acc62e1fa90cf6bdfdfa26c3e27f5e9f1c91f00df8e5e724bcb361332718a7d0

Sharing

Copy URL Twitter E-mail

General

Target
Native-Access_2 (2).exe
Size 177.5MB
Sample260724-1sektstybs
SHA256 acc62e1fa90cf6bdfdfa26c3e27f5e9f1c91f00df8e5e724bcb361332718a7d0
MD5 994d06a5703a586278290a008e469524
SHA1 6bc4e11392786844c1ac1b31ccaba8088b92134c
SHA512 c910ec3fb7515f339ecaacc3adc438e05184ebbf35d98c1f5a8712181f0b970c4c1e7472df3660a7d51e2cb8bc0a5c00983b70650c7bdcee248c20e0343de589
SSDEEP 3145728:MH4oTb2WwFT+LNRm0kuoNcJfCf+j509TKX9aWAE5PJ1nQfkZCnrzmuEFd5L:I4o+WwN+LNRm0kuoatC2jHIWfPJ1nQfg
TLSH
T1739833A392688054D44F257C9712E5744990DEBBB086C2E6BFCDFE6F71B2A200BD67C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Native-Access_2 (2).exe
- Size 177.5MB
- SHA256 acc62e1fa90cf6bdfdfa26c3e27f5e9f1c91f00df8e5e724bcb361332718a7d0
- MD5 994d06a5703a586278290a008e469524
- SHA1 6bc4e11392786844c1ac1b31ccaba8088b92134c
- SHA512 c910ec3fb7515f339ecaacc3adc438e05184ebbf35d98c1f5a8712181f0b970c4c1e7472df3660a7d51e2cb8bc0a5c00983b70650c7bdcee248c20e0343de589
- SSDEEP 3145728:MH4oTb2WwFT+LNRm0kuoNcJfCf+j509TKX9aWAE5PJ1nQfkZCnrzmuEFd5L:I4o+WwN+LNRm0kuoatC2jHIWfPJ1nQfg
- TLSH
  T1739833A392688054D44F257C9712E5744990DEBBB086C2E6BFCDFE6F71B2A200BD67C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution ransomware spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 152.7MB
- SHA256 fb2499fafd47f9e111ce76cc38fd4131761e47516eb4f9e1da11d157d524169f
- MD5 399f57adea1dc3fcd5a9883ff6d77d81
- SHA1 2661dcdb86766fa4c19858b4057de27618e31792
- SHA512 10928844a015445cec7a6766cf7e3c1de3217738b11d5f113baf14cc34f5b667615d07c187246bd510dbaaca1a48e9c09c5d7642a58257ffa5effca3377b9914
- SSDEEP 3145728:wT+LNRm0kuoNcJfCf+j509TKX9aWAE5PJ1nQfkZCnrzmuEFd5B:M+LNRm0kuoatC2jHIWfPJ1nQfTmuEFrB
- TLSH
  T1447833F342744960504F96BCEB22A18558509ABFB4C3C2D5BF5ECA7CB862F604BD23D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  resources/app.asar.unpacked/node_modules/jszip/.eslintrc.js
- Size 896B
- SHA256 0ddfbda0c594ca371f67baaa166734f5075d34ef56fdd2984f574564843c2a66
- MD5 b4ffccbf970b4bdf655d07867ca30037
- SHA1 599b0c07cdd17ffbb0cd70e427fedf60cbc5ef69
- SHA512 db7cdf14c28564d708136d3cb6b109523aef5f118274e6175b3c4dd921c0c1ec60aaab02e3c8e442824ed4c14a383dc11f3177de3bb6b93b43ca35c0f6697f97
- TLSH
  T17C11D61DC5E90D6305D8B1548C4E61C2B69040D75DB83F2877DC428C2F1D62F99B93DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  resources/app.asar.unpacked/node_modules/jszip/deps.js
- Size 1KB
- SHA256 35b1b517365d5935151333ef8b57048261b79573b765e96e5ba69aa0cc05a8bb
- MD5 b388c22338126e8da0ddc519021a0c34
- SHA1 c865c3f9cc041ff5e3eb664b5e87b66f859f036c
