1ec9afd93f751fad544d26311
SHA512 509bd1b62815d98341eed58bf5b67c7e4e554960fe6a567e5df5f661966ddb3369a5ae84969db46ac9efde30fc66aa376f2ddcd8c9b971fb0e60ed4bf7073b44
SSDEEP 1572864:ZYY8B/5wEUd5V2ku8ArLBpYmIwGC2luHSi91ScNxyoX6+dXwxPUm:mBSdPfu8AhpQwGUHp1SkVBXeMm
TLSH
T1C1D733CAD9200B9CCD62E460E8CE8EBD7CDB37041B5A5A177504D2BB59A281DFC687F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AXEDOMCore.dll
- Size 787KB
- SHA256 a43f61fb2f92c329ca7fd120577daf695fc4915a58ca7034509a5ed678359ca9
- MD5 800c2b3bf101dbc0e00f3caa37aae8d5
- SHA1 06706b3d24e026a888ef74d789faab415cc7d460
- SHA512 c6cd123039e6ebd41cb7434b44a30e3e8da7003acada00b09a986f477fa40cfad378220a8dc01e28c4a4e23e4c0d8374c0b84a3a90afd2ac2f4283d0e1195081
- SSDEEP 12288:9Ghmb/4zNo73oX1iIMTCr9OwmGantH8kXGtGstF1FFf5gyk:9gzNoEliIMOsaa9+F1Lf6J
- TLSH
  T151054A2EAB68C3B2D06FC139C5A18A47F7B270555E31634B16C2837E1F376A56D2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  AdbePM.dll
- Size 2.8MB
- SHA256 a677174b1900e3b3f237f0f500b98b415ca6c127843fae75b3ae51dcb71d71dd
- MD5 380dda07e3edeab72019b36bcdb43e64
- SHA1 6e20aa0478f45eec98a06e1a0ea819152936308b
- SHA512 5e5c082768246feff6482b93d25a378416ee4f8e907cca3f3a2150cddef5a224950cdf6401d9df87bb5909d5e79474c896395654ceabd74e278998f9361337e8
- SSDEEP 49152:nG080aAbPUY/SRtGrgh2xQ08UEgg8cm/pB3YV46:Z77gh2V+
- TLSH
  T1CDD57C0978A481DCC02A91759EAF7A97F372300407255BFB42E18E651FABBD05E7F329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Builder.dll
- Size 42.8MB
- SHA256 4249d73588d4542919bbbcf7513f197eb94eed15a4e40e70e82411a659b14809
- MD5 0c99bba203b31a27c3f43b85b23abda5
- SHA1 62f6c93da9a82cb0b54c8c7fb1336f6ff26bb998
- SHA512 3741b5a0ac0759d16292beea136a234802dc8fce70c4a7b363b52c441fa46ede7fdb6f1c1050bd5bc10e02f0f6fa85752663296c4d8ba1657a0a7e3ea4fe5305
- SSDEEP 786432:Si7rWC0fdyaDRQyVEHwQLs2ajHEF6+Ke1NWIdP46dYIqTXoEXiPzXOYRLO/cNByo:Si7rd0MaDRzWwQw07d1NW0w2cME5eLOo
- TLSH
  T192A73349ED20472F8F53D470D9D80BF8748F3704A78A6E6AD299D1F606A241DFEA47B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Launcher.exe
- Size 20.0MB
- SHA256 4b840844ce458265427c1d9f11917bd94b84561ae7add3252e56cfb8f567e305
- MD5 183edf6dd1ef070eb3d386090354acaf
- SHA1 832e66d84888acdab6232662f19c2b33bd4990e6
- SHA512 9a21f13264d293579a15e48d999313d04966d9504b9578434594986f1a859e1f68a11bab56d6816db3abefc53ab109629de97229770ab8122cc1cfd7bc0373c8
- SSDEEP 196608:DrBXt5LXCuz9eL5FUtX48nvhbTWxszcRNdBMKSrXegGW9nsAy:nFt5LXCuz9eL5FUtX48nvoaQYtnsAy
- TLSH
  T11B27290567F98194F1F797349AB28787DA76BC416B34C68F0250620E1E73AE0DE7A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral7 behavioral8
