0250daf621d6c3d7836b9be456f80d874af97276680bcfe005b885e5676d351d

Sharing

Copy URL Twitter E-mail

General

Target
Localhost.exe
Size 129.1MB
Sample260716-rtl7mabt41
SHA256 0250daf621d6c3d7836b9be456f80d874af97276680bcfe005b885e5676d351d
MD5 cf8ed02007cc3636b9785fc8843f7a3f
SHA1 02905a1a4c9d59fd8f61e065c44fddb218e66365
SHA512 5591a44b61f96a59a63e02f6ed30068a96ff58f04fad970a1a765d9269a7cece6f60d9647c68ffb45a18713c5c615233bad46803b4f7bc4d940bd4a8aeb4223a
SSDEEP 3145728:v6PluLxO6GxUn5ulUmGAtVN3oaM8YyKwgF:5tODu8emGANvYTF
TLSH
T17D583374F002C693DE1CB3B491730DA3112BBF62BAB48A6D550CB4756F736ED182A46B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Localhost.exe
- Size 129.1MB
- SHA256 0250daf621d6c3d7836b9be456f80d874af97276680bcfe005b885e5676d351d
- MD5 cf8ed02007cc3636b9785fc8843f7a3f
- SHA1 02905a1a4c9d59fd8f61e065c44fddb218e66365
- SHA512 5591a44b61f96a59a63e02f6ed30068a96ff58f04fad970a1a765d9269a7cece6f60d9647c68ffb45a18713c5c615233bad46803b4f7bc4d940bd4a8aeb4223a
- SSDEEP 3145728:v6PluLxO6GxUn5ulUmGAtVN3oaM8YyKwgF:5tODu8emGANvYTF
- TLSH
  T17D583374F002C693DE1CB3B491730DA3112BBF62BAB48A6D550CB4756F736ED182A46B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/java/jre/bin/management.dll
- Size 29KB
- SHA256 22bd8612ec95a38dda51382f50352df8dbf7d6798165bed9640e049e6ecd9ba3
- MD5 ce48b70b0d5ea3e782db8cc85f68b13c
- SHA1 6e42ebf502eb9d187a247743bfeae2bf3c010b0c
- SHA512 65cafe1da8d40f5c0cdbb315d1a5541b3d6e472c575b94965562d042f4dd88e4b41bc21c23e746683e19c0d0172f5f2d47d678ca109c01c0f6f00df02497eba7
- SSDEEP 384:OJPQgjLZjraUzz2Vjc0hcEWsuMacbNyEIYi2mL4/y8RFvIIvZVXy:2P1Zr3ScEWb9YiDLk5kIv
- TLSH
  T132D25B52A65C6445E5DFB535B0A006369BB3B5C61FC153870674C23C4BBBFE2363827A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/java/jre/bin/management_ext.dll
- Size 35KB
- SHA256 ce0b9d24068699cd1768e734027817f07b700f1b56399736fef70b3349aaffee
- MD5 0f3f2d329ccf72798e408551284db9b8
- SHA1 1076569a5e71190cecbbe4e2a48053f4dfe47d9e
- SHA512 56a232e9b5b12ce2a5019deb37a604cdb2ae21602fc720aea56013187054125f801b57a9baa5a8a5c4fb9a65212a199b7802c0b927a5391b76efb81792749afd
- SSDEEP 768:5CdJfDYjyjsZrWqQcz0MfVVvEX2YiDLk5kIvhk:c9DYWmWQztfjcX27VIvh
- TLSH
  T14CF28F1B92994483F88BD57450611A23D6B2787223E2D3CF57A0C62F5FA3353772C75A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/java/jre/bin/mlib_image.dll
- Size 509KB
- SHA256 2b33c638723fce7a43b5858ee0bed0dd81b4dc9782bb6d03e6d02e44d9455397
- MD5 f02dcd9914c8449c0e78349af73fbc28
- SHA1 6e828eba9aa5dc04ed1bad92c1bb600af820e0ea
- SHA512 2d3683193b4481190656e7ea18b6c11757e869848b439fc0666c3802d9a6943d45119d7ebc4a6cf91390157188c2a3b1451f6e6da186439046fea98d3e66a1a5
- SSDEEP 12288:BDAlGD08UowoIikrYzXDh0iRteccD8d7nGgwL7hkxU:BDAlGD0qwoFc+XDh0iRoxD8d7nGgwHhz
- TLSH
  T154B47C43F5EA17CCC06AF43146BD7297F961341906145A239BA3CE687B26F11AEFB306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/java/jre/bin/msvcp140.dll
- Size 561KB
- SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
- MD5 72f3d84384e888bf0d38852eb863026b
- SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
- SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
- SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
- TLSH
  T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/java/jre/bin/net.dll
- Size 58KB
- SHA256 7be667a7a539a410a0fe28808068f57a01a011f6a6899c930823a8d7229a7815
- MD5 e7af88f39ac1df202e0821d224411513
- SHA1 6c1189128b5f95f86dd709a421a21c0b2720bb7b
- SHA512 11ef20943e981cc333cda992a8c63b96844ee8d6a74b2b52f11e068b5b250b73bbde8d9d044bf30211685db010bc6f9f40a8214ef4233f677cf04c2d736dc256
