6110ed3cbb1a76dfd097e09a1bb271c5adca1f0f76af94c5cff6855162ebe62b

Sharing

Copy URL Twitter E-mail

General

Target
download-windows-latest
Size 278.7MB
Sample260718-2cq5csg19t
SHA256 6110ed3cbb1a76dfd097e09a1bb271c5adca1f0f76af94c5cff6855162ebe62b
MD5 7131f4ed75e49948f3390766d48d6135
SHA1 5e70342dccb67b5b9c44d304a38f4d6e780491a0
SHA512 500815153c37abc7b309968854e136582f8b113cd343c25daa3b6ece1bde8a968948aaf54d2fca7bdbe4d9b4171d1154ce3fe93cdc05b960391fca83f30dc1d8
SSDEEP 6291456:myNffcAmfRtQUz9C0sNffoMjf63JtAL/t8fl7:BODx91OT6EL/te
TLSH
T18AD83350ABE9054BDF881E740347BDFAA94BCFCD2B590C439A3EA18CDB6D9B5312601D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  download-windows-latest
- Size 278.7MB
- SHA256 6110ed3cbb1a76dfd097e09a1bb271c5adca1f0f76af94c5cff6855162ebe62b
- MD5 7131f4ed75e49948f3390766d48d6135
- SHA1 5e70342dccb67b5b9c44d304a38f4d6e780491a0
- SHA512 500815153c37abc7b309968854e136582f8b113cd343c25daa3b6ece1bde8a968948aaf54d2fca7bdbe4d9b4171d1154ce3fe93cdc05b960391fca83f30dc1d8
- SSDEEP 6291456:myNffcAmfRtQUz9C0sNffoMjf63JtAL/t8fl7:BODx91OT6EL/te
- TLSH
  T18AD83350ABE9054BDF881E740347BDFAA94BCFCD2B590C439A3EA18CDB6D9B5312601D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/build/Release/bufferutil.node
- Size 126KB
- SHA256 07d275d38abce0269c409ced16a6190bad622808f36d66d42e5af3dc3237cfb1
- MD5 fb4a4d20b8d3f5e5a9bfd3c1dfb67930
- SHA1 29288c6fb3570530008a7ea462495dcafa52608d
- SHA512 45170c1e67e49973ba841bfe176ed8517ad8914afc04d488a947113608e52d0880a0bfa1e0146cb3245c27b792735f0d2bf1db7eeaaadf7e105e59fa3927cd6f
- SSDEEP 3072:WUOwt3pQQRvhp4Ghu8x2taTxQ3hvTyw19G+LNA+18:WUZZp/7hZ2tatkFx9m+18
- TLSH
  T12CC38D41B5C1C031D4BE19390938CF759B3E79A4DF608DCB63A416BA8E342D1DE36B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/fallback.js
- Size 899B
- SHA256 f4a65d1a98db49439616119fba09be0d9a4217af57b21282ab7b91c8b5a082b9
- MD5 e7225196819df0032629fa873f3a6a47
- SHA1 2e089facf7a2df11e50f693565c810b9de0e4095
- SHA512 56b89a7aff78fe2a231f3622804461e41ad67ebb87ef2eba4dc75cf0b1cfec769318fbabf7f2bd2c701b7beae3856a38d226905d16be7353199d215dd5758191
- TLSH
  T166118C6F6F14126D0407F7D581859E8F42344724F3EBE988853E7D210DDDA614EB2CD2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/index.js
- Size 136B
- SHA256 70846a43c2bd3b1077461563194e4d2407b18e7d767d6fd8785ea9b7d6ddd044
- MD5 4ce2ef7ae60266e7ee9f8a4078117193
- SHA1 a11314facf16ceba23abf556cfd3a13264a3e390
- SHA512 840f27524a2b576ba11631beb55940473b74f540dcc5fcad058b47e5c0a137fea946555041224fb6ef1c1fbf2704d01ffc6a046c7352dca45e7b55d2acc00df9
- TLSH
  T1CCC02BEB0CFDBA8312D5C143E160861360CEC090084C4401C75807C303C0C880B93DA2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/linux-x64/bufferutil.node
- Size 14KB
- SHA256 9d0bce137193c8630da76797596742368798f72d1564d43be0d716ac74312bda
- MD5 7bed42b6c8c87445fcfa9eff7e053014
- SHA1 545b666326b5b29679acdbf31d799331c12d6c59
- SHA512 9f395cda93ff254edfe56614095ae73337dac604b605f60088ea81f5cd32b6c8c97df649992cf54c635ab33b4a342a9bb1a3c35cb2d478156f8200e86d5bc726
- SSDEEP 192:RbP8IWzwUBxpB5RJhjPee+CVVRjTIU+6tpvkQi7A:Jyz/BxpB5RJhTeebVyUttpvoA
- TLSH
  T1F462C81BF361CD3EC45C8234C95F8B3067B7BC98567103272B04A63B1C936656BAB99B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-ia32/bufferutil.node
- Size 126KB
- SHA256 d3cc72764c09f4b2a7f885f5167811fd22dd3728b59bb1a18fa5a6f504317689
- MD5 788a615b21988f3643ac21a8669c72a4
- SHA1 1e74df3e1215bbd035817e73e8f6b9dbd0f8a064
- SHA512 72987562ca9cbfe5dd513081f8d961bb66672d4bdf0e28a411ad870c6c0942b9602a9a22e6674b13b121f821ceaff371bb3fd6105ccab6eb5320ff5df3c311e8
- SSDEEP 3072:xcVDS9QbSK27JKr/AS9SaJWAGk52TpYndT+6FSGVJr:OVeaZIJ8/AS9Sag1k5cw4GVJ
- TLSH
