32352bb4e38a428d08411503a20da654ec1bdfe16022b047be22e90f5a5f9caa

Sharing

Copy URL Twitter E-mail

General

Target
Redact-Setup-0.21.20.exe
Size 200.3MB
Sample260715-vf11eahs2l
SHA256 32352bb4e38a428d08411503a20da654ec1bdfe16022b047be22e90f5a5f9caa
MD5 c6235a4a043d878274bb148059d1b4c1
SHA1 2d92e6d1c44619148056af1e802b934e980050cd
SHA512 d9aa498f5e8702a44856cb864d05e8152b675d1d311830ef7c4e7ed4a5ba7d0f254d99633451cbd7dd1fa3085befe7c917d0c1d92de003242f420b05266dfa30
SSDEEP 6291456:icX+zVsnT1DyRzmCfv83gwwvxhMBZXUoOs73famMaFaXa2h:iygh1CgTxhMfis73faMFaKY
TLSH
T116A83361E4100C4BE9A727BCCBC9C7E31664A609E50E3A0E6CD7312CAF27E576DD8719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Redact-Setup-0.21.20.exe
- Size 200.3MB
- SHA256 32352bb4e38a428d08411503a20da654ec1bdfe16022b047be22e90f5a5f9caa
- MD5 c6235a4a043d878274bb148059d1b4c1
- SHA1 2d92e6d1c44619148056af1e802b934e980050cd
- SHA512 d9aa498f5e8702a44856cb864d05e8152b675d1d311830ef7c4e7ed4a5ba7d0f254d99633451cbd7dd1fa3085befe7c917d0c1d92de003242f420b05266dfa30
- SSDEEP 6291456:icX+zVsnT1DyRzmCfv83gwwvxhMBZXUoOs73famMaFaXa2h:iygh1CgTxhMfis73faMFaKY
- TLSH
  T116A83361E4100C4BE9A727BCCBC9C7E31664A609E50E3A0E6CD7312CAF27E576DD8719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/chromium/elevation_service.exe
- Size 3.6MB
- SHA256 d32e0debd4bb5651448fc0e752b9d7f9292268ca2d21968a9d52076f1f36b743
- MD5 38e31a8ced2dd15c3cb182d3883926a8
- SHA1 cc19f866fab97f6d9bd45cf95a6f3316050b2749
- SHA512 4c3ec821e4ef95392b4a2f7cd1538788430642f887c70e5cdaa469b6462e7db87e522434a443aa564602fb398591ef681fcbcb1642eff89d199f9d7f6899f9fa
- SSDEEP 49152:gBfD9V+7ABKjwPxKDn/pDsZQDuvTgcsaVFF3olg1cs525YeLHsgtFKeW6GfsNk:mfREKYDk/wQAFrq
- TLSH
  T168067C03F19651ECC059D1B8870A9632FA61BC494B35AAEF07D0BB211A72FE06F3DB55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/chromium/libEGL.dll
- Size 513KB
- SHA256 3b275208489795e80c7fcd9ef14f93f3fdbacb8c41f5be27fa1c2ebbbf42ddc9
- MD5 f53c3749675a717df70b0084170ea913
- SHA1 99408f241f1b93fb38d498f22b032bc964273f16
- SHA512 947866d9eeff648c07f22851e09a4e817584e684f71cbc8f6a5742dcb93a9706f418fc980b4f47883ad71a0dde0a0acc2e6cb7b941d066f64864e6cddbb1b700
- SSDEEP 6144:Il9PZZD000b94DXwMbZFi0fDixBYnSM8dXJDyt5m/8NlWcUC/zy1irJ+qUu:YRCMbZFi0+xSSMQJX/8NlWcUipxf
- TLSH
  T134B48D55F29983B8D47AD1788A134A42F77178410B6179EF02E0A27E3F77BE41A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  resources/chromium/libGLESv2.dll
- Size 8.2MB
- SHA256 ac8025b02a24c7276f1bc92f012e947fafaac18a5a81d186c061bb6bab4cc81a
- MD5 db7b3cfe724ee6dbf1ebf8faf270a86a
- SHA1 60772d45fcd8a30a376870dac8d36580cd3ca289
- SHA512 6da8b55c4f889ee35a2bbdf64ccd8b162b90a7c7726b0d1be0d6f11299f88de51ec93fd5a73a9c3391c06c94be328e6834230f0ea26fa6d70183d63d28529534
- SSDEEP 98304:zu22zumajVNX6G6jsY+pk4M5Jus+9OJjDjjzjjzjjq:CXabX9gpK
