13f1813e176cb5cf1ccb92462c9cefa0d7f7c7d0ef1c2b05df4174f73a3bb2bf

Sharing

Copy URL Twitter E-mail

General

Target
strawberry-jam-Setup-5.2.0.exe
Size 104.5MB
Sample260717-m2rd4ads7x
SHA256 13f1813e176cb5cf1ccb92462c9cefa0d7f7c7d0ef1c2b05df4174f73a3bb2bf
MD5 262c819c608311b16e50921e9ae7703b
SHA1 1d6273be2425f0b09827e5fb1548b5ed230fe89e
SHA512 dc0ebd340628a7ee6ddaa1c7408494de60fe72f49d7511f2c1e202d22ae4484d85ecba9fa69a151ae48441d15672632041a37c417814c2841d170ff529910bdb
SSDEEP 1572864:VX/xrTDmsyuZLOibM8TYhzS/JA2VizA2wToIue4MWNevkmmgfmGwms8yKt9d/xEr:VZHHIiJRGT5pevkuf1hQKt9d5HJbc6jU
TLSH
T16E3833E09F6CE4FDE7A92C398FF2DF51411715EB908824AF226EACDFA4B51410698353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  strawberry-jam-Setup-5.2.0.exe
- Size 104.5MB
- SHA256 13f1813e176cb5cf1ccb92462c9cefa0d7f7c7d0ef1c2b05df4174f73a3bb2bf
- MD5 262c819c608311b16e50921e9ae7703b
- SHA1 1d6273be2425f0b09827e5fb1548b5ed230fe89e
- SHA512 dc0ebd340628a7ee6ddaa1c7408494de60fe72f49d7511f2c1e202d22ae4484d85ecba9fa69a151ae48441d15672632041a37c417814c2841d170ff529910bdb
- SSDEEP 1572864:VX/xrTDmsyuZLOibM8TYhzS/JA2VizA2wToIue4MWNevkmmgfmGwms8yKt9d/xEr:VZHHIiJRGT5pevkuf1hQKt9d5HJbc6jU
- TLSH
  T16E3833E09F6CE4FDE7A92C398FF2DF51411715EB908824AF226EACDFA4B51410698353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 46a20d91861f6e966959635dd5f1adfd7f33449dd814a9aecf207b0cd53117ba
- MD5 ebf0485fbf546b010c2b10c5c8e7d5ed
- SHA1 a4a546f6be93bae535aa724ce2832f428cc91f89
- SHA512 9e6011c0269556376907850fddac8fdf50e132434da7daf4d87be83c1b89b7aef847b25b6216686915225a82374fac6ff987f22efc01d5b1c2cc81d53d7facc9
- SSDEEP 49152:SQFsi7+HXKvCJkvYio7E2yxIHjcQ++X6CfzBDWV/Hf3d:SQFuJ7iW7yCDcQfa/V
- TLSH
  T10DD5BE03E6CA50D9D029D071979F9223F631344A8F2567EF16905A213F6BFD82E3E729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 473KB
- SHA256 e36da1a4228899bebe50cc5da1fcbbc590cdcb3ddee0b2a19defd99a805b6ed4
- MD5 4c01b3614be1f38a6d594443a547c257
- SHA1 7eaa456b164613577d0965ab5a57ba2b681a6ffa
- SHA512 b72fc071dc791c63978465a68c9a4904d5f1c458d302bb710e83576f20ef928d73c487248a305bb455990c2d8a6b894ee47d88bca6bc92360f286849ae1a1257
- SSDEEP 6144:fx7X9FY9N9dlUxMxHbjjvKir8WQ3hP3yUo6DyKuyY:RXgNlUixHbjDIWWP3yUo6DC
- TLSH
  T1E9A49D1177D444B9E06AD1708A574642EB76B4920B65FBDF02A0D2392F7BBF89B3D320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 2b80817443265e7979b9a77075492e8e29be3ba775d20f646cdda391efbab21c
- MD5 9bbeb7b27646442c8bc2d202a73516d5
- SHA1 a7f7a52dc45bf130581953e07ce9b9851cbce90a
- SHA512 f9826e43f53bb9b906b5c62ff2502d4e8dc3ff99b72420cf313a5811061cb146651cba3b8f864f34dfcfd51c6e3b39a0a640719ef94d7696bdc4fab7e9d16785
- SSDEEP 98304:HZM87bHub/9cQtRy/EguNnOqofF0iGULhtNn2uXC3ST:HZM87bHub+gR4ukv5Lhf2GmS
- TLSH
  T1D9867C03F69540D9C04DD2B8975B9623FB3178990734BACF269017252F77BE06BBAB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/assets/flash/ajclient.swf
