9655e56ad9a55b533a0bae9f84f9c8893fe62fe488dab7f25d5ec4a8b2f6a98a

Sharing

Copy URL Twitter E-mail

General

Target
Emiware Setup 1.0.0.exe
Size 100.2MB
Sample260722-etd5ssvxgs
SHA256 9655e56ad9a55b533a0bae9f84f9c8893fe62fe488dab7f25d5ec4a8b2f6a98a
MD5 b421191cfabfa39cec93f25a413bece5
SHA1 bb234d8431389c4ce6d871683cd3cb41aae594bd
SHA512 581c50c54bb36ac8c3efd8b363214b59af284b3e755f11e6e86b6293fe9bb37ec9188a3de2526be00ce02f9d6977ddc61b320cfca9c0466dde63294b64e7c1e5
SSDEEP 1572864:1bu/U1RESsuvvizZrXY6q6tJ3Mtx6xzCAAq63b1+ga+24UOIOxXZNnuxXHXQj4DS:1bqkvSpqEaMC3kgRMANkHXUHrRD
TLSH
T1A938335B92C3E3F5CC2B8A30D7269D5DFA009797D3A49F661721D09DA9781E20201FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Emiware Setup 1.0.0.exe
- Size 100.2MB
- SHA256 9655e56ad9a55b533a0bae9f84f9c8893fe62fe488dab7f25d5ec4a8b2f6a98a
- MD5 b421191cfabfa39cec93f25a413bece5
- SHA1 bb234d8431389c4ce6d871683cd3cb41aae594bd
- SHA512 581c50c54bb36ac8c3efd8b363214b59af284b3e755f11e6e86b6293fe9bb37ec9188a3de2526be00ce02f9d6977ddc61b320cfca9c0466dde63294b64e7c1e5
- SSDEEP 1572864:1bu/U1RESsuvvizZrXY6q6tJ3Mtx6xzCAAq63b1+ga+24UOIOxXZNnuxXHXQj4DS:1bqkvSpqEaMC3kgRMANkHXUHrRD
- TLSH
  T1A938335B92C3E3F5CC2B8A30D7269D5DFA009797D3A49F661721D09DA9781E20201FAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Emiware.exe
- Size 172.5MB
- SHA256 eec3590d136dd9d86b1ef7f7448cb28405ad90104213a6255156ba965985d429
- MD5 a53858d79fc179b753ce8241d52a5a3b
- SHA1 831d9fd00bd510d4a3e2c4aa32ff1488b98d1eae
- SHA512 7b55d225a625a0f27d7b850cd1f410649d7ecd683d4a979042818894086773e10e3aeea4e0bce13c2c16bb51a8d9075b475e6f3faa473b61fab1c5bec1d7ad24
- SSDEEP 1572864:a7NR7Rm1DKEM9Lx4vpOzDE0Yyb5IcIZBVAM9gjMdCjWqgXVbRgTsndR0aL/9eO:TVxsOcY7TR79T
- TLSH
  T14D889C03E29A40D9E01DD1B58B9B9233EE71B8494B29B6DF275407522F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
- MD5 11ee9d008e924e19b33e0b45fdf145df
- SHA1 140773241b15513e9d7a7aff4d1c1d8f7e0b7e41
- SHA512 4acd065ffee81972fb1cfbe11507aab75c883aa94e359f3c455f87813925bb2d3416ce440561b430d6dedcc2f566d5cb74de139e181da68507ad36e69a672662
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmf36k6T6W6r656+eGj/dBIp+:oABeGLp
- TLSH
  T15796A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
- MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
- SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
- SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
- SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
- TLSH
  T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 470KB
- SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
- MD5 b12e3c1e72935273492da1daee50eef1
- SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
- SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
- SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
- TLSH
  T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
- MD5 5082e41d7a57506fe6b4bd58f87276b4
- SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
- SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
- SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
- TLSH
  T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/app/src/burst-preload.js
- Size 200B
- SHA256 3e2901f09fa15134e0b440b54e32b9920f3286d4845df9bc6444025114d732d5
- MD5 794429ef0a12abb36b658603d73c2887
- SHA1 ccfb687dce59e39c72cdfe83351f3d914557e2f0
- SHA512 075689bbda7b585af61a6762d1c3a1d66701ed34896b2948994f09db515d4b0c723b2dc56fb65c87c2db3714955d356cd2095836e18575462c7cdea20ed1f1a8
- TLSH
  T1FDD0226034A7641E773A41DB9B036D2B0659D508B01CD265C3980BBB3AC80C0230B7AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app/src/burst-renderer.js
