3368af6e4c3d6003e36ea968a653c5ce7fdadaaf39fd6b9bb0e78b75a666467c

Sharing

Copy URL Twitter E-mail

General

Target
3368af6e4c3d6003e36ea968a653c5ce7fdadaaf39fd6b9bb0e78b75a666467c.exe
Size 79.5MB
Sample260720-rdkc4act7n
SHA256 3368af6e4c3d6003e36ea968a653c5ce7fdadaaf39fd6b9bb0e78b75a666467c
MD5 ac1199ec9b73bdb5be0a70080769883f
SHA1 581ceeb13e86a99e4d88e757a6a114516798dc02
SHA512 773e1dfdb10aec2514219c7a7510fd0663932832dd09d9ba294c0fd30bf49af9fe288244006acb2365ce6c49ca0699d092ef5f4df2d78f78a63a304d23d6709e
SSDEEP 1572864:AtXZrwBtq8oHgXteXS/hkbSmQ5tYrrib+z666sqv1TZke39KxHrLmj7:+dYHSq/hGSekg6cqZZz9Kxqj7
TLSH
T119083329185E4A32F88A35F43E6253F78A8BEFFE99BC703BD77131E7A1715529210460
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  3368af6e4c3d6003e36ea968a653c5ce7fdadaaf39fd6b9bb0e78b75a666467c.exe
- Size 79.5MB
- SHA256 3368af6e4c3d6003e36ea968a653c5ce7fdadaaf39fd6b9bb0e78b75a666467c
- MD5 ac1199ec9b73bdb5be0a70080769883f
- SHA1 581ceeb13e86a99e4d88e757a6a114516798dc02
- SHA512 773e1dfdb10aec2514219c7a7510fd0663932832dd09d9ba294c0fd30bf49af9fe288244006acb2365ce6c49ca0699d092ef5f4df2d78f78a63a304d23d6709e
- SSDEEP 1572864:AtXZrwBtq8oHgXteXS/hkbSmQ5tYrrib+z666sqv1TZke39KxHrLmj7:+dYHSq/hGSekg6cqZZz9Kxqj7
- TLSH
  T119083329185E4A32F88A35F43E6253F78A8BEFFE99BC703BD77131E7A1715529210460
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 11.7MB
- SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
- MD5 0b24e08f0d1dac2ee54364e50fef0b41
- SHA1 a4f3ea66556cdcc2e92bc924965e225488ccd94b
- SHA512 2beb14f31a87f0df953af26945288f35e916159b114ec1c205c3a58125fa6911b888c2a0b17b593c5b2bcd8e51012d8f2cbe4629f1968335ee3866a19712dfb9
- SSDEEP 24576:S9dQL6poq6jBCjK6D3UwRmETlmfTKjZ6ojK6QjZ6UjK6ajK64jK6cjZ6ijK6b6ck:SvPeGAyWPbX8meu
- TLSH
  T1CBC6A52F7B48037306C642A26B8B65CAF31F903F3B561654345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 99fbd8bd11696e24479d22e29b490c7e96c7d9875ab4392ff12307ddfb5a9503
- MD5 931b7dbb1b27b4ff0ac5cd6cca485c1f
- SHA1 22578fcadd0fa4b1159dd721c2d8dc6bde89c07e
- SHA512 c5f19baa9de5502c752797fc8a488ac4b85bcd1325968a88461b25844fe36b313560c454cd2849bc48b7bb67724d2f1dbfa67dc7ff0c21c34438ffd0f9da56f2
- SSDEEP 49152:oJ2o28BhFrhzXIbk8HV22QNPa12wLOA1AdL10SApX7jCf1Xh/+Gk1ekxjGsDefo9:oCWFrIb1HV22QcSAZ7jCf1Xh/+Gk1ek5
- TLSH
  T151D5AD07F6D6109DD029C070979F9213F671344A8B205AEF26D05A243FABFD86E3E769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  libEGL.dll
- Size 481KB
- SHA256 e55fb10fb929b28446583ebc5afa89fc647bafc2eebf3b12e6a0adf91a7bb202
- MD5 46f2bd2a1c312a65e09ecd1d04e559b6
- SHA1 6b071a36ed51b3829da871ed2149abecb22ee6fc
- SHA512 ae082bb8d6d161d185a8d5b1f4fb20b020e73e9711688b4ef7c9dea610206ed5a95b2b2691db68725d38760aec5a918c89a36e94c61651e31cafe59407f77818
- SSDEEP 6144:5qQPf2bILvlflS9XHaT9ZrgDUypbrzi4uBcFObfckF0fASM9:x2q49XHu9ZrgDVVi4nFObfckIAH
- TLSH
  T17AA48D15B3E544A8E06AD1748A534642DA77B4920F65FBDF03E493392F37BE85B3A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 2289eb00380b7f143d81df224d5bb412dec9b5eb6002b5213518e295ae8256b2
- MD5 3fcf2af2ac606196af5b362f6b9c9470
- SHA1 6f17c685b886f98141d10d1c8190bbf8db232b71
- SHA512 69da96f6bcaa5685dfe372ba461d015be428deddc6a687415c90a0d12c125e6b0cca514bc9518f9d2c44886eca43f9f2624e07204757dbc6ec907dc657675335
- SSDEEP 98304:/XQ27zNwptqCK5M8twgfM+P9hKBswndb1GXJij:L7zEwPP90XdQi
- TLSH
  T1E8868B03F39A40D9D04DE2B8C7579626FA35B8850724B6CF279413292F67BE0EB7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  locales/mr.pak
- Size 1.2MB
- SHA256 0eae188c9a81bd3257a21dc28448b5e9e5c3f4f4de4dc8e178e7f13cab06d6f7
- MD5 b7fd0eb57e0a1266990bdd0b405675b2
- SHA1 74becbfb683508912e703f31c650cb29057f1f74
