e1156306a917a50c7a0f3565ca904f117395508c7af7802c4feb7aa11a92307a

Sharing

Copy URL Twitter E-mail

General

Target
TurklionLauncher.exe
Size 205.6MB
Sample260723-qea1dadk3z
SHA256 e1156306a917a50c7a0f3565ca904f117395508c7af7802c4feb7aa11a92307a
MD5 775fa7d21b33b9bdec636afbef5fdb36
SHA1 d712750c91afd609568f9a653e0123ef6c885198
SHA512 198d81f0ee6362d232c6e90435d7b34a63910c3786f21754879bba554bb18e7932498a2b74bb0d593f9a906130cbf3f55300a02eb3aa5e1cd2b3d6d3e4bf183f
SSDEEP 3145728:veLeRTgyE3LyoTYPE9IJGHkQgeYnvPbAlgos2drYqUTjCD4fmlNfikxtR1Pul5q7:icI3LRcxJGHkVvcvihTjCI0NfiCbag
TLSH
T1A4A83398726AD069D1E82076C3512D8F834A32B497884437CB765425BCBFBC3BACDED5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  TurklionLauncher.exe
- Size 205.6MB
- SHA256 e1156306a917a50c7a0f3565ca904f117395508c7af7802c4feb7aa11a92307a
- MD5 775fa7d21b33b9bdec636afbef5fdb36
- SHA1 d712750c91afd609568f9a653e0123ef6c885198
- SHA512 198d81f0ee6362d232c6e90435d7b34a63910c3786f21754879bba554bb18e7932498a2b74bb0d593f9a906130cbf3f55300a02eb3aa5e1cd2b3d6d3e4bf183f
- SSDEEP 3145728:veLeRTgyE3LyoTYPE9IJGHkQgeYnvPbAlgos2drYqUTjCD4fmlNfikxtR1Pul5q7:icI3LRcxJGHkVvcvihTjCI0NfiCbag
- TLSH
  T1A4A83398726AD069D1E82076C3512D8F834A32B497884437CB765425BCBFBC3BACDED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
- MD5 11ee9d008e924e19b33e0b45fdf145df
- SHA1 140773241b15513e9d7a7aff4d1c1d8f7e0b7e41
- SHA512 4acd065ffee81972fb1cfbe11507aab75c883aa94e359f3c455f87813925bb2d3416ce440561b430d6dedcc2f566d5cb74de139e181da68507ad36e69a672662
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmf36k6T6W6r656+eGj/dBIp+:oABeGLp
- TLSH
  T15796A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  TurklionLauncher.exe
- Size 172.5MB
- SHA256 f67078a01db869b529d12a317192690427605526822fcc834d7b8d151de508ad
- MD5 8765124129db25eecb7ff17881c0b811
- SHA1 fb425d7b7637aeda460eb28766f9f6b283b0b7b5
- SHA512 7bc1db853fa0f8559830bead119b4d900fd37885255b281e547d9addf76595323908f2ab618faf0332658d5e40d35a0545492b6ea40f9c9f4a318b746c04f383
- SSDEEP 1572864:w7NR7Rm1DKEM9Lx4vpOzDE0Yyb5IcIZBVAM9gjMdCjWqgXVbRgTsndR0aL/9eO:pVxsOcY7TR79T
- TLSH
  T1E8889C03E29A40D9E01DD1B58B9B9233EE71B8494B29B6DF275407522F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
- MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
- SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
- SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
- SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
- TLSH
  T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  libEGL.dll
- Size 470KB
- SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
- MD5 b12e3c1e72935273492da1daee50eef1
- SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
- SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
- SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
- TLSH
  T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
