1d594dd99a616db73e3c6decc588b22945b8a0fa2253f503124a672ac59d0349

Sharing

Copy URL Twitter E-mail

General

Target
Blockbench_x64_5.1.5.exe
Size 99.9MB
Sample260720-a4h5aaav3p
SHA256 1d594dd99a616db73e3c6decc588b22945b8a0fa2253f503124a672ac59d0349
MD5 13dd6fed94b09b7dfb5376c2a85f9c47
SHA1 3fe5a32a6f91ee5c4760dc11c81f238dba567b31
SHA512 0237a06466d7d7b5db4c2de870c4d5d44082c7dc6150d6942321ee266427310ed1d624cd947e138f781d99e4ba028404c558fe041f2055c31269b2a730837aa6
SSDEEP 3145728:TfL2YaHElvoqsVl629ZSICV5e8IgCsjrHS7xmgyKK5:TSYRAqol66YIQlCsUqP
TLSH
T1C03833BD732A9813C109BD7E39728BC08BF62FDA6994484D1929361843F597E734B09F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Blockbench_x64_5.1.5.exe
- Size 99.9MB
- SHA256 1d594dd99a616db73e3c6decc588b22945b8a0fa2253f503124a672ac59d0349
- MD5 13dd6fed94b09b7dfb5376c2a85f9c47
- SHA1 3fe5a32a6f91ee5c4760dc11c81f238dba567b31
- SHA512 0237a06466d7d7b5db4c2de870c4d5d44082c7dc6150d6942321ee266427310ed1d624cd947e138f781d99e4ba028404c558fe041f2055c31269b2a730837aa6
- SSDEEP 3145728:TfL2YaHElvoqsVl629ZSICV5e8IgCsjrHS7xmgyKK5:TSYRAqol66YIQlCsUqP
- TLSH
  T1C03833BD732A9813C109BD7E39728BC08BF62FDA6994484D1929361843F597E734B09F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Blockbench.exe
- Size 204.2MB
- SHA256 f1dbe3939cf124a68b78006ea0459bd24705b997c8ec6473bd275acd982e38cd
- MD5 a20bf6e37a15b05b76f3fea3afebb04a
- SHA1 06dd0f7a423d7d305b8128c24ca6a85d9aba8173
- SHA512 ab97d138503f41623b2fa494122296eef412705cf8ff87aadef919a655ecad805a0f599bb824ade2302fedf1fdece17874d2c4664cf9fcb88cc2bb81e708f9b9
- SSDEEP 1572864:XGF3qZJHvHemnGCDaMTRdtusuiTuYpmfHlcWSJN73YjHaZy/0gPovW74Sbj9eje1:2F3m9aKIWPs3I5Pw
- TLSH
  T199A88C03E29A41D9C05DD175975A9233FEB1B8094724B7DF2BA407522F76EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11
- Target
  LICENSES.chromium.html
- Size 15.3MB
- SHA256 1145a9faaadf10f97ab6a1d0c5b7f74c6a2eae46b532f168a233b9a5cd7d52cf
- MD5 632ae2b84ce5a7ae5c51dea5d5b66de6
- SHA1 62d8d66952166c8c32de54aef13ab57bb7b6afa1
- SHA512 f17fff1ae50d99b2454429bdb5ec5d39b9d5d9ac133297a5c8e16ca3451d35e3a95305c3c0588c0ea72eb8ced419ca62f0d42bf067e99f305088fae011688361
- SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+O3r8xd2zJQf8xF6D7gQdGxw:0
- TLSH
  T1CCF6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 ac082e3da7852e20fc434370594f485b181173e0b31d59bdf049cd698a166c30
- MD5 4dd4610da8cb8493cd5ef3c4dde42cb6
- SHA1 71403f9c8689a7006a5ba40651764ddd4aa1659c
- SHA512 026145662b47f1179c63535cfcdd44c6a50bfdd4557b4527ee52de312d7777a2b76af8c7b79d737dc5bfe9fb5e7270b08ae1cc92d48fd4dc2d021c812d85c904
- SSDEEP 393216:NDo0qtOp5zxtGlyWOLynvTWcRedqlB6P2RJ:yOPxBQvlk2
- TLSH
