709faca3fb587719c8d185478ddbb4c4083d4218c6b79a7ff9ea749c106e6014

Sharing

Copy URL Twitter E-mail

General

Target
GitRelose Setup 1.2.1.exe
Size 83.7MB
Sample260723-bzzf5seh82
SHA256 709faca3fb587719c8d185478ddbb4c4083d4218c6b79a7ff9ea749c106e6014
MD5 bb105737871c5efc15f1acafcea808e5
SHA1 6f15861d1cbbe1971ddc6f391e49b7270ff74fed
SHA512 3a3d07032f768bce2d76a7a40e684bb01dd5c7c5690106b352e0ef808692647ac890ddb702dedcc8c228d31b212d3d63eadeec6f01103332cde50450030298f8
SSDEEP 1572864:uPnO6MOs5x114j3Of7LqFdzLcBdyNyB13jSQDOqVxh1P:uPO6MvPqFdncBdyNsSMh5
TLSH
T1BB18338C9A620DF6F0FA6C38E690ED7246837EF82AD55D8397BD2D26343149539F160C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  GitRelose Setup 1.2.1.exe
- Size 83.7MB
- SHA256 709faca3fb587719c8d185478ddbb4c4083d4218c6b79a7ff9ea749c106e6014
- MD5 bb105737871c5efc15f1acafcea808e5
- SHA1 6f15861d1cbbe1971ddc6f391e49b7270ff74fed
- SHA512 3a3d07032f768bce2d76a7a40e684bb01dd5c7c5690106b352e0ef808692647ac890ddb702dedcc8c228d31b212d3d63eadeec6f01103332cde50450030298f8
- SSDEEP 1572864:uPnO6MOs5x114j3Of7LqFdzLcBdyNyB13jSQDOqVxh1P:uPO6MvPqFdncBdyNsSMh5
- TLSH
  T1BB18338C9A620DF6F0FA6C38E690ED7246837EF82AD55D8397BD2D26343149539F160C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware stealer themida upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  GitRelose.exe
- Size 191.9MB
- SHA256 d946be0f25e0b1444ed11a0760f6ed415314acea3c6f7439b3500f7a53cee194
- MD5 f148b8e2a4189fdf2ffba32d5e758129
- SHA1 30a0596fd70b381b7e44eff97a2661fc63f925e9
- SHA512 1e0bf54526d400f885d5c28aaa75421e94a98379ddc97f7ec4675c84db0739732b3fd1c2b717214a7a0dd97456c84ee5ecb04f0ae8f4e919415a1c0f09064142
- SSDEEP 1572864:uhqI5OOengTDlkGf97McvHp/i8mhllqtSIOr3alJsxjEP6H5HlTShW62Su+709x5:TOMMpBKvPTJJlf
- TLSH
  T16CA88C03F39A50D9E01DD1759B479633EAB1B88A4324A2DF2B5407912F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware stealer themida upx
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral9
- Target
  LICENSES.chromium.html
- Size 11.7MB
- SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
- MD5 0b24e08f0d1dac2ee54364e50fef0b41
- SHA1 a4f3ea66556cdcc2e92bc924965e225488ccd94b
- SHA512 2beb14f31a87f0df953af26945288f35e916159b114ec1c205c3a58125fa6911b888c2a0b17b593c5b2bcd8e51012d8f2cbe4629f1968335ee3866a19712dfb9
- SSDEEP 24576:S9dQL6poq6jBCjK6D3UwRmETlmfTKjZ6ojK6QjZ6UjK6ajK64jK6cjZ6ijK6b6ck:SvPeGAyWPbX8meu
- TLSH
  T1CBC6A52F7B48037306C642A26B8B65CAF31F903F3B561654345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral11
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 99fbd8bd11696e24479d22e29b490c7e96c7d9875ab4392ff12307ddfb5a9503
- MD5 931b7dbb1b27b4ff0ac5cd6cca485c1f
- SHA1 22578fcadd0fa4b1159dd721c2d8dc6bde89c07e
- SHA512 c5f19baa9de5502c752797fc8a488ac4b85bcd1325968a88461b25844fe36b313560c454cd2849bc48b7bb67724d2f1dbfa67dc7ff0c21c34438ffd0f9da56f2
- SSDEEP 49152:oJ2o28BhFrhzXIbk8HV22QNPa12wLOA1AdL10SApX7jCf1Xh/+Gk1ekxjGsDefo9:oCWFrIb1HV22QcSAZ7jCf1Xh/+Gk1ek5
- TLSH
  T151D5AD07F6D6109DD029C070979F9213F671344A8B205AEF26D05A243FABFD86E3E769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  libEGL.dll
- Size 481KB
- SHA256 e55fb10fb929b28446583ebc5afa89fc647bafc2eebf3b12e6a0adf91a7bb202
- MD5 46f2bd2a1c312a65e09ecd1d04e559b6
- SHA1 6b071a36ed51b3829da871ed2149abecb22ee6fc
- SHA512 ae082bb8d6d161d185a8d5b1f4fb20b020e73e9711688b4ef7c9dea610206ed5a95b2b2691db68725d38760aec5a918c89a36e94c61651e31cafe59407f77818
- SSDEEP 6144:5qQPf2bILvlflS9XHaT9ZrgDUypbrzi4uBcFObfckF0fASM9:x2q49XHu9ZrgDVVi4nFObfckIAH
- TLSH
  T17AA48D15B3E544A8E06AD1748A534642DA77B4920F65FBDF03E493392F37BE85B3A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 2289eb00380b7f143d81df224d5bb412dec9b5eb6002b5213518e295ae8256b2
- MD5 3fcf2af2ac606196af5b362f6b9c9470
- SHA1 6f17c685b886f98141d10d1c8190bbf8db232b71
- SHA512 69da96f6bcaa5685dfe372ba461d015be428deddc6a687415c90a0d12c125e6b0cca514bc9518f9d2c44886eca43f9f2624e07204757dbc6ec907dc657675335
- SSDEEP 98304:/XQ27zNwptqCK5M8twgfM+P9hKBswndb1GXJij:L7zEwPP90XdQi
