a34f6ea95e97614a5c271bf9e759358049a025b2664ce871675bc095eea5d7a8

Sharing

Copy URL Twitter E-mail

General

Target
start.exe
Size 66.9MB
Sample260727-bfk5eafn2y
SHA256 a34f6ea95e97614a5c271bf9e759358049a025b2664ce871675bc095eea5d7a8
MD5 0e5ea64a79b773f519be67bd4dd4861b
SHA1 c41a59efad3149f951a55125e92e634bcae2cb9e
SHA512 a8d91d51b6ab8b8205be2d79213c2aba5dd29741eb0c6fa1910475526050e048c98ad4cd8977ca3840ae546fbf1315e60ba6bd3ad4c21021961550924987f43c
SSDEEP 1572864:x0F1s9gq11q5Mjm3wC8Ou/Yy/KmA9rPNI+em8Z/tY:x0F1shfkTdXyymiNIZm8Z/q
TLSH
T111F7330CF5ED942FF8C79B3002329A7D9F069A782554725B735E4B26480AAD33D607EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  start.exe
- Size 66.9MB
- SHA256 a34f6ea95e97614a5c271bf9e759358049a025b2664ce871675bc095eea5d7a8
- MD5 0e5ea64a79b773f519be67bd4dd4861b
- SHA1 c41a59efad3149f951a55125e92e634bcae2cb9e
- SHA512 a8d91d51b6ab8b8205be2d79213c2aba5dd29741eb0c6fa1910475526050e048c98ad4cd8977ca3840ae546fbf1315e60ba6bd3ad4c21021961550924987f43c
- SSDEEP 1572864:x0F1s9gq11q5Mjm3wC8Ou/Yy/KmA9rPNI+em8Z/tY:x0F1shfkTdXyymiNIZm8Z/q
- TLSH
  T111F7330CF5ED942FF8C79B3002329A7D9F069A782554725B735E4B26480AAD33D607EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  LICENSES.chromium.html
- Size 5.1MB
- SHA256 fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
- MD5 6b84319ee8a0a0af690273d3d2dcbaf4
- SHA1 857ca353e0582d100dcbc6cb6761bb4430d0cb90
- SHA512 26f9842bfdb429ef132cc1a930da9187071a339927eda402e8d54b5eb9e03067612cdadc3a2dad3d0977f8e6af18c05eab6ac91720221c6a0104f96638f85a8a
- SSDEEP 24576:yd97B+mnLiLsrDy2VrErjKCqzkU98wwg3QeXuh:0P+mLAqHBCuRoeS
- TLSH
  T1D046D66BBB49037316F282626B4AA4CAF31E903F375A1514345CD15C2B7BA2483FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  ValorantCheetos.exe
- Size 129.8MB
- SHA256 f89ba1733ba8de6dfac886acbefd49dc661ab0c0153af2b3e5281a1e2c9d3dd6
- MD5 e8a348dd00a3d0e683ceec1a87e642e3
- SHA1 ca87d96a53cadefa5ce9cde27aba7f15b25576dc
- SHA512 e6294de11fd87f54f76367e8118e4711c4f272f229c1d3bedba3f075b378156c33d8028dcf22bf6bb0d690080352916b9214f81377a14c215d4747bf04ee3d44
- SSDEEP 1572864:+yW7j6awALpskto61KrOh9ha9pDYiTiAiFYGXB4x:xkRskt51mbVaFH
- TLSH
  T127587C03E39610D9F05DD1B59B568636EE72BC460739A2DF2690271A2F7BFE02739720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates processes with tasklist
  discovery
behavioral6
- Target
  d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 61a65e313a8ec1416ca57a778f440a502041a7286252e9fe52a8df0cf0e021ad
- MD5 6e8ff0c1204825a0427f568a0af0bbd8
- SHA1 fac43d02e0f24e92e5bd9faa5050523469486565
- SHA512 5b866de52b22b6dd3e25b60de71ac2675b274485dc4bfc0a1e0b90e12b6b7c0e57350740bce30f57c3fff323ac8eab1ce38e4cc5c4526a3d0b6c28f1beae4034
- SSDEEP 49152:GMnbcrH9v7eCZPxX+qzohT99hDoapghnshy43yBcxnyKbZtjB0HVEMGJSj/8NOi:zCZpX+q27saesDSjbi
- TLSH
  T184C59C17F6A644EDD02DC57483AF9233F93078454724A6EF2A809A252F7BFD06A7E314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  libEGL.dll
- Size 429KB
- SHA256 9727aa72f942760d6608d41ef41ca1a9351a57b1609795ba25abb61da6486855
- MD5 dd89d4e2e2f87a0408f71324b1b12bf6
- SHA1 d2cddb78e1e3c9f3806410fa4599a115c0981c12
- SHA512 1d0ee8fb90b3fb2181919962ec2cbe709308eff9e3671350e5fd7ff72262f46e02572f206eb6c54408cdbe80c86eade6b77d8538f0b131e9501fe30c7afa11f8
- SSDEEP 6144:U7Udu1o3YnElXvzYhRk9o+3Re3wpcOQy5n+Y7dPs:OUdu1NElX7QR2osJ5+QP
- TLSH
  T148947D15F79048B9D076C078CA634642DE72B8DA0F64EADF139492692F7BBE45F39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 213ab083b6b7b6ee8a1cb2786d0cf5af6d65aba34d4e8f3a63dc153f06fd1ffc
