87360ab9a99392619b63133dbf50111e104ba599f04b21740de16d380d723da6

Sharing

Copy URL Twitter E-mail

General

Target
Slack (1).msix
Size 155.3MB
Sample260720-gfkrjaaw7s
SHA256 87360ab9a99392619b63133dbf50111e104ba599f04b21740de16d380d723da6
MD5 0c2768b8821b2b4908a6ba43765bdbec
SHA1 0ce9484ea05fed5f9f1f549857c533f7924e772c
SHA512 1ac191a891f7c37ec732c18f269fb5e53f0bf199491aa0a08791e85e7a7840e7d00018c555652aacd5eb0530313251aa3af51eedb12c5cfd0e2c2bfbad0e1019
SSDEEP 3145728:F0vTo2uMYJBCEKBjaBSBeWMZW/1XDizwMmURiGFR8qzpqRfQG7uSYeK:6CMYJBgjnAWME1XDiTnFRFEOjh
TLSH
T1E07833D3DDA8309DF525383AB98DF4E4C01DB5C425B08DE3AB1413ED19AB9D8837CA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Slack (1).msix
- Size 155.3MB
- SHA256 87360ab9a99392619b63133dbf50111e104ba599f04b21740de16d380d723da6
- MD5 0c2768b8821b2b4908a6ba43765bdbec
- SHA1 0ce9484ea05fed5f9f1f549857c533f7924e772c
- SHA512 1ac191a891f7c37ec732c18f269fb5e53f0bf199491aa0a08791e85e7a7840e7d00018c555652aacd5eb0530313251aa3af51eedb12c5cfd0e2c2bfbad0e1019
- SSDEEP 3145728:F0vTo2uMYJBCEKBjaBSBeWMZW/1XDizwMmURiGFR8qzpqRfQG7uSYeK:6CMYJBgjnAWME1XDiTnFRFEOjh
- TLSH
  T1E07833D3DDA8309DF525383AB98DF4E4C01DB5C425B08DE3AB1413ED19AB9D8837CA5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  app/Slack.exe
- Size 221.6MB
- SHA256 6d1e770b10f10931e64c87ac43d427feac8d72031b62f5fa2c6a6e506dbb60c6
- MD5 7708d6ba04d34b3402b6205bf13c6630
- SHA1 f7f2c3383c58cf62b8dcbc03404772b6f6f4a3ad
- SHA512 d7495df60de510bc6ff46e33112ccfc5b7d6982cde1e26b42d649041a0002315ef3edc80120c8ad7b4f4ab7344a05787aacd8c16b9bb4d7228474089153e9827
- SSDEEP 1572864:IlJpGIpz7FVPQVgVDKyZ2sCF0hr6q8n8VqpWhe1DBUjKxQ8zafiVnjXl3YqaSdVg:w3pz7Bo2SmGmwbS
- TLSH
  T1FEB88C03F29A42D9C05DD1798B5A9633FE71B8454B24A3DF2B5407922F76EE82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3
- Target
  app/chrome_100_percent.pak
- Size 117KB
- SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
- MD5 750913d55e87def9108e55728ba67d00
- SHA1 a5944bc170d1f6c3223195c043134566471dae1d
- SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
- SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
- TLSH
  T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4 behavioral5
- Target
  app/chrome_200_percent.pak
- Size 192KB
- SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
- MD5 d476c19d21b3c2861f08c1c82fffddcb
- SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
- SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
- SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6 behavioral7
- Target
  app/resources.pak
- Size 6.6MB
- SHA256 5585dc0e39e6efe9ee79979c8d50938633bf72e329848ca79ca07998d4d8c949
- MD5 06a4f687b75fbe3c6bbe926545da3a37
- SHA1 d55567a6d6f87f0c863d3eb99ae5a0651682fea6
- SHA512 7951fafca6402d9510726f67f0683c63edb33ab430f1798e6d42d4fb682f04617ce06c75c817acc6de6f03c84cf7dff1c4667af64686652aa9bd92749f94f0e7
- SSDEEP 196608:L4BRzefMlDTz9u4bkriACmZnC3gEL34tVrW:ETSS/zlkrDntEoVrW
- TLSH
  T1036633D276E2A81FCD80677945448F35599C6F2532D0B1A3889C6219EEACF6C0EC4B7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  app/resources/SlackAppList.png
- Size 2KB
- SHA256 84f841ed6b5d1c46e8c600a459e1e87549eca8124f8c4c41e37701df764ea5fb
- MD5 20b6348629ad97e09e3dce7c7c3d5f7d
