edaf2f7d798ec50334bd6e3b01ae2744b32b4b371cc92168c24be4d7a9b704bd

Sharing

Copy URL Twitter E-mail

General

Target
Silent Client Setup 4.4.2 x64.exe
Size 70.5MB
Sample260723-2vr5dade59
SHA256 edaf2f7d798ec50334bd6e3b01ae2744b32b4b371cc92168c24be4d7a9b704bd
MD5 94ad60ac3c0ea10cdb95c22247c4caff
SHA1 fbe2bbbfb254c020dd322d52c42a07f32acc9d3b
SHA512 bcb7300d1cf9318f5b3874ecafa2385bf31501090567833255364cf1924ff0e3c61ab583d855c5c1ae6a9c5447e7bd3e5c7763c21d2fbccaa5142310f241eae9
SSDEEP 1572864:OH4opqebd6+v9xFJgHaXOTqPLk8rDbDkkagQkpIEirY/5xiPM:OHHlbd6wzFJsNH8nkkagQfXYRxUM
TLSH
T1A4F733D1CC7E4912D8801E7D5A708BFCDD8AB63917A6C6D8C482796CFAF343C471A46A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Silent Client Setup 4.4.2 x64.exe
- Size 70.5MB
- SHA256 edaf2f7d798ec50334bd6e3b01ae2744b32b4b371cc92168c24be4d7a9b704bd
- MD5 94ad60ac3c0ea10cdb95c22247c4caff
- SHA1 fbe2bbbfb254c020dd322d52c42a07f32acc9d3b
- SHA512 bcb7300d1cf9318f5b3874ecafa2385bf31501090567833255364cf1924ff0e3c61ab583d855c5c1ae6a9c5447e7bd3e5c7763c21d2fbccaa5142310f241eae9
- SSDEEP 1572864:OH4opqebd6+v9xFJgHaXOTqPLk8rDbDkkagQkpIEirY/5xiPM:OHHlbd6wzFJsNH8nkkagQfXYRxUM
- TLSH
  T1A4F733D1CC7E4912D8801E7D5A708BFCDD8AB63917A6C6D8C482796CFAF343C471A46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 70.0MB
- SHA256 01001309e4378ccd251582ae52e885b2ed3d7b5e248eda32760bf6a059d86325
- MD5 f1d46287d220cb5a9b84644351559485
- SHA1 38cd1c09208b2d53216721562d3aa1d0cc0826a6
- SHA512 f8df0487542766e896ad17421d4375d7d2093e910e9ba84cba019ab12927d1c04e1cd2a72f61b7fad4768b5052fb5cfa2178c0ee78a91b47d1080785099535a9
- SSDEEP 1572864:t4opqebd6+v9xFJgHaXOTqPLk8rDbDkkagQkpIEirY/5xiPs:tHlbd6wzFJsNH8nkkagQfXYRxUs
- TLSH
  T1D5F733D1CC7E4912EC801E6D5A708BFCDD8AB23957E6D5D8C482796CEEB343C07194AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral7
- Target
  chrome_100_percent.pak
- Size 126KB
- SHA256 2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59
- MD5 8626e1d68e87f86c5b4dabdf66591913
- SHA1 4cd7b0ac0d3f72587708064a7b0a3beca3f7b81c
- SHA512 03bcd8562482009060f249d6a0dd7382fc94d669a2094dec08e8d119be51bef2c3b7b484bb5b7f805ae98e372dab9383a2c11a63ab0f5644146556b1bb9a4c99
- SSDEEP 3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
- TLSH
  T1D2C3E1E3B3F4ED7DCEA755B7661600B2ECB3462907A5434B078ED4362A26648DCC8793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  chrome_200_percent.pak
- Size 175KB
- SHA256 07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce
- MD5 48515d600258d60019c6b9c6421f79f6
- SHA1 0ef0b44641d38327a360aa6954b3b6e5aab2af16
- SHA512 b7266bc8abc55bd389f594dac0c0641ecf07703f35d769b87e731b5fdf4353316d44f3782a4329b3f0e260dead6b114426ddb1b0fb8cd4a51e0b90635f1191d9
- SSDEEP 3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
- TLSH
  T1A704E1D763B8DD7CC9670AB3522601F1ECF2113A56B6425B07CF9C353A5AB898CC9293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  icudtl.dat
- Size 10.1MB