- SHA512 e6fb9760d62051f1185b060e8288c56b95e3e8d701767d8645ee9cd464993b76c78aff365f401a56e391d63857307827d716ba026bb5e4712444b09b0ddeea4b
- SSDEEP 3072:rMfCBVYlp+n/4xasCPLmFZfr1iuJvm89/njU6TkeInVEwFEyGRg3R5QodgEPYyla:Q6DYL+CZTYgKZOa3Vq9X5km/Iwp
- TLSH
  T10345C24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/db-lib/build/Release/better_sqlite3.node
- Size 1.6MB
- SHA256 7729639f31ccecdc88f6b0d42cd1014cdc44c087433269514633cafe48762fd3
- MD5 cd0318eeeff8fea4e4c3dcf362004488
- SHA1 d7bc1067b008b66982c66b2ec9c182a9387dc90a
- SHA512 21ba591bec0905603239b01fb2993cf80934457c39ebaca089cb8810c9c223ccad88c38fbc49f3ca936a208f35619708eb06bf56d9729e6476841864b9e241c0
- SSDEEP 24576:MzQcHBikIP1mAf9/nN/KW5d/TlTO+vMKW2c86ljqhA4wlnOdhien3RpUxNac:MzQMIP7f75dblQKW2cnlX4+nsBL
- TLSH
  T1B9858D47B2B900FCD46BC174861B660BE7B2740513749BEF56908AAA6F33FE1167E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/db-lib/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
- MD5 722c2b2dbeee143a14c7ba04edf8e3f7
- SHA1 88321c5c15ed00c72570b28e8183b2440bbf6419
- SHA512 0537a881c397d0bb0836ff74a881d650d59fc151f0e4ccb1c4f5a9fe84549dc9753b886b3e14534c551c167ff702fae71b58fe4fe90c78b43ef05a4cb2761855
- TLSH
  T11C115CCF4B4A2678E3F2B7C1EE21E94E046442E47A5A0824C0CC1DC139AB15A78C6DB6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/db-lib/deps/download.sh
- Size 3KB
- SHA256 5de8af6e9f41fc1b5f6d280cdc55d62c2a210faf722c7e529b6b3427be7c80a8
- MD5 cf1d12194f2ffaadb8152502571c19a1
- SHA1 68777900b2d533d72ae32ede40862a0db8196791
- SHA512 8b20362f71c1ead34bb448d9acf31ccade3ead4c3fab326e7abc4617c0abb1a56a36eecc3218ad87e43af8289c8bf0280469c0e59dd1d0f6d5cc3246a6a1730c
- TLSH
  T1118160F7A789067D24C70069A12D62CABA23C32F8B7478485089566C0530AE45FBACFF
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution antivm
- Executes dropped EXE
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/db-lib/lib/database.js
- Size 4KB
- SHA256 50fe0b490f29174d961c4d1ae54f22973447ff1255fd710e785d201c0ebfb4d0
- MD5 633100cb9dec3e4ae1c672c0b494fbfb
- SHA1 185d7fd4070157aa1eb4ad0fc53c362ae649030e
- SHA512 1ef6d19f98b38ac368ddeefa58d8f8a8e064e6402dd95d9b6e3b7a847c41cbd0f46dbb72646d27d01eb7b7f3200419c7ef8003b9ff53c9bfca76a71d22423a7c
- SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrhxtjFvcLd3s03Mb:ac1ZFjQBG1oQZi9qSvBBkLveomRz
- TLSH
  T1E9817384DBF5641247EB30D4A674A48D6234D27971AD08E0C8CBC3F531E50C9BBE3B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/db-lib/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
- MD5 26660b3078523a953ee252b4e86e1c8b
- SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
- SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
- TLSH
  T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/db-lib/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
- MD5 25fdd950809b2b22d0ba6917fe014c35
- SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
- SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
- TLSH
  T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/db-lib/lib/methods/backup.js
- Size 2KB
- SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
- MD5 69638dc10c19961a0c05350ae333d6a4
- SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
- SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
- TLSH
  T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/db-lib/lib/methods/function.js
- Size 1KB
- SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
- MD5 1036ce624efbb9fbbb387fec25fd1bcb
- SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
- SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
- TLSH
  T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32