3789770601141d11acd37261699f379e6f0b90144591334f08431b3db11d441f

Sharing

Copy URL Twitter E-mail

General

Target
ClipVault-Setup-2.7.1.exe
Size 77.2MB
Sample260714-b33mzact4q
SHA256 3789770601141d11acd37261699f379e6f0b90144591334f08431b3db11d441f
MD5 c2ccb1c60c5d0283db17139c32394bf8
SHA1 b04e59a96de8bb730e56a3e5d2a414cff94abe7c
SHA512 6ebc6e5247dda3c5051714079eaec2beeb8f2ca3ea0bf777f14dabb4442b18f0900da617a506f8c5e4010a697a86fc75277bb2a12124c0fc0016407021c58916
SSDEEP 1572864:Ytu/U1RESsuvJlDA4h8MMSoe7YLgAj9ce72Weccl3asKW:Ytqkfq5e8LgAB92We9
TLSH
T10B08335F2396D54EC33CC639C9504E4AD06AB667A68CB37BF7885FFB72A065C0A03485
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ClipVault-Setup-2.7.1.exe
- Size 77.2MB
- SHA256 3789770601141d11acd37261699f379e6f0b90144591334f08431b3db11d441f
- MD5 c2ccb1c60c5d0283db17139c32394bf8
- SHA1 b04e59a96de8bb730e56a3e5d2a414cff94abe7c
- SHA512 6ebc6e5247dda3c5051714079eaec2beeb8f2ca3ea0bf777f14dabb4442b18f0900da617a506f8c5e4010a697a86fc75277bb2a12124c0fc0016407021c58916
- SSDEEP 1572864:Ytu/U1RESsuvJlDA4h8MMSoe7YLgAj9ce72Weccl3asKW:Ytqkfq5e8LgAB92We9
- TLSH
  T10B08335F2396D54EC33CC639C9504E4AD06AB667A68CB37BF7885FFB72A065C0A03485
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  ClipVault.exe
- Size 172.5MB
- SHA256 c006ad0e09aa9d802352e02b3e3796dd4547ca5dee1a740c6810d542babaf651
- MD5 06e615cfa90ca3e6cfbf1627cb80c1da
- SHA1 39e68a4a8d2391884de60191416a45a28669b3c7
- SHA512 1b424631cff0a10901a2aeb16744e1ae5fdc86b2737c348b7671e115eb5dabc9d587a81d35407135e0582f4eaa6af330d8b61782a8e8ba131a5feaba6acb351c
- SSDEEP 1572864:U7NR7Rm1DKEM9Lx4vpOzDE0Yyb5IcIZBVAM9gjMdCjWqgXVbRgTsndR0aL/9eO:NVxsOcY7TR79T
- TLSH
  T177889C03E29A40D9E01DD1B58B9B9233EE71B8494B29B6DF275407522F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral6
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
- MD5 11ee9d008e924e19b33e0b45fdf145df
- SHA1 140773241b15513e9d7a7aff4d1c1d8f7e0b7e41
- SHA512 4acd065ffee81972fb1cfbe11507aab75c883aa94e359f3c455f87813925bb2d3416ce440561b430d6dedcc2f566d5cb74de139e181da68507ad36e69a672662
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmf36k6T6W6r656+eGj/dBIp+:oABeGLp
- TLSH
  T15796A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
- MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
- SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
- SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
- SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
- TLSH
  T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  libEGL.dll
- Size 470KB
- SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
- MD5 b12e3c1e72935273492da1daee50eef1
- SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
- SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
- SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
- TLSH
  T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
- MD5 5082e41d7a57506fe6b4bd58f87276b4
- SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
- SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
- SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
- TLSH
  T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3-multiple-ciphers/build/Release/better_sqlite3.node
- Size 2.2MB
- SHA256 1ae6aa06afb5ae884cd8cb45d2601cc8ff9f0d5145919870d9f9f4e168642d6a
- MD5 db3ea4c7957af6f3cd141c8c1949c419
- SHA1 72182550bb7a65e2792f14173f02cf55360db071
- SHA512 2de43b518f69916e7b4be222d25d7f962461158077d9dba43d9330b06d537deb6cdb70b36ebeb76469222bc7a2664c7605f8b0830f9308841744fce5f8f19c81
- SSDEEP 49152:9Bz2ZR0UetkEnSdIaFtyklOIfxVcf8Pt7P4C:9CZD7B4C
- TLSH
  T1E9B59D4BF6B500BCD067C1BAC61B5617E7B174061360A7EB05D0CAA96F63FE216BE324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3-multiple-ciphers/deps/copy.js
- Size 928B
- SHA256 1b4a6f84b51aa84007a852a93f1c405ecbfc299bcbfc67b9e388d663dd5a9769
- MD5 509bbd6e6300a73906d2ab9fee05b257
- SHA1 17a2aea949ed8edda08b1d5ecd60edb38a44b62e
- SHA512 c0c844d9235ac0bb1826dc5dde3aabb36a2adc2517b0c0a125f95faf59253c0b7691910a5f6c9d2761f308937275331017a8a3a2bd38d16f78f64a8e0f0a710b
- TLSH
  T171113ADB4B4F12BCE7F2BBC0AA30E90E045482E07A5B5868E4D85DC1386B15668C6DF9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3-multiple-ciphers/deps/update-sqlite3mc.sh
