7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b

Sharing

Copy URL Twitter E-mail

General

Target
nsis-installer.exe
Size 74.4MB
Sample260719-v816waf12p
SHA256 7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b
MD5 85aea19a596f59d0dbf368f99be6a139
SHA1 9fd84c0780b6555cdeed499b30e5d67071998fbc
SHA512 7de04cce49edfe48555b68d0a9935292b8e8a494af62dd6da9c92c022697d579b6d81685a91594e8402266b2ad73939e78a761110f9c39b20544308591db0f06
SSDEEP 1572864:fb6LBYCN9I9oap0lwmwBYQi2Jrydy/UgJnsI0SNcucgzxTMWIymNx:fiuS27WqBR3rEy/TJnsqN0QMWg
TLSH
T1830833DC5FD0BD82E4EC7BB85E1F7AABFB22A04C5CC06D56216856C26C12C531E1F52A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  nsis-installer.exe
- Size 74.4MB
- SHA256 7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b
- MD5 85aea19a596f59d0dbf368f99be6a139
- SHA1 9fd84c0780b6555cdeed499b30e5d67071998fbc
- SHA512 7de04cce49edfe48555b68d0a9935292b8e8a494af62dd6da9c92c022697d579b6d81685a91594e8402266b2ad73939e78a761110f9c39b20544308591db0f06
- SSDEEP 1572864:fb6LBYCN9I9oap0lwmwBYQi2Jrydy/UgJnsI0SNcucgzxTMWIymNx:fiuS27WqBR3rEy/TJnsqN0QMWg
- TLSH
  T1830833DC5FD0BD82E4EC7BB85E1F7AABFB22A04C5CC06D56216856C26C12C531E1F52A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 7.9MB
- SHA256 c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
- MD5 312446edf757f7e92aad311f625cef2a
- SHA1 91102d30d5abcfa7b6ec732e3682fb9c77279ba3
- SHA512 dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333
- SSDEEP 24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
- TLSH
  T13886942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  SerenityTherapyInstaller.exe
- Size 131.9MB
- SHA256 df4030369ca29744f74bc4932a4ffd0537d41796c9d913623de0d6214ec39d91
- MD5 d05989ce9be7ea67632845fa837299c9
- SHA1 359843b36a73c0d1d513b8684a2f83af34ce96a2
- SHA512 bef82d9fb46849489fb87e8c5dbde7a86dddf2a1dce39e752a30992258c7e01c990384d918be99b4f51b285e77ca6adc820948cab6bbd12140b4f806578c5817
- SSDEEP 1572864:m4sMLl/BkZTVV2iplzf+ekzrMdTOG0AfhgojwlwVgmPQtn06H9rejAEdCoIZXCVb:/l/BkVVPBDgmPKa5Wnu3X7
- TLSH
  T16268AD41A4A1207DD80370F7352EBB3D5A6446138F394AC7AE886CD46FAB5D1263F36B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral13 behavioral14
- Target
  d3dcompiler_47.dll
- Size 3.9MB
- SHA256 35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7
- MD5 3b4647bcb9feb591c2c05d1a606ed988
- SHA1 b42c59f96fb069fd49009dfd94550a7764e6c97c
- SHA512 00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50
- SSDEEP 49152:OS7PQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ir:O4PhqqFVUsLQl6FqVCLTzHxJIMd
- TLSH
  T131169E31FA41807AD8EA05F0666E776E943C9B341B3444C75290ADA9ECB01D37F3EE96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  ffmpeg.dll
- Size 2.5MB
- SHA256 c0d9edde3864d9450744f4bc526a98608b629aeed01c6647f600802e1b1cf671
- MD5 1bb0e1140ef08440ad47d80b70dbf742
- SHA1 c2e4243bad76b465b5ab39865ac023db1632d6b0
- SHA512 29d71e3bd7df7014a03e26ca6ee5b59ff6e3d06096742fae5dec6282abd1f0d2f24c886a503e3a691d38cc68e0da504a7f657dcec4758b640a1a523d3eeaa57a
- SSDEEP 49152:YKM7YWN1tYNFKtJPP5f+8xH6UahvIxi9xrBYHZU7ewdCUQFdqQi9muA:YKM7YWNT2Kt9QoaUalEi9xqZ29dA
- TLSH
  T144C5CF01B16192AAD44E3131395EB37F2D3D1B75871289C78384ADA8EBF86C149FB367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  libEGL.dll
- Size 371KB
- SHA256 aa5da4005c76cfe5195b69282b2ad249d7dc2300bbc979592bd67315fc30c669
