5013e0845e27e0dc6c0eeecb0796f66258e661bc338c21dd9145929438fac2d3

Sharing

Copy URL Twitter E-mail

General

Target
komuna-0.4.5-setup.exe
Size 11.2MB
Sample260716-pf5eyacy7n
SHA256 5013e0845e27e0dc6c0eeecb0796f66258e661bc338c21dd9145929438fac2d3
MD5 e538c71c75c4f5e478804bff716df897
SHA1 da064eb2808ad921c56815c1344ede754cfb1272
SHA512 a74814063103094c0ddd84a220cb87dec15ff0047dd2a3a905d34433c2029244f8bd3ca0049b5ac1d3d8a602e97165a16f925bb34790dba8d392766d3589063a
SSDEEP 196608:Tot70yAyMGVlQTEtko92GMZj6Xfxhsii7jCBxwsuaVFavWCp6yAGDsT/qBmQOzCT:TRO4YtkI2Gc6XfxnkAOWF2dp6yvDsGBj
TLSH
T1E7C6338AC31BC69CF56A90F3C7B34BE922BA9B2A8D30CA53456F1F1109B5111DD17E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  komuna-0.4.5-setup.exe
- Size 11.2MB
- SHA256 5013e0845e27e0dc6c0eeecb0796f66258e661bc338c21dd9145929438fac2d3
- MD5 e538c71c75c4f5e478804bff716df897
- SHA1 da064eb2808ad921c56815c1344ede754cfb1272
- SHA512 a74814063103094c0ddd84a220cb87dec15ff0047dd2a3a905d34433c2029244f8bd3ca0049b5ac1d3d8a602e97165a16f925bb34790dba8d392766d3589063a
- SSDEEP 196608:Tot70yAyMGVlQTEtko92GMZj6Xfxhsii7jCBxwsuaVFavWCp6yAGDsT/qBmQOzCT:TRO4YtkI2Gc6XfxnkAOWF2dp6yvDsGBj
- TLSH
  T1E7C6338AC31BC69CF56A90F3C7B34BE922BA9B2A8D30CA53456F1F1109B5111DD17E39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
- MD5 7854290f8bc473fb9fad1917b0065731
- SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
- SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
- SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  komuna.exe
- Size 30.3MB
- SHA256 261d7f79a895c8fd9dec5b7b2992dd226274fcb130590815a37209a5ce64a7c0
- MD5 a8ca616f2e7d881816d186de662ec143
- SHA1 f96936d8492493b5a6c2afc1f7c94794ddd1a1e3
- SHA512 9f56d5ebbffec2fbdc01c22f9f2c1897fb728ce22c76c1f3b2f46ea2cd632555c77dd77ae2d9fd3ecb02c40e0dd3c219b13077956396db9b84d650cc3614c973
- SSDEEP 196608:sfJp0RW/Ix9Rtd8fFV6GPbA0ClO0DnuJuJkfM24/p:sxp0RD9REfFNGlOQ9aX
- TLSH
  T140675C27F96908EAD5ADC530C676A1237BB13C45473023DB8FA0FA156F7ABC0697A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral11 behavioral12