- MD5 5082e41d7a57506fe6b4bd58f87276b4
- SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
- SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
- SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
- TLSH
  T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  resources/app.asar
- Size 71.0MB
- SHA256 c142abb05d0c27bc46357dcea6d28276ab222e242e2b0573051f098f695b98fd
- MD5 82bb2d9be289d00f6e49770c4564178b
- SHA1 a9cf14b074a379b39bd2e5de9d5c635d23b5671f
- SHA512 e951bf87a02d21ac181e95f331e8e743dba20248972172f858cd3ea3808faedcecf0d14783dc59f71fd604c128900bfb3172de280af1129fefeb6911a3dd2e44
- SSDEEP 1572864:i+9J5WS7B1BRlbuloamhVGKqUrnEvRkWJgBp8UtUBwTop:i2b1Aodn3WJg8USD
- TLSH
  T15EF733D0AB94115E92BA137CCE81119DF6B70079204CA835F9CCEC9C1F5DBAAD293A7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  bin/java.dll
- Size 154KB
- SHA256 5334f75ab3137dbc594f728c2d93f33874e2f39475ee63df84c2b2d300b668eb
- MD5 cc3a0d11af573e4d9198bc998586d6e0
- SHA1 68476d9bcc92d3efae8eb982dae49a42b905041d
- SHA512 2784cebb08482f072f16fc9e9abdfca020f56c1dc893b5d4fe2e21fbfd3cba0e1808b096ccba2505de8eb12806df2a01342cebae03027c973b7aee92eeb7661c
- SSDEEP 3072:MoaQnnwK1Ve8xgWFED01rIDhDVaVUOJrris2qx:MoaQnnwK11vfSE3xeq
- TLSH
  T175F33B47A35280D2F417B6B8B02A410BF37A7455132C92FB83E14A6E5FAF671BD53B90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  bin/mlib_image.dll
- Size 654KB
- SHA256 ee22ac5bd3fec5c6347159f1dfbb28de27c5245b45707ab7355c3474827badd5
- MD5 afff984c6a0861194e1c5280425a4554
- SHA1 6b233ff1566810eac4e79cce736c0f2b9dadf96b
- SHA512 f6a2d947a8c91e55f20a668529d05c9327c86e0295d968a66871268212abbcabe588b53766301d2bda1f372bd3f9e454ed715043a38e3b43c1515f7e3532313c
- SSDEEP 12288:cSjiAjX+y28TooKNEvM892BHPw80yg9oIDDkx:7XTyEvnMvlJg9oIDDE
- TLSH
  T181E46C01F9EB13DCC02BB47499F87197F7603419071869739792AE296B26F11AFE730A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  bin/msvcp140.dll
- Size 544KB
- SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
- MD5 bc88b387cafa556068b5c5d6ff3ccc8f
- SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
- SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
- SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
- TLSH
  T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  bin/net.dll
- Size 94KB
- SHA256 2af6ede7ab204d6595442500a564bfb000e2fc0ee05841e4d4bb021282e05cb3
- MD5 b991141453018e0ab58397b61d28c2b7
- SHA1 6dcdf0b68a10e890afc01786ecafb38c15e71997
- SHA512 feb36f30e1cab6eea62c5cc6f6de3ee0306da0338fcde8320d08c57f1f823266ea6bbd09cae35092d8e0a97b7820d0f8899560e9c475b4507c9f6d2803200b4d
- SSDEEP 1536:HHaf+8hPGZGY7DdNw5Y5MXZZ8PoVWtZpPqrG/5LxmRhf07JqlQTSEnzVQ:H6f27hKK6XZZ8AVWJqSLQqUmTSEzVQ
- TLSH
  T16C932904B36860C5F837D2BC82964217D7B37570632057DF03A6CA5A6FEBAB27E25B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  bin/nio.dll
- Size 56KB
