e9b9ab9bcef3b7ac020869c8cf0dc963774ead097daf39013742c9cae94b438a

Sharing

Copy URL Twitter E-mail

General

Target
40289796840eaf6c01851528dc680082.zip
Size 17.6MB
Sample260722-eqdpvsad82
SHA256 e9b9ab9bcef3b7ac020869c8cf0dc963774ead097daf39013742c9cae94b438a
MD5 221a8586004f1164943139a032707454
SHA1 0bece10ff550175def7f6298df878c639df9c7c1
SHA512 711ed98c6b00ae7bce88a36e44d7698792e6b26644a637f898ecc6564398cf5950f1d0e45bd726ab39f424fb5d917e1696a48dc4483a42076e4994e806e92348
SSDEEP 393216:l7v+tNItoE2URWFQLcpsAk3uglR/Fup7vyy+8FE6MMcctlqnTHVr:xCUyQLohkF/iY8zMQSTHZ
TLSH
T1FE0733766BA31E11A650F4DF9759666B330FAFD38AAC221ED5C8E979B0DD0709C30C48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  TDCCsecure.20220428.exe
- Size 17.6MB
- SHA256 a6325c25bfe6df068eede517e14c284ac1497fa52ac22e172e8ae7f463f31fcd
- MD5 c56f286034d3c5b1957461556f704bb8
- SHA1 da01c6b790694d244e60fa2c315022aafe6bc938
- SHA512 715c7bdedd75429e0e7b24f89a99c7c9399c2783927d6799f52ee1344067d302075eb5aca303d7bde8b5455eca6646878a8d660cd079167aca9a46d9b465e775
- SSDEEP 393216:dx9xQtduXGmWORWFGdwtoCa1uwRjvx6JBd+IuK/uwwM0uh7sRTjz5:dr2OuGdUhaRvUkK5wwqTj9
- TLSH
  T1EB17337667A34E12E250F4BE575AA66B330FEFD3499C221F96C8DA79B0D91709C30C48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 22KB
- SHA256 096a5eea11e75217c87570930bc0617dffcb93bc99b74c764a88adb2ac0ac1db
- MD5 a8b5c9a71245582dc17aaaf962f40082
- SHA1 336f3a85d4b23e2207ededb44c292d74997466ad
- SHA512 69730c43143c015e121b88ce8fcb9f49dff6916e99117c0a6ab3a86a91d08b0e8b0055c5b63669f9d488c44684ec03be2e1ac808e9e6a23f2cf05b5a401a8766
- SSDEEP 384:EaC43tPegZ3eBaRwCPOYY7nNYXCg/YosarRKChAHThnN:ETTgZ3eBTCmrnNAoYyThN
- TLSH
  T1DBA26A513BD028B3EA876D3539E1E7138FB4F752A482CD4BC6361E416E86B922E7C315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 107KB
- SHA256 8ae2b995ade6b752903adbc798ec4f2414d4ae0db59cf694e91fa74ae3a412ce
- MD5 f6a5e3307adfc5f8ea245c31eed13a7f
- SHA1 9361d4171209c69ce179e746e6066352a20126de
- SHA512 d5a26cbddc9ba81f3cbde97da866c4ee716b439a7c5a8dc7f4946167c32eccb8c6bce03cbc61d5a299311293c3d8cdbede98c0c1f24beccbe167f94356273e03
- SSDEEP 1536:oyy+wx2YAlWrU5OX9crt5c4DBqiC7hk333kbQk:Ty+wojIwgNcr1a7WH0b
- TLSH
  T178B33B527174349EE5E64B7C136E2373847E1778AB28A4DB036249CDC3762F1A0F9B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 18KB
- SHA256 e2cf2b8202cb1593f1fd0b848ccb763e836f7f2209cd9b0b0540d630fd11274c
- MD5 da7091e7a3ab298aedc60d9f9dbc44d0
- SHA1 2c244dcdcbb98d8a7df0f700a77efe004c167f33
- SHA512 34775b116a0fe92d6172dc307cbcc581deed0b0b0f336faf5c0ebf1abc709c243e233ae6e2a0e621482db1803d4a2b78597c0ff28914c0119ba598b9f5995837
- SSDEEP 384:g8+Qlt70Fj/lQRY/9VjjfL3RKChAY2hBw:gSqFjm6HLhkhC
- TLSH
  T10F826C52876008F2F9829C3431E4EF27AF7976C867E484E39BEA81905F817D7256D14B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 10KB
- SHA256 2bf3e02abbf3558a83b3d529c0f97093d317c56254b6711fd5213d0f0cf7a60e
- MD5 82553ff92e95c587d15005d186820589