  T1E8C38D41B5D0C031D4BD19390928CBB59B3E7970DFA48DCB67941ABA9F302C1DF36A6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-x64/bufferutil.node
- Size 151KB
- SHA256 9bf6ec4d84b75403a50f22d9bdba2cfb287f12472374c9d5eb736c963a997ee9
- MD5 21452ef6b0cd9fbfbdb622b50c2adaaa
- SHA1 2bc5f964994ab2077796849a4b544b550e2145ea
- SHA512 a9b53bc1f2ec0afac2e3609fd53330aeec4c21f46bec0d96af2922e17e88dd56f8761228d391efe093399deb6d3ed9cb6e0f7358bfd311635474388c25317b3f
- SSDEEP 3072:AU2S5EUeVT4H4i4T/qB1YwTeQrZSmwVZwNRNScC:Xr5UxkPYOeKUF
- TLSH
  T1EBE35C47B3E500BBE1B79679C9A34646E772781107609BEF03A443762F233D19E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/utf-8-validate/fallback.js
- Size 1KB
- SHA256 74ad313e48d1008cf20e4ad691f883319be8baaff4442d86796819fb4d7969cd
- MD5 8ef7300c1c722fa879a08ad91aa6b5ba
- SHA1 b433b379a86afd5097c30b13a87e53fdb520e321
- SHA512 efb74434a74eb69d290f510128cef51bf0827ebef4f1269e45785ff8411ddb86ab780596c36890c91ee5c7bfc1801b29448c9be34039aa13946836052684d88e
- TLSH
  T11E3105C9949335714BA3E569CED5980A221888E731586A08FC8D3E80DFF4270D663ECF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/utf-8-validate/index.js
- Size 136B
- SHA256 70846a43c2bd3b1077461563194e4d2407b18e7d767d6fd8785ea9b7d6ddd044
- MD5 4ce2ef7ae60266e7ee9f8a4078117193
- SHA1 a11314facf16ceba23abf556cfd3a13264a3e390
- SHA512 840f27524a2b576ba11631beb55940473b74f540dcc5fcad058b47e5c0a137fea946555041224fb6ef1c1fbf2704d01ffc6a046c7352dca45e7b55d2acc00df9
- TLSH
  T1CCC02BEB0CFDBA8312D5C143E160861360CEC090084C4401C75807C303C0C880B93DA2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/linux-x64/node.napi.node
- Size 6KB
- SHA256 08c0737834fb5c2ca38efe64e274c1072d7edd18415275f9e0573df5bcdd0e27
- MD5 2f99a3efb47cfbbc6afe89ff5eb5f305
- SHA1 ce50fdc0bf7d1893dba7a7422cac99f151d758ba
- SHA512 2bca6d60aa7fb9a98136b4beedbda0e0ed55769da43afabc4fe4e19f1b3325a62284383211f9883d9e01cd8a79394b880ea808a4d03ea65e48b71265b88e626f
- SSDEEP 96:RsLMBWBmvYSnOe7WQCW8k62rhTRNE+iVeZIE:Rf8CYSnONQ4p2Hli
- TLSH
  T151D1645FF660C63FC85D473848DF427077B0AC5A664203336604B9793C166F82B566EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/win32-ia32/node.napi.node
- Size 119KB
- SHA256 0808ab542c43b9df85b668a02f0705529b7bb9ac79e26b0776682657c6005352
- MD5 5393f4627178086c3fc6002a46ed7282
- SHA1 c1337f1d3d21ea57ea3029ba45989ebc074920bd
- SHA512 7492b616080ad51f429036a31d2686e179f96f8b45f57bb2fc9b184e77a5c99b00ea66ffca03aa5a7f0352d4b06976b782c14ca17a2f23553923b506340f63e3
- SSDEEP 3072:3h647Utr5SJnr16sgKNhaqKpgn/MbFDIMHk:RCVCrwKNhhWgwHk
- TLSH
  T1A4C36B01B5D0C032D4BE19380530CB7A9B7FB970DE609D9BA7941ABA5F702C1DE25E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/win32-x64/node.napi.node
- Size 147KB
- SHA256 48b7275f47cd44a05d349eb4fdb6cfc451ccbf609a4a56fa34452bcf231c1208
- MD5 5cb6b3762df753d84e4ffd4afe1a7e1c
- SHA1 ae2b1c4652aec7315607fc413a4c258f11b69544
- SHA512 5723c10ea9c26524f7866b9c749d9887b10c1514bf0cc893ba2a6e9c5d9690015cbcbe024653956af3fb842de3290b4c6c4beb051b67480bdae543d8fd3981cc
- SSDEEP 3072:Tg4thDJpRhZoZKuaIXWl3zvcIS2zeqsVHCx1s8d:57DTRhmZHLijvz1x+8
- TLSH
  T1E7E36C1BB3E400BBE5B78275C8670A46E772781207609B5F03A4477A2F277919E3FB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/webp-converter/app.js
- Size 5KB
- SHA256 56c4f09778906e29d51deed09dfdc981aa07640bc7b60a4b01ddaabd66488295
- MD5 446d769bef129a1c57fc00d96c86f178
- SHA1 8928c6f043c13fb5f79321fcf2d52ba63355ba64
- SHA512 43ae2f671c8a10ea072fad464a3224cadd110baf8070c557e27ae93e7ab977db6d4ef47dd32ede4d5800752071922013ad1341effc57df64d2dbfc05d126a2c4
- SSDEEP 96:eHi29T0imrE3rEN6T5XEUGv1M0ZXLnaIxi8s8PYlm0HVyj2uVy6H:eHiq0iroNJUa1xZXLnawPYlzgj2t6H
- TLSH
  T146C14F4B3DC62D13323224C5688F88C36D8431CBF764E758B95DBA448BAC4A1A1797DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32