- MD5 e0a5d1a5d55dffb55513acb736cef1c1
- SHA1 307fc023790af5bf3d45678de985e8e9f34896f7
- SHA512 094e23869fd42c60f83e0f4d1a2cd1a29d2efd805ac02a01ce9700b8e7b0e39e52fe86503264a0298c85f0d02b38620f1e773f2ea981f3049aeba3104b04253f
- SSDEEP 6144:6FVfk760MmXXwvT3WpVgvpqwm9SPECshBZeD6EHh:267rjnpVgvpqwm93rIW
- TLSH
  T102849E81B540C4B1CC7E31753E19E3681B7DA8601F665ACF93984DBE6FB02C26D3636A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  libGLESv2.dll
- Size 6.4MB
- SHA256 f6259a9b9c284ee5916447dd9d0ba051c2908c9d3662d42d8bbe6ce6d65a37de
- MD5 44f7c21b6010048e0dcdc43d83ebd357
- SHA1 d0a4dfd8dbae1a8421c3043315d78ecd84502b16
- SHA512 7e03538dd8e798d0e808a8fc6e149e83de9f8404e839900f6c9535da6aac8ef4d5c31044e547dde34dcece1255fab9a9255fa069a99fcb08e49785d812b3887c
- SSDEEP 98304:ZHYQkvdLN+UNQR14/hr5njmwSNDBVO0Bz7arD+0t1t0zA5Lgs2+A1tCw:itvwq/hr5jmwSVBJBz7arQA+sq1tC
- TLSH
  T1B466AE02A8D29039D81B31313E2D7B6E6D3997614B2142C7E5A8ADE42FF41D217773AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  locales/af.pak
- Size 368KB
- SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
- MD5 7e51349edc7e6aed122bfa00970fab80
- SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
- SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d
- SSDEEP 6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
- TLSH
  T10A841C0AD780277D09B07696FA0545F7BB9CA26CD770B2BADD9D82321962EFC017D1C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  locales/uk.pak
- Size 688KB
- SHA256 54324671a161f6d67c790bfd29349db2e2d21f5012dc97e891f8f5268bdf7e22
- MD5 ee70e9f3557b9c8c67bfb8dfcb51384d
- SHA1 fc4dfc35cde1a00f97eefe5e0a2b9b9c0149751e
- SHA512 f4e1da71cb0485851e8ebcd5d5cf971961737ad238353453db938b4a82a68a6bbaf3de7553f0ff1f915a0e6640a3e54f5368d9154b0a4ad38e439f5808c05b9f
- SSDEEP 12288:wrccq9nty/KiDswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:HGX35EEK
- TLSH
  T15FE49AA19A9D58DF0105F05BE84C7A0D7DA741FE7FA6871625A43DBF38F20248A3C71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  vk_swiftshader.dll
- Size 4.5MB
- SHA256 4c4b935cbb320033f504a89b1eb0a4bcb176bbd46a5981153cb1f54deb146a1c
- MD5 65a5705d95a0820740b3396851ff1751
- SHA1 a692a80bafc41ba1b29ef19890f8465b3fb20dcb
- SHA512 0c5df23b96eaf952c4a498ff6d854df2b62e7631b16c2855ed37ddbadffba3dd52e7450f2e06cf094bec2e0d70d14c87a652150766d90ec8662e03123df5942d
- SSDEEP 98304:x2GmsucG1vUTM3SFhCrHglx7LQDCwchuW6ugI:cuuF4XhCGLQDCaI
- TLSH
  T14B268D01F211B074E40B20B9391D7F659EB487306BA646D7CAD87CDC6EB41E26A3B25F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  vulkan-1.dll
- Size 786KB
- SHA256 29cb256921a1b0f222c82650469d534ccdf038d1f395b3aaa9f1086918f5d3fa
- MD5 a947c5d8fec95a0f24b4143ced301209
- SHA1 ebf3089985377a58b8431a14e22a814857287aaf
- SHA512 75f5e055f4422b5558fc1cb3ea84fb7cbeaae6f71c786cc06c295d4ab51c0b1c84e28a7c89fe544f007dbe8e612bed4059139f1575934fe4bac8e538c674ebd3
- SSDEEP 24576:cJObHhG7TEnCGlrpZpjL4TB46Z5WODYsHh6g3P0zAk722:c0c7TECgpZpju46Z5WODYsHh6g3P0zA+
- TLSH
  T18A057C16FB48C476C71F30317D61F376067A93512BA448C7279CAFA96BA02D12B3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Looks up external IP address via web service

Enumerates processes with tasklist

Loads dropped DLL

Looks up external IP address via web service

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32