- SHA1 f0f85db83e4dc192e5a9458c2bfa836569d267ca
- SHA512 8672952d36b76b93b96c7289a13c0f90dd8dc7e745778a8ccce5cce3c35d33b1e1d0c91745d8db61444fb3bf77572f1bed555a30ef2707a5b4da6a73d0637979
- SSDEEP 96:5SkFZruHSXTH6jkRnGr7X7gUkm6ybK7mTwsAuCZfaxtU7f9P7C3JUfhdyEi7ZHeO:ImTH+klM7xR6t7mCax29mBZHlsDC
- TLSH
  T118321AB68B602C53ED878E3230D4C9239D75B6D0779584DB912EC2905FC1BA376BD12D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 13KB
- SHA256 560036b94ea238bc3bd551fa5b6278587f0bfb191770d88a7b1e519599ee0223
- MD5 a7ac3bbececd6bf18e00f67f141f2704
- SHA1 e55a53693ed8c5a3eb819a2b9e74083759f3dcc5
- SHA512 a4a3fcf65d3661dc7ba43c85a848fb0e9f1feb2b2c41da2590a22f9f7060deb45d45106e66dc3b8d5f7fd303b3e0d53f865cb174955d439f5e622bee6eabc44f
- SSDEEP 192:J7jRrlfA6Nv6eWIElNurnNQZGdHcjUR6t7mCaxmTnBZHlzQ:BRr269fZeurnNQZGdHdRKChQlhW
- TLSH
  T10A524D754A802C93E98B8C303498D917DFB4669167A984E3957FC1906FC2BE3F62C25A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $TEMP/vc2015_redist.x86.exe
- Size 13.1MB
- SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
- MD5 1a15e6606bac9647e7ad3caa543377cf
- SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
- SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
- SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
- TLSH
  T189D63336A3648126C5E30573EE15E1206F687329BB1488FBD3447E1D3E69587A3BB34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  $_10_/certutil.exe
- Size 107KB
- SHA256 b3f3e28a4e9b5f751268170fae99c12bff471fe683178bbe6b0c4f05374b0660
- MD5 e8ced36b63ee0a43d4302c749bf06517
- SHA1 84fc3c1aa60f42ef5913635ae137c4c5f5ac0d81
- SHA512 ec1b8de5f07b47fbade20b1d9294c84fdd2548a2dcb4d2142e9ebce16e67308499c410b52e68e4100ada4ce8fea931fc4e7310c47379121614369c9ddabce93a
- SSDEEP 3072:e6t2WKOxRTftkVeSl8w5d3wgtRgc7k8wXC:0WKOzTlkVzl8w8yRDA8wy
- TLSH
  T194B36B01B6C8A4F1F989133B12A15B336D7AB83D27165CC7BB94AED195427E1E03E34E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $_10_/freebl3.dll
- Size 223KB
- SHA256 7aa61e4265e2180d39ae305c0fdb3626346533db94bec4fb9c192b28037d3d50
- MD5 3f8680a26b0b1b2587eb530f74700a6d
- SHA1 2d5e25017358ebb0650013121517d56a49ddf0a7
- SHA512 d47b314101467b73daec8e7c4241432217b9441313e7630a7d3dc75e7a23dc8f0885778d228775c9fc95852384030eb1a35d073432139698ee090cb8b49027df
- SSDEEP 6144:mcTE2XtnPcWNo4eT4hs8LP71DRIUqqDL67PXGHrIrH1:JTE2XtNrLP71Dyxqn6jIy
- TLSH
  T1E4244A82FA9B4175DAC7F9753196F37B2E38D75A232095C38BD40F93496A2C4863438B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $_10_/libnspr4.dll
- Size 201KB
- SHA256 15a25c02df447ba7892569224d4a7d0b93ac1316be9057f3f2e80ba758eb3b27
- MD5 6c9799694df0134ebbb6a42c892891a3
- SHA1 f63f9397893243182b2d819776fecd1bed55988e
- SHA512 56c21bb81081a9753794a44f66b8274fe6470cfe1d0c83dfb3acb8415bd4fa3e15f1c738887147815919e450ccdcf43be726bcd8f45249fcefb7c09656efb57e
- SSDEEP 3072:NzcwXcVnDhH5YI6KkEK7207EmrRelzafK+AnF4xH6dVHwpXpE92jDBSRYO6s0eEo:ZUDF5YTyBJuF6DHwpXpfSRYO6Z4
- TLSH
