a6d1a04c9964fc2350d86930aff7a1b0ffa0142bc39f6c90d0720e5cd5410294

Sharing

Copy URL Twitter E-mail

General

Target
RecRoomSetup.exe
Size 82.3MB
Sample260716-ypzeqagw4v
SHA256 a6d1a04c9964fc2350d86930aff7a1b0ffa0142bc39f6c90d0720e5cd5410294
MD5 534ec7e4a3098edd42ad96fb8df2a602
SHA1 a337cfd796e0423f47a66715afc9632a955162d7
SHA512 2645c6bb429285584fbe4f7a37fa1d41f50f9d3c88e9b7416f590740caae95ccbde38ca67a00a150312e06a42b84ae254f8d9ed103bf6a9e7ea7ee143e7a9507
SSDEEP 1572864:IOTRwZHnc9t/VwZYbqZlN2A4ytJ8/9c2elskp7UPRAuu0jYGe5BYI1xqp8Ws8RH9:IUwu9t/VNcl8Cr8/9c2elFCFSGe5BYI6
TLSH
T12B183333F062DD36E468FBB2BE42B2EF2C66C16F362540979B491540F8028591DE6B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  RecRoomSetup.exe
- Size 82.3MB
- SHA256 a6d1a04c9964fc2350d86930aff7a1b0ffa0142bc39f6c90d0720e5cd5410294
- MD5 534ec7e4a3098edd42ad96fb8df2a602
- SHA1 a337cfd796e0423f47a66715afc9632a955162d7
- SHA512 2645c6bb429285584fbe4f7a37fa1d41f50f9d3c88e9b7416f590740caae95ccbde38ca67a00a150312e06a42b84ae254f8d9ed103bf6a9e7ea7ee143e7a9507
- SSDEEP 1572864:IOTRwZHnc9t/VwZYbqZlN2A4ytJ8/9c2elskp7UPRAuu0jYGe5BYI1xqp8Ws8RH9:IUwu9t/VNcl8Cr8/9c2elFCFSGe5BYI6
- TLSH
  T12B183333F062DD36E468FBB2BE42B2EF2C66C16F362540979B491540F8028591DE6B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/libpkapps/PatchKit.Apps.Updating.dll
- Size 219KB
- SHA256 adaca553274c78d2899beb44b3c213490690f775e0eb28ecc173d0084586c35e
- MD5 09e782fbc73c1de64fdab12a2f29aa7a
- SHA1 2044330de1984c223a45a5a81e3ebd0ae0c7ce84
- SHA512 bd8016f15f7af43782343f660055713ec8f40ed2ffd7d1388c4c35a91fc23ca254259ab1a4338ec94208f5075c78f39b0c73774f683cf576c9f1aeb2a2799765
- SSDEEP 3072:DbyKjjcRNoe5mYErYSpv5wd3rLd3NT0i/bDybB7TQ:DbyRNTrPSATdCFT
- TLSH
  T1FE24C36627E04B1EF1FF4F7E993104241BBAFA67A972F35C5A4294E90C23B51C864363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/libpkapps/PatchKit.Apps.dll
- Size 233KB
- SHA256 ae9589fd7151184faff732ff15fbe3ecd69e2bd8b4b349c64367c6e97f3695e5
- MD5 2947607e5b8bb4e3958f62243d099267
- SHA1 77d9afc6ea247b7dd0e6bb0be422b55be8a76d6d
- SHA512 d8ff28935fe8fbf308fc2cc762bcaba3c4f7ff3d663aa9fd78f6164405ff793614ab202483471b78f38cb72ed33fecca219604c468eb40c59d66b0405fb050cb
- SSDEEP 3072:L55kQ44+MRqAIzwW/I4aioYmfbRxB3Rdzo2VMMwz5UIJPsIGcuKDJEmo2VhbRs7R:L55W4kzwWgoflYHWQNZZ
- TLSH
  T17334C5502BE66725F9FA0F3D5A7016108B7FBA1A6962F36E0941C4EA2937F44CD60337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/libpkapps/PatchKit.Core.dll
- Size 124KB