- TLSH
  T12F865A03F29250EDC45DD2789717A223F6307C4907287ADF1A94A7262F76FE0AB7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/chromium/msvcp140.dll
- Size 628KB
- SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
- MD5 4796bb351c00d47717906bbee4e20837
- SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
- SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
- SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
- TLSH
  T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  resources/chromium/msvcp140_1.dll
- Size 34KB
- SHA256 206c931bf90fdad8816de3b5e2ef80b2bcaa9406c89ecc05fe6fddffe251e982
- MD5 d2b43663ed95d09af78bfab3484b1916
- SHA1 52f87dc7563078c0b9f839ecb1f9bea11ad608df
- SHA512 8984cff1c8f6eec407dd4cf7599950f42fc7dc9926e6ed3120cb1a4ab9f4f6ca5b3d040c8451adf2113ecbd4301d21f1ca88c9878618ceb5f3da3b4edce71663
- SSDEEP 384:FtXxBY5SA78zxAXUaWdWcu5gWAJk6St+e2KxaoR9z/bcIH2y4GlN5vEMgYR9ztDh:FtXrAh74RsuJc009zZXdrgE9zRh
- TLSH
  T157F25BD6A7688442ECA6183482E9CE437C7DB7D60F20A6DB12A2E51C0C937C5FA3595E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/chromium/msvcp140_2.dll
- Size 268KB
- SHA256 d50d7883f20d1dc6191768d3746f52dd9cac89c346ffaed5be1f110c2f34a838
- MD5 80d633b41909290fccc9cda534ca7128
- SHA1 72d779fdd27916e918ae4c15323d8c336074dac4
- SHA512 ff594e63fabaae58da7383b57d4d90322e6d2b2da42f99e58e3210931e043f8236cc8dd1f437e3d343da63af660b9299dee46a8d6e8aa27a096e8bdebfabd817
- SSDEEP 6144:m7KX1bsaPn3JrdfsUOEw/tpn76cAYQWO0H:iArNdZ9W9
- TLSH
  T1A1441615B94A1EBFC8E6E8B085397402FD2229014765C4CB1BC31D5E6B2BBD77EB341A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  resources/chromium/msvcp140_atomic_wait.dll
- Size 56KB
- SHA256 3d0cbfaa1bf3eecf5a3f4491d2960ee803cb994f30292c6adc4a07c498f60e2b
- MD5 cb5404c8773b6a3758d05c9c8b551339
- SHA1 8544021005709c682ce4d2430fba88aff0fc7eb3
- SHA512 691dc781dcfe2ad9f1e324ad31fdd55dfa120a4a56e6dad9f61e62029c9687a7a3806d920a3eca2dd2c8e3fa8a9c420132b342d74d59cdeb3c749be5630a05f9
- SSDEEP 768:E23X0bNO5FEEsn/H2QzRclqoLJcb9zP4s9zW3:raUfcnf2Q1clqoLSxzRz
- TLSH
  T11E435A19CE39E017E74A8D74C616C806FD72BED78B90B5CB67419CCA0DA6BC8DB39205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/chromium/msvcp140_codecvt_ids.dll
- Size 30KB
- SHA256 8a65c7596ef2e6938731f5a1058e7e40145b6d97967cc649231a076b9a608d78
- MD5 c6aa14b90f156ceecc4269537df73530
- SHA1 3bb5afd909c5271088a223191f38ca916c7d81f0
- SHA512 3d402af4a1f21542012bbf46f1a94f5e71a37191b94bdd8e30c816f1fb0af9bff938fa9f0f998e784e094afa91059c9120530de390a867b7c226ecfab184ec43
- SSDEEP 384:mwEkrtLNmH9j0jfVWi8EWmJk6St+eScDR9zgzzDD2y4GlNvKMgYR9ztDjPQ+:mwEkhLH+UJcJ9zgfDr3pgE9zR0+
- TLSH
  T130E26CDAD36C8086F996A97092A9DD473C3CB7970F10A6D712A2E01C1C537C5EB3916E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/chromium/notification_helper.exe