- SSDEEP 1536:0rBn2zLBxyvTtPnhv5awOYwT2eBIUmXgXW7VIv1:wnUevxl5arpfBIUmwXW+v
- TLSH
  T1F5436D0597D454C4F86BCA7886A75E16DBB2B470225083DF1379C56EAFE73B23B29380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/java/jre/bin/nio.dll
- Size 78KB
- SHA256 258ff5c878daf328ad6dca0df2101ac432b4461cb7669077659a1431bd8e6224
- MD5 2c6b9ea27a250378dbd8519e57e46bf1
- SHA1 5ed71b807359a9278bdaf815c709ad5170156e0f
- SHA512 58366a99cfcffb9e0a6c863d01d036d50c454315048208e7f5f849f4afd641745b7ffb6eb8e36e700caecfe8630e303265d7bc3533d600bab3874c8eb002ac01
- SSDEEP 1536:luKDrKVqEiWtCnNXHlJ4Ozuwc7tGaRHpiys6gu7VIv:luKDuVqaMN3lJhXw/RHpi1Ju+v
- TLSH
  T1337339A243A4849BE86A7538825A4747E733FC114510A35F5368CB699F5F2B33E3E783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/java/jre/bin/prefs.dll
- Size 25KB
- SHA256 52084e97865aa49f4927cd2c5bfa22b8de79ad0d6417f8dcaffc682ab23661b2
- MD5 ce6331100f1eba55e361bb833a75d56e
- SHA1 6feafca63d652d6b7d93f88135235e9a91db5673
- SHA512 3ed6fdedaaf498d9241c9b438d721b1340e4dd6b21b43230f48bf70849227cb60167e0a8f4ed47327e8bb500f26b8c10de2f63398e49de04ddb614518879696c
- SSDEEP 384:FRu5PEBA0l5W+ClYs9YJ1lcSKNiNyEIYi2mL4/y8RFvIIvZ8qy6i/:PePEBLl5oGSYJsSUfYiDLk5kIvP
- TLSH
  T1CFC28E57CAA408CAD9774934A8B64F17FAB3B95517A1D3CF027080191F52BC23A6C7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/java/jre/bin/rmi.dll
- Size 20KB
- SHA256 2fb6fcde5ec06198919c8544a7f589d53f944eb5725923f3f3fc02a646eca63c
- MD5 c2330de339be18761d5cb3a6140f0e6c
- SHA1 dc2044af685338e7743208a3e62c603746dbf7ea
- SHA512 ba5cdc414408cc129a891456d4be4809fffc48a3e6d13dcfa22e03fd0c71df7edd19d48cea8d1996c494829ba56d1d5f6ee2f18c39245aabc5ad967367d311fb
- SSDEEP 384:w/jEBD7U59NyEIYi2mL4/y8RFvIIvZLuwG1G:gEBPGCYiDLk5kIv8
- TLSH
  T12A928D9B99904C48ED578A30E5E15F1BE8BAB7101B91E3CB3354C1290F923437BA93ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/java/jre/bin/rmiregistry.exe
- Size 24KB
- SHA256 c3433099a1411bf209eea284de75f474da8e74d510e2f0f8029bcafe96ec11af
- MD5 3e9a48abf57a53b3c6f4780b6fd93d58
- SHA1 7703138155ae6ceb1a4c02afdd49935afd74951a
- SHA512 b5736a29bb72be0ee62a257a6f1a8d4a7e221a0a58bb47afffab055132b35acaeb1f3bdbe9db8a97b8c727f869e7d0a5b3e93cb063348b0c83960b3bb71ce32d
- SSDEEP 384:z47wdxFyyFs665AGNyEIYi2mL4/y8RFvIIvZEZmn7X:z48tFV65gYiDLk5kIv4gr
- TLSH
  T1A9B28E57CE400C86EE5B96B0B4E5231BFDB2B6956DD1C3CB6368C0191F513813B992DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/java/jre/bin/server/jvm.dll
- Size 13.3MB
- SHA256 9dac8ae1dfe88cb107e27ee952071682f48ab67266920cbecf03b15bb02ce181
- MD5 e0d77cbc30bf03af6e78b43b0cb0c92e
- SHA1 f7b06565bb09ad7152f89c63923131616e97e798
- SHA512 c0de5c4831e0a66dc013b3963f1c850ddb028a06046aa7fad40bb02abc6dc641cfca1a809840b9194e6895df88ab6b01c22506c06dce4338dc1e9bf38087f3d4
- SSDEEP 393216:YhQGDgO065OTXJ5ILPPrDOJ7TOD9Ey/cocqpfm7ApiCjoBYGsiFVUo83X+mq0sEB:nG
- TLSH
  T1D5E67C17A77840D1D06BD078CAAB9E0BD7F2B894433197CB61A056AD6F63FE2153E360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/java/jre/bin/splashscreen.dll
- Size 211KB
- SHA256 c077ab503156f2f30a0d73ec8d4995a66f28fbd2019335da6d2436597489ad75
- MD5 31ab51d61a978616c06a3adbafd8f6a3
- SHA1 02d470aa9ee7a4cb4d5d3db03c9d82db297b44ff
- SHA512 d4812fe709fec4ce5df9d4a5ceeda6235131423f3eba199111384bdaa2cf40e03beed95c62293e1973022ffe26a2355c14b616f10d65afbeec2a80d1b66b6841
- SSDEEP 6144:xnWPoG/x8iltQmKxHd7fMU988B1wPzL2UGk:QQesMQB160
- TLSH
  T18C249C46B67418A5DCFB81B8C6E6861FD3F2709A13A0C78F579487666F17B203E0D3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads local data of messenger clients

Reads user/profile data of web browsers

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32