85216220e30eab9f3afbe6c468f75d40322af1fe8b680d6a92c5aae65f84c982

Sharing

Copy URL Twitter E-mail

General

Target
Notoq-Game-Center-Setup.exe
Size 104.8MB
Sample260720-xd4pmab13q
SHA256 85216220e30eab9f3afbe6c468f75d40322af1fe8b680d6a92c5aae65f84c982
MD5 85fbb0b7819c4dfb2dfca0c385ad3e98
SHA1 dd5fa6d417044723f38e8f9cd1d8b2728e126f21
SHA512 74e56ac64744e7a33b34abc35318b5657b09b4a069241417f82a9a7343e18a444b62215337cb53beac3104fbe164aa43df94a82bd1c705dfbf397689fb508757
SSDEEP 3145728:xWXCiwyyXYSqKOD/3GW+qAyEAFUz7BnR77m:bHaSqBfGWbDXw7/7m
TLSH
T175383359CAB65A5AEDFCFBF9200AF83EC5157FA126F24013859E1D1BDCE9F080384466
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Notoq-Game-Center-Setup.exe
- Size 104.8MB
- SHA256 85216220e30eab9f3afbe6c468f75d40322af1fe8b680d6a92c5aae65f84c982
- MD5 85fbb0b7819c4dfb2dfca0c385ad3e98
- SHA1 dd5fa6d417044723f38e8f9cd1d8b2728e126f21
- SHA512 74e56ac64744e7a33b34abc35318b5657b09b4a069241417f82a9a7343e18a444b62215337cb53beac3104fbe164aa43df94a82bd1c705dfbf397689fb508757
- SSDEEP 3145728:xWXCiwyyXYSqKOD/3GW+qAyEAFUz7BnR77m:bHaSqBfGWbDXw7/7m
- TLSH
  T175383359CAB65A5AEDFCFBF9200AF83EC5157FA126F24013859E1D1BDCE9F080384466
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence pyinstaller spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Notoq Game Center.exe
- Size 221.5MB
- SHA256 0a5cf3d18ed7598484b486058e5ea622c11f42c699360781e28a6889a6b52ce3
- MD5 a80d0b7cfece4bf3b69c40af684d46ea
- SHA1 fd874e3d11de89acf34190d5a6f855d119e5c415
- SHA512 574ddcbcb25b6f5d203d2bad533e7bfde0c3e08466d898c17f6264c8acc4a09f3955e20b5944ef05193e74ac53d62a612ae7a08105eb18c0d86e493025b2b207
- SSDEEP 1572864:86s3R+1OrrQQrHzz/HNBnhOuKb3aynBZS+OdF9/f1FlKVROhJA0lf9MQyRUHuJTQ:jn1Ofrv5GttDl66w/
- TLSH
  T11AB88B03F29A41E9C01DC1799B5B9633FE71B8454B24A7DF2B5407922F66EE82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 f0eecdc9bd3bd048b888b19c1be803867dc5592e9b0745914ef48781a3956d32
- MD5 216959e543bffdc463bdf22504e2558c
- SHA1 4cd5407f4f09be3b01def31ce829e165bf7b463b
- SHA512 d733b224a3c79090e50b093162756d768c8c9de798fdd22e7e9a78ba69f97aedda9f048ea45d79a5bf58fb9169f4a486a4e0596a15993fb42fde5a4a1f91cc39
- SSDEEP 196608:zKkG+l2tvb3nmgD131GYN7aPtAH+R4gQiUiV1gFould/5YmO0r:z5G+lkvb3nV1GYIP+H1gQoV1Ioul3Yl
- TLSH
  T1B7473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 80d1ff5d7689071edae78164eacf92e4924689936d8cd818340377318b0a5da6
- MD5 aaf703b6b18fb9aaedc7f9096728a241
- SHA1 84e6437212b30f4be80d48a7e8576527306a5459
- SHA512 ee4701f80b8d3a125f894effc92832d5dcd2cc56cf015afd60606a5ba28d3a7b9817f907b8c9c4c40cf81740c79cb65adb8e1d58b76e88febe4931eddd043c78
- SSDEEP 49152:Rkg42lel5GuCT7w5LHBXz81IQbx6i1N2SByUSo8hqaLujbLDQdQcLNZ:RWlEuSwRHB/aaLujPm
- TLSH