- Size 2.5MB
- SHA256 4eae83fec9b68cc5a3fff2104de7cdc2ad649d161dcf44e56f5e7c0d8b038987
- MD5 6a929066a7eac4a559dfb1abbaeb9d5e
- SHA1 3086746d31bafef4ae144bc9f27221af58d538eb
- SHA512 0583d2ec2daa2b11d3f55b69efda12a6bbfecb084be65ea278ba5a1accb9baeb08045cbc4137ee411881ffd634e724051e8f8f252c34cd767814d197c3e33797
- SSDEEP 49152:YaoBLBvsCOHRdDbf2b3P7bZFalNX7bZ6PLtaPli6:boBLBvxKDIE
- TLSH
  T1F2C56C53F29611ECC069C178871A9232FA61BC454B31BAEF0B90B7651F76EE06B3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  resources/chromium/redact-chromium.exe
- Size 3.9MB
- SHA256 23734245b9f0bd13f7cb816990625fbd71213e1e7fa537064192ff58d571406e
- MD5 adaa8629f6934636e4729c2376400190
- SHA1 b7ae0059c379fb02c6eca1553091171ff68f5275
- SHA512 a1a425847fb3eceb76fd79637a393493a30f971b9ed864ba54867969aec6bfa4e6d607d97b4d9bb32f098262bf95d6a13610fd43016a6eaa8860f1287208212b
- SSDEEP 49152:TscA8akKMSiJUifMOUeMeRID8R8ejRRq5veFNGleiW2yCNpnrbLas4qtDdMNNs:gcbHrnRkhetAvJdMNNs
- TLSH
  T156165B43F19660ECC059C178871A9632FA71BC495B35BAEF0A90BB211F76FE06A3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral25
- Target
  resources/chromium/vccorlib140.dll
- Size 342KB
- SHA256 09f93d5ff96ae09767f3e1af3cdd43a5a58f2598654fc63089429bb6f9f4737f
- MD5 95513ddc9980568940387d16af447ef7
- SHA1 fc827331baac99d775470022fac2b111de24db0d
- SHA512 9b3a7380a0de5a7e5e8bca618d07945dea37d01fc66ce1a8b382c3bd0d6f820f34dedf06c272871c14271c6600b4eb33d69f45f7a44a976fd9eaa3c9caed734d
- SSDEEP 6144:iXKqjR1OmXkRLO1UPTMXhPEbUbeUG1bPQ0D:ipOmXkxHw0D
- TLSH
  T1C874D5277B9C4CC3C935A0794A878309E372789107A1E2CB1194570E9F7B7E8AD3B679
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  resources/chromium/vcruntime140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH
  T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  resources/chromium/vcruntime140_1.dll
- Size 48KB
- SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
- MD5 bbfa92d8173376c972fd58dcf5ca6aaa
- SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
- SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
- SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
- TLSH
  T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  resources/chromium/vcruntime140_threads.dll
- Size 37KB
- SHA256 40f39e8cee5f5a531b4010e18b807e8fe265b908dc58f959ecb7ebc6ea6cb11a
- MD5 26f75596dd43b14e7a5d639ab6fa190a
- SHA1 5dbbfebab5c4ba6d8046bbd733ccc7b20161431b
- SHA512 2cca83c39747c4ccad7a1a17a882d1b2e915f689951f0eae0e3cd8df8fb09924ac92a75ee380ac9b7174c68339870bcb711048efdd4b420657f0d30bad906b0c
- SSDEEP 384:ZrOFknwOd6LJSpEpMnv7FJzwa93wlH/Wrk+WmJk6St+eNAFR9zWlW2y4GlNVdFbL:IFtpMv7j3kbGJcoX9zND9z4SiK
- TLSH
  T1D6039DE6DB684583E8679874C2E6DA07BC78FB821B2151EF4392F4590C73BC0EA3454E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32