597fe7dd458e4ca03b2ff8bc3c7875de51d4e5ab607490dec82fdcc380386f69

Sharing

Copy URL Twitter E-mail

General

Target
Surge-Setup-1.0.2.exe
Size 117.8MB
Sample260719-fb3acaex2t
SHA256 597fe7dd458e4ca03b2ff8bc3c7875de51d4e5ab607490dec82fdcc380386f69
MD5 4ccd307797ac9b5ed87dcc6e969f3e08
SHA1 66dd34d8e947d119079780c150e4313312c83552
SHA512 7271790342378b11e7119a5f85bba05f3861f06b875c2d32cc163bdd1cfffccff22a296627b46e34653deeedbe13bb33199c48fac71fdad9aa63d4afdf8861d1
SSDEEP 3145728:rwT+Lg2Xzl1oscJfNfUkddXF98mlCH0wbYXBs1n:I+Lbjo7tNvdz6mbcQs1n
TLSH
T1BE483332D7ACBB3DC8AD6DBD9B515F9484400EE66664C48AC1FDF79C63FA3406E06821
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Surge-Setup-1.0.2.exe
- Size 117.8MB
- SHA256 597fe7dd458e4ca03b2ff8bc3c7875de51d4e5ab607490dec82fdcc380386f69
- MD5 4ccd307797ac9b5ed87dcc6e969f3e08
- SHA1 66dd34d8e947d119079780c150e4313312c83552
- SHA512 7271790342378b11e7119a5f85bba05f3861f06b875c2d32cc163bdd1cfffccff22a296627b46e34653deeedbe13bb33199c48fac71fdad9aa63d4afdf8861d1
- SSDEEP 3145728:rwT+Lg2Xzl1oscJfNfUkddXF98mlCH0wbYXBs1n:I+Lbjo7tNvdz6mbcQs1n
- TLSH
  T1BE483332D7ACBB3DC8AD6DBD9B515F9484400EE66664C48AC1FDF79C63FA3406E06821
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 117.1MB
- SHA256 9943cde0564df657ab90274c31c783f878961487931207795b01dfe5eeadfe12
- MD5 be4b3eeb70b40f671957ca8b6c223557
- SHA1 c5bb89387773ba876297dcd78f6b07557c9fa42b
- SHA512 36bb597d49b42986908f937e71d5161c27a9f2e99035efecaff09ebb59de0bc1b32ceef32451e9c2948d24cf398d6d936e361c543cda8751294062d5ccf0a885
- SSDEEP 3145728:XT+Lg2Xzl1oscJfNfUkddXF98mlCH0wbYXBs1f:D+Lbjo7tNvdz6mbcQs1f
- TLSH
  T122483333D6ACBB3DC8AD6DBD9A515E94844401EA6664C88EC1FDF79C93FA3406E06C31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 113KB
- SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
- MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
- SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
- SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
- SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
- TLSH
  T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 183KB
- SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
- MD5 e0d4001307e8e8554810b27796ad636f
- SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
- SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
- SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  icudtl.dat
- Size 10.3MB
- SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
- MD5 5bfd3eefca4b5ef2d1a869396390a7de
- SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
- SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
- SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
- TLSH
  T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/af.pak
- Size 596KB
- SHA256 7bf59977f051c1ccb19cb8c48a8efd57922d088ad26cd51a85a671000c845a4e
- MD5 0a95fc23b7a7e74189088ad0a8590875
- SHA1 118c82d27a1d13776e37ef229e11cad30d7bb0f2