- SHA256 7c8c7b05d70145120b45ccb64bf75bee3c63ff213e3e64d092d500a96afb8050
- MD5 adfd2a259608207f256aeadb48635645
- SHA1 300bb0ae3d6b6514fb144788643d260b602ac6a4
- SHA512 8397e74c7a85b0a2987cae9f2c66ce446923aa4140686d91a1e92b701e16b73a6ce459540e718858607ecb12659bedac0aa95c2713c811a2bc2d402691ff29dc
- SSDEEP 98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
- TLSH
  T13FB63803A2FB4EC2F9FB6F31D8F452679567BD496E32805A01042F3B5C336908665BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  locales/af.pak
- Size 353KB
- SHA256 0ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1
- MD5 464e5eeaba5eff8bc93995ba2cb2d73f
- SHA1 3b216e0c5246c874ad0ad7d3e1636384dad2255d
- SHA512 726d6c41a9dbf1f5f2eff5b503ab68d879b088b801832c13fba7eb853302b16118cacda4748a4144af0f396074449245a42b2fe240429b1afcb7197fa0cb6d41
- SSDEEP 6144:j54QCpN9/WiHIR9a5D4+kQMGSB+jC6kAw1TUKKpg3b9xIsVxSt2y5qP3ux5tPwDV:F9CpN9OiHIRX+HMT+jC6kAw1TYpg3b9P
- TLSH
  T12B741B06D781277D09F07696FA0445FBBB9CA26DC770B2BADD99813219A2EFC017D1C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  locales/am.pak
- Size 569KB
- SHA256 fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450
- MD5 2c933f084d960f8094e24bee73fa826c
- SHA1 91dfddc2cff764275872149d454a8397a1a20ab1
- SHA512 3c9ecfb0407de2aa6585f4865ad54eeb2ec6519c9d346e2d33ed0e30be6cc3ebfed676a08637d42c2ca8fa6cfefb4091feb0c922ff71f09a2b89cdd488789774
- SSDEEP 12288:QqhqEuPxT8xZTtWosuF9Q5m9yAAVzfukCQox30jH8+I:Zh8T8xTWoZF9Q5m9yAAVzXCQ0
- TLSH
  T145C4CA547EF9F7170F8E8A19A4310E4EA594AD4652913C38C35AE3FC2B2DF1B4DCA219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  locales/ar.pak
- Size 624KB
- SHA256 a62b848a002474a8ea37891e148cbaf4af09bdba7dafebdc0770c9a9651f7e3b
- MD5 fdbad4c84ac66ee78a5c8dd16d259c43
- SHA1 3ce3cd751bb947b19d004bd6916b67e8db5017ac
- SHA512 376519c5c2e42d21acedb1ef47184691a2f286332451d5b8d6aac45713861f07c852fb93bd9470ff5ee017d6004aba097020580f1ba253a5295ac1851f281e13
- SSDEEP 12288:K+sgtqIj5/XvYUtOkQIkqBJ5SNbW+eTtvZEMgSENjM:KD4Fek75z+K
- TLSH
  T16ED49CE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  locales/bg.pak
- Size 652KB
- SHA256 898621731ac3471a41f8b3a7bf52e7f776e8928652b37154bc7c1299f1fd92e1
- MD5 38bcabb6a0072b3a5f8b86b693eb545d
- SHA1 d36c8549fe0f69d05ffdaffa427d3ddf68dd6d89
- SHA512 002adbdc17b6013becc4909daf2febb74ce88733c78e968938b792a52c9c5a62834617f606e4cb3774ae2dad9758d2b8678d7764bb6dcfe468881f1107db13ef
- SSDEEP 12288:MMq8w2kMLlYrdAs1aQUx41aVVwslMLOmFOMw35uKN31tfbDMxbV2Jfu64Kjz5fS+:MMqckulYrdAs1aQUmBsmRw35uK7Jgxho
- TLSH
  T10EE434A15B9A689F0101F55F98087E093CEB84FE3FE7879241642DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  locales/bn.pak
- Size 838KB
- SHA256 1ea245646a4b4386606f03c8a3916a3607e2adbbc88f000976be36db410a1e39
- MD5 9340520696e7cb3c2495a78893e50add
- SHA1 eed5aeef46131e4c70cd578177c527b656d08586
- SHA512 62507685d5542cfcd394080917b3a92ca197112feea9c2ddc1dfc77382a174c7ddf758d85af66cd322692215cb0402865b2a2b212694a36da6b592028caafcdf
