686d6def5b1e62225848b7df62849028f7f9176e0638e97a9b418d4639d55f4a

Sharing

Copy URL Twitter E-mail

General

Target
Ledger.exe
Size 151.8MB
Sample260720-yf6gnsdv8j
SHA256 686d6def5b1e62225848b7df62849028f7f9176e0638e97a9b418d4639d55f4a
MD5 5667ed40a2ff1d48d4294a1985e4de98
SHA1 c81a7e94f9f7bb90fbb4269b9662e7e66a118710
SHA512 115e632bd55ca084a0bbc3a564d216c45360275c4039fcc754b3613ad8951ef5acfd6365daa0e3952f29f9371a0cad70818fc6025036d393af989b7a12da4311
SSDEEP 3145728:OY2YZrQMg/7otLuT270Wb7FT/g7ZzCCRjBcuFK4aklxsjKbZOIv/o0mad6:kYuM246C70Wb7VgZR1xFTzA0mG6
TLSH
T16878331BD2F9D680F57B2E77EB2F7F74D14270A10218B986AE68150DB2B7D518832363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Ledger.exe
- Size 151.8MB
- SHA256 686d6def5b1e62225848b7df62849028f7f9176e0638e97a9b418d4639d55f4a
- MD5 5667ed40a2ff1d48d4294a1985e4de98
- SHA1 c81a7e94f9f7bb90fbb4269b9662e7e66a118710
- SHA512 115e632bd55ca084a0bbc3a564d216c45360275c4039fcc754b3613ad8951ef5acfd6365daa0e3952f29f9371a0cad70818fc6025036d393af989b7a12da4311
- SSDEEP 3145728:OY2YZrQMg/7otLuT270Wb7FT/g7ZzCCRjBcuFK4aklxsjKbZOIv/o0mad6:kYuM246C70Wb7VgZR1xFTzA0mG6
- TLSH
  T16878331BD2F9D680F57B2E77EB2F7F74D14270A10218B986AE68150DB2B7D518832363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  LICENSES.chromium.html
- Size 15.2MB
- SHA256 850f3ba4ecf28b8710e3b0a5255b2660df7b635302dfefbab02111eb88f9c4db
- MD5 ebf5480f681977d018fd188c9da2bdeb
- SHA1 7bdbbf1386f4741556c5a96ec3f53a63050b68fb
- SHA512 822b6e12d4c0d96409dc14d26e104e9e0ecdeca4d78e15f004a7cfd0190009ec21ab143edda037b1660b316b4f61bfd699a9fa38e64fcbba9c032cfe8597ed7e
- SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+U3r8xd2zJQf8xF6DNgQdGxw:w
- TLSH
  T1D9F6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral6
- Target
  Ledger Wallet.exe
- Size 203.8MB
- SHA256 5b01ed9cc3276f13e413989b3688a8e89fbb7e18b75e42f6ff353b8f3536911b
- MD5 dd880ddf53c4226c7dc58804c22ddf34
- SHA1 3b9cbf90c76ad0bfbac3d3f01a4a708d2d02c826
- SHA512 5913e72e03d0cd023d91b067603764fe0995a9f9c84a6a2642ba8986bf1bb1282406105c535d17bf801e06c94cc7b3cb6763b587d80c4fd5526e3ad0b6f7e98e
- SSDEEP 1572864:9MJjIlzI9kho1fxxXujtX++c3tg8xSHqyPjrpt4chiEj8HNXXZxLuVUKiec7DVNX:taAN++fUHTeTXe
- TLSH
  T168A87C03E29A41D9C05DD179575AA233FEB1B8054B24B7DF2BA407522F76EE82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral7
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 c9fad88ebb750723e6bd13d2d2eee6706ac97d4edced1f3e3e070d7c0c3b3e4e
- MD5 560911f421b9a3436d286df2a81b6dab
- SHA1 c7eb0805c30e6d16aaba73070d10cbc67c1f324c
- SHA512 3e563b5c57d12376ae58ff951d84e868b2c86cb897b55b2516e57efdc1185ff9e7f9ded0c701045f9d9eb0ec5983130ae6cb9e7a30a8018101dc6ecfbd2794ab
- SSDEEP 393216:/7jIPs+XwoZins+Ubobb9EfNxMM81GD6sT8:H+XtinF92skj
- TLSH
  T1624729122646D49DC059C879C7678B268A6C30E73FA7B8EBC0F451252B79EFC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 5957ae05e9811e24fb31bb6a57bd19935815ef4a831dcfdbfb0946fc0116a8ab
- MD5 29540e3d75ef535ed50029b37fbf6b00
- SHA1 40e54fc8c3bc164ce3bb073f10c77faf1da5f499
- SHA512 92f1541af81758f908b3c0df2322ed784877f6dbfa580bc45d7f0926286959a3c6ac38d676afcd52616faa67c1c7c640abd23106587b8c68b891b6f84ec663d6