- SHA1 020df2cd7517fce09dd4640ebe929e8979634e8b
- SHA512 e6d59605d26d557791c7389886f31843a79c4ea628049f3c2899357228335765acc3ba72a4510b647c5a575feba0730e0d6521458f3fef37482745cf59ab4167
- TLSH
  T182512B9AE363DEBC4B2930B683DA7D37C52C0BF894FC45464650D37B5984E45D02265A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  app/resources/SlackLogo.png
- Size 3KB
- SHA256 b19c078825aa5b1861a363acec767fcc58fa2fdd5dc190082d06fcd185aa8489
- MD5 2e9e3621f478827199228855c4849164
- SHA1 d05bf5b7428ac3d8f60765bc823ba4bb94fe61d1
- SHA512 2cb448140688958792b59fb4dbc76bfebe459c4d8ab22c755fc7db5e1ee31ecc111cf33e7792abe71e095c2b160b6f09543637036ca2becd711a4741419405ee
- TLSH
  T128715CCA608350B062AD646F297BA4401D667AA2A1041EE64FD18ED471FB2F0B80CB7F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  app/resources/SlackSmallTile.png
- Size 1KB
- SHA256 fb0bfbb438234fa87a9615884c2b57d4ef852ca529c4c5372f616ed56f33d912
- MD5 4f977fa2b0387ed4ecaa60af32d898c2
- SHA1 05862cf03d0b2082a4539255e460721027032c8e
- SHA512 c56f357cb1cdacdda5e6f84089bf411628d6c1a1e71fe7e5d2e0de46610f578b727e9ff63292a7b8733125b6849ca7c8ba2be03815d0b0b884fd8ecda4449235
- TLSH
  T1BC31C6924222CF35884B2E7BC53CC28231A6915C29B22E394A7780D5A317E37BC17F66
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  app/resources/VisualElementsManifest.xml
- Size 314B
- SHA256 a68f66dbc5c849ea0a72eb4e72b5c73a4eb6c657a9128042f49fb14526ef551c
- MD5 b051db02028a0533412e9f5653b71cd1
- SHA1 6f1776d81ae451daf34723f3bd5f617267b24ba5
- SHA512 b9601f2a7a6a0577288a1d071fe16a605a9be2f0f0250075d3acddde0fdc5cfd84c2573973138d8f7ed535d415f3afc7fa22aa900cd92c8d733cd1f85ca4e63e
- TLSH
  T195E0C2E900680A80E2B7C56CA81EF44BA10D34BEC3E64589F95E55363BBDBCD0957640
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral16 behavioral17
- Target
  app/resources/animal_stick.mp3
- Size 13KB
- SHA256 3d259ed0c2ff734f82ab61834637fe6e6f131e00ec5f0aae0edd3c857bb14aef
- MD5 74d2956ce9d363e74a0fd89d49576c38
- SHA1 26e91de390caa839b9667008653215e3be12f918
- SHA512 896cf28bfc026b791907df29b77471a8bb155767638dd1d2e62961f1711e4b2d41e3a44101275d83505685c1b70936f5f435d57096730dc1dcf150322aacfab8
- SSDEEP 192:iXz82aod9ZRvqKN04q37tyV9smlfaFTspKriSKKtbdado:iXz82aod9WSGgrRaFTswT/tb
- TLSH
  T146528E646779E285F64799B4A6093FF21440FAE739F540430558FB9FCDC7F02D888A22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  app/resources/app.asar
- Size 10.6MB
- SHA256 75d71517d50682735fb3d359fdc1fd910426eaa931dffaca85f61f5d8572e4ae
- MD5 d14f30954e034079b9181eac1375857e
- SHA1 2ed6cc24b39b8085eedc336c25233d554b7a6c1b
- SHA512 8eebf272e92216e2c195ad9ee91565776d0bc50282bc034993e640b0d52b918b7715e8568e6562ca32dfb3302b38d9d8ac28bd1969a22bb9bf9f59a295e91606
- SSDEEP 98304:u6OZu+pZ8+K5cbBRrQuZaTQegQPGaKiruPzFOijN:xgB5QDTveaApN
- TLSH
  T180B68DD975F220A2C3A251B4546F0102F2396826784CDCA0F69DD9DC2FA941DA3B7FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  app/resources/app.asar.unpacked/dist/resources/macos-menubar-icon-Template%402x.png
- Size 583B
- SHA256 7ddef6eb9aa7135f13b340e371fecccee493a1fdb3b83e1542b4064ced8f3e70
- MD5 ee31fa33f3f53b18c8722bf95a2c1f3c
- SHA1 7f444727aec992f6b6a60b1fc6825e36b9378142
- SHA512 85b300d66ad8442380bacef048da382e9f0d977320f945fe932371e3dc93302598da7c2775f5eb5c0940b33cbd1f1ad5e2c5d7b48c603af14afd70e78fa1b925
