522834f8bee1b6f22adf6411bbdb8c07980ccfd51c32ce1a19bdad07c8722efc

General

Target
QoderUserSetup-x64.exe
Size 181.0MB
Sample260722-fmrmzsdl3w
SHA256 522834f8bee1b6f22adf6411bbdb8c07980ccfd51c32ce1a19bdad07c8722efc
MD5 c7fb7f82fd247042a4b93d68f95707cc
SHA1 09e6d93a53902c9c5eb1be66fc8d543e93b223e8
SHA512 2777c8a895d4fb3858ff6196c2b7091a0a0947295ca39a1e0bec2e3dd303b8beafe815489170484e6c6996ff3efccfc0a0e2be88932b7af500a8cd3e1790fea0
SSDEEP 3145728:m58JNtk8Is4L5V1syMzWo0zr89xx+yzrto0/qiY3jrlZQh8y6nk:HJEC4LTY0EsOo0JY3jDm8pk
TLSH
T1709833067385D83FE146933690FA626C11FF6E150B2ADC66ABF7705EBE350281D1A1CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  QoderUserSetup-x64.exe
- Size 181.0MB
- SHA256 522834f8bee1b6f22adf6411bbdb8c07980ccfd51c32ce1a19bdad07c8722efc
- MD5 c7fb7f82fd247042a4b93d68f95707cc
- SHA1 09e6d93a53902c9c5eb1be66fc8d543e93b223e8
- SHA512 2777c8a895d4fb3858ff6196c2b7091a0a0947295ca39a1e0bec2e3dd303b8beafe815489170484e6c6996ff3efccfc0a0e2be88932b7af500a8cd3e1790fea0
- SSDEEP 3145728:m58JNtk8Is4L5V1syMzWo0zr89xx+yzrto0/qiY3jrlZQh8y6nk:HJEC4LTY0EsOo0JY3jDm8pk
- TLSH
  T1709833067385D83FE146933690FA626C11FF6E150B2ADC66ABF7705EBE350281D1A1CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution installer phishing spyware stealer trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Identifies Xen via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Looks for Xen service registry key.
  defense_evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Modifies file permissions
  discovery
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1