132cf0c30abcee0aeed5eabd6b363896dc4077712bf6f405fac0008d4c0ec254

Sharing

Copy URL Twitter E-mail

General

Target
Notion Calendar Setup 1.138.0.exe
Size 98.5MB
Sample260728-145ldsap51
SHA256 132cf0c30abcee0aeed5eabd6b363896dc4077712bf6f405fac0008d4c0ec254
MD5 181ffb4d3e1ca8d085e6200c5084aa13
SHA1 598f50f09d0c149a35b3ba74e8bc0bee12e5146b
SHA512 b23bf20ad4f118e9aca4a472f7c05f15d009cc51e8469e0705aaa96be89b78e81eb1b2468888b7c2038a344aabff73e1671a0708ba498d7557426d6c8651407f
SSDEEP 3145728:Fqk+LaSkzI4Ahu2Fukswu/oASBoa03NKArxU:r+L1k04Y0kswxBopNKAC
TLSH
T11B383393902C974CCB184FF8A959051E1580CF82CD21D7E76FEE021EAE5E2E55F846BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Notion Calendar Setup 1.138.0.exe
- Size 98.5MB
- SHA256 132cf0c30abcee0aeed5eabd6b363896dc4077712bf6f405fac0008d4c0ec254
- MD5 181ffb4d3e1ca8d085e6200c5084aa13
- SHA1 598f50f09d0c149a35b3ba74e8bc0bee12e5146b
- SHA512 b23bf20ad4f118e9aca4a472f7c05f15d009cc51e8469e0705aaa96be89b78e81eb1b2468888b7c2038a344aabff73e1671a0708ba498d7557426d6c8651407f
- SSDEEP 3145728:Fqk+LaSkzI4Ahu2Fukswu/oASBoa03NKArxU:r+L1k04Y0kswxBopNKAC
- TLSH
  T11B383393902C974CCB184FF8A959051E1580CF82CD21D7E76FEE021EAE5E2E55F846BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 18.6MB
- SHA256 62e3b53be6bbbb2e7747b7a55c8b4f4a3cf38b95e0fff594737b3bfdac8cf373
- MD5 0f6417e60719dfacf3524b61cca87e8d
- SHA1 f2f4fa439dc120908a53965d8f292b00e51f7647
- SHA512 1eff62954cf80b2ffaa1d676a9ee61c8da9488a327b458268f6efe94dfef5f6030ab11e9ad2df305de5a8bb05c4e2beb21e027a0a0c9ba3fc94a15ca9f85e5ed
- SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6I3r8xsJQf8xFTDeQdt+lHx37DoB:i
- TLSH
  T1D617B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Notion Calendar.exe
- Size 212.8MB
- SHA256 80ed081ed72186aae1184d6954cd9b1f7c8f6ba6b124b96ccb27d0d1f4f98e3d
- MD5 50a914f68eec9c0e414ec24a74e5cf27
- SHA1 c4f5925eb95dccb5c47be0451f48317e294ba87b
- SHA512 47e494c085ddf9f1d7821d83e7d7d033bab4864a8f0c5afdcb72a7970de06cf457c49a0ddec8ac5b227690bbdbaaf0fccbd85b04a5c69d1825d86a398411666c
- SSDEEP 1572864:HMigx/kcxbcOpj0RoAzI56mgJiwpoy9TbnyFxXK5Ylldcm97LTHxuuq+w5J7SRim:sFtrg6d46bB2IQFA
- TLSH
  T191B88B03E29641D9C01DD1759B5A9233FEB1B8454B24B3DF2BA447522F66EF82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 7c33a9097af17c63de0c2eb37631545dbacd3914d49fd76161e29c349c0ad8c4
- MD5 988e3db9473c5cacd0f89f7f56195f2f
- SHA1 d07fa9b28c6e09cf26e63149f0ca6cd227303c3c
- SHA512 99f5bfe950df9babf04301c8b27fe21319bc98c6214597bcaedf83dfa04766dafa91efded0d381b60745c602464ee9026e640d6646b55766e964a4cbc8b515a1
- SSDEEP 49152:bSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqG:GuktcrfNlTyj5byqS5
- TLSH
  T182268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 0f0a720f2f16ce6ba6ef81c07c91515b88a38d4cc7749dc3759dd1ad54f5c55a
- MD5 3ff98c7b48580aed2173cb7e7fe98f06
- SHA1 8c6f13fe926a2ce7d9333293effea9e78d96e41e
- SHA512 a100022a53dd48d40aeef27a1d3501a2fcc50ff91bf90d922325998f72e0b9329dd23a1a20ade368ddc48e8df1236329a39f02cf3d4605a75aa9ab7417bf6881