  T1D3E59E02F6D251EDD029C03497ABE213F271780A4F205AEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libEGL.dll
- Size 467KB
- SHA256 380900fd2c24f14d602e5bf6d43c86f9c69362ac911d44f9609971a62735dbd7
- MD5 28bf6bd56c12532526fbb1c914c0e1b5
- SHA1 38f2c595d271a1d6281c5f49ff6aa7c3ec5f58bd
- SHA512 a9518d1207b03b416428705034d88e8e831b2aab1405dfe128ae49e86d32cb8f7d34c896909f9d24b3073eb9d5c64f10c76d595dfb69f860dde953784a331ca4
- SSDEEP 12288:w6/vCrog5QZ9yJNe8DcQir3YB9ANZMBg:w6/vCrovjLA94Mm
- TLSH
  T1A6A48D15B3E948A9E07BC1388A538643EB75B4520B61F6DF02A0D2793F77BE45A7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 d6a0d6700956b66e4b0d75f6cc102a9e0dfd7d923c5fba1ab227aa3cb0ba3b0b
- MD5 e62d384a041358e5c15183e1663f2c65
- SHA1 6395e53b2d148c902c4efc757b365cbbfdadab64
- SHA512 b51f18eaeee4ba49fe27dab5f075e946839974351fb5caea237f4f7a28e7bb7f95c826fcd87decf315171473d19d49530ebdc5166d64b9e078e31261c84561bd
- SSDEEP 49152:WZLjoLYM0JCVIM5OImUoJbmQO+76qJ6AJKibKnTaUueVYAO6a/wBWUx0IXvJ/k8m:gsLYR7J19mO6c8LSPkOSR6hLpsH8s
- TLSH
  T1C8867B03F69681D9C05DD2B88B57A223FA74B8450724B6CF2BA447152F6ABF0EB3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/default_app.asar
- Size 108KB
- SHA256 06d4a28be095a80eff94dbd18edcfac5b5805e1b5538e0fb7cee7c7ae81db76a
- MD5 b77337fb8603878f51166531d417cc81
- SHA1 7633d1649735b8a3b223ff4a31940b3ac9ac4799
- SHA512 85a307d774ddfb658956263919ed12cbdf64f4e6d8db7222fb827548c5345427193bfe273aa30ad537ad0b4ea40c1c66e88fa3f6d6fe4a81caf9c871dd2560b9
- SSDEEP 3072:ZWHxvTvFRWrjXxs8xbKNkCeF1SBRbFdPQrZsH0L5uRD:ZWHd5R4XxRYmS7orZsH0L8
- TLSH
  T1B6B3E19112F60231D86B4AFE9FAF16267A39241732CDD0C4722D87609FE15D6A5E3BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 ae7e65a4462a2f8fdfcfa7444259a8d2625ebd3bd75c170128025fa70e1ca037
- MD5 8834d95b94614dcbe837163a447b08c0
- SHA1 44e34ac3c70f66f922aa80feb64f166742930688
- SHA512 43db036181849cbbd58a1a1e5b2afa22281ced906cfd1c9794fe83eab0b1ec260c5bdb907412e4a232c4cb7b9b1779ae6e38076b4d089a61acc0e20b2544a490
- SSDEEP 49152:pvMQibTIlI/EyGhcIDlpcSJ13DFDUgcD2Qn9agdGgkkDCqBK2WgPM+2HryKAoxw:pvMQCkgUrr+2yso8FX1+
- TLSH
  T11D464903F68681D9C06DD6798B5FA623F672F8800B2276DF56A00F192E65FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  vulkan-1.dll
- Size 904KB
- SHA256 ef8b7e499fc34f5057c498702694de37fa87289ea3d866717fd1c001d955883f
- MD5 1e5544ce431425eca51f0bb4e940da57
- SHA1 0fafac1cb6a72bc021fc7d8fb877fde8407efadc
- SHA512 2270a3400a9eddc07eead69e6e6a056fc2190e162d0e26fccf97a616fb5e116db7c88f5c9be3c6819519d223233944f2589948300a58313f621dd3c71146ecd9
- SSDEEP 24576:SGq7F7pknIiAXUMKzUjvg6Z5WzcxDYsHkDE6g3P0zAk76oOH0Y8:5GF9kIiZAjvg6Z5WzcxDYsHkDE6g3P0r
- TLSH
  T136157D23DA548B69D67AC074D8D18A0789F074851322BACF07B817147F6AFF42B7DB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32