- SHA256 7f4e888b0d801b29b3824406016c6d75c2d94437d825c5f8b8f43c3a02d18c26
- MD5 99b35830718a89da7f8c02ff2d33fdb7
- SHA1 f6488309fb598efb20dcf7e196cf9ea5dbd7addb
- SHA512 847de51aa83991a310f30f18e1ce9cdec5a7c2b82baa21e3cc6d3b507d1840b28089657f17c57f33b6430e99f2b218bf5dfda8d45d14b7eef4dc94eb7d30df2f
- SSDEEP 768:ur7J+Uqc0RASs1UbclEub7Y9gu/U4LA4m/6OWm32A4h/o5e2I:uf1mASs1977Y9T/U4LcJ32x/oI2I
- TLSH
  T18D43E96293A5499BE42AB13C425B039BF063BC105710679F53298B16AF5F7F33E39782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  bin/npt.dll
- Size 16KB
- SHA256 58e7d6c9213ab3782fd7cc0223a2f2862448d8f1cbd215e961555d51adfc14fb
- MD5 42afd29b80171d435ccb971365baf54a
- SHA1 9e7542c88d2bc87d452f97ca21aba2a7c35d669c
- SHA512 35a0259bfa5554c1b0cdcb8a19130b67ceed9ee479445575013022719d2ea799fa1ed7683cfe56a24c9175f2221b857d6304f61299c4f32a2aa4b52f6e809e36
- SSDEEP 192:wVZydAvYqamnEawCv+S6sbFHv3KLDSH93tS0958TCeUaHHvDlq:AqAFEfC76sRv3KLud3z8+0nvDlq
- TLSH
  T1FA72F85CB69945F5FA33427CC8B30F1AB235F8155B6217DB13B1211D1E73BC1263AA98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  bin/orbd.exe
- Size 17KB
- SHA256 218690989953b8e06f2f53261cda5f1bafdc2153fbc75a3c55809a4215ea7ff4
- MD5 45702847201c0d2b16ff1aa99c6dd293
- SHA1 e4eaab341e24bcca6d3076a812b635af6fd95310
- SHA512 01f93fbc5f13a7f10877b31f1dfa2a051cf0a232cdb2d1809f6245dead556371cee76aff9e2b7a3d4fcec2195f604e8b5adedfc846d40c8961b1bff330ea0c40
- SSDEEP 384:VAZm+UERQYPX4C7vXrSUjTtl0G3718eE:VaJRQYPRpd715E
- TLSH
  T149824B45FBF50DC6F5224236C6F32602A5B6BA3B676542EF57840A082F7A3C17D32B58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  bin/pack200.exe
- Size 17KB
- SHA256 44bebba0090001e2e32a7eb3d542f86c222f3f5059308d916def7ed8cee4a638
- MD5 709ee253a541b4595cd675b2ab4fb533
- SHA1 e12aa3309ae77820046ce88b59896e692063984a
- SHA512 79c679caf3b416fce0ed2ac3d38ff9347fe6f402b316e68f621fbf11ddfc34e9b7f807d75f8b8b31cca685e09c4af1ae2914e655817b3e669f2f8f58b0c8c5f8
- SSDEEP 192:ehvftEtjEnfdYBvXv4CbSCJ2tY3OuTJw2snl0E7V17S5tf94AeE:ehdEtjElYlXgCV8eemdGl0G37JAeE
- TLSH
  T190725C05F7E50CC5F5224135C9F31612E5BBBA3A6B2682EF578406091F657C1BD33798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  bin/policytool.exe
- Size 17KB
- SHA256 b03e3fd521fbcf9cd70e8e89e9817433d6537694c5aef9b97707ce08bc649e50
- MD5 d49d5f1129bc73d67e5ff09761ade872
- SHA1 14333fdde5d53f866e1398a6db492ba0e3b2b738
- SHA512 7623462cf175f470bfe90364052e0951dd66a5346ee08ca4f3c2f409d64a41f357f1a9ed281b28e969284a17e008ed2de282b44f8f8299818f1c079246362c80
- SSDEEP 192:sNyt8VEnfdYBvXvIybSCFTg+YXLiaTRzTg7nl0E7V17S5tfiYeE:sw8VElYlXwyVRgTbiWngzl0G37NYeE
- TLSH
  T1CB725C05F7B50DC5F122413989F32612A87BBA3B6B2592EF678406092F793C1BE37794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  bin/rmid.exe
- Size 17KB
- SHA256 36c1f69f1c5cd8e2953059c7d68dd94a06b6377ffd263b80425c18406c3d1844
- MD5 6384995b8612376c82faf16bbedabc44
- SHA1 e203258ca448a7b8bdae14926e01ad7ff6d1490a