- SHA512 5ac41f6ed1336295166417dfbdd8b5f9bafe8fb5db2c2dd4e99a14e74a5a6d2bc2e5e4053cc556a0434466de4aa67b39c26cbec10669551c8b90a42e7baf6e7a
- TLSH
  T1AF218C095EFE3530D16367C4CB4B40163BA3E6873A0AC244B29CF6759F4A958906AEDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  resources/app.asar.unpacked/node_modules/jszip/dist/jszip.js
- Size 365KB
- SHA256 e2e1be5c22d3f15b0b89e676d3eede94644529996d9898a6b1587c9908a78506
- MD5 a592251014cf4c0edcb64c57deff7a88
- SHA1 98e50ead811e86b2a55ede0151472ddaf6fbeb8d
- SHA512 dc528028d0c76df5300205b8e70340bdf8090c374da138b93d9594eda9375e6d17f2ed0b6c3056644c8f92545e6d367cafea743362882560d86508c33f261010
- SSDEEP 6144:5AjW+DHJdQZP04bFid7Hq4/wHJAmF7DpTOl:zMQZP0Hwyl
- TLSH
  T1B784084A2AF62223051334B4DB4F6185B2AAD11F136AD9947C5DC3D42F94B3982FDFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  resources/app.asar.unpacked/node_modules/jszip/dist/jszip.min.js
- Size 95KB
- SHA256 acc7e41455a80765b5fd9c7ee1b8078a6d160bbbca455aeae854de65c947d59e
- MD5 b5d02b3f0bf3ae026451909419df07bb
- SHA1 c96375d50e72b199aa54de7b9ad908fd5a2dc7bc
- SHA512 5cc55ddbc175a07fceef57f3c019d5ec7b9c2f1570b717f6e9757c3f8c0f936e840f1b8667dd4df1bb0eb6d9a7a267020f7092e593112f9d07d0680e1ef7a0b6
- SSDEEP 1536:7YwmJxUOuK5LavAojGhgJAVdJRE2z86zTf4W/Ht9Np0P/AK:7OLVjN/X6AK
- TLSH
  T12693179A31A0705553E629E4405F2B4BA1B62626280C406CF738D9DA7DB5DCFF27BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  resources/app.asar.unpacked/node_modules/jszip/graph.svg
- Size 44KB
- SHA256 4ee632fe1845c8981cf958f30a34b585ccd1d6562d8f1657938a67ca4d25e6af
- MD5 ee3058313ec10b6293a831bae7c43032
- SHA1 fedf80ec2c9058e9568a4c2ae902fcee578c2060
- SHA512 63129d987dc44b4501f8e21a0be0489d7919e2cc9dc408071a8d6aec37e29a6539f626e7f3d53fa5c6b043cae227a0cc55efb48e3f6f24f5249feb0a7f3c2269
- SSDEEP 384:1m2WNfEAYJVPBFb3uooD4TLc8MrMm2QnQ843n8a0qsQkKfPh4JGOvVBY/sLzKqdn:1m2WNVYJVvyo9TLc/w86fJ49LzKSCxM
- TLSH
  T1D02353A897280BF58B904345F7863DD566D3D8BDC4FDB6B88200C4EBF88496EF46958C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/base64.js
- Size 3KB
- SHA256 5df6b73d9ed6c317c67835f3427d860c16fd93acf503eb471fd897167e747fdb
- MD5 8c54fa01388e8168e4c53875748d21c0
- SHA1 39caef779e3cdb7070e77a6e0bf172ec80fe2b0e
- SHA512 f56e934a9fb5f844886b9da387a7a27dd3ddb753bc1b152e59aa98712abb2b2df6bc120c0044c2800b473dd755e2c235234ff9f450adcfb9b698f1d9b636a8e4
- TLSH
  T13E61FF85569304B40AD6B2757BCFA1481AA9A4370B5DD961B86E87100FC06E09BFDFF8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/compressedObject.js
- Size 2KB
- SHA256 b91f823d32f39cda4002bc0954993f20ffea6747d42109253b7d6347b4abb31b
- MD5 732d8c64ad706c5b2b0e8da2688bb49f
- SHA1 e508e0e72afb009ef1518181202215427dd01e1c