- SSDEEP 49152:kZhLm66AU9qQWU+Q6hMOxmSzrFm199aNLKIbs7k65enE0NoJPX8VnNqmCc:kZhLm6iT6iOQKrFcINoJoo
- TLSH
  T14AE5AD02F6D651EDD019C034979B9213F631780A4F209AEB17905A223F6BFD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 495KB
- SHA256 b7583fd3f419c367ef2165e42fcf868baa4ed2cdf3aaaa3aeb4064e0eaa54842
- MD5 dc084c8f508d8503b2c266391ec4ce95
- SHA1 8760b6f6f882a71b24d7924fe1fe4661bc8261ea
- SHA512 487cb85cd10d9d932b4f5a7c30b84174b43a91574d77a634b58a3aae14a4ff9f80509ea760ca912fae814be7e8a8bc64b890e0a25eb5a0c83e4d2c8c7b68a3a0
- SSDEEP 6144:EDVG8Fusbk09QEZLyAg/uL/hm0afqlNaU7O2POtjY1cUd1SWMmzAvAbWI2:Q69E1pTxNaUBOtjY1cUd1OmzQC
- TLSH
  T133B48D15F3E846A8E03AD0388A538643DB7578560B65FADF02E052393F7BBF45A79324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 c56fbb84f73b7630f8ab8831056d660a46b945e495378efec078153b446b6b8c
- MD5 34d6bb1622bfdc40808f36a7f20728d9
- SHA1 39ee22a77f37a13b02602326dc0154c011228f0c
- SHA512 a166547348a38065c39020798158ceff628200662bb0c444ba7db51454a4a299faf34fc9c85a8752ab6cf403faf67cd203de383dafbdc9c3c49cf6e98948a510
- SSDEEP 98304:NmMuSQ4Lu9iy+rm+6QCoAqqDCyyxQCWNAU7zAf:QMuviy+rf3yyqpM
- TLSH
  T111867B03F69641D9C05CE274975BA227FB34B8450724B7CF2A9453262F6AFE0EB3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 6562324157ed32977e9f0f2227be04a2a8fb19a4946fee21e09a164ddc48310d
- MD5 3c0a4d3f9a21a3428c59568a231dcea1
- SHA1 12602dddb8025e65cc57800f5d19cf9ec7519f7d
- SHA512 4c10fd9e09055f9dae8ae0ecd55c792b8348725dc55c93bd0a03aad050363d78fe0beec9d53c3f74da037eddb40c6b1947147aeeb031de657b01e91209be9abb
- SSDEEP 49152:TB8gL+1wzrBezYzIVUUHZYj3P7jo8dSCeJT9ztiPAjgPQVvCvbUHEZ1NkgcUYQlj:TB8wzJSiIjjVDHzkmwLvLIC3si
- TLSH
  T1D4463803F28681E9C06DE579875BA633F631F8850B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  vulkan-1.dll
- Size 929KB
- SHA256 72c87bd982744c34d1caf5c0ecb58603831a28e32ac85638a1723f8467f6c7eb
- MD5 2bc986dbe76067a56b1279eb15437cd9
- SHA1 61078fe847ccf0c59c1340036321636b01e288e0
- SHA512 2267fee0698fec70031663914f6b1b4d5b7751c7f0907df16277a88a602aa4d852b3382981e74d12255f09a925c09efecf3773c85f463797bdb8cf0b3bf5250d
- SSDEEP 24576:4UOXU/JwV/1cJpXWEko96Z5WGcXDYsHQDJ6g3P0zAk79oOHrQMM7s:ROXU/JGNcrGEko96Z5WGcXDYsHQDJ6gr
- TLSH
  T166156C139A544669D976D034CDD28B078AB174822326B9CF02A817047F6FFF47B7DB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  $R0/Uninstall Ledger Wallet.exe
- Size 169KB
- SHA256 e11010437329cba988154556e9fceae27f3ff9c3b6eba80e295c971468683380
- MD5 80900225d168bb14f8ce9a23086b9774
- SHA1 57d5108118d9d4bdcd3dbc2c93f5cda5ca153e98
- SHA512 a03274c15b986fba13e25606a4b97a2a6c4698524c48a39d69504dd653dc9a41a0679e5ba17b9b8f44601b6d98713951fec3f6bdbb0254bb3edeea2e7e0b372b
- SSDEEP 3072:an77v00hEoDEtauwMQgff/xxDvlIOAEjYaHfMNUaq2tvhOEA1RJCir86SrSrvrR9:a740IjfffloeSUaq2t0EyL+2iar
- TLSH
  T1FA040114B391C167E5B38FB246B997D71EBAB12460384F477F80376E38A6691DE2E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral21
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Reads ssh keys stored on the system

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28