- TLSH
  T1E8868B03F39A40D9D04DE2B8C7579626FA35B8850724B6CF279413292F67BE0EB7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/bin/win32-x64-133/dpapi.node
- Size 126KB
- SHA256 a0c16a0eb9e48d376480c63aed0ccb5dbd7d909dc2e6e2b182cee7a60e653dc1
- MD5 818fcd185164d9f805b706d7585d22d5
- SHA1 6645bd6bffc6c8b3d9fd840ae2185fd0c8873ed4
- SHA512 5926242264a4c4d17c609c34a6262c893174c0a4a33adc7f570645588fffdf5fe9807612ecdc8dbecbdca47409a1fb068a2af27bd67e173bfd941dbe3939d4be
- SSDEEP 1536:TqOWzpju8EFHYBFSOS2kubpmSae62pA/vtKntBMJhLsW8d09dllAWh5TQB9+u:fIpS8OYBF9S2ZbU7qpA/vt8MwMD9TQ
- TLSH
  T1FEC34B57B2A840BBE0778278C4630E15D772B8214761DBDF07A4465A1F237E1EE3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/build/Release/dpapi.node
- Size 126KB
- SHA256 a0c16a0eb9e48d376480c63aed0ccb5dbd7d909dc2e6e2b182cee7a60e653dc1
- MD5 818fcd185164d9f805b706d7585d22d5
- SHA1 6645bd6bffc6c8b3d9fd840ae2185fd0c8873ed4
- SHA512 5926242264a4c4d17c609c34a6262c893174c0a4a33adc7f570645588fffdf5fe9807612ecdc8dbecbdca47409a1fb068a2af27bd67e173bfd941dbe3939d4be
- SSDEEP 1536:TqOWzpju8EFHYBFSOS2kubpmSae62pA/vtKntBMJhLsW8d09dllAWh5TQB9+u:fIpS8OYBF9S2ZbU7qpA/vt8MwMD9TQ
- TLSH
  T1FEC34B57B2A840BBE0778278C4630E15D772B8214761DBDF07A4465A1F237E1EE3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size 1KB
- SHA256 3043aeba077d86d8b2e7fbbd6e1ecc3438c65ab184a2bda9fa0179976c5b0170
- MD5 526095b58d1cf0113586690f4e449a40
- SHA1 878de5a556f1d56afdc1eb9e1eeeeda6b23bd7a7
- SHA512 000db3def9ce5a4cc615fbbd57b2b8077bc25e04cbb34744293ab18e89be1f6534c564d3b8d2ae3d515f6ee5b1c6b003a8601a39071caeba93c5cb8e5badb16f
- TLSH
  T1A121AC1B2BB19C76C223B1C3161AD412AE61813B2E19EE1D7B5C43EA6F14450FC82BB8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/@primno+dpapi.node
- Size 134KB
- SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
- MD5 5dc8861862329b3b4122314922be3ed9
- SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
- SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
- SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
- TLSH
  T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.8MB
- SHA256 901381b3f1fd78cf8858bcc14fb60a55242a9832da937e8effcafe6b889a3532
- MD5 232c34202f0a3dfced855cb5a9c95538
- SHA1 7428eaf872098d55b558322c15eaf837f1ee3ce7
- SHA512 4c46234ffd65ff036b49ba615d20ff7655fb5d0b49fc2d9228368bc6e74b3359f2530388e2e2602bac29b863f116aacd05faf49eae5c11c08a4dfeb23b94ead2
- SSDEEP 24576:ORnpg3sDMfVo34DLpJQdAO9k+uJ5tJKYXtuQi0Y7dv4ZJtvYvT/2LBq41hAX4vRL:InpNeTO9uJFduf0Y7dgg7e1hD9/pnH
- TLSH
  T184958D4BE3B400BDC1A7C0B9851B560BEBB2740517709BDB1694CA696F63FE217BE324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
- MD5 722c2b2dbeee143a14c7ba04edf8e3f7
- SHA1 88321c5c15ed00c72570b28e8183b2440bbf6419
- SHA512 0537a881c397d0bb0836ff74a881d650d59fc151f0e4ccb1c4f5a9fe84549dc9753b886b3e14534c551c167ff702fae71b58fe4fe90c78b43ef05a4cb2761855
- TLSH
  T11C115CCF4B4A2678E3F2B7C1EE21E94E046442E47A5A0824C0CC1DC139AB15A78C6DB6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/database.js
- Size 4KB
- SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
- MD5 952ebcfa3d8727e8b1d7b681c9f5bf32
- SHA1 6168b5f5ed77669b3c6c1f1d526f0eb116bd3a43
- SHA512 d2dc310d2e4a491903988ed88228d35e9688e48c9b6180c797fb58f84d1105724ab3933ade92be0e73c8a27fb6f3064449bfe00cfa1dc92919ad53a81af2680e
- SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrtRxtjFvcLd3s03M:ac1ZFjQBG1oQZi9qSvNRBkLveomRz
- TLSH
  T1EA818388DBF5611247EB30D4A674A48D6234D27971AD08E0D8CBC3F531E60C9BBE3B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
- MD5 26660b3078523a953ee252b4e86e1c8b
- SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
- SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
- TLSH
  T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
- MD5 25fdd950809b2b22d0ba6917fe014c35
- SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
- SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
- TLSH
  T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32