52066e9e8ed0a49b78043ab298bfe597e6d24c0aa2eea27475b0fad149f9fe2a

Sharing

Copy URL Twitter E-mail

General

Target
LiquidLauncher_0.5.0_x64-setup.exe
Size 7.0MB
Sample260727-s1ea2awcle
SHA256 52066e9e8ed0a49b78043ab298bfe597e6d24c0aa2eea27475b0fad149f9fe2a
MD5 b85d46dc29fb476fa844c094c833225c
SHA1 2d0a3d8cb42265e4e94376f5c6b4b8b90bd9ce37
SHA512 4e773b38dde6bd5702380c43183479a0067f9f7f42634276a3cf16dcbc07a4e0244a64a84f2e5e1e3a8f2d885c7ad9036cbf399d0ef1d20114bc59f04e8517e3
SSDEEP 196608:tCMPGAra0BAjvAhXC1l9JZZVSzjz+UKqgj9TU:tCMPlrlBMmSH9JDV4z+9qgj9I
TLSH
T1947633A069F7C16FD9A12630B34EA5326C573F0B211811B6629C1DF8B6B1D7CE31E5E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  LiquidLauncher_0.5.0_x64-setup.exe
- Size 7.0MB
- SHA256 52066e9e8ed0a49b78043ab298bfe597e6d24c0aa2eea27475b0fad149f9fe2a
- MD5 b85d46dc29fb476fa844c094c833225c
- SHA1 2d0a3d8cb42265e4e94376f5c6b4b8b90bd9ce37
- SHA512 4e773b38dde6bd5702380c43183479a0067f9f7f42634276a3cf16dcbc07a4e0244a64a84f2e5e1e3a8f2d885c7ad9036cbf399d0ef1d20114bc59f04e8517e3
- SSDEEP 196608:tCMPGAra0BAjvAhXC1l9JZZVSzjz+UKqgj9TU:tCMPlrlBMmSH9JDV4z+9qgj9I
- TLSH
  T1947633A069F7C16FD9A12630B34EA5326C573F0B211811B6629C1DF8B6B1D7CE31E5E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- MD5 d070f3275df715bf3708beff2c6c307d
- SHA1 93d3725801e07303e9727c4369e19fd139e69023
- SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
- TLSH
  T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 30KB
- SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
- MD5 fc4691e51cdfac476b2fc63bbe951e82
- SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
- SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
- SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
- TLSH
  T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 3c60fdbd71b468cf52fde6f780740a910c9d190e7023b1ac1217d427d794ccb1
- MD5 5424bac02db3d21e75c21ff2049cd04f
- SHA1 331caa8fd3168ce4cca33fba823acecc379ac917
- SHA512 879887a64c39dd9721c1cdc2361dc3a95fadda6dc7d4850c0489ffce7365215698eb3bceb09f274c585a0c2f9f991f5e3735b7bd4c4249bbdffc9f9cbbf2e511
- SSDEEP 24576:AiEMl33a62nb8ZY2gcUKq3J2B4dZSpQKmpNx/oKD+EKzWOTxO2vzLqw9JEa:AiEo3K78i3cUNZ28qc7/AEE86uw9Jr
- TLSH
  T1C075220135D14032F6B72D305AE0EAB66E7CBD714EB159CF53845A6C6A306E1E33A36B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral6
- Target
  liquidlauncher.exe
- Size 19.1MB
- SHA256 9bd19eb5493a6268b1bcec59c93ffbbb78c67bf525fafd01517316e7f1db7652
- MD5 59902ecc2fb0f0dd26a5a75ba15ca806
- SHA1 fec59645c03922a8a7b9f7880446b124396c69ef
- SHA512 b2f07535d0fcc2de93f0e441d6ec1e5b9cb6a4bb73d174bdefba8ae27a8f5f45bf2b0095a1d7e8d16ed63187b09fc052cc5870305198c0fffd5db96f0fed85d5
- SSDEEP 196608:X12i4o+RG0bsd7GfbvL1gZOmgemvO88zG9Xn:XgRG0bsdCfbZgZ1gemvoG9X
- TLSH
  T1781729117A5B98ADD09AC8B083474A735E2170DB0A36B9BF44C456393FADBF06F2D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral7
- Target
  uninstall.exe
- Size 75KB
- SHA256 25a79a1647f3aab92e3071cbac160814bc32a587aefd3e5ca1aea35a99c389c0
- MD5 9487debf1c88abd4bc472e7534eb98e4
- SHA1 22ac1ab22964214616484443d8aa495944147cdf
- SHA512 7efb002f798fe6c5186aaac080f7713089f361b3ccdf88ed89139c64099a8a4f6486450b62b231e8558cc05e6702a0ef5eec8eccf9b4f4cea994e74943f3e9a1
- SSDEEP 1536:DmsAYBdTU9fEAIS2PEtuggdLeAyNZ7IyvCQUWSGP+TUYypG:SfY/TU9fE9PEtugceAGPvoG+oVG
- TLSH
  T17F73CF15B3A0C4ABD9A60B311E7A67677FF6E81304A8971727905F5EBE31241CE0E363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral8
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- TLSH
  T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 30KB
- SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
- MD5 fc4691e51cdfac476b2fc63bbe951e82
- SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
- SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
- SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
- TLSH
  T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11