- SHA512 0e0096f7b891643ab3df941077262113426f1a8a5ee5e0a2d340ed97cb31a46b0795cd2eb66068bb18daac028ce329a3d658381c81ee0e23b8b0c91cf041583e
- TLSH
  T10651CD7A195D0131B507A8900F1ED3ECA364A23BB1A5C290FB5CC3981F9E97CDDD6AE4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/compressions.js
- Size 350B
- SHA256 50e650a7eaf2a54ede299c12dfba30a362c7644e7c00df0d16ab3cf228bb77b0
- MD5 d463d013fc4b542c46e1629188289beb
- SHA1 717ea29f0547d43d090fbfa8d3d1c949018fb01e
- SHA512 c81fd38f65f675e276dbbc0ba37f8566a1550099362f50fa0ba6bbae23255fa5f938fae3122ef96c433ad253b0a20cd4f1bc255bbfd2917480d560318047d69b
- TLSH
  T1EDE04F5F29E691A4628BA4908E2FC259B69E658320895920BA0CC7E29F428584B74DD8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/crc32.js
- Size 1KB
- SHA256 63750f4131b1eabb545a4718c863af860184baf033c76851be282f1c7f5dcba9
- MD5 0709cbe7eaef0ecdf98941e39d9641a9
- SHA1 c616d0d8e8b883a1d6e9b16d95cd55cdd2a3eed8
- SHA512 1fb72caa3fc30991e9ed577c06cc6bb04e313a6c8fe5351557be1e4d5557cc5149c0d26008e88f372a46282f62bd89c26213d6f4c3e5505fc00bf605c854eddb
- TLSH
  T1964140A637F173A08123F1B853EF804594A9586B0629C8E87CDDE0505FB176886F6EDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/defaults.js
- Size 284B
- SHA256 585eeeb04375fe7bd27e846d8941d26fd435efb36a87fba9ff137fd8b97880a6
- MD5 0d952368666fd8e6560a3c34e1809b68
- SHA1 c0ae17adad24b22102d104887b215cc84f16d63b
- SHA512 dcec207930b47ea46a288e864f7b47acdda9752d2f766f5a488581daddb022c2207b0eb3cf00e97011dd98a7fa8ac14fc8d583a30b32f427e1d0e03cad3dcd58
- TLSH
  T1E5D05E5F087E27F443C190206BA2D7C38E30ACEB33455173893E6B039060A048455E0C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/external.js
- Size 438B
- SHA256 982fed36a600668223d1d0ce8c446f87ccd1f82634df18f206b4a2f4096e31c7
- MD5 767d6368f99872ae08c32712ccb66b2e
- SHA1 dfc550706594c4d2c71bf1117afdc671177a77a2
- SHA512 c163e28ad147ac1428248ddd866fd953830e84207fa957a98d7ae6d97b74078e54af0f15ae30446c7a299a4d80a4ae2f33d210d7a162230feb9e80b50cf61e70
- TLSH
  T1F3F0AB835CF0992B105DA0F0B01EC16B76B4C63300CC1C5738FD86904EA283023170C1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/flate.js
- Size 2KB
- SHA256 57f1452680cf7af6a9659de398d847dd1e870ea3a601662c498b073c640eb547
- MD5 84b2d8c602bff5f114b6c5dec83fbc7a
- SHA1 3e5d9038e24623581088b76fbc450665aecb42ae
- SHA512 29f4e48deb25802b2961ddac5a866a85934f05442f136501c66a074a390a759cc6f1fbc355f7e32792fbe2608997d1bc25a0887e662daf810b2da02ac1738359
- TLSH
  T12D411F8811BD5120D0272094CD6EE34925ACC13B229A60A4756CC7FD5FFA0B057AFFAC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/generate/ZipFileWorker.js
- Size 17KB
- SHA256 907d84ea582def3954aade073444f398bef6edf1b931084da4a77bb4dc26c1c8
- MD5 9e01a5a0b6a7fa86e655dc16aff77083
