3e16a80aa5c86d23298bb619ad4b091d44b4374c62c832c966e6dee14b49055e

Sharing

Copy URL Twitter E-mail

General

Target
SirHurt V5.zip
Size 151.0MB
Sample260716-lyeqfshy6m
SHA256 3e16a80aa5c86d23298bb619ad4b091d44b4374c62c832c966e6dee14b49055e
MD5 c54023afc0f3fa5925e6d8a99b93aef2
SHA1 5f3e0ca5726ff906444770df37f4a1d2f152d476
SHA512 85778131a246e80cf8f321b93aa5a8cb14d3ebbf2ca89585b0dcc2c67ba3149e9073adfb4cf77e3e8caac7cdba6de0f108143e5d66cb0ff5624763155d138686
SSDEEP 3145728:+DC+QUqBdeaTVW0VSBkTjKp9jlcre9DwVXYYdm62:0QUqCaTVtZna+a5u8
TLSH
T1147833EC6E3D6BE7D3658432C9A76B549011D78A0F122921C0FB20922D67CEB4F572ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  SirHurt V5 (Legacy UI).exe
- Size 7.9MB
- SHA256 d4d17aa88437fc7d943279e63f0911ed088deb97bbec3bc630c1ec9383befed8
- MD5 3943517c49fd3ee802e251d223330a81
- SHA1 bdf7464b621a0328d81c99dd67244aca807b3270
- SHA512 ab310cd08d1c1e16e27670bc5a1c919fa780d0dd1bbaf52e3e3afa2fcf2252f2893b3299d53b01a52cd1a30281da7a7b0806934f25b1655adb51f5093bf85c7d
- SSDEEP 98304:NEnao7FFwXLU/xkWr5/03FIgcCfx+vEnao7FFwXLU/xkWr5/03FIgcCfx:NEausXLqxVmWZCZuEausXLqxVmWZCZ
- TLSH
  T11F86221877A8E542C9690235E871D2F00B7A3E43D892972F78DD7F6F3F726960D0621A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery vmprotect
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral1 behavioral2
- Target
  SirHurt V5.exe
- Size 4.2MB
- SHA256 99e50ad000dd05288f91d00f77e240b8e22706df8cb0baf7e19e7a2fc016a006
- MD5 15266c5e437999fb491fdfacf8cf146d
- SHA1 52fcf136029b8efc5653cc7b92a39add06f9fa80
- SHA512 7d6b2b9ec04c2f706cf2b9d2dea29e7b5d43fdd5ebabcf6a123d8c86b2c451ffd2a8460c7367263eccc28a1338dad76f3fcc1c1c5f358136152d31fd30decae8
- SSDEEP 98304:w8l+qcf1SPxzuWsq9aG6yyJ9j9BRHylMDpjutrblJLFkQAdoI:R2NwRum09R9JHHWMornLFtAdo
- TLSH
  T19E163385CF226FE2CC8C1138D9533ADAD669EE556D9847D798C03A22EFFF2050C5D928
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  VMProtectSDK64.dll
- Size 116KB
- SHA256 a56239b26392a8ec49a47d27b0632b65a3f98a2735bf60dce66139a71ff804fc
- MD5 8952450f3d98016016682a6b0b716518
- SHA1 03bd7828a9d17dae5e3a97f000e17b0199b2b7bf
- SHA512 fa8b2a9464c34629b65b12184d2e036eab7b076eb2cc50802a397dc52a4690d208afd201f31a57e61ee584faf37b51d162b9396fda08e936553dd3dc841e7e43
- SSDEEP 3072:bmcqYHq7Aiytzg2ScpvgJcG5sqYX6UMHTlBS:a0Hq7AiyegZgJZSX0zH
- TLSH
  T1A1C36C57B3E540BBE1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  bin/CefSharp.BrowserSubprocess.Core.dll
- Size 900KB
- SHA256 71bdab8ef6753bcbc6641411653d210a6fa5b735afc0037e9bced320727586cd
- MD5 9b05add68f191130bdc2efb0603154e2
- SHA1 fb05fa0268d1b9e1008b8592035305a5b9dc9715
- SHA512 7a7f090c6799bffad06cbf8720a5ea806ac94292dddacc488e0d80ed64b4c035e91276a5ed952d5ec81a5ab679aee276b5d9438248bff12f9a342f8fa81773f9
- SSDEEP 24576:6xwKo3wcOSHjmgGD+sfTjkgCIqes0ve+CZ2ZiVkhEDssQjPc8DnXoSiW+YfDx5LN:6LhCdes0ve+CZ2ZiVkhEDssQjPc8DnXt
- TLSH
  T185157D3C7F66CA33EFC92571CC3699AE171E61401756A3C3C268A768AE792D08B73117
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  bin/CefSharp.BrowserSubprocess.exe
- Size 7KB
- SHA256 a88698d7360327fb7e2c749425067230d1e325fcf47003f533fa2f93a51d9dcc
- MD5 e186bd9ccbb2b058ad245eebf80fcee8
- SHA1 4ab4fdf824999e11744c1d410c40fc012d6df378
