e4d7eccdb9afa33be3bf208bf7a994c4d4bf870d20908d6f987455f5d02ff813

Sharing

Copy URL Twitter E-mail

General

Target
VibraLCE.Setup.1.0.1.exe
Size 93.5MB
Sample260724-bykllaea75
SHA256 e4d7eccdb9afa33be3bf208bf7a994c4d4bf870d20908d6f987455f5d02ff813
MD5 affc65dd9b8e2e4927a129214f658493
SHA1 35a4271420c67660d36acb194be96f243ee842e2
SHA512 c09baec95d7d0771f05b38ff289f1cd18ff9e7d65b4a540a08d62d0fa13f42dca945a9de1778dde89ff0d5332e2e76ba9c833b709fc98320f0d66157e5104cf5
SSDEEP 1572864:Vm2YwYWYJ7FCCjaZYwXf/hcH0yM5+cYy4/TqTWK+JxgavYJoHrKfDx9JkXPkmL3+:Vm2YwYNtHe/hcH0zh45K+JxV1LKLxUBy
TLSH
T11628336B10799A06DB32CF79ADE68F59B26D74904C8A303F770C172A7F94944DB2D04B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  VibraLCE.Setup.1.0.1.exe
- Size 93.5MB
- SHA256 e4d7eccdb9afa33be3bf208bf7a994c4d4bf870d20908d6f987455f5d02ff813
- MD5 affc65dd9b8e2e4927a129214f658493
- SHA1 35a4271420c67660d36acb194be96f243ee842e2
- SHA512 c09baec95d7d0771f05b38ff289f1cd18ff9e7d65b4a540a08d62d0fa13f42dca945a9de1778dde89ff0d5332e2e76ba9c833b709fc98320f0d66157e5104cf5
- SSDEEP 1572864:Vm2YwYWYJ7FCCjaZYwXf/hcH0yM5+cYy4/TqTWK+JxgavYJoHrKfDx9JkXPkmL3+:Vm2YwYNtHe/hcH0zh45K+JxV1LKLxUBy
- TLSH
  T11628336B10799A06DB32CF79ADE68F59B26D74904C8A303F770C172A7F94944DB2D04B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 15.3MB
- SHA256 e252ff70e8d0a84350dfb28fb0a217e2955c7a5fa6599328643a02fa28ddaada
- MD5 ac3819300c2dd8002d56beb3a0d4aef6
- SHA1 d56a42c5d48c7ffe8f3b95c6c47f731d003e419d
- SHA512 5c5dcca04887d625cb52fbd2df610856618d1baa055f933244eabeb2c6518797f63b451f7aa37d2cb68bd4d427e7eddea6cbaf319725499cb5e3b532d024c603
- SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+O3r8xd2zJQf8xF6DNgQdGxw:w
- TLSH
  T1B3F6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  VibraLCE.exe
- Size 204.0MB
- SHA256 7c3bafccbda007cc0ccf17047471e927f11c39eebec67b9676c83340242cee2b
- MD5 d444e1cfcd080d19bc8d787324fe6f54
- SHA1 524a4556b408c05766e2db653182dea6fa54f7eb
- SHA512 3fe7dcbe6cc5189624881cae603bea3087f506f0963be4d4815342f10205a6dc21a9718ad613f91186ab3e1615c4646e98ab3d5c8f32fba0e50792573a108f53
- SSDEEP 1572864:tB4PuKuPCPGv6p3GWhe6RdAzNoJcEcm08jPF9aWbfEA32pKGv8WzXgGDPexfcK1X:zvuNB36/HlMjZ
- TLSH
  T15CA88B03E29A41D9C05DD175575A9233FEB1B8094724F3DF2BA447522FA6EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 a40a84bd8185a4fcafd1099119800826f3f92d76b7c063c080391b9730eb6519
- MD5 217555afc8d5314c3044cb0e642a511e
- SHA1 7ea25474433ccca80215fe4540df7f1faf8eaaf2
- SHA512 e654d9809fab5696d76bb2d6c3459d8035e828a924092974074c4172e7c43b1b4c3608a5f7137476f3568595706f6f7b4bfff5b2f03102a7ff688f4ee56a0dcc
- SSDEEP 393216:LDo0qtOp5zxtGlyWOLynvTWcRedql66P2RJ:cOPxBQvlh2
- TLSH
  T157473A122646D49CC059C879C7678B268A6C30E73FA7B9EBC0F451252B79EFC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 0b022f4e134f5306d9a84b05df6d8c3902b271f44fa6fe04f49893eb3aca5837
- MD5 fcc8264f5f5cf67159fb40e6c9893cd6
- SHA1 5e6ebe50eba2c5aeb2115e92c4c8aa1082afb1bb
- SHA512 2afd5580a39528d6ba2b85f483343c5be04f798d44608793cdf848ae0dffac905ba37b7ce3cd57d0369f1e41e5765c739ebe74ff02df9d85b2b44903d1cb09df
- SSDEEP 49152:5WP28bu0s6grWFv/iGOjeaGgQbalS199aJLKIbk7k64aoijQrNoJdxljA6iPyfI:5028bu0CKiGWeL1bal9ZrNoJaL
- TLSH
  T102E59E02F6D651EDD019C034979B9313F631780A4F209AEB16905A223F6BFD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libEGL.dll
- Size 500KB
- SHA256 826ad6072ab5e780e35eb6e92db88a18a751f327b14e178758c50a55d51855f7
- MD5 a05134b15a27d806a628ff10a2029931
- SHA1 302a1e0c078cdc271daf59322f34222a94f96dc2