- SHA1 a0e706f9beb08d421bd13c744024f3967f0bf46e
- SHA512 e4b2713d0ae8f48372d942dc6b1703868a4bca04729090b9b3d60e05444033e43f088a9d123d7c4eec216a58a93018705c0a4691a954d53560db5364d92ed048
- SSDEEP 384:Qtck0G2ukH6PNq7wPYxNXkhIiT/WcgWLEg7wg/hAInPk8kSpOgtUKTTOG/x/aaXK:Qtck0Hu06PNq7Ak/cgWLEgMg/hAInPrS
- TLSH
  T12082952B05E91230DA43B0144B9F6299636CA01F651AD55CBD8C93C92F95F7C81F8FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/generate/index.js
- Size 1KB
- SHA256 19f13a6ff615464657aa5b8651e669950c633095cea37d3179a51d8c645adb3b
- MD5 591d4de9ccc131afcbb943054dcc00b0
- SHA1 4e73992559bb4fc744c9c3111ce511435234ae85
- SHA512 a03c90de2805f1759ab98dc2ffd155d181b60fb62d86ea723ed21b484686825c1c5e39b30f332c7ea172d2d9d51d0cc8bf8a4c469e11be19028ea00475aa2910
- TLSH
  T10B41BE3A1CD902702893E0605F3DC18D93B491AB3649E1A0FD5DE2413F48865EECAFD4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/index.js
- Size 1KB
- SHA256 0fdb844fcdd6fd8ce8ced5e20b37cdabb629b4c155a1d3fb5df29c69eeb4f228
- MD5 f9ae13a5b07397c641a0c725926d5bec
- SHA1 e60da77b111d4317371e9bb018ec7ae5fe0bebe5
- SHA512 d55eb5775f8730852153aab8dcd0030179b73314d5bba58985e460ac47ac59f6ea3b194800e91459419839e16c7b467c5335c975c5ee3864cdba46c720db01d6
- TLSH
  T18431FDC43FF5A0638972F08C5B0A1209F360C42B5069E9817D9E93D16FD00285BFABE5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/license_header.js
- Size 388B
- SHA256 27873abeec2df3693480a8d1b8fe17dd61bee843d1b39c1c9cfab57ffe93099e
- MD5 ad3a5a4bad0cffc28652c9301d194060
- SHA1 928a316641d6f7d234e3b2ec94a15acedfd1bfc8
- SHA512 8b44cd16e7488818da6f890cff8c2a4ea16a3c97676aa4bb5f7fbe29886eac37ec4dda69dbb841deb6fb7bd7f58f6e9a5f14237f3835141f9f8c4307b174b5c7
- TLSH
  T155E061C7061445971B7088EDA81E1D5FE17C118D174EC9D59C510623003E81111CE77D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/load.js
- Size 3KB
- SHA256 7e3181c7669cfc584f29f3060cdf210021ec5c723c36af039fb5433de52d25da
- MD5 bb8c6d8a551a827dac739dd7f9d4ced3
- SHA1 78dd574a82c5bf7cfab658d5afb2d3c401a708a1
- SHA512 633d6336277e067dde2f7998af88a2698c709457d6ac6a9e7e0a741484699197bc85abd263e580b8886499bbd1fd7f2027ce1d18eeead16624ab4a41d66d1e5b
- TLSH
  T15B61F35E1DE1235432A370B4AF9F410574A5A2231958CE347B8C93D02F45569F6FAEF8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/nodejs/NodejsStreamInputAdapter.js
- Size 1KB
- SHA256 dcf35c72168e825d2e634cfa13a289ba8c7a76da0584a39b785611d0d736ddd9
- MD5 ba7572e9cd7a93894f67f7fe68866360
- SHA1 946c8eb1a1ab8da31abde986fad142db6a708223
- SHA512 294e20b6dbdd6ec4a4d78cc088655e5876c06e49b042d5a3dd2bc4973525135e9e128a9a2c632f9a7fbaa9ec67c50228faa1ab7daba0ec7c679d3c3ceeae8084
- TLSH
  T11341AD9F0EF53026D25376B49A8FD345A1AC906B100E48523ACCC2E55FA687C97B5FBC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/nodejs/NodejsStreamOutputAdapter.js