- SHA512 fe37cdbe5aa04c519dec09313b6719e65f07f52eecaa2a7ec27a157c68e63f41c7261840db0bafb9b7adffc90023a54f61531f767e7c3a91c6934a7d0881bdb1
- SSDEEP 96:Fp/ZxmQI7kVmQBDv7+0N3SeFZJetmAHNt61OYcXe5U:7jhIimQB/+m3SeFZSsAYcXeS
- TLSH
  T1FAE1B42053E86332F7B342B678735641AE72BB63A94B47FCB44C425A3F3A650C923657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  bin/CefSharp.Core.Runtime.dll
- Size 1.3MB
- SHA256 6cace3ccc356513a0e458cc4d40fa42d63e6effdbf4cadc8f5c169edf5dda7e2
- MD5 b9bbb38c8ad4e1fd29b36b1f12f00d19
- SHA1 8e04b3d98c4dfaddb0bc8b31e620efb3991c98bb
- SHA512 7d719cc9fb6d47b19bce7ff125cb5a4d4ec34e6c9cb01ddead4edc324b5f13f4137b92c905339bba8fbbe3c5d17a934c3f762eeb1e05a5aee8c29ace323dd3a2
- SSDEEP 24576:NNkJmL0VxfKiF6l6EnKSLTzzgcaNvdSg4wOkzJqc4CQKZi5P9xh0EsgLgiJesm27:xBXySg4wOkzJqc4CQKZi5P9xh0EsgLg0
- TLSH
  T167554B3522A68D33EA892577C836426A732B9445B36793C3E601127D0F667C1DF3B3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  bin/CefSharp.Core.dll
- Size 944KB
- SHA256 6bcd053d62651ec4214047b25753601b34b67e0d284bfa570d1d0882749bde02
- MD5 0147ad323a5e6609b213ef0921a7487c
- SHA1 edd06e277bae67d3b1e4f0b4cefc90c6fba87f6f
- SHA512 b52f045f2b7e88697b1f280e62a3e829ae98ad68f0ef33dc00a3d693dfb460eab4f221447815c2dfcf4e07e126bb73b220eb051ac2a6c55d53c3cd751074f680
- SSDEEP 6144:oddVDtsFb9MLMdq1I+SuDJUicUFOzdCwLMgPij/DSGTTFLqXZWYI6yCLrbwzEI/8:odHt6O/XDdcDPw6yE+X1tgyT5ou7
- TLSH
  T11825E82C37E8AB7DE6990477E16717BD06B2D31B7952E7AD8750986E3F8230099001FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  bin/CefSharp.Wpf.dll
- Size 116KB
- SHA256 f3edc2f398beb6cf04dc3ce19a18a054896871b6c85019f063abd7249d1981b3
- MD5 28198bca45bbede1f5ea3879f6dea26f
- SHA1 a2bd10f048f04053517c4bb9c785230a325a5678
- SHA512 d20f0ce1ba5d54fd4fa4a23b1a909e106e1585566fa74e03a6e3fc6cbc3faa9eb8e9e986ea5f27e5d015d88be66bbd6f9552e7f246df159579a7f191b829d603
- SSDEEP 1536:Re+4bCMf3zdUKenxL/2SL2f1XZ7PrlttRjp6yGx+VgjsjMTTOtmUbwyovrT:Re+43f3mL/0fX7vpxVgjsjGOtmUbwvT
- TLSH
  T162C35C25137C8A37D6EE073C90605D514772AA47B61BFBDA8E40A1ED2AE73B058053EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bin/CefSharp.dll
- Size 275KB
- SHA256 a3782f4d5ece18be149e2052059cd406df86b0770e94769aba28a803c0df7e67
- MD5 076870097f4b6de11c4039aa2f75df97
- SHA1 35f941ece7e5714428878a124c4450c3693df8a7
- SHA512 7a5f54c18d6ea38dc471dd88522714061231893a89bfbaad4c13cec61f547901f7586d6cd29ce1e8cc54e765173fa045d76e91563c7f930f0b8aba9e86f3072e
- SSDEEP 6144:2ZB3g2kToRc1Gf6NG5Z2CoOZ4ucWG5cfROm+pmTmF:sXAC9CufGGROq
- TLSH
  T1DC54291163E8A729D6FA8F39B8B019170A7FF80AB131F75E4D08665C2793B199E10773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bin/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  bin/ace/AceEditor.html
- Size 19KB
- SHA256 dc7ee37391338ef832033be064426e65b690a6b54702c924d0818b36eb9e33f8
- MD5 c5283ed3323ce058716d285c09f86204
- SHA1 c8fe6edd800c3f9c50a9f2aab46a9bb59c626bf5
- SHA512 38a41eff839108514e0f81a86d7a5d58b55e9c80b9ed9c9dcacad70de9093c01f2d5eef2817192d84cc6710c1a1ebd84d557cb97eecf70dd6e04ae35283d5256
- SSDEEP 192:fxpIFjhFI2txFj/oZNZh1fKUFhMegc7omrIi9RRq/iSCySSOkB6FNkZ+C17ihGBt:puF/FGh1fWsomEijMOpmB
- TLSH