- SHA512 b39b7514f34d1905186b6fb7847da8a788ea1054cc96daa769d326e1b44fe59670a96319cea98553d17bdb36f9aa49169f586b3be34cb351361ef4d5a8be04a9
- SSDEEP 192:PNZBtsVEnfNYBvXv4CbSCJ2HYXS2TJo2snl0E7V17S5tflwUXeE:PbHsVEVYlXgCV84iOFGl0G37xUXeE
- TLSH
  T126725B05F7E50DC5F5224136C5F31606A5BBBA3AAB7242EF978406091FB53C1BD33698
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  bin/rmiregistry.exe
- Size 17KB
- SHA256 d3ef0c0ad3bfe02164b39b906d6d9c56246de3c2b9ffac1657173cf06382ac85
- MD5 535bdbe15ac9ab65f97ad580b009307f
- SHA1 5898a9e694b8da3f141391b819842888721c376a
- SHA512 6f0d7574ec7390faf57c649c35033179a84a3dd6169ac7bb5d85cebe5bddd27993ec1002ecb4d083a41efacd4e84f2c129c2acb108aa63aed297830446628060
- SSDEEP 192:MNZBtsVEnfNYBvXvIybSCFTgyXge+TRzTg7nl0E7V17S5tfiyeE:MbHsVEVYlXwyVRgyweKngzl0G371yeE
- TLSH
  T196725C06F7E50DC6F122423589F32207A47ABA3B6B2592EF978406092F753C1BE33694
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  bin/server/jvm.dll
- Size 8.5MB
- SHA256 48cffd84141bda58a78121b906bbba391e71a7b4c189e209b42a1d6e2faf3f7e
- MD5 24b92b4debd60a4b3e6c6e2005f1adfc
- SHA1 7107d09ce4cb29b4e8077fb82316bbb27c3252fe
- SHA512 dad7122cec9e1cbcb5284879534e3ef5f128a592917508a20891fdbc26817b7adfec1e2e9e9cb0ccce04a1cd71d909b5583b1f2b898a1ff795fb39dd6af49a9e
- SSDEEP 98304:aHrXmypAvcwUZT53Z9pWnHm58/71RsNNjUjPndN:aHrXmypBwUZ53Z9p158/71Rs
- TLSH
  T1DA968D1BA3F10098E53BC278CA5ADA07D7B3786457309BCF62E047151B93BE95A7F290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  bin/servertool.exe
- Size 17KB
- SHA256 b3b1b4bb0445acb2083a3b7fee651f9722957dd628efc7ca95aea5bf5e3bf472
- MD5 3a1985002a9f35b03b033056efe09697
- SHA1 9b745037c48b7948cbffbb1028528d95f5113c11
- SHA512 63b85c413474feabe156407e03de879f0b49cd251ae018b9de2b22ff0b861824bd4a6bf785c1aef6567bd62e7d9ce09b5e3e488e880d594aa7d5ec8269d114f5
- SSDEEP 192:hNyt8VEnfdYBvXvIybSCFTgcnYXJOTRzTg7nl0E7V17S5tfhWXeE:hw8VElYlXwyVRgcYZangzl0G37GWXeE
- TLSH
  T14E725C06F7E10CC5F5224239C9F31612A57ABA3B6B2592EF578406092F793C1BE37794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  bin/splashscreen.dll
- Size 193KB
- SHA256 4ed6cb494d69c2d9959f7b9a0a6bd4d36a998c2e331e473dcfca1c201a7d58f9
- MD5 319d7a61f5a77d6d959e6cec5d09d237
- SHA1 5a4939f699bd415ae481b32555dd2a72512a12b4
- SHA512 739a0f38e095ae1b8f1c4d6371c454fd86e94fafbde2c0abc0bf39b65eb3e8e2044719b8630273474b4cb47928b542f454f243e1daff25791cd40962d99b4cfe
- SSDEEP 6144:kiL2BXaAlGf5aFxmuK5Na+uXl4vIzQyP7nKNj:kiLv5NkQ0
- TLSH
  T1FE149D46B3B040A5ECB38078C6E7861BDBB1B525139486DF87848B767F277706B2C7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  bin/sspi_bridge.dll
- Size 32KB
- SHA256 384c60eab2f61705058998097e0ce4cfd4e4896346052e86b7c6e6f3f53105ec
- MD5 9747045ba39272c135e75b48075ee4bc
- SHA1 34041948921497df7b0fda614216c24dd4f2eae5
- SHA512 158a5e59552cf8f4d3e0a15c34e85e725be2468820c9d7e64f08acef82aa505caab5d349ffed7b91abe882f868d0f9f12a12a66946c1a40f534f4acab282fc5a