- Size 1KB
- SHA256 cc88c3a8e6aa74262bd1ecc452ee8f78c48a16a0b6095d2f9df7500320957799
- MD5 fe378cccb91e45ebf8b5faf510b8d339
- SHA1 122865011b214d0c334af5511d36cab6819457ed
- SHA512 a989bd4d21e18fc7fbb44909cc0569fb5ca92c5d0090863e59db0882ba1c0166e01a4b481d498bb3b1092c575e56b784bca387ba9022465ee97ff1fc2235960c
- TLSH
  T14911ED5A4DF03B11457371E8A81FE2A221D1C267224E88107A8CCEC20FAD0B49BB6F78
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/nodejsUtils.js
- Size 1KB
- SHA256 763d0af1cde619da6d9cfbe1ee82e2e32d86349d8abe32613c7481e8143740e1
- MD5 fefacb3665ecdf94651c534cc9dd490f
- SHA1 842aca3516e6cb8cba0f5a8f2a6aa10efe6b0559
- SHA512 308e67bf01c42af5687306c056f9f1845301473342a6f67ac15fb9d7b1c1f4315c63ddb7a7bb60cd6c33699df1b79e76ae64dc276b5a5171af1c6d5d5d4bc6f9
- TLSH
  T17E41ED48AEF692110563796103CFDDCFF164E05F276848817CAC4DB82F946F8DAB22D5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/object.js
- Size 12KB
- SHA256 51f8d689e02f62837edeb449866238cf03df7d779d260d19a683abee27651273
- MD5 08968390a420c53002dbd733024b357b
- SHA1 e85ca65b74bcba38e83013859f9535cedadb7c42
- SHA512 9e127f85ef99ed1db10548d899d856da210e71575f1f4e2459c61de2d08abde272c6da33dd3d9612f3d072216b2002cb59717de8f69122b6e991296985af20e3
- SSDEEP 384:poZYGJmKS73IRwRxC1N0wRHYWlW9WJB3VDG:4lw4oYrYK0EBM
- TLSH
  T10542859D2AE76222516376785B8F2448F238C00F236CD8517D8CA3E07F90A7496F6FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/jszip/lib/readable-stream-browser.js
- Size 441B
- SHA256 ed51f0a96964f61d5700b6c681b055dd07e27140f1b719d2fe1c64fd14b506e0
- MD5 72c894328184433f38138c85558fe0ac
- SHA1 1cc48eaeb6efb47772fc22bf34c9741db98ce506
- SHA512 1ae55cb9586b9ad563298960454076002986127315a59bd2516365ba0af3c4141d032405945ecdfac28ee9cd43cecd1c6db2dff25088c5d640c3dc124d0cb967
- TLSH
  T1E7F0F18AC9E873336A0B5DD1D70B23EB87E6E0CD2A11E101283FC3484D28D884377DA1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $R0/Uninstall Native Access.exe
- Size 299KB
- SHA256 fc082041075200902d73fe0e8787f66fed2b29944378c98fefacc8eb823bfeb0
- MD5 6799f9db02482d8418a790fca0a646f8
- SHA1 5d7e86ee5db1d7c616ec79ff8481ab134ef2e56f
- SHA512 9dc2e6e0e69b24fb917be9b08f8bd18dc0b96772b6f51a85363116e4b162c9281b4764d269b86b99242b7405448695579dcb731525b05001e8e1783c5dfca378
- SSDEEP 3072:xn77v00hEoDEtautaxiDVD/Inycaa12tvhOEA1RJCir86SrSrv+a3MG:x740IAUDVD/Iyc52t0EyL+3ar
- TLSH
  T14264BE11A790C45BDD7A0B3046ABC7B63D72AC8429664B937BD53F2F39B17806F1AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral31
- Target
  VC_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH
  T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral32