General

  • Target
    SoftHub.zip
  • Size 43.8MB
  • Sample260721-ntldjset6k
  • SHA256 383c829e2265c1edb540d78d47d700774dcf6fe260e4ba719d96832d559a37c2
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      SoftHub/LICENSE
    • Size 33KB
    • SHA256 76a97c878c9c7a8321bb395c2b44d3fe2f8d81314d219b20138ed0e2dddd5182
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      SoftHub/SoftHub.exe
    • Size 93.3MB
    • SHA256 430b7b1a40143e04e84378b7d14936c6ae6dedd33fac2cad461d9b98b42ca2e7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Target
      SoftHub/data/project.xml
    • Size 220KB
    • SHA256 8913b73cf7aa15f23df46cfca50783c9bbb41cf87377e7269d4f3e61ce97124b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      SoftHub/data/remote_settings.ini
    • Size 20B
    • SHA256 78efb7d5f66cce1c0de86a764bc48450b929df61849280b861fb0db2128b2a37
    • MD5 SHA1 SHA512
    Score
    1/10
    • Target
      SoftHub/libGLESV2.dll
    • Size 1.5MB
    • SHA256 9ad0710c53a7da8dd856a8b6a2e0a1830fd0b58d6dd3ff7e0c17dad6c25d62b0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      SoftHub/msvcp120.dll
    • Size 437KB
    • SHA256 f622711bb30102655d34b5a26eb082e77906648a8af26e64f3a9b8a272ff61a2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      SoftHub/msvcr120.dll
    • Size 941KB
    • SHA256 8e183b2ab71e73c485cda6c21c489f3e0efba4b0a2226961e28f3f7bc276a463
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      SoftHub/opengl32sw.dll
    • Size 14.5MB
    • SHA256 deda544ec525a575d1197c4c66323d5f65a0250ed3140a40904c91214816f832
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      SoftHub/sdHookpp.64.dll
    • Size 3.1MB
    • SHA256 ecc31fb4371a842caad6cf1fca700af6f3c6a3fd72a56258a7fd5f46da114519
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    • Suspicious use of NtCreateUserProcessOtherParentProcess

MITRE ATT&CK Enterprise v16

Tasks