  T1AA92645E17B311719567B16E9FEF920C322290473A46DD183E9CDAA04FC3AB485F2BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  bin/ace/ace/ace.js
- Size 718KB
- SHA256 c635ed59bb141b5b1b819b448aeecf874e06b4328ca3ba4e404b53f2d83509b9
- MD5 6a1aca1328b0a6bb78e7053a33d3fca3
- SHA1 51cfcddd2212167775c2d4e01a17928305617b53
- SHA512 7a5dd1758c9da1b6f3708849df1e9b2a38ff3ed50a39fa0892cbf57d1130571c6a442b930884dc619868296e30c09e435382adbcd81aeaa52c42c6030a0798d9
- SSDEEP 6144:ok4ZSgtU/GSghjfVDIsTMUSlJiujPPBELeq/SFJbXbZV8dxcQAPme/FRBHY/n68C:oF7tU/GUf/jPB67RGTHdWnvZLGI8Rt
- TLSH
  T12EF4844E7AFB2062DA1B7039AFDF5106A675404B680AD9087E7C96D41F9043846FEFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  bin/ace/ace/ext-beautify.js
- Size 11KB
- SHA256 315e22ad02969c76033cb8326d69bbac69a8246d58556ac00ffc9075d43011aa
- MD5 ad7f90d7bdcd39232e4743c5f73ebd9c
- SHA1 a03f7ab48a8dd87a69ff28c1af786caa77b7a8ee
- SHA512 dff94f9002bb20b875fdcefde1ffd493386929a4d0ddeff5d25d7192d8c3e342ae94ec2eac937c9a667004b8ea077a47e31c1d1d833e0ff9f3133233dbd6f058
- SSDEEP 192:o25ATmD2Ixw+gO1WSS7PXOig6iGKiPiZ74NmZbhBoiMS+k28iSCqHAFvSYJppW/m:TATmDrgOcKZbrL0GY7
- TLSH
  T17E42EB9878E304364527703D6FAF801A77B70427440DEA117E9D8BD0AFD4A7583ABBE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  bin/ace/ace/ext-code_lens.js
- Size 7KB
- SHA256 602914c0f5ab373ff920f2d439beb682ffdd45fd525c105ea17442987cab0698
- MD5 741cfb72dc5b4bed433fa0b85098f3ef
- SHA1 1e1107cb6fda9b43662506ceb3f54e519de33e62
- SHA512 2baa7101a637798d4a317ca252ae1d064351569a12dd4683963b8d845e5c7054fc64ebfa3dde31a56295868eef2ab5b887e7e82d464fb433cb6c52a384df4a19
- SSDEEP 192:+kCH9KCH9TAH2K/CKCHKH4H5iwt0741tHJHyR8Hdj6oLum71dybxHPur9yxCCHJC:jCH9lHBAH2GClHKH4Hg743HJHbj6UumL
- TLSH
  T19FF1E00ABC9711A16507A05DEF6B110B15A5420FE15DC9007EACA5E44FAACA81BFCFF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  bin/ace/ace/ext-elastic_tabstops_lite.js
- Size 8KB
- SHA256 f6ab990cc11cf3c0ab259cc0c7b07a886c7ec36639dbfc6cbb94c1b691a879fa
- MD5 1f03c9a69a8b9f79bcb7a338963f80c8
- SHA1 d925d54a1f55aefc33fa9e5c8c63d98f18f52972
- SHA512 1b641285519758eb7958cd385740db05865b760274f827c2f88b372fd91fe8eea39ac6abbedab7ceefb14570774a46b3be0145a356b53de5a821df1857b6c406
- SSDEEP 192:1lgCuuLpykQ8yuhtLMa07bsSslMosy9gyQoFx/UUhpUSbax3r+/SyN+TCa:jgC/rQuMLsnlMojx/UUhpUSbax3r+/Bg
- TLSH
  T19402F14D2EF71964960B303A9FAF820D68760417950BC6047A6CA2D49FD2D740ABDFFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  bin/ace/ace/ext-emmet.js
- Size 47KB
- SHA256 0f98448535f77517b790fd4ecaf88944d6df9935166c350149b99a796200db7d
- MD5 7538e0fe4abebcdb3ff1e8d7cde58f35
- SHA1 282f12424c860484e72491f7c3f223a83e1a4189
- SHA512 75e8bc936f73e131f682ebfa19df387ef049e10e77293726e80b643860ea4cc29623f0bcb68e0468b9a1063d725a16a4877238a6ee90b71f15db4a0f9a2a8f6e
- SSDEEP 768:Mz5x5p5gfW3oq1D183CPjvHUEJyYZBkn7yOTbGK1JLP3KWa7kg/IqzCDrpNyBhbC:Mz5x5p5gfW3oq1D183CPjvZJyYKpZ7CS
- TLSH
  T19123324EAAEB24259B13707E8FAF40097A76408B5459C9087EAC96D05F5183943FFFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

VMProtect packed file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks computer location settings

Themida packer

Checks whether UAC is enabled

Network Service Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32