- SSDEEP 393216:D9tCn2P9zxhOMXtVz5icpXH5uVUi+zYuD:eGzPdrIVC9D
- TLSH
  T10D473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 ebf1d2261bea535595abace0489f206183850e11c62c5986f49adce8fc0731d2
- MD5 b4b11131b63cf43613bc63b8f0a3e06d
- SHA1 32aaef031d2e80278a8ea143a54ecd95db75d136
- SHA512 f415ecf0a804400ff324862e10283d23a28aeb29ad0f539e4c195019c98cea5726c9b9ac15cfb061c825c32b608c89616d8f3d3630ee82b4c3a80d12e6dee264
- SSDEEP 24576:wY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Ka3:NiTMYxy0Sy66Zh7Sh/cyvS5d
- TLSH
  T1BA657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 688002e0e87618fc45a818b81a1a7ad3a7db95462efaaa18be5ce685bbdaff85
- MD5 c9a664794f396c8de19a2c5fcc718acc
- SHA1 77e0cdb452537d29991dbc1d59eaa92e25fd4f27
- SHA512 f1802e87deec28d72dcf336409a2001fc3a4ba811957e372864649abd8139db147b8a7b8bea6071c56193a2187f7822530f1a155ba5b9e51734475ff0b86a158
- SSDEEP 49152:DlyMFEi+bSxsTUs3mFNYisl199a6LKIbB7k6TNDNoJHaKyEC8bWTW:DlyJGsQsU+is9dNoJAel
- TLSH
  T1E5E5AD02F2D651EDD019C034979B9313F631344A4F209AEB16909A263F6BFD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libEGL.dll
- Size 525KB
- SHA256 95c5bb2f2f7ae6ee39efa629afc63ba608989cca70f104fb23fd3722de4b2322
- MD5 1c346de24bb8238a2ceee773ac40fcec
- SHA1 72e301ddd8eb400712cf239a42b745823c655b81
- SHA512 bafa530fb2b75ad060a4d8744bc6d83f9f1ef3d031b6bd741d6c61d5b6b2500859a22e7778b35c68cca6d6deba7828b55f6a50195a6029b3cf4d9fdc1dc75426
- SSDEEP 6144:BeQszxnw5uBqWh//UlBowkZDYJ6RSQmWYmkHGVGWFcsfAVMugP4TfaguL1iMg5:xG/V/iZJOmW6GVGWFcsfAOugP4T4105
- TLSH
  T1F7B47D15F3E84BA9D07AD1348A438642EB7174961F65F9EF02E052352F3BBE45B3A324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 bd2716238c7702000b09eebbe76f17ad885d18db25e9b9ae2a14a3a79440c519
- MD5 57dfddbb232d3872326ed5718f5c05f8
- SHA1 a50cedcc61d482728621abee2f35ba45ba5be0fd
- SHA512 4010a657c7af0511af5dc01f97804421f85612ac88a8318d6b825e7b68b50987849b64a0913e72de38a0e1745ab7050c61fc13bd1eff4b61771d268209854d5b
- SSDEEP 49152:ptcJFnS5a/8VEWaXVK+cviQOA2Ag/xdNTj5Pq0AOEsls9wVk9LcpSrosg5VELGgb:IJw5aEVg8c/92p4tsKb4hbRDVeW7
- TLSH
  T1CA867C03F69641D9C05DE2749B67A223FA30B8550724B7CF2A9453162F6AFE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/elevate.exe
- Size 120KB
- SHA256 a0f375a520d863db9deba0dab91eca948c2096e53ce18cc0ca37ea708dba6b64
- MD5 1a6a4db784aa4c651a89fc9ef3e985f9
- SHA1 134c70548b39bd9566afb07a4c673b8e22a4674c
- SHA512 5cde5623d2695c8d4093609fa4819bbda43fb0d5b55ddd9caf2c4e2e015100216158b3b68c3aabdd46d355b82b9062d0d03b0848415ab64d19aec17b71f50c61
- SSDEEP 3072:7hbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlpc:1PrwRhte1XsE1l
- TLSH
  T1CCC38D0174C0C472E9B32A3555B4DAA15E7DFE710E749EAB2398127A4F602C0DB2AF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 a82f263a6c57f19494da8aa69437f0dc55441cb7ba4629f2c7ad55049672b35d
- MD5 7bd8d008800f854d663b7e111661a5a3
- SHA1 cb706536bed1ffe9926770a504b376238f6e3de7
- SHA512