aa7d3ae41c22e5cc35f9473ca831f2793fce949f5bc6935d5441da234d434902

Sharing

Copy URL Twitter E-mail

General

Target
Trezor-Suite-26.8.0-win-x64.exe
Size 147.1MB
Sample260720-e1cwbaey2m
SHA256 aa7d3ae41c22e5cc35f9473ca831f2793fce949f5bc6935d5441da234d434902
MD5 ac1914a5c163f8ecb7ef852ca9c14e22
SHA1 46270b638ddc7a181853dd59648c6d4574b68dd6
SHA512 f00158bee6182b4e53844e5f68a7b83bfe6caa17f6f63ba2e94e3bd0cde2fdde0dd443f9bbbe30b226711303bb1ec5ae93e3cf1ecb65f86666fa77bb07221487
SSDEEP 3145728:0MXL4i84pEFLgeK2bb8WxLlOKvH09LL+35WjO0Og3XXpJ5OLma80k:r4b9nfLT8LKYjggH5JEqak
TLSH
T12B7833E1D43AA025FBC8567F47D168B6B60A7FE1C5502487AC0434B6F27EADC6D086E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Trezor-Suite-26.8.0-win-x64.exe
- Size 147.1MB
- SHA256 aa7d3ae41c22e5cc35f9473ca831f2793fce949f5bc6935d5441da234d434902
- MD5 ac1914a5c163f8ecb7ef852ca9c14e22
- SHA1 46270b638ddc7a181853dd59648c6d4574b68dd6
- SHA512 f00158bee6182b4e53844e5f68a7b83bfe6caa17f6f63ba2e94e3bd0cde2fdde0dd443f9bbbe30b226711303bb1ec5ae93e3cf1ecb65f86666fa77bb07221487
- SSDEEP 3145728:0MXL4i84pEFLgeK2bb8WxLlOKvH09LL+35WjO0Og3XXpJ5OLma80k:r4b9nfLT8LKYjggH5JEqak
- TLSH
  T12B7833E1D43AA025FBC8567F47D168B6B60A7FE1C5502487AC0434B6F27EADC6D086E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 146.6MB
- SHA256 304a7a10c7d3493c93c47947b47e747ae8a2bc852440a0bdecec9edcef88d86a
- MD5 846be77481e55902d73ed482efea84e0
- SHA1 13b5993429c5170232c6ced77ddc440b811401f8
- SHA512 7df8164be8b943450fe50a77cd74a1938323bda6cef74541359da29882f265dbbc6d42d5df996f023529faf7eb3890c0e0d1370e7f5faad5da6b3c10945299f0
- SSDEEP 3145728:GXL4i84pEFLgeK2bb8WxLlOKvH09LL+35WjO0Og3XXpJ5OLma80+:s4b9nfLT8LKYjggH5JEqa+
- TLSH
  T13B7833E1C43AB0353BC8567F47D168B5BA0A7FE1C5502487AC0474B6E37EADD6A086E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Trezor Suite.exe
- Size 221.6MB
- SHA256 f5749aedea03586ddbb7fbcc716415daf4c481b5bb86f62dc9bcfdb91bf9e634
- MD5 0a62bd04c25f33ee858a2a2ba89767a1
- SHA1 8874dd0baca10dca30d5febbdd76216f85ff181b
- SHA512 9a7f81adb9802c9b0ac2e15a7f2ac499c3a0efb5631661d8b1a03cb1074bc78f0a840565271f07c394c629bb0896ee0b9f66bc86ce09feb956046d0c5c22ac1e
- SSDEEP 1572864:6Wxpsb1ZVbUZNPbMPSD4mJVz+xHbMk8eBpkmHcqdj/AWWceMVqfL5Hn371NMKlay:teZV6W86TmPE00p
- TLSH
  T170B88C03F29A41D9C01DD1798B5A9633FEB1B8454B24A3DF2B5447922F66EF82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  libEGL.dll
- Size 467KB
- SHA256 630401e4e008b80c4bfca28cf01b02e371698e855aa132a7a31f6248c0a5c32f
- MD5 04f48321f798b648d2012d05df785c41
- SHA1 b4a8c3cb50fe663dbf74a0ba0160339f2d54b5aa
- SHA512 94c06b38f48d90d025fe2dcc670ccec4eec38fbf58dbdd8f4dfc1d2c77761d812d560d7e720c93160ab2b837a5191707ffd79bb556d490365565dfa750644983
- SSDEEP 12288:66/vCrog5QZ9yJNe8DcQir3YB9ANZMBg:66/vCrovjLA94Mm
- TLSH
  T1C9A48D15B3E948A9E07BC1388A538643EB75B4520B61F6DF02A0D2793F77BE45A7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 e9c1b0055ddd591fd33fa9a30a9adb262490f998b3c343b8225e14996aecbf77
- MD5 b60f635dbbdaa84199fb6e00131686c9
- SHA1 1f2e0f81d00f1e5cd9059130dbccb0feb966ffe7
- SHA512 3f7b105d93bcdab0243bdc36a17709944ab1af1f0fce3a1f14dbdc367e458891183ef5cd4bfebdd5e64279a0746f594ed02fb9f67c633a5b7fa44c67f095867f
- SSDEEP 98304:q28+0qrgWEefZGd0Txn5XUTMSEyGEEEE:u+0qcYfLctr
- TLSH
  T1D3866B03F69681D9C05DD278876BA223FA30B8550724B6CF2AA457152F6AFF0EB3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/app.asar
- Size 60.2MB
- SHA256 55f1f3fa43886f626e749f772d7d40bcc67e562a49f3fcc9a7af55ecc23815ca
- MD5 3edf54acdf526843a3869a8cd7e35697
- SHA1 e24c342d71a5e3180765f315a7ed6216b08200f0
- SHA512 c61059b7f8a5731ffda81a550e71af44cfc948825303b58b6739f29dfaf8dac14a3b408385701746627f320844ea6d71f2c87f30d2bbbeb993c1c06361474667
- SSDEEP 786432:nGwwG6GfGm08i+CEHkKJyUjb+0wT67sLJig8eS:nGwwG6GfGVa1bjXP
- TLSH
  T1E3D7D085B6E3B472C34316F6516B4011F339A41A30588854FA9CFDD92F9BA58E2B3F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/usb/dist/index.js
- Size 3KB
- SHA256 9df73898111f24b045b3537341f2253aed08b80a29b24f796e59dd55177c34ed
- MD5 58697f18bbf513e11c0e35247c7bcf8e
- SHA1 79a65364aa6ebff1ab2bfa6d5f9a4e24d9415aa4
- SHA512 48c1ad9091ef5756b291fba4c3f9e62e2fed2ed5deaded21b2aa6724ce18b758c7a465825913f05e24336e387f739476d8b6e158fc00e69cb7cd712bd78be9c4
- TLSH
  T1D271330B79E565B202F330F90F5BD083B273456720108AE47B9CD7B0AFA64D596E4A99
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/usb/dist/usb/bindings.js
- Size 476B
- SHA256 f37a0d89a10a9789b4b1961c3defe48ae05d759d2fab2b83d934929ce5b22490
- MD5 643967220d0eeb138588178809fba653
- SHA1 a1e3048e8d65e1de59dacc913fd8abffea83f1c1
- SHA512 431a42e973ad6d3fe87d6918a1b2319985a88c9863d8d837f1e810d4b9139707d7c7cf78d756db89f64597733bfbaa17610966f82c6a03d2350a3418132a3bda
- TLSH
  T10AF09ED2BAB359500B5042CAE45EF48173D6CD73E5964845D36540E9C5014893581662
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/usb/dist/usb/capability.js
- Size 574B
- SHA256 81f8533e05ce49f405258dde11c3c1dd7c23cb18632b4793610d861e5c6b5c1c
- MD5 53b074df36ba4aaeab0ccef433bae585
- SHA1 2faeeabb8c3bf367020e2eb886076940a8b81b15
- SHA512 c4f127d37b48b22b0b2e4b8cf57a6a490cff88f6daf8e3f76ff6c28159fe68194c691daec620ccb0cba6af4c3dca3aab41190d3be04fd24ec46d3359c2b9598b
- TLSH
  T1E1F0595F7FBBA144C986B1C34E1D90815552524B511AC66A33ECC7DCAF50BE0CF30A29
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/usb/dist/usb/descriptors.js
- Size 116B
- SHA256 22d661890c311f9a9fdfa8893548d1ab6583579f861406ba91e41971d7b8be63
- MD5 4848160c28f95d6a7278039741208a16
- SHA1 15ea837c741152c8d4270fced8e20bff134855c1
- SHA512 e032d81f1658be9626740312d485bfd3e161437e94f7f627c960c40ac50727011ef752758df855e13f64de87d1ce722cfef0a17d4bc74c9594d3e01b4782c29a
- TLSH
  T17EB0921AAD71DEE50BB048CC492AE0D2A0819962E026686AA7E859A96420D8EA870A11
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/usb/dist/usb/device.js
- Size 10KB
- SHA256 33fe3777c31dc6d2f184dc70499d27d11b6e238bce765e5591690eccf2f28840
- MD5 6689260406c66e10f7c95ca5e82b7abf
- SHA1 6286cdac6e6eb317e48d5f8721a8a212714d97d3
- SHA512 f50400048b9ab4081244ac72df669d2e68fb953ffdc80d3be58b9b6bc9a5fd11ff699385c659757130d147c9dafdc93a3c892a1cbd70a4d048dfecd9de7b29cc
- SSDEEP 192:KOr3RVth3kWimiLg0imiTeVOmIRLiyK3CCvxbXdIU9SyNyLmNUnTCzI+MyhK6FIL:V2pXnNExYhHhQ3n9ZP3b
- TLSH
  T13B324F052EEB75120073B27A0F2F9561B224C51B212ACF99BA5C4B646FC5AF4CBF97D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/bin/bluetooth/trezor-bluetooth.exe
- Size 1.8MB
- SHA256 e4011ca1f7d10e8ec79509602e02f48bd1b2d7dede7c32b0bb2d3777aec74c67
- MD5 a3c1a67a5c167ddcdc36e948c0b9ea7e
- SHA1 cbba7f461c256547475596c4afee7653e589ce38
- SHA512 f10c03e6be0cb86f5ae63fa4209cef02d594b55292a7de708131fd38e6c5993f25b417eb32e6fd7dcab599b6f40c8717944efa1ea76a0a70f7af18ef7fa99f4e
- SSDEEP 49152:yABGrhi85OpeBn/nnGPOWB2ruG0f7gvci4:QUe5/n42A7gvc
- TLSH
  T178955B03D29480FCC0AEC1B98756A736FA71BCCE492572AF1BE44B612EA9F505F1D718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32