- Size 1.7MB
- SHA256 ffc181fb3fd9648c99f649611676fbc8c907138841c6fbd845b73da75d70e82f
- MD5 6d39da9cb5321b8b19ca322968743d11
- SHA1 e24d71847192e84e7c58031eb4b4140fbaa3d666
- SHA512 6a2480f017136496b9010f12fcaf4bf327c0d84e60b9f90e2758e2e5e3e740595e354fe3308c5cb068e4791f58dcd81dce5777107670ec3f759c8dcd9f248bba
- SSDEEP 49152:mPSeEpfa4+1IwxVSRrJHrYmdU+n62fj8jjzY:ISf3+Iw/SRVrYm7n62r8jvY
- TLSH
  T1B085339365ACB07FF436EF4EE9691B40511F40FFE40C38FD989AFEAE506C169058249A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14 behavioral15
- Target
  resources/assets/flash/options/non-purple-private-chat.swf
- Size 1.4MB
- SHA256 afe87b7d3f8cd07b771e8365a0834ea28e780ea2d8a58e0d7ac293e69d7755cd
- MD5 bf8e7dcc00e32bde31abacfca99e9cc2
- SHA1 1088f45076c4455dab7fb40ecd040a319f66d4ff
- SHA512 c67a6a196109425c89822e30b850536c9f8e1b8680c1b4a1da44bfa0d44097ec2f901006a1a97cbd418722461c4d0a14367af7f4dc3da7f48dfc9319631a929d
- SSDEEP 24576:yoTh0cSpGBr+6lQ+a62qiPnOnJppZfy3WZ7d79w+mpU/:DvSpGBrXlQhlepmWZ7rhN
- TLSH
  T164653306D73DA70AF37D9417237B46960E108B927857447E0ABC45ECCCD6A8D2F29BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral16 behavioral17
- Target
  resources/assets/flash/options/unmodded-ajclient.swf
- Size 1.3MB
- SHA256 cd60de359f2cabdb0ab2e1b48ae49ee81c240c5fbbb8932b07135a52e94a9d46
- MD5 f744874abf29fc2eda052936dd544a16
- SHA1 45c4ebb571b4175c32443489c0aca7e14016e58c
- SHA512 976e60de08cebd1274165c5aca3a0b5091e40b9a448d433ddf7c094f0a5b975190b659b2319edd0a3c926ce92a5105f3cbc3616e5be1b1cf09a7cd8ad8301595
- SSDEEP 24576:6b4rDBe4iU2bIpnNHXu4vFobtmbXowfV+saQMutQI42hzFLaqeGMa8:rNL4czZdoxK59+sgcRlH8
- TLSH
  T1BD553371E341878CA9FE511DDCCAF1CCB76574BDA4496810DB2B6A7E2C30B6248ACB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral18 behavioral19
- Target
  resources/assets/flash/options/v4.2.3.swf
- Size 1.6MB
- SHA256 5581df25b7d3fee58e4d9c3c83122e4c0180b2e267b4729e9f884605ea114181
- MD5 7ac6fc11e0e9a7651a47366bde71daef
- SHA1 5c4cbc9fc25a44c814fd71e69eb49c9129d1ab72
- SHA512 2c79c04fe7a6b640670f2059940fd80ad07bc4d073f9bf9a4b0a75746359dfbb8eb8659023813e3bec1a8a4326903b28f9c72f115fd72b3e8488457363846a18
- SSDEEP 49152:mJiDVHu3z1Ybe00wNe2C/Bt7218Jp5CkR1DC7:SGwDii0fhqBMiJp5CK1Y
- TLSH
  T1047533E4CA52E568B950AD6F4CCC66419D4AD31189D0AD4B3A0EDDC9C3ECFD923693C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral20 behavioral21
- Target
  resources/assets/flash/options/v5.2.0.swf
- Size 1.7MB
- SHA256 ffc181fb3fd9648c99f649611676fbc8c907138841c6fbd845b73da75d70e82f
- MD5 6d39da9cb5321b8b19ca322968743d11
- SHA1 e24d71847192e84e7c58031eb4b4140fbaa3d666
- SHA512 6a2480f017136496b9010f12fcaf4bf327c0d84e60b9f90e2758e2e5e3e740595e354fe3308c5cb068e4791f58dcd81dce5777107670ec3f759c8dcd9f248bba
- SSDEEP 49152:mPSeEpfa4+1IwxVSRrJHrYmdU+n62fj8jjzY:ISf3+Iw/SRVrYm7n62r8jvY
- TLSH