- Target
  adobe_caps.dll
- Size 1.0MB
- SHA256 502afd64541dbd1a10088f3bacf6047d08b06c9bb82191714c2cf49f89a8547f
- MD5 6028b7ce65512ca328710e163bafe292
- SHA1 061df5500d4802e0d5b900cfe72724f8c2f01f5d
- SHA512 4752190e974d91a722e0d42db23ce881eecce7f6304a94e516e3f43937b423ef0871563729104346a01400f5febbba5d85dbd354280c6bd18862b18a5cad21da
- SSDEEP 24576:jesi4PPQ7BG8Xtkf2VeGB9HCb5ajdWkyRTn41y:hiAP5Ytkf2kGB9HljdVYTnd
- TLSH
  T1F4358D5AB7A841B8D9B7C27886678513E7B278051730DBDF06D0A75A2F23FE1663E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  dvacore.dll
- Size 3.9MB
- SHA256 f6adeaebe90c69e14627774ed557a6d5bc03b521d921a149025d5c1ad6431863
- MD5 59f8e030c24cf4ed50ca9a80a45e33d7
- SHA1 69e98a71677b80375da894b111d82419a14a0dcc
- SHA512 a2e4d117a3856172cfd1742f9de070b5555878b945ee472f6ae014a9e5a59064592086b85f40bc6447b0caa6117488993482ef2a6264ce84a3ba044a23660d9c
- SSDEEP 49152:1HgWWK4ugTEIo54S5bWLhEynObPzeMC4zGyPdydPfhMm97DTf5eJfF4zc1PWL:+sL+vL5eJfFLJQ
- TLSH
  T1D9166B2A7B38C166C0A6C2BDDEC5CAC6F6B234415F329BDB0191931E1F37AF1567A211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  dynamiclink.dll
- Size 2.2MB
- SHA256 63e3cfbb7b8be166c3a74b5919455162ce9efb8843016714223e7750c298b9e7
- MD5 fd005daef1e9d88fdb8022b91f1e4db1
- SHA1 fdfb04797aeccdc978b06b9be68a6dd98436823a
- SHA512 5adb80dbd4f4f8d93c6741c3c637f212dea147c8fac9d66d0bbc14af6e7f457603da7b90b815387cc6e42fde9724114d74ab20d2f071b159f349d9fe42193733
- SSDEEP 49152:JNTwuS0u6FnrFngY7yrjY2V9iZlfv9rveHMe8ipq:XdERVO9eHrq
- TLSH
  T186B53B67F638C1A6D196C37DD9C5C988F6F238511F318AEB009A862F6F73AE5493D120
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  icuuc64.dll
- Size 2.3MB
- SHA256 65eb04cfa9ed2f5e4296234bdf2c9fd3b90dd335475bb2c336d769c228940559
- MD5 49aeef3e2a29c062765a747e8e227ee6
- SHA1 69498e9a4431390b6172aecc656590b4ad761265
- SHA512 4745e1c5d19ab3276cb7c832af544a412e242801b5d7d09976390ce39a41aa30f72c2e63eadb27005297e66de8ad9424f8af97ee707c072370999fa4a4dc2501
- SSDEEP 49152:+gtKs7mHw0MQL9MLiEGr0AuJZPHIJXBU8jQJ3:Os7mQZkK+sZPHCm
- TLSH
  T136B58C57F76A80A3D47BC13CC5A60BA6F6B27C014F21DADB069B83592F236D045BE391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  igestep30.dll
- Size 758KB
- SHA256 92c1b1956dbd52edb9720fedcf1be023c6f2f72cbc761032ce29dbb8e7f93290
- MD5 b7b34b5c4f6ddc5975aa2e7c58fc7026
- SHA1 a2f4e5a50061a16e6966135a3a7b5e80515b3764
- SHA512 5d7064187c469a972723eb1590dd4828d1981fd64cf5b473cbf38a5f899a84fe728dbff61f1d937d313c7ce9082feb4fb6d7a4fbeb0d796adc6c4feae71142ac
- SSDEEP 12288:6NJKEqr0OQHbQqoa3X2xRJbZVCkMssa0QbxysxZ72m/n:6NJKEqOHbQIXKJ+ysGEsxZ72m/n