- MD5 2a4b48bb231427441c0f044fd2452f87
- SHA1 195f1442aeaefccc38b19873f6a98fad3500963a
- SHA512 7a5ffcad4ffb8f08543291b9adf8d29628df361a73a79abaf0befe2201c39b04a217c1627d6e9e34357ffffc3495960c1f5fbddb421468ec6c645cbb248a0d99
- SSDEEP 98304:nZhH85ghf5DcIgPeUOFuxmDt1FGZxXR0wtDV52h:nv5VF/1FGZj
- TLSH
  T148866C07E2A040DDE00DC1B9875BB222EA31BC491B64B6DF369477052FB7BE06B7A754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  swiftshader/libEGL.dll
- Size 448KB
- SHA256 564ccffa0fbd3ab325d233d785e79e4cc2cefcdbeadbbac1c12617e84ac97729
- MD5 9eee95cdd2ed20d20fa66e3cb61cd7d0
- SHA1 f3495a0b23e0a2047001bc7ae306b45249a0cc66
- SHA512 9e243a199a275648c31bd5013b12a10cc9c29dda17f153bbdc1e79bd03ce01a71f93873e3d2b4806b8745516ae0dd9d5dc6bb83766e7ce5e41a1314dab7aa403
- SSDEEP 6144:FH0B/LCOJ7lTp0k7zKd0POc37Tta9pdEp2si0xeLB4Vz:FMCOJ7lFx7zxt6dEY0wLSV
- TLSH
  T16CA47C16B7A044BDD066C034CA538A53DE71B8960F25EADF1394926D2F7BBE46F39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  swiftshader/libGLESv2.dll
- Size 3.1MB
- SHA256 24074d69f67605752e79e669ad1ffa3790700d707d742266ad4657b9ddfbaa77
- MD5 a95b468a1ca95eed5f6490e9c206a443
- SHA1 6ac1c8947f424b83c03d2c0f807739ab84530895
- SHA512 6c76d1e1a374947ab22fd33659856857ff5867c0c38599037bf7aa19ddc52348623e0310c2536d4fa5c63d544f0cd9f15a902172f74f2534eca68058733417b5
- SSDEEP 49152:eAtfKpPXV/5DdijA29+0QdjwSx+qovRYFDguXfol+4iduejy3bEW2ehvxLTL10di:twNynDyguydMVW5vV
- TLSH
  T1D2E55B43E55980D9F06DC6BC874AAA2EE632BC81177272DF52A06B121E37BF0173DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  vk_swiftshader.dll
- Size 4.5MB
- SHA256 56d7254445cbbaa5fc755649c6888bfb4296c2ff2acae7eaa6bcd4510d24f80b
- MD5 28da89a58a9858b7dc6f6e5a47fa1fbc
- SHA1 c5408c1a6608e5bab172f8c28c9d2a6a13a4ffd7
- SHA512 3a7c7465de59966a42be7bf375ae2292f20fd35845a5dbcf0b4dfcbe902d947be1279e7c7a9b0492beb820c90150f58b9da3162c9658847a6b118d1c546a63f9
- SSDEEP 49152:j3YxjaP0AETYj7g/yaI75j/7wiSmQEZLT/lbMnP3cuJUiId+R9iETUjdCB2KmGsi:yAbIASP1aRldV
- TLSH
  T177264A03F6558199F02DC67D8B4BA622E631BC811B72B9EF12A03E051E77FE06B39715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  vulkan-1.dll
- Size 707KB
- SHA256 c3718a47dd8cf5e0a6b45188e42f5c78ae535e98119276d7e54441f2def911cc
- MD5 5d38080e124b350146e1adcbeb8a87c3
- SHA1 baa9f9e204eb7d2525d55a011ec43a6fa90a5ab8
- SHA512 8d877fb269bd22272999e24735765a3ab4c295809411d5c630d24348a928fb0ec1442b94ca69318660b722e5e50febf3636e76e29ca115eac7e7606fac256bfc
- SSDEEP 12288:twc+2rLfirhAu07HvM5BSNraGMiuvo5PAp:t82r79KBSwBiuv
- TLSH
  T1DEF47D3A7E94015DF5B6C038DA074621EA71BC620B64B5DF13A0131E6FAFBE42B7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  $R0/Uninstall ValorantCheetos.exe
- Size 135KB
- SHA256 24cfe2ba50a0f81dc6f3b1ba12ce2a3f873d9f5c25199e29bbb46ee01d22ab50
- MD5 a12d377b37fd925ea27917f72b2ad249
- SHA1 bc1cac18fc10bd552d4afb6951e9f55a3d70307b
- SHA512 147b8080e77116383dd49f2026fe42bdbbe043a99173c07a69354a5aa867c6993f516412e0e2926530bb058af0cafffb018d52397768fe352a8dff23f879164c
- SSDEEP 3072:on77v00hEoDEtaucceA9ZRJXVmaH2tvhOEA1RJCir86SrSrv6Ia3W:o740Ism9Nss2t0EyL+yam
- TLSH
  T1D6D3E000B7A0C867E5F64F325AB647EB2EB2F51124285F433BC02B1E79927A1EE1D751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral18
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Enumerates processes with tasklist

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Enumerates processes with tasklist

Executes dropped EXE

Loads dropped DLL

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22