e0988fd53958eca3febc2dbbf0b80fa5d1ce793ac7e4537b1646b953030e5847

Sharing

Copy URL Twitter E-mail

General

Target
Updated.exe
Size 70.6MB
Sample260714-yz68bac13j
SHA256 e0988fd53958eca3febc2dbbf0b80fa5d1ce793ac7e4537b1646b953030e5847
MD5 64d993be131179a4a6e470195163cf40
SHA1 980b24b980c7b9a93627371c4b6ebe0484197f22
SHA512 1b042c0facb999e9c9b3e47d1b9077dbbdff4900b254caae0e6dca1b90c95630896fbf83b389f388d18d618c28fa7ceb970e0f22e683811ad09fe85b6d36d23c
SSDEEP 1572864:xLdkq3CC8AEFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7m7:x2DHaABZVPArg/bXeB7m7
TLSH
T17CF7338447568115D08F7FBC612F1FF2EE2A5DE0B36CA09B06A68872F56686BC5CC14F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Updated.exe
- Size 70.6MB
- SHA256 e0988fd53958eca3febc2dbbf0b80fa5d1ce793ac7e4537b1646b953030e5847
- MD5 64d993be131179a4a6e470195163cf40
- SHA1 980b24b980c7b9a93627371c4b6ebe0484197f22
- SHA512 1b042c0facb999e9c9b3e47d1b9077dbbdff4900b254caae0e6dca1b90c95630896fbf83b389f388d18d618c28fa7ceb970e0f22e683811ad09fe85b6d36d23c
- SSDEEP 1572864:xLdkq3CC8AEFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7m7:x2DHaABZVPArg/bXeB7m7
- TLSH
  T17CF7338447568115D08F7FBC612F1FF2EE2A5DE0B36CA09B06A68872F56686BC5CC14F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery defense_evasion execution trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 70.3MB
- SHA256 ccc4b8f2a9b9112b4e806763f7a2de3cb399c83fc37eaba5f91a6865a746379a
- MD5 bfbaea5fbbe6e5e0f855666312b96cb1
- SHA1 197007bd6b0d64f05af467a019b061b2c2daf117
- SHA512 4d58598d56d60584bb0578abfa44f1748ad21a400fd49042e22659fffc4f551edcdb049465430bb2d0517ac32fb3f640977fe65235354388b02f9e2d97cf303e
- SSDEEP 1572864:SLdkq3CC8AEFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7I:S2DHaABZVPArg/bXeB7I
- TLSH
  T129F7339443568119D08F7FAC612F1FF2EE2A5DE0F36CA0AB06A68872F55646BC5CC14F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  chrome_100_percent.pak
- Size 150KB
- SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
- MD5 b1bccf31fa5710207026d373edd96161
- SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
- SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
- SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
- TLSH
  T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  chrome_200_percent.pak
- Size 229KB
- SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
- MD5 e02160c24b8077b36ff06dc05a9df057
- SHA1 fc722e071ce9caf52ad9a463c90fc2319aa6c790
- SHA512 1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e
- SSDEEP 6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
- TLSH
  T1A734F1D763F89D3DC9674AB3522601F1ECB2013946B6424B03DBED357A96BC988C92C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
- MD5 74bded81ce10a426df54da39cfa132ff
- SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
- SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
- SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
- TLSH
  T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  locales/af.pak
- Size 478KB
- SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
- MD5 2602cd68ebe25f12f5d9892d5fa92b11
- SHA1 478766dcc8ce4427872bebd81ad929f7aef250a3
- SHA512 6bbecbeaa6e09857a5698a280475496498a88488249025b2f58ca7a8493a77bc13fcd783041a6198f58696f4e2a84c3dbee0891e89800dac6f3fb317f70c5492
- SSDEEP 12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
- TLSH
  T1CFA43C06EB84273D09A07696BA0845F7FF9CA26CD770B2B6DD9D823509A6EFC017D0D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  locales/am.pak
- Size 776KB
- SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
- MD5 ac7a72616a544cdb022eda20b0dc8872