  T166473A122646D49CC059C879C7678B268A6C30E73FA7B9EBC0F451252B79EFC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 dac252b5f8305bb16b7cff7e9b345149d815fd7103b253b10e680fe6f9b18bf6
- MD5 7c69d24304fefbacfb40508184016dba
- SHA1 d78fed931d846be33fd2a505c73a63faf335db3f
- SHA512 5d89c676896e6a36208adf31db2bf318e7a71e57fdb1bef195e41558379c48688d2e7657bfe35429584c9c4fcf5314ca6cf2736a3d4873f149484bea544976e2
- SSDEEP 49152:TWP28bu0s6grWFv/iGOjeaGgQbalS199aJLKIbk7k64aoijQrNoJdxljA6iPyfI:T028bu0CKiGWeL1bal9ZrNoJaL
- TLSH
  T179E59E02F6D651EDD019C034979B9313F631780A4F209AEB16905A223F6BFD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libEGL.dll
- Size 500KB
- SHA256 7a5a93f4348142303fc1617b3751b922266ba1dc0b18332811bdcb70c0bd50d2
- MD5 8a357d54f3d6a6aeddc3350046851873
- SHA1 cb68378213af69be56255c55df9d50ab5d91db1a
- SHA512 cf9b40bb4f908184a7e5c053f4876d9c964c79be705513bf35dc513b5b02521b916a95d15039d01ccf055744480f723a799d5a6300d9abdcac0fbef91e316892
- SSDEEP 6144:RwKVOb8lys73EbAi3uYDbW1XJ5aihN5Iio64haxiVNcPPmWF3PdPN8kygV:RBKA3Z5XSiAaxiVNcPPmW1JN1
- TLSH
  T171B48E15F3E947A8D07AC0348A538646EB7574960B65F9DF02E052392F3BBF45A3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 3049c87eb4ae02a13a22de529d66d6fd5627e659bffbd6ad82c14056b5013f1c
- MD5 5cdec47d0c0bcd5e5587b01ad6b4d687
- SHA1 630e139cc13f9a23d962668d26fac5e48ce4af1d
- SHA512 c46efccf10c7bcb685c4d45b1fbe75fadb1fd7cc180a1d8f9932e82228eb2803d420be1ecc3836a0fcd2ba1b84d856cf907ace12fa7e24150daba44d4a4fad1f
- SSDEEP 98304:PZqKv5yzkjFgW3WkQ6HqVokbPdzix7ZSYm:BqKYkjF46Cokbsm
- TLSH
  T169866A03F69681D9C05DE274875BA223FA35B8450724B7CF2A9453252F6AFE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/app.asar.unpacked/node_modules/electron-color-picker/library/index.js
- Size 928B
- SHA256 4d796dff507a477ebfc56b6442f41a357690e1f4af5294d1c446a0e975a30370
- MD5 b47b6275f2c2e92fdcd92da075ea95f7
- SHA1 dfc5948e5313f5f57e39b9ca68153322d2a5e942
- SHA512 ae8d144aeebc50f9d9215361f467b78f420ca6052728ea1726a065a3c6de5230704874b2c0be1121b7f9864e4607122115d8e0a0491354479466764fce602e7c
- TLSH
  T12D111485E3F7793113AB09AEA81440906C63C2563CAEAD76D91C430E51170DFCFA920D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/electron-color-picker/library/win32/index.js
- Size 230B
- SHA256 c90001421bc0729844528153ebe53ac6d43796575beaa1af91f9b5740f3d7db4
- MD5 fb017620338f5f13e16c2b6a53815ff4
- SHA1 91e47d5a85f59348bb78197b7871f682394f196e
- SHA512 fe4f7ed4cbcdd25b94ed3933c30131bfb73e3371fa18606bb3fde5f7b72bbb036aa2c55ade4f397828bf04cefd98c3811c6368ebd3e66a90d9b5c96a5c05d893
- TLSH
  T143D023B1B5C104AF7633911C351DC5112CD3D439124849B9F02BD74D174F18A035F937
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/electron-color-picker/library/win32/mockingbot-color-picker-ia32.exe
- Size 247KB