  T1B085339365ACB07FF436EF4EE9691B40511F40FFE40C38FD989AFEAE506C169058249A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22 behavioral23
- Target
  resources/assets/scripts/Sortable.min.js
- Size 44KB
- SHA256 6dee1a4b1c4b1715fa7a6f74595c07243f88b0d9af77ec1dd774c7e8325b8060
- MD5 8842d8cbd42e4843057752a6302094d8
- SHA1 3e471549e44377a1d9afd34ca2e92f9b391709c7
- SHA512 44415fdbc30657624e118628ae94432e6187ee68fe0b98fdbad0642a795e2f5427b5cde36e8f1f4f1ef3c9d16bf2c3bd71e09b4f9175ca37bde6cd254540816f
- SSDEEP 768:xYkC5DfNzWNNMB3RQ9bYo9+7kPo1yU5x0NDKiLjh8FzNOUQvW49UPewRk:x+Df0N83RUE7f0NxLxmS
- TLSH
  T1EF1319CDB3483A395ADB52B1827F460A72315594BC0A9028B43FCDD86D7C42A529BF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/assets/scripts/jquery-ui.js
- Size 526KB
- SHA256 0bad7e3a8031272f74e25e91d73f50a3e90f9726df30b38823b94f956ea82c67
- MD5 e0e5b130995dffab378d011fcd4f06d6
- SHA1 bb29ef940e8a15144a4df2b5c68e944087934bd2
- SHA512 4d22c9446d09a99fd927648d87313f6cc3232b3c168282a43edff11a649d05bf9656de729e7dafa6b392afc0e85b364fb82dd6e3aa02b4ca636d18caed8cf141
- SSDEEP 12288:BBebHeg/md/THhsncaLBata+3XIdCgTf9kDUUB:TbHhsncaLBata+3XIBf9kDUUB
- TLSH
  T196B4C7D5334F226F86EA3359983A9289E63DC075D202807D789D58DD25A8C2843B7FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/assets/scripts/plugin-utils.js
- Size 4KB
- SHA256 96ce66d9e0d9cb78bc47cad2bc4c6282fb96a5608b632b8b332922931ce076b7
- MD5 2c0dbb23ae6d8efe8b116b836db7fc21
- SHA1 c9db9022789ccade26d0b1f1ae2d0959e5ed5b66
- SHA512 368052ad510a357d8f6b190c1e328d5c8d1fde0dc0f6160f3f61b0d04d117e5e3470f6fe9a1e0d809fc34094b92f4d0638c5b75a1df92e4a863e77c441b3c3b9
- SSDEEP 48:3MrqXMSHFqm0MP3JLGqjZuv6qNWLv33w4MM1o8s0n8c3DHkADox3seWzLG0YgZxG:3/XYmXBlRgWLo8t8c3DdkRvoG0ZZxWqG
- TLSH
  T169A1445820652236A53673A9976BB3AFF93702B3210AD21478BE53043F71C63D526EDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/assets/scripts/popper.min.js
- Size 20KB
- SHA256 03f5c3670a8445c0af75a1b934be176f6c1cde339fbe76b1062cc51e590bca98
- MD5 855075c14fed65779e9226874c12d223
- SHA1 eb352e9da7a729ab8dd14f41e8aa3c47d3a9e4de
- SHA512 7ca3d85a512e71642eced745f71fab314bf33b70ed9250fb93ccf725d3d3dbaa971734fcc73968f66e6112303c7e41b92c0d3db55e0596404bd923aeedf108f1
- SSDEEP 384:xnMQG5rwVO7dV9nNbRGCB9D45Hkn5vj2xpOxvIAgD75zBi5vISg3gzopL9TidOgp:M5sg7X/jD45eSxpOxvKD73i5vTzwL9TE
- TLSH
  T127A2B3CC3294B06643A791A7A0BF960EB2339875610E9410F199F2E97C30EF9917FD79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/clear-cache-helper.js
- Size 3KB
- SHA256 1c4e4de0dcff95ff8137257abdc5c4f71af8dd71faad0008f32b0ba6b942c78c
- MD5 b51b11238dbaeabe99f6c792c81fd3ec
- SHA1 55cc924caf41f74aa57a9cc0414e5efc25aec418
- SHA512 97189c09305b23b3fdbdfd7625710d429018ed574e8a9768bf5b975014e6f6b7e6bcb06b839d79cb77954839019b8e075578646d230b7d95d4bc93400da59d0a
- TLSH
  T16E81FE0607990427D4B287729B1EE033F55DD93F136182A0F5AD926B2FA580820BDEE9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32