- SHA256 fd41271c29075079e41827e12d1fa24c9dd2e35c7feec82e874d3a562c86bbc4
- MD5 b6a469fb0bc7d303326070424d21b473
- SHA1 0b687516631c0e53ef30393c911dccdad3451555
- SHA512 6a3459223cb320ddd04f0c311a3c64dc52c72f51c88ec4f31ca1c4877e2fda94676490c2af948f3884d1682340f44bec84246f53a4bd9d2399c981a990147a51
- SSDEEP 768:9QG2DkzYN9fUB54dI8bSNRywY8RlkCkNH7obz3fSWhkA3hB3woj2sra8itEvfffQ:qzz+SaReA3Djm8PqkNX7FvYGpHOVD
- TLSH
  T19FC3B6086BF54B19F3FE5B7DE43101064BB6F8177932F71D4A45A0AE1872B86E860772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/libpkapps/PatchKit.Librsync.dll
- Size 16KB
- SHA256 abf95406385519e27d4207ea6b719be0b912e9e41e2f5a53aea24dc8252a2261
- MD5 d668f3c949a6932a35b34765ebb4f1c2
- SHA1 53358312ca79b47921c19d60b14dc0adbe562b68
- SHA512 45113d3efcd3866b4da96c44f2d4e780864d58c1060d9a294207c6fe7b7acb63ae4fb67931e1fce282d1febd19f2a09c954d217d052d69bf46c986372c659393
- SSDEEP 384:5+Lk5NBI6ICOQsBwp600Vw+rM0oGE0L0vvxjjUTc1Hsxb3Vk:515AzQIzVwvpGE0L0vvxjjL1HKb3Vk
- TLSH
  T10672E747DBE54336F8F61B7E607100050B73F81AA922E74E4E4D508A7E23B985DB1FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/libpkapps/PatchKit.Network.dll
- Size 39KB
- SHA256 e9d24b4c2f47f397f877a1d0e8eacd9bd7424fbd17cd1f82e2523474710f8d2f
- MD5 f5ccbfab7b0f21383e379ede95e42087
- SHA1 44c0957afb589fd4e733219eda57392f2fd0ceae
- SHA512 183bb170588707bd52cf1328a90b37cdf119207c2c93cf75352a58cab44b29cc8084c996e6b7c0039bc9aba955ca2bf119e38d5fd0fd95b45289803e35494734
- SSDEEP 768:Aa6YOM6lnAa18Mby950dyD0acce0znx6:ZSAk8oyL0oc10zx6
- TLSH
  T14203F8587BD49A22D2BD4F7E947105004B3BBD9B3A67F76E4B8470AE1932B80CD20767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/libpkapps/Sentry.PlatformAbstractions.dll
- Size 11KB
- SHA256 34ba12e713d65c76e4aa93ddd9381c4e3bbe5df6cc3730a3466e4555e8e9c197
- MD5 5cb38b3b6f9898c712307e68a857f03d
- SHA1 6c8c323f40fd851dd22b544fbd9adcf89739174c
- SHA512 4f4668840904fb5ae590d553b20ddc96381c8eb1ee2173db4ceb0744951102f90edb505a79186628316871e2672412efc41a90dac7fddfbe62f23eb2eed957fa
- SSDEEP 192:VuhfAtWsYBLn5M5KyKaSbGEA6yUDRIfuP9wR7CgAh33seNO7nc:8fAg4dKaSb1z9IG07kVbNO7nc
- TLSH
  T1B632E621A7FC977AC2FE4B36E46622144637FB18B502C7BF4E48518E1D327892D21B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/libpkapps/Sentry.Protocol.dll
- Size 47KB
- SHA256 acc9636568558b95def444b2c0a9886f50ac88721cb6d3ad9fb9524ba6dc2474
- MD5 72693ad7db5c5bea06340f4afce06d04
- SHA1 d6f3f9dc5dd9221be8c6e3479091818bfedaa600
- SHA512 72de9d90448b45b165878f9bbd8b762d97fc8e60278bd1e6a591e9fe16ffa1a2be5aed90ab9b2510a47466409d219ad7d7a34168f659f6358b7bed1d29bff931