- SHA256 a0fe0d97c656ca677f87efaa855e359c185959f1a45106c191e4e887d789fd24
- MD5 77728ea4d9dcd84e42c428e60ad444ca
- SHA1 a6876247305df27abc6f3b593b84ce37e5d602a0
- SHA512 4eaf1ee37852699d62308368a28b194caee6797aeb8e5eb4dfad92d7d76b81c749e9b1ab2cfdcb99bf732a99a3805665b2c6d09ee7ee0ff0e38fd5b24431138d
- SSDEEP 6144:jSfPjqZp57cENm2eK7mnoUSgpAY8ODcDcm7cIskt44F0T6mkk9ABAO2Vam7GeR7E:jSfPjqjrt44F+L9wze5E
- TLSH
  T1F5449E1235D2C872D1B3183509F4CBBA5A3DBD210B6596EF57D40F6E9F303C22A356AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  resources/elevate.exe
- Size 127KB
- SHA256 bb7da1cf464b3d5460bb72fc63c8f2b4c13f434cedbf12cff400cb417f788e61
- MD5 24c406a291707a4ebc6232760fac6de0
- SHA1 92fc07eba4cfe53b87d7a1c362449791e250492c
- SHA512 30ad0183965844fb401220dd0ef7ecd732f644f27f9f95c2f672660580f6e203922f0cf31caddcf00f0b7be31b2c653cf894e48215e94752c40350b1359bb207
- SSDEEP 3072:YNbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlS7GU/7ht:4PrwRhte1XsE1lS7GK7ht
- TLSH
  T16FD38D1278C08471E9731E3564B4C9714E7DFD711E759EEB23A8027A8FA02D0AA29F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 fb1c846f1fe82a8a7cbb5f438075d212aebea91210a61774c50cf8471c47adf0
- MD5 5479c0a7181220a3d7f46b6cd8524b25
- SHA1 92141e92873c30c9a30fa0eba6a82264615fe87e
- SHA512 3c3560eebb4a465b30fce65c578f30835a663fc305051ae606f05312690bf265e37909a042649985384aa2bbe5b6067de1d9aecdf9c6a2a44aa3cce4055887b1
- SSDEEP 49152:/RAYccoQajkjwWrTd/hMFsfyTpkXNYSsnt4p+L4lvgPTvFaHmJrL+4jopldbIqd/:/FccS3OQvNToxq3cTHIXP
- TLSH
  T1AF463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  vulkan-1.dll
- Size 935KB
- SHA256 f2420e9c0b4caadf05e622a159d5aba3b22f2fd3348f0ffd538b49d269a22767
- MD5 7327811804c6e294b98a65a1253b62aa
- SHA1 c2b2a441a31a9ce99064661fed6d4a5c48dada77
- SHA512 881085c8a1530e60df8dd92ea805ef3336a6fbdf15a9fa08c4c1e039f3e662380d43c94cf0816c9a30a067d6b428c2cfd3fd2166a07ef5926f64f6f3acaaaaa2
- SSDEEP 24576:0hlEEziaf58fg5rY4M2IP4rB66Z5WGcXDYsHQDJ6g3P0zAk79oOHTQ0:0HESiE5845U4be4rB66Z5WGcXDYsHQD9
- TLSH
  T14C156D23DA644669C976D034C9D28B0789B175822326B9CF02A817047F6FFF47B7D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 fca04cec99488a124d0b2f53f3101c6bf6ed69a8a3f5fb7c100396ab98635658
- MD5 009fac2fe792ade4815716972b0a2c0a
- SHA1 8894e25a4733d21137d4bb11fffbcce5a546bebe
- SHA512 53dbe7b635cd97ce6efde4deefc7ac6c5b5bee6b75c33d77eb98e3774d27716906a105cbe17f8f3fe0db93fa439122bbc20c31770657f9d4210b22054993f888
- SSDEEP 3072:ytZLw+9yhUy34GFsRM2oqzX55WXCaOgw1usy25ioqSY2CHbE:ynLw+ENFsVb5ISb1uzqiCHCHbE
- TLSH
  T19FE3F18637AC4500F0F54B3ECB682C16D71787D942525C98FB6199F8E527ADFBEA002B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads ssh keys stored on the system

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32