- TLSH
  T146F047C29712805FAA8576FE1246877079A4549AF4B426525BC5C0F6A07F510504F745
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  app/resources/app.asar.unpacked/dist/resources/macos-menubar-icon-Template%403x.png
- Size 828B
- SHA256 f0016fa915d730b52075a212ff8f454fac2ba44322285c0337c49ef2930efe06
- MD5 b78b6b23893278f6d544bf2fc723c007
- SHA1 2e35fa8a0febf20bbe087cf490b081618061c6a1
- SHA512 48379b3d82b5a162f15323b648735f2a75dff9aad3fe6b92b2179db11f37bf43c11ce43774a573cedb177abfd51ff3ca36281a15945e70bf9647f8da57f1f1f8
- TLSH
  T14F01C5D248EA48AEACC7C94359D7406DA6F920CC8303DA3C02B0521B2617E6E45C33E3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  app/resources/app.asar.unpacked/dist/resources/macos-menubar-icon-Template.png
- Size 366B
- SHA256 0870f158fedcbea16b3a567e4d90d207e5151323efb9d74e6dba8c65f1168eb0
- MD5 88fdfe5030e55ddd5cf80f2a5e396a8e
- SHA1 0bfbe33e24d02d5d554fd031e8ad6e8dcfd9583f
- SHA512 77138299f68def2333313a8e6302d207a45d52f6f14e404dcee23127f0b7523ff9eb355f5967ac73dfe5f17f8999a7c040fc8fddf41154af30ff6c48519a3a41
- TLSH
  T19EE0C0F637C62C168ABF0AA9709F6414ADB62E0E56601C386F16882628457E05179BC3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  app/resources/app.asar.unpacked/dist/resources/slack-taskbar-highlight.ico
- Size 11KB
- SHA256 423d8120bbb927895b0862ddc8a8f8e87a55ad2f1f9d40ecf54514f9a9cd705e
- MD5 259d17c314b14e00d28fe1322a6db56d
- SHA1 3438bac60ea8799dd5ede8513cef5c9ee2bd1cd3
- SHA512 58a1c509c61ba7b5380bbfe9c1577487075631705cba76b76f5303f5cfea10d533aea044228c2df193c1cd982ce1fbea3678c9087f106aa29626c47ad01c4bed
- SSDEEP 96:DWnFyAGGGGnEIvKZkmU9/n+w0YYOjPEYa30Y2FFFF5LB1dyAa9bbbbbbbbbrXF0:DGdEVoGMtsYaZaLodbbbbbbbbbr
- TLSH
  T1FE324390B692C52DF9C423FC6E1F09A46D86CDC1268A2DC6157D37BE8DFA1C322A0917
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  app/resources/app.asar.unpacked/dist/resources/slack-taskbar-rest.ico
- Size 11KB
- SHA256 6678f55e545c2181ba1cfb5427eab880662d028d1614e2de263cb9e8dd3b7ab5
- MD5 ffbe7e3f32354e068f94b863820c35de
- SHA1 f5acb7376feb2421b7faffd2b23f3c091345664f
- SHA512 cfa640cb259ce5f4a7ecc4695b8fe6cc2d8282b46533ac8be9a0d40f35b927a59315b8fd1c1473b7c04339a6380557975f2ec3ce840c9cfa705d4528078b1d2d
- SSDEEP 96:D9LcXM6tGuiAvKZkmq4sNibYMjPEY6083xlqTjF0:SGuQteibYKsY+w
- TLSH
  T1B632DB41BA528971FC067135ED6BC1288E2ADCDA79F249C7327C339E4EF652611A1F08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  app/resources/app.asar.unpacked/dist/resources/slack-taskbar-unread.ico
- Size 11KB
- SHA256 736506e84ffb200d8d3c394a101e52ab6efe6e26ca522b6fcc67df47b22f85fc
- MD5 ad185dd0ecb0c4a08db34ced7fa9a47e
- SHA1 837b87a40cf81f4d6da4085cd21088d4c72e8d23
- SHA512 cf0c803e5ce976b77c5ae1bb85a9198207f65b5d9d01ec268b9bc8ad3b227fd5a18d47ec184e143a04bf7b5359128cc9f07665572452aa154f794800a15ba175
- SSDEEP 192:67ooooUV9UEV9IQ5ZoooooooM9CYaLTXH:67oooo2lV1oooooooU1cX
- TLSH
  T19F322E62F11AA938F744B1346DD784354E644DCA35E35CC622BA332CDCB367B21FAA58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Network Share Discovery

Reads ssh keys stored on the system

Network Share Discovery

Checks computer location settings

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32