- Size 242B
- SHA256 67ed279bc3acc50888b99341315379f4f4fed9e026db746096dde43510ea15a6
- MD5 73166b4eb2d9ea1738f10b545251d7cc
- SHA1 7bbc7a715b08a294376d9d05e83b59c2cd983f9c
- SHA512 b0882ad5182934ba0965fb23facbefc115976be0b922e35374dd6c3090f9e577c3e79380abf15d70ca08a5fd259ab89e7950fcaca6babc4cc20a18614a82ac1f
- TLSH
  T116D0977A20F30032063F81E631DA02F93BF0A0603A0A00FA101AB88722A56651B222E1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app/src/burst.html
- Size 496B
- SHA256 c8017f905d776245d09d97f2b45f8b1b442c1dc63951d2e18d8e1a3b954432b2
- MD5 fbc6cfc2f88e12acb6d57dca816f81ec
- SHA1 970523fc7bbf61d7dd46abe30e47dc503eff41bb
- SHA512 f7f0b6e96212c835053fa399f51e358ab8db6483b1f2107b20ee03936cf87dfe4b57a7137b3accba4228d9b6f55251d54d5c7adf9ce7369d6a60dbad299767e3
- TLSH
  T11CF02748DA9361C57016D3B02AFEB20C260BD2879796CC2C77DEB662CF052049B536E1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  resources/app/src/index.html
- Size 1KB
- SHA256 ba92c5dfdd66f4888023f097b3309fefc43bbff61e01c4f2a91a05ab3bc8210b
- MD5 ab1d2cefe378d22e40544c6e457e6a94
- SHA1 b4c2dad93ada8161eed19a71b5e28bf53d8f5b7f
- SHA512 43b9d902c1496e199329636a06c3814b9c9fdc5ea58b8ac2d04f7f74f72ec10a39cde89475b1b7738d9a9092aa59b9cdf964481ed401e3368f662fd283dee3c1
- TLSH
  T1A2415BE9F5F80BF243968141A5D3E7C17681D203DBDC62087AAF19E00FC1D6AA44F32A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  resources/app/src/main.js
- Size 5KB
- SHA256 664c998aeb213fa1d57e6f4665b94cf0fcffd4245ab297110ba9ff86101d4d7d
- MD5 9531888a8e5377a265830b5f4e0dd136
- SHA1 77094e4e3e979f47abd53b4a363df010e8844742
- SHA512 d200f968b1271ad29d9314a7abbed987770a89d8851b78a9bbfb2eae2f7d2382ca1784aa7ca652666f36df738b013526ce21803225df70083cb8eb59510beff0
- SSDEEP 96:BJ9iEqa0pNoV5gcJ2PD3doPyesTJJWCHOn7Q9LdikVArBmq8UZCDXmYNxv:BJ9iEqa6c5gcydoKvnHCURikVdrDmYNx
- TLSH
  T13EC18264E7F42239453386AC698F460A931925333647DB60B5CC63807FC771A9AF2AEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app/src/preload.js
- Size 407B
- SHA256 da866ce2e5adef81e4f665aac22100483c70c9ee1f2601fac674433412cb0a55
- MD5 755eb91193fe612beb86aa144cc27495
- SHA1 77b3f80a33d89db7c8cabcda78614da359165f58
- SHA512 ce44bb3affd89852a30690021da7df338727b0f4cb6fd723a70e342f0ea29534ed6628afbf090064d34e4c4d413451b6ed33fe4bc01890a77250825b53e98832
- TLSH
  T117E0E5E536CEED7D2B152233E7130C5B4A145C05D50D92A0C38520F6B7C9C5466B6F8D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app/src/renderer.js
- Size 5KB
- SHA256 e2265af310af87ba8b49b2b60ff05d7334ac2cb8350de9c390504784e1d72ae9
- MD5 aa75180696000c1ccd22a38367a08ee8
- SHA1 24c1a59d204f6635d6c0d0e0ee11e480f8eae3c1
- SHA512 a1d735a3e91b002bfa64e6f07073abad25c8157408ce1c1b5395561330be0cae7a73b8eb2d5139d8693bda025340afb069a876ffcebf2a4e50ecf4e05ae102b4
- SSDEEP 96:x5mgVoQf70oA3rXoKL5aXaIX6bF67mAR7OYZVyEG41no4SRA8qCYmOTcQvdrovo8:xnoQf767X3L5aXtXfV7Ol41nSARaOTcz
- TLSH
  T1D0C1431FF1F5093408FB19B172CB76CC721241272B42E6187E6FD5181FA3EA6657A6C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app/src/set-wallpaper.ps1
- Size 587B
- SHA256 3af716645247f073ab1bcbced2cc516251be3dbfeb16fe67a35b73591ed36069
- MD5 b0fdaa81d404347611580bad7b966045
- SHA1 083c63c485c421c39801403a91e640c308791074
- SHA512 6118099dce8434f7eb260d65312fb84861efe82c14a97a3f72afd67bee6431127be0bf308aec4f648cd40553f272e847e74ed4e41a291f7f636848f5081cccb6
- TLSH
  T192F0E756B7525DF8C842C20D9DB2BC3DB53995CD31F95100B0DC611549DBA38E63571D
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Sets desktop wallpaper using registry

Checks computer location settings

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32