- SSDEEP 768:UCRkueBEDENGJI9bD3cbEWQwEVRkqkEQNd3fbmqj8SC3:UYtFENcI9bDsYWUBVQNd3fpj8SC3
- TLSH
  T11AE2182133950199E467C179C9E6072FFA74B8E23B2383EF432187AE4FB22D25635E55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  bin/sunec.dll
- Size 131KB
- SHA256 5eeb27f27fb194b7aafcb75368a28b005d54c7dac1f020eb97d5fa86d1d6b2a3
- MD5 80a51af70f5901a8b6a341007a7a0d28
- SHA1 0dcd9be9d94771c233fb57d874f29a5f5d087a21
- SHA512 8af4db6c748ed09fca84177042e452b2cfc23f34cf02c67a7c797a3f05d0bf87a7dfaa91969e1959e4dfeff68ad1c494d73e16127231ae122852b13e4b003d03
- SSDEEP 1536:qnVN0q+BuMMbBbTVpGqgcPKS9D2i8YuWz+vUT3bKIY5hNOt0hdOmo0JvL7w/W6qY:IVGjopG7wZ2iIWCOZ6OuheI1484A7AN
- TLSH
  T10DD3194B72D09297C922C630C5A3F156EFB1B82973E083BB13578A45FE273D5AD36264
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  bin/sunmscapi.dll
- Size 35KB
- SHA256 8b6ad422e6044a76130792dc0d84b8d197bfec26732c61e5e1a2e8b4f8104b50
- MD5 e6b9f54cbfc7a69a7c8c82ed52dde9f3
- SHA1 9ee4eec3df73110f436bc29a4687a0e681ab1172
- SHA512 7aec24d24ea4d424a62f9465083c2d86c82bab7434563dc8f2bb2a2a22330b6b23ea461e44d6a1fcd6230cac099593b904107277343716dab80ec5d622376cd7
- SSDEEP 768:SwVt4a48XM6fhfd2/TU4YeHuks0m+yDhmtz9aGw:SwVDXNp12RYeHuks0m7W9an
- TLSH
  T1B4F20906D3A204D6FC73C9FCC027561BE275B816A322DBCF43508A5A9F57AF1A63CA51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  bin/tnameserv.exe
- Size 17KB
- SHA256 d829778e902120d1b61ab1f7766b9734adcdaec0af627ff298e2bf0e576eddba
- MD5 b9ccc60deb01161572c7b0d8fa50a97e
- SHA1 1c6801a4bff8fc56e978a6861363657c60c825bf
- SHA512 dc3ee8c1a3f95fee34d8368d2d1272244b0a653230f9f50689d1f5ff7391a7f5fbbb94938c2eede0166b3e68d08af0f8aebad9bfff277e33a6496c975da9c214
- SSDEEP 384:0xFUFERwYPXIy7vkUoQaDkURl0G37Z0eE:0xFNRwYPOUoUURd7ZxE
- TLSH
  T1BB825D45FBF51DC6F132423589F62602A5B6BA3B671582DF67C40A082F793C0BD37A94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
- MD5 15d9ca6f1d87f15f5c67740df2bfa874
- SHA1 6d84c52d33249b216223e02cb445b886bea6b45c
- SHA512 24796d3aded0a49713489b285b9d38fd041a7376e900684053c1df106a509a315db9e646c7286fd59c79c664557e6d4e6843a55828abf04fc04d8b307829fc6f
- SSDEEP 49152:IgQpJ5yZBtfCp00oSO8hCsDsbJQk/tJ4q0nLhII1ytiT45z+WEjNHsRLf7OFJOMZ:4n5yZBXLxkf5FJIaye
- TLSH
  T15D463903B2858099F05DD1B9474BA623F632F8801B72B6DF52A41F192E77FE06B39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  vulkan-1.dll
- Size 938KB
- SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
- MD5 8bd643a9f7ef2619b792cf2544f27a8c
- SHA1 8d5aba34d852c9b9f62a4dca5ca138dbc458c931
- SHA512 8a81c4edde9d20ee24d3390338915f096a27956bf57815c443a37f15bdb4072a0c959376721d2354fd565045efb3340922a9a22f3293bb3784cc6df6a0ac353b
- SSDEEP 24576:gawxZ1onv5Sp+D9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:dSSApY90IDWb36Z5W1DYsHq6g3P0zAkw
- TLSH
  T163155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32