- TLSH
  T188F47E19A5E8509DD073917845BBA286EAB238490734D9EB1353C92C3F3EAE07DBB711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  lgpllibs.dll
- Size 151KB
- SHA256 015416a1f39dfe40a2f659f058c8b95bfed2ff1ff38fe8aa1cd02bcd8275c4e3
- MD5 89971e59cb27757a4c5e379a565e0aa9
- SHA1 acdc9f2fb1df0380c3a4471ed0e08be15100e45d
- SHA512 b7ed83c3e3febd3afaacbeb59b3a871870ff4238943becdcc8c5a680c785f43754907b57c23ba3cef939e4413faf5d34d88e34c1c0360527ec70cb170774c198
- SSDEEP 3072:AW2URaYbc7J4xSVns0G2L37K6q7DnBTc3TFPC2v/xWj+Xk:AMaDJ4UfrKxDnBTc3TRC2vUjf
- TLSH
  T1C1E38D6EE6448CBEE436497415B68B0B677E3C400B285FC797A09B146F5BBC03AF6391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  metadata/CRClient.dll
- Size 326KB
- SHA256 dfda0d97560ce9d9f2052d2ae21ee01a71d2cc1e9848d98d99995439b9bad766
- MD5 0c1cd59a19572241c6c2282623d97309
- SHA1 b62f4c450589e5e3958d208a5041303e60867e10
- SHA512 6a7015ab70a7e4011134b8d9abb33eb06cdc33501b87c8b692ec0ef2f1593a819c074a06d5efcaf0eb8573f7f80f882db76d79072bceafa06fcc96430006c3bd
- SSDEEP 6144:H0uTU8Jh1aQgAtXpzHtKlWAKvKUc8odYr78oqBhz0j:DnpX7KUAhUc8j7VoE
- TLSH
  T17364090677B80C65F5F3A2785AB78645EBB2BC511B31CBCF4210625E0F33AD5A939722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  metadata/dvamarshal.dll
- Size 263KB
- SHA256 a1b53d73fe7db96ef6d3f40eccc848b5887c5c90ad4e251e9fd30cbfb16d43ae
- MD5 832f27c4e7152c8a8f7762f442de2e07
- SHA1 4edf20bbc92b8674925b5de7cc603d5d75c0ccf8
- SHA512 e8632db2b398c3f57580ac303dd6787b525afb40298a95827a772f28cd7e71f9c5bfdf34d15aaca701d61d966794587791894543e75cfe3b428066a2bd3c64d7
- SSDEEP 6144:JyYrTg5JTRbYQmF5JK52c5/utnQQoivvVy2:oiT0RbYQmko+/uhxzx
- TLSH
  T16A44E55ABB648D66D413C2BE99818A85FAB338414F32DBCB4151833F6F77AE5AC3C111
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  version.dll
- Size 8.5MB
- SHA256 f2c4c9cb65cab45ad778a811fac6602706dc3a5499583eaadfae4a386f28c3e3
- MD5 68b2985b3d1cf864847dbcb01518db75
- SHA1 4e3ec7e7f9bd17e22b06f0f1ba03b9b24f0d8708
- SHA512 e0202007ee293a0ba5d5ae1d0505fe0a4304e197ad6d26478145766cafd401d043dcd02e0326e063f3f4e16f151cc647fddd878d83cf254c139c5a325419dca4
- SSDEEP 49152:UB81mmD4SRwRYrQicmaMp3Jl6hoq7r3t8wQUckZtMpa4dM/dBBtZ7U1NPOvoJOHH:U20H
- TLSH
  T1CD96E0AFE84C1093ED66B9E58D9F67D78151A7222A01580733FC1D4CC72DABFA507B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral24 behavioral25

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateThreadExHideFromDebugger

Badlisted process makes network request

Reads user/profile data of web browsers

Suspicious use of NtCreateThreadExHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25