- SHA512 1ed4b9f719e3d9e147618156aa20c59d7e3fece7fd7f2a23e7b22299d78bd61609b25f23cc77ec1bb14cdbb07e17a71696b0cf35f6270a5383be06c613ca0235
- SSDEEP 6144:PwKVOb8lys73EbAi3uYDbW1XJ5aihN5Iio64haxiVNcPPmWF3PdPNUkygV:PBKA3Z5XSiAaxiVNcPPmW1JNd
- TLSH
  T14EB48E15F3E947A8D07AC0348A538646EB7578960B65F9DF02E052392F3BBF45A3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 9d4c2245410bdbe624325b1d7f4c27dd48e2541ae8de5ad62f7e3a6ecc9cbb2e
- MD5 21a5355ba57d6cb0725e71227072e399
- SHA1 e35d839f6ea79428c3e6a5740ca6c90063feff77
- SHA512 ba5b30682866fc7a832285965387940d4bb5cc56d38fb6541c203bfc271db2149f4b0fd25f551e19fef24578cf0f5a9fddb4e0d20385c9f4faab2fc324c40bcf
- SSDEEP 98304:4Hm3j3XoOkLxIpo4WddKJT8Yt5d4o5we5MMWR/:8gj3/0xIbZdO
- TLSH
  T1AE866A03F69641D9C01DE274975BA223FA34B8550724B7CF2AA453262F66FE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/app-update.yml
- Size 89B
- SHA256 9195f88caae2a7000c6055ccf899025a640f1834c2a9c8d5f1121e8b67c29b55
- MD5 4167764d26f627555dbf344013767a45
- SHA1 0c1820c91c9d54763ea126a075b58f12f3256ae5
- SHA512 7502c1a0923f613482868f8bb259294160c511299de96535f3bf480491e53bfbde27b285f11bf32307e7df983049671a2e8dc05823e4e6a01dbf0332fe8d2298
- TLSH
  T16AB012348316C43261354814B8881434506820A194014A10D8DF001E40038580E452C9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar
- Size 4.0MB
- SHA256 43a4375f21a35f1c5c1cd69a28eb757743a88fa88a29dd42d1029a5b98d80ede
- MD5 3625539edc45719f086c290794a94dc5
- SHA1 fdb2c9607d6025311bd687ce9bf54bc68cb4f7a8
- SHA512 a8319b870eeff1ffe12ed599faa3b502e5646012ac207e19de957c7edcb9ac3ec843df3512f7caa64db7e31dfc0ebd141f7e3c76cdfbd6940784a7ad2d6e0535
- SSDEEP 49152:C4UlhAejRmg4zjRmz4zZFNI8QFThKfXp59o3kyhAgsJsZJsWEwl2QhfkCN9CBLCs:C4U34i4zRCfkKOLsdlw09BKoS/60RD0E
- TLSH
  T1ED16AE082AF39522856373B64B9E4002F775C81B5924C664F98C9399AFC5F38E2F5FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  snapshot_blob.bin
- Size 331KB
- SHA256 3e89e63b9aa6620c7345861747bf7ed94fa47cdf5bbe4ae0e0fe24fe6d8e7cc4
- MD5 797dd305262b5ca109a12176164fecea
- SHA1 ea3895386bc11cfe9fd092992d3f337fc6fb8d48
- SHA512 6178690ae70dddaeddd102090787be70f36c9987215a96324757ec1913bdcc2de8e0d74e5161d68f3c8e9b05bb1090506b3c93c9410457d11a66235208a9f37c
- SSDEEP 3072:y/nTOiXKMOt+xbRu2frRRyaBQ6h1WuNI07/X1A86M6VHfuOLQK+:CT5Xkt+H9Z1WuyclxEHf/N+
- TLSH
  T1A574BB06F759CB26C9893A745DE983982E2072CD9D55B30B3109B37E78BA3740D3A72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  v8_context_snapshot.bin
- Size 696KB
- SHA256 a456287a78bca496f9ff079c80d3b72bd70ee945c873c39808aa4e4d0428ac60
- MD5 f2ebb61cc3ea54a3e177f05853a756b3
- SHA1 db7be2bf5130f7a45fc681a2026b348129d6940c
- SHA512 edf6d862025e69a3bdef2a5501fa705ba07bbe3e713614958d496153054877a9ba3414904c074cc6b277251b7e7e518d36d00242f31134705c3077b02e6e1386
- SSDEEP 6144:Eaf8tLrT5X3ukt+H92AqD9clxP2NyhaigNw69I3ndbkboE/UZ703yCTzrWD:Eaf8tL35X3usCN2NyI4NbkboE1rTzm
- TLSH
  T1F4E49761F71ACF26C6493A7D8DD657463930B2CE8E46E24B3406B33E78B96704D3662C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 0344aa5093ef1253db98158930b32ac1ac4dd2fb6d4f7ae60c5e820ace47f5c1
- MD5 16baa4ee45971f69b18eb96e9e19fc54
- SHA1 ed7aa878d4c4d84d8c6456dcfc855bb3f5360648
- SHA512 e0f1dc4d89c85283812e6b0fc1e212cc123f1ed461b1296194edad61aeae4ae2a289a77086ce6df27c98c5815858f8ce2684edae4cfb3ff87705bc7558511c97
- SSDEEP 49152:lRAYccoQajkjwWrTd/hMFsfyTpkXNYSsnt4p+L4lvgPTvFaHmJrL+4jopldbIqd/:lFccS3OQvNToxq3cTHIXP
- TLSH
  T1CA463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH
  T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32