- SHA512 7264d75250c98bd9b9086422c87800484d3658fef8cde3677a16d3d8c9398a85cf042b96da03881ff00500c17d7d84cab15426fc464443ab99468e3074ae6cba
- SSDEEP 12288:VfaIq9BmRPxgtRGt+2d5nPw3NtEKQNZ3GOZKv4H2JynPN+DgWALlzNozvnLImgU+:JFq9YRPutRGt+2d9Pw3NtEKQNZ3TKv4B
- TLSH
  T140D41B0AE781173D09B07696FB0845B7FB9CA26CC770B2BADDA982310566DFC11BD1D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/am.pak
- Size 966KB
- SHA256 a387f4af550667980c7631532b5c8f50a20ecf2c2f45392a7e0bf23f8f6c91fc
- MD5 f2f6eac3736bc92f92d00aeb8da1b847
- SHA1 3579b89479ceb7c297ba15c044471eb700a2299b
- SHA512 9c6ccdec8a5412b2c65804464a1c7532bd9c76f0cf3aec8ff45558e395431abd1ace149ca4e99830dd07431c322a8f68e768c3407e885cfde5ce3404404d790d
- SSDEEP 24576:T6BeLyUTG1g9thTCKfyYtxPTtfjnX7TBzv8XqSBhiyPVABZpPQx:T+PH
- TLSH
  T18425AB547DF9F7570F8E8A1994320E4EA594AD4692803C38C35AE3FC2B2DF1B4DDA219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/ar.pak
- Size 1.0MB
- SHA256 e8f4b9b64235893bbee95c8360c739e5ba09687072dd4b7d706cee9ae4032887
- MD5 0c66aa7d25c9602b75dd709b87613b95
- SHA1 bbd6b7c484118f4b601229b17000f71e1b3a00df
- SHA512 60734fbac06ec1f74fd1f72d544a8051f86473593a980a6cdd4924190e1856965127c0ca184d766175457541395eb641a69af6cc1205acdbaeda159296651e25
- SSDEEP 12288:1nZ3HDZGmBv9p7NNHHGCPXwjdb7Ae3v4UCKvkb3GSM8NjuE/YhG3q:zHDoxEA
- TLSH
  T17E358BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 da36ef0cde92b2021ff39b6c3341f4d2832c1129d13248aa371573812140db9a
- MD5 06a20adf56e618ee61a6abccd937126b
- SHA1 7c15932c946ac82d5e3633d46cd9330c7038dabb
- SHA512 ac5241c9120652eea1ebc516fd330d15a0a77cc3fba5c62db2b59847fbbaa66022f04c83815f6e79da78c706e8eec7e3458e838587ef07b56ec06c899c693e65
- SSDEEP 24576:fMrkmpWmldLYFg9zQkEC1UcVb6IM2Ql373ZJm8S3G2KjUfVDDMwh74u2VnJNIdky:fSpWmldLYFp8UcVb6IM2Ql373ZJm/3G8
- TLSH
  T1843535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/bn.pak
- Size 1.4MB
- SHA256 4f246bc78ddfc2cc249ae99990470e2d470a13a2d7599ab8787400c4fd179cdc
- MD5 6c5580282c738d26326f8848944534e1
- SHA1 25a6bb7327c14a2d8fac979f44874b40aa39694d
- SHA512 8e40eb5833cb1a9538e0f7037ddbb6988c97285fb6253fee59bc0d75ed4db3387396dfd822e5f7910aadbef5132939ae9463c50239aa0e4f436b25c504f35755
- SSDEEP 3072:37qCtC6WuIjUrGHbC1AHPDqnSIHReYw24Oc9pjgEf/8UR+q9N1IfyjWBbNdQZ3k+:3H1p4bCpSFYXq9N2fyjWBbjwn
- TLSH
  T19965EF209C6E81B6A8C5CDC9434C6370C523AE9B9B65F74DDC17A14938ADC3C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/ca.pak
- Size 671KB
- SHA256 b232cebcb102bf03c81286f1ec082e80d0e399d09d9251c3e574ef24fb15b68b
- MD5 84661624b4c3be881266e6626298f40e
- SHA1 25a98d2c399923cc4b7835520e5c37d4ba51b2e1
- SHA512 d10e9a98d19cb35ee67993d9d902626c58cee12018a36e87a491fdd492d13c30302f5a2ae20c9609441084180bc7ad7acbf250e28a2e557a869d2b4d10767191
- SSDEEP 12288:drkuMWeY7hj3lCiGOwpQa825PsF4N3Mw2juwwPR9zejm0t3l7C7T2nLfUowTLX/8:yuMo6NvLvE9p+MNe3GjUyUK
- TLSH
  T11FE4F8239FC93B7704D2330AFB46C253A48CA9847B16D254F4AE1B1622CCADCD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32