- SSDEEP 3072:6gGTLRFbMdhBVHvr5eSnC6PRWhk7Bbd8+D95H0XluZ:YWBlvr5FCYRWuBbdB5wl2
- TLSH
  T1F905DE209C6E91B2A8D5CDC9434C6370C123AE979B61F34DDC17A25938ADC7C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  locales/ca.pak
- Size 400KB
- SHA256 56efff228ee3e112357d6121b2256a2c3acd718769c89413de82c9d4305459c6
- MD5 4cd6b3a91669ddcfcc9eef9b679ab65c
- SHA1 43c41cb00067de68d24f72e0f5c77d3b50b71f83
- SHA512 699be9962d8aae241abd1d1f35cd8468ffbd6157bcd6bdf2c599d902768351b247baad6145b9826d87271fd4a19744eb11bf7065db7fefb01d66d2f1f39015a9
- SSDEEP 12288:bgoRVrijIs3cejEYBCqS4o3nbhjJSwHQliEwfwVEMXdLbpuQ16BtryBiGIle3nei:b3GQUwJAMNTCypxB5WMml
- TLSH
  T1B1940A238BCD3B6744D2320AFB46C217F18CA9847B06D254F9AF1B1622CCADCD677695
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.node
- Size 144KB
- SHA256 1fac6ae00576f9e5b0b777b0865cca390640cbfb5187911956b62d97ae01ab9d
- MD5 2cc150c7946db41966dba988072ae9f3
- SHA1 c726381840f4874b2ab5689cdf61289991c3e129
- SHA512 fa1e0368cd81e0ac979fdc3ae966603ea6ec11d115e9824e9a58a1839c12d958403c0c6fba584e3ced8a942fb6035091c24df7d07226e3540c54136505cadf93
- SSDEEP 3072:jMpaTHsmOYrr3sFsHuhfbty0SN3fzF3yYMC/1:o4TMmOYrIhhTty0hC
- TLSH
  T1B1E35C1BB7A500BBE5B78235C8535A06E7B2B81107609B9F03E443756F237D1AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/assets/icon.svg
- Size 86KB
- SHA256 ad1d859b9f2f5b7dcecd6b199a96b6bb164655b33b9545506f1479c94899fcfd
- MD5 d22bf1aee0486d9ce98e69e9507fd357
- SHA1 62b828b051b4773185d0414905574e9b8b17d235
- SHA512 dfae09b7871f26e0aeb12799dd60ff79e61b590d8e3537caa3aa2a898f75788465a9780360ca4fbfba192d1f76ffff766d3113ccca610b5ef967b5420cae13e3
- SSDEEP 1536:yxzVcjBgQybTGNYqJkLbG1uokIOOKr4r85ujR7b7TJVHeyH9qEW5j4Q8T2yeBvzb:yxKjyGgqSOWGR/7TPeyH04AyeJzb
- TLSH
  T1D593F1B6565874CE29989E3EF23C2A44AC35613756D062CDFFC11102B0F8D0DF6AE796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  resources/assets/images/full_logo.svg
- Size 7KB
- SHA256 57492f2cab5858e746ff51282ffe5b9e9636c0313114e9051d3898a46dc2dd3a
- MD5 3a1ce5da249d01d6dbadd602223674b7
- SHA1 3026dcf6ee2e84e2d42d9a4cfb97b06712ae7f0e
- SHA512 c401170ae2e7cc76c5051b22de056d0c9e43688e7a0319b9ef987243ed258af8b0bb0ba513dfc4643b4c34cd77aefb7bb32a7478f2134b8b53b0808d570f3bda
- SSDEEP 192:CNv2uilYt9Nn7Dphcsh2Svk0X8Sg720t9m0MlVGHC:vUPldhRhTNMDXo5
- TLSH
  T1DBF110FEAFB11CE19D89CAD2EA2345EC750B597B6F528B10C229C7353907C9CC855983
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  resources/assets/images/logo.svg
- Size 86KB
- SHA256 ad1d859b9f2f5b7dcecd6b199a96b6bb164655b33b9545506f1479c94899fcfd
- MD5 d22bf1aee0486d9ce98e69e9507fd357
- SHA1 62b828b051b4773185d0414905574e9b8b17d235
- SHA512 dfae09b7871f26e0aeb12799dd60ff79e61b590d8e3537caa3aa2a898f75788465a9780360ca4fbfba192d1f76ffff766d3113ccca610b5ef967b5420cae13e3
- SSDEEP 1536:yxzVcjBgQybTGNYqJkLbG1uokIOOKr4r85ujR7b7TJVHeyH9qEW5j4Q8T2yeBvzb:yxKjyGgqSOWGR/7TPeyH04AyeJzb
- TLSH