- Size 5KB
- SHA256 aa45b6d32ad374e23420cd1be8bd17cdbd00cb86eab321a06dd7a18027cded83
- MD5 9a15cf7089391bba5656103aa8e36a4d
- SHA1 08525ffc7658c3bf192335caf222620337bd1fae
- SHA512 8637f2394f43e12f87bc08388a94acb40a20ee6943476e0d660ea2720000740f7ac5e8a00933720c68d00f063e98cfa9244aa0d40dc6fdb80bda7112d6e5b134
- SSDEEP 96:ZO/0PAtCIm4z8FcC/3tUeT9SubbE/Iqj7sPQGZuRtQFjZ4dWZ4CWt2ZQbPfRfkfg:ZO/NtqN5hE/IqfsIGZuRtQFjZ4dWZ4CA
- TLSH
  T1AFB165F76A4F4B3D24874186647C61C6BE63927ACBB074486C911E2C89309D41BFDDFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3-multiple-ciphers/lib/database.js
- Size 4KB
- SHA256 06e2193b7d884fa7106d3f7e0f8fc899148a88f7c95e89c76ac4d2dc08583c58
- MD5 7a178b66654ce55731ce61ff15dec064
- SHA1 f91988bf989e244b4e9e442067d92c57c0149985
- SHA512 131c1edc3cc65167fc1b8355647765c1c68bef29e7c894b3e57af59450fa7a0944e6834559d6b1dfcadabf098fa3a33ddd110c4a9f7612fb021e42975a271741
- SSDEEP 48:IFAn9b9VZFesxWy8/0xYVXM7r9ZqQZ27eKzNQactRLC0QIPYoSxp8LF6cLg3pplb:gAnFvZF2c2K2QZitzNEzhSHC3LEbRZKW
- TLSH
  T1A99131849BBB606247EB31D4A174988DA239D179616D05E0E9CEC3F130E6089FBD367A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3-multiple-ciphers/lib/index.js
- Size 113B
- SHA256 78422ff88886c8c8e99904b49add7b3899e1c42a6c9f93960c8a93f701ff85bd
- MD5 a5ff4437f5a3eefabc008893364733a1
- SHA1 26abc3a6537d852fd83a402de9b5a4be4e7e711a
- SHA512 daf4338d35e4a419974071faa5a5b191282608360f576bb21173d712320684352a164aa84ea7d4e56ba690b697111e92f90c77232acae0c94e790b3d38dd8b85
- TLSH
  T1ACB012CF17F4F18F168441C4ED75885398CAE064441880608F15DFFFA484CC82EE2EE9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3-multiple-ciphers/lib/methods/aggregate.js
- Size 1KB
- SHA256 b6116526a47835052f90215f53ea77919d2d48b61085cc9f669881321d9a08e7
- MD5 cdc04774c13ed87ea0dc805f8d07460f
- SHA1 ee8c2b55eb3ae9902debc09e0860f561962b44d1
- SHA512 77c168b1c2e460de7025f67e017b1cc75a640ab8cbda31d33a0cf3c4d4e19dad9859b4c573beb8587a169af97c2d35fb3f551eb7088a364b583730d5fe3842bf
- TLSH
  T19A411250A2C6225649CB24E0B077FD09E67FC720764EB0F4D52EA7EA2091C9DEDE7984
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  vcruntime140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH
  T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  vcruntime140_1.dll
- Size 48KB
- SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
- MD5 bbfa92d8173376c972fd58dcf5ca6aaa
- SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
- SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
- SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
- TLSH
  T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
- MD5 15d9ca6f1d87f15f5c67740df2bfa874
- SHA1 6d84c52d33249b216223e02cb445b886bea6b45c
- SHA512 24796d3aded0a49713489b285b9d38fd041a7376e900684053c1df106a509a315db9e646c7286fd59c79c664557e6d4e6843a55828abf04fc04d8b307829fc6f
- SSDEEP 49152:IgQpJ5yZBtfCp00oSO8hCsDsbJQk/tJ4q0nLhII1ytiT45z+WEjNHsRLf7OFJOMZ:4n5yZBXLxkf5FJIaye
- TLSH
  T15D463903B2858099F05DD1B9474BA623F632F8801B72B6DF52A41F192E77FE06B39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  vulkan-1.dll
- Size 938KB
- SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
- MD5 8bd643a9f7ef2619b792cf2544f27a8c
- SHA1 8d5aba34d852c9b9f62a4dca5ca138dbc458c931
- SHA512 8a81c4edde9d20ee24d3390338915f096a27956bf57815c443a37f15bdb4072a0c959376721d2354fd565045efb3340922a9a22f3293bb3784cc6df6a0ac353b
- SSDEEP 24576:gawxZ1onv5Sp+D9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:dSSApY90IDWb36Z5W1DYsHq6g3P0zAkw
- TLSH
  T163155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $R0/Uninstall ClipVault.exe
- Size 188KB
- SHA256 7ccf31652a0fac6b93ad6f0ecfe417dfe5827235457a03ef9d3a1f9a2e8f8dd7
- MD5 0f3645194dd32261b926b9dd09959e51
- SHA1 b9f05fd2f2edeeeb27c8c159604a4b92498e293e
- SHA512 921979f899dd3ab9f862032083a6086c8869591b2293d8c8a0c8a9a8ec693a83f89e7db95113a06e367426bd7111a658287bdb4ad882d4f9095545d2f8dee1c7
- SSDEEP 3072:On77v00hEoDEtaucwqEvL2QhJwvMrtLeyGj1bu/a2MNUa8b32tvhOEA1RJCir86g:O740IM9Ej2KJwvMpLeyGj62Ua8T2t0Ex
- TLSH
  T145140111FBD0CA13E0FB0E7066B683DB5D72B21468199F1B779517AD3892B42ED1E380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral26
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32