  T137148D44B64010FAF49B82BA19BF133B7A309764435187C3CBB46DB91B751F1AE361AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $_10_/libplc4.dll
- Size 20KB
- SHA256 f90a58f5055e9f394919b4fdd0c6fcd027f25f13c327265e4a6820d05c595266
- MD5 d5935f4f0093505d00899b92abbff9c3
- SHA1 e7e8a8dcf58c3710524da87139714fca124e04cf
- SHA512 89a4d5aa8babb30cb5a3daf2e213642ed8b472ceb7f8c682145093726f406efe71283466502bebec1daaf2d06f5be278086e393f057e0395badda0d2ad053e4a
- SSDEEP 384:kRUyZoVwAFzusie6wcZxrPVlpHS6c+5nYPL9RKChwsuA:kjZEwAFzNie6wCrdn5c+5GqA
- TLSH
  T19B924C4B172D50B3DEC78A7712AEE32ADE39B340EBE424C355615BA01CA57E06F3A14D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $_10_/libplds4.dll
- Size 18KB
- SHA256 30e857771b02fd241a332ea4d0bff34c423a25e1c3a84af13d687b04e1886d9b
- MD5 deae40532b618c8a9416f538a254046a
- SHA1 c8c5800849d11d7bbae80c82cdefd76cc98244a5
- SHA512 c3f8f294e2f79648b32a03bc2d8f965f4baba680d09428dc1eee501b9c327fc33d77049565bbb4d9b389770b7b326c7c15a3da1a5450b533785261771ff317a4
- SSDEEP 384:O/uHE6Yr/Y+h0AlU4prPVlZlFfPwnYPL9RKChwaJjq:OiYrw+qALrdnTnwGJJjq
- TLSH
  T1C1824B872B25A0B3FECB897532E8D2665D3A7750A7915CDBA1B783401D40BE17E3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $_10_/msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH
  T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $_10_/nss3.dll
- Size 786KB
- SHA256 275f078f495152a87d4e255b6fffa8278cb4669a8f1047c84a7767db9d5b50ab
- MD5 091233e74dca8f48954a470d452089a9
- SHA1 e271d4553fc2689ae5b0ef0a018f8e54416c62e3
- SHA512 e2503a2a9553194ce9f660a098449061d406a4a5bbfb102a6b3040a49e20beb4f303752344a83e7c91432b7f9d95088a5d15872d6f5fcf712d3aa2440d98c60d
- SSDEEP 24576:FN/cDx/LcwkjTGAq8f54Y6ifuGJk3c8IXRvg/W68IALE/ZcaFL4FzS17BAw6:jci+m9LEazS1c
- TLSH
  T10D052A12E28691F3FB2914386165EB3B0E624B29F3269FC3D7503EA5C8435C6693D25F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $_10_/nssckbi.dll
- Size 367KB
- SHA256 997636802a7c5866759672fbdc09a48d200ad63bc82e901c6f5e03d5463f1d3d
- MD5 2572d7c3cd54019809a67069db949d96
- SHA1 2e7c83beee7a73e9e2a92ac3e4888231af04de6f
- SHA512 950b5ebbf469ebe7f38b8f06576a54f33b77fe5231019d3d5bcf8660a53a83a73901d4184a7488d1d5c1eba4e9151fc504504ee036e7aa752947a6a0e6828c09
- SSDEEP 6144:YeP90QTcdMTWfpUwFygo5zUM38ME/Hs3nXHkUXUy:YA/TcWTWfpf0gmzY03nXHkUXUy
- TLSH
  T12C8406A69B262D91EECD7D74F185D3623E36BA91F30681976B6084D1EDC2FE12F1400E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $_10_/nssdbm3.dll
- Size 112KB
- SHA256 24417db1170a995d4e2ac7b80e58b52653f237b6cbf0a1ce376e42adf66744d1
- MD5 cce22c96c511100ff4eed9f339895629
- SHA1 6d3408020dfd38d94045a583cc2671f396680153
- SHA512 dfac21a69824c300dc512dfdb89bf3e83fa1b7cdf295baf2ad4503f4b6c2f25cfa80cf18c3ea6393d2124f9980733a44676caf316c265adefc96c7b0677a2253
- SSDEEP 3072:uS2ipxnUGhrFxZHkZvmYHG+iI2iV6nu+ZfX6AKVqzzF+FD:uS2ipxUSwv/m+1rAKVqz5GD
- TLSH
  T134B36B95F747D0B2E9D5587D21B6873B2E3B9310A31389D3DB611EA0AD201D29E3E38D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32