  T1D593F1B6565874CE29989E3EF23C2A44AC35613756D062CDFFC11102B0F8D0DF6AE796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  resources/assets/updater/updater.html
- Size 423B
- SHA256 6ab2c4f63e9c6fb6b29315b9a0909f0977d935e61027603dc4773f1f673848ab
- MD5 80ca9f9545a5cb816ec202c5ac7cc6d8
- SHA1 383035241b86667aa8cc192d675706974e89eeef
- SHA512 a78d8c9ae1cc2e40a113c1843bb03efe7a09ab1125338681a580bf2457efa582a3c4c72c61b3a3e06849d9fe200a2005648ac8276533f583abf7fe03eb8a786a
- TLSH
  T153E0682E89AD8472D8E1119EACD1B7E93DE5D509C78F902030E4A948DF6AE81CC4F426
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21
- Target
  resources/assets/updater/updater.js
- Size 606B
- SHA256 8f27a967789167ec390e233e30dfb140cc0db66260fa786e725b074402a4621d
- MD5 83b1bf75fece90a4c4c38666c825446a
- SHA1 b84e504367405feeef33d136d7b6e5f43cbcd8aa
- SHA512 d5808d242367151f7fab672313f9ac4f976a4f437b9f9a8b441f0322cc1cde922a74ef9f82ad2200bafd6793b270f6382ff858dd51e67ab7f9c363a76202277b
- TLSH
  T195F0D39E74972D380EE7B4926032410938249C11980A9445552C69B56F58ED2E56DF5C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  vk_swiftshader.dll
- Size 5.0MB
- SHA256 6150a413ebe00f92f38737bdccf493d19921ef6329fcd48e53de9dbde4780810
- MD5 a0845e0774702da9550222ab1b4fded7
- SHA1 65d5bd6c64090f0774fd0a4c9b215a868b48e19b
- SHA512 4be0cb1e3c942a1695bae7b45d21c5f70e407132ecc65efb5b085a50cdab3c33c26e90bd7c86198ec40fb2b18d026474b6c649776a3ca2ca5bff6f922de2319b
- SSDEEP 49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4
- TLSH
  T1D0363803B2958199F05ED179875BA233E632FC811B7276DF52A42F192E37BE02B39705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  vulkan-1.dll
- Size 899KB
- SHA256 f681844896c084d2140ac210a974d8db099138fe75edb4df80e233d4b287196a
- MD5 0e4e0f481b261ea59f196e5076025f77
- SHA1 c73c1f33b5b42e9d67d819226db69e60d2262d7b
- SHA512 e6127d778ec73acbeb182d42e5cf36c8da76448fbdab49971de88ec4eb13ce63140a2a83fc3a1b116e41f87508ff546c0d7c042b8f4cdd9e07963801f3156ba2
- SSDEEP 24576:PR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:PR1l1culw6Z5WUDYsH56g3P0zAk7
- TLSH
  T1D3156D27AA54496AD4768034C9828607CDB27C921B25B5CF03A85B19BF6FFF4373CB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $R0/Uninstall Silent Client.exe
- Size 134KB
- SHA256 a740bf0ba109ff5da913aeb4a3736437402bfc1c0be1b23b7cd690f41ef4a693
- MD5 6262e26d1fbe0ac0f18bfb47b8a77e7d
- SHA1 b6a39405b1792fdfa3cf9bdd927576d1c087aee4
- SHA512 447a104e313dfe92cb1107d2404041d6e37dfc7f99ce6dbb6cba6f9728bdc7b9a1e3b4794139300a52a373a500ab588d8466b6d4e5f5e6d35819996652ea7f0c
- SSDEEP 3072:+n77v00hEoDEtauK1fe2zsD6+Gf7aH2tvhOEA1RJCir86SrSrv6Ia3U:+740IIf+m7s2t0EyL+yak
- TLSH
  T187D3F111B7A0C563D9F30F325AFA93DB6AB2F11124684B873B80275E3EA6791DA0D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral28
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Looks up external IP address via web service

Enumerates processes with tasklist

Executes dropped EXE

Loads dropped DLL

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32