- SHA1 50b7f8363894a7e33042412804efa2bda510aba2
- SHA512 d5b3b851a0d6615eccc1223cfba6b285ac8387e0c0f9df1fb5bd95c9a208813b31f56546fc9c624e7f3a12b35ab7e8acd13ea85025b5f9cf74def60ad679a546
- SSDEEP 24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
- TLSH
  T181F499547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  locales/ar.pak
- Size 851KB
- SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
- MD5 4d0a0771176823bf004f9182b94bde82
- SHA1 7e0601d8dca0404736787d85918d1a680a7e68ec
- SHA512 6dd144273252026bcf08be52189ea5a15410a42a616c9fac14edb4be7d98023b65fa1746ed50b654e57f140790e8a92b1080f2f035adb81b7d10aa473f2dca61
- SSDEEP 12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
- TLSH
  T19A058BE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  locales/bg.pak
- Size 885KB
- SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
- MD5 d0b47c1cf62b29b866ca630958a019fb
- SHA1 bae6e1af9d7225584510443aed21a40fcea349e3
- SHA512 39472b1f6859c10cc782a303761d63a2409807d7d342c3bc558075284cf455a26c3e1b9b4ce67a5fbd84e6c4b621adcfd8fd8a819cfc25554962454e5f4b5816
- SSDEEP 24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
- TLSH
  T1C11514A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  locales/bn.pak
- Size 1.1MB
- SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
- MD5 83a0030387afbe1cd2d6790079fc5024
- SHA1 9d4253d253167aee6f3ba9cf6f8f376266832d00
- SHA512 20c92c5c3634a9663d933aa98d9356e18beb8927f2975778967a65cc25522560784eabecfe99037008689cf3b77093c35d3f109f32ae2db2160e9798415a3771
- SSDEEP 3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
- TLSH
  T11445DE209C6E91B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A24938ADC3C8CADDB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  locales/ca.pak
- Size 538KB
- SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
- MD5 d5d6200b582b9b12a0bd8c773dea0474
- SHA1 341650b76af1c74129a97725673b646b7256d4d6
- SHA512 1465e7214c4ae818b545778b831b7773f0373726f705160ba4df33ce3c206a2166c8b6519336fd2b1e405ef6811d2cfdc2a655f1b767bf9b4e083c6a33b34ae4
- SSDEEP 12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
- TLSH
  T113C4E9239FCD3B6744D2320AFB46C217F48CA9847B06D254E4AE1B1622CCADCD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  locales/cs.pak
- Size 555KB
- SHA256 5635587f6ffb152c027b4357092fe78168e31cbc7f6be694c627f819c1ad1d73
- MD5 0e52ac897f093b6b48b5063c816f6ca1
- SHA1 4f4febb42fd7cdd0bc7df97c37db0e4aa16518e4
- SHA512 9cf5594ac47ae967bd4221f61b92c97343ea0c911fbe992d35a9391e3e1e6560b1b41bd031074cd262a622ca88af3b25ba33575b456a4d5b8a7b897233c0a54d
- SSDEEP 6144:0/AkCOZjqspN1oAUGCDAfiebO5zU8rEsiNOPY3SBFmPy38Qu:0dJZuSPoAUTbe65zU8rEsiNOA3SzmPH
- TLSH
  T1FEC4492EEEA36425488002497BBE4128BD1E83540B2FB5BB6C8F9D91217577ECFF4D58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  locales/da.pak
- Size 501KB
- SHA256 0c75acb008dd5c918d8a1a73c22fa7c503961481bf1708f6bda0da58693c3c08
- MD5 d5bf4aba2d82744981ebf92ccaadf9c0
- SHA1 1a1c4ea1d4ecf5346ee2434b8eb79d0bf7b41d46
- SHA512 5bccc18687fcefad5e78c5c8072acea36ce7687c5b848a1e0367c82a38f32f46402ff01edd4fb1379ee77083ef0e1964e24bad87b18ce78077b28f0c1bd4bd08
- SSDEEP 6144:gRsuNwWzVPsP5sbse814e8jKwlRDdJwL2obEZZaFRQ5Mk2rkvb3d4nTGqFwJ:g6qskjdTv5M/rvTpu
- TLSH
  T163B44A4BDC9C732F89AD4A65F3108DA7EB5D943CC684264F65D894390ACFC6093BE2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Windows security bypass

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

Hide Artifacts: Hidden Window

Looks up external IP address via web service

Obfuscated Files or Information: Command Obfuscation

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32