- SSDEEP 768:n5ePGQiKF3ChYWC8/UHpe29fE1ZocmxbutGWc1h:n5EGQTVW0JeJoVWxc1h
- TLSH
  T12E230A21A2BCC3BFC7950E74F060562619B9974FB067FAA1CB10B1CE3E6B352D1455B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/libpkapps/Sentry.dll
- Size 72KB
- SHA256 f4dd299c21c131b317ec78d79d0bfbbcd8a9939910b9eb63e72afb0f42417afc
- MD5 91b242285674b7ba8ef2eab2612bdc07
- SHA1 f171877d5232f853c4b61db87b7c4725483816f1
- SHA512 b5ff9cfa51d19bc5f6a9716a3843d8622bb02174d80c82f91c942f8ffcaf18e1eeba16ef7a551135e6832b0ebdc95324ca28811d184ea3b96b38437bdb19daf8
- SSDEEP 1536:Q22KZIwiMrjLyjAqXA3oUa+EJMc+iBJuLiy:QuZIwiMrjaAqXWoeWMc+iPuL/
- TLSH
  T124732A41A7BC8327C6EE2B78B4B455090FB2BE56A562F75D4D58B2EF1D633404A003B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/libpkapps/SharpCompress.dll
- Size 522KB
- SHA256 02e264af3b80cefc5c495b2398527df3071e6dbc1c8b7f3672e31756d3a29537
- MD5 efecb0a1e54dda7aaa9b0e8ec92211b7
- SHA1 5ae949e8460042ce58832468ee31da206b129757
- SHA512 b3cd5a4aa5567509cb0f61050f1e689db237dd95251a620e9f8545181efb3d3b4dbeee77d826c310bd9b38cca4794d61d3245d9b290c54b8a16b10d86a374bab
- SSDEEP 6144:W0ysVCX0+YJ58PbolFluUCvM6QJ2xL9KcE3Az6B6Lr9UWzRTBli:rClP8vlLcxL9cA+Bsi+2
- TLSH
  T16FB48D2923F4673BD59E8371E0625C2583F2F06A7246EFCFAD4079AA1D877199D006E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/libpkapps/Standart.Hash.xxHash.dll
- Size 14KB
- SHA256 2bcb2952b97b9af5cd56e57ded5c4af42b0df25f12c1b0cafa363ed11b5672f3
- MD5 c27acc207a5c3b0ac36f82cf34288912
- SHA1 2a1a5d4c31f418ca13088ded8a54abb6f2ad11a6
- SHA512 ae9b0722f6bb655598739d0cffd9c59b1c37ab1874c7d4792dff293eb14be5bc9dd42bcc3c40ca1fe13a8f24d81198f7f3490e3be4bc163f6cfdd710983c522b
- SSDEEP 384:uCFTeBVKrDiao+k+2WVQf257Ikm6XZx2x:uCmVS+aoj+2WVQu3y
- TLSH
  T185621A064B585323C5EF713D9BF57F028B62E324A522EF8EE2ECB43579423951C50BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/libpkapps/System.AppContext.dll
- Size 13KB
- SHA256 feda430268c14adeb2f94cf9ec6b41eec1baebb1dcfb3623ebe2f42a81bbde66
- MD5 41ae96dfc6cd05a03b592bd7680eda92
- SHA1 add16595ecf22283a1e2fd19be111266c88cadf7
- SHA512 3522a75c068ce58d020d2956d27f67d8f8cdc2c34b1e82ba72527bc3c6056ab0af210a4b54a8d6f8eae3eb30f3a0eabcb6390639165df0242dbea3ed4568e32b
- SSDEEP 192:NiW+YsW39GPRzxVCXw2pigW4GD5dHnhWgN7aAWUeuUgxfzfqnajZ3QzH:IW+YsW0VCXwWizdHRN7YIrllu
- TLSH
  T14B524B958BA84203ED676C709AE8E9037D3DA7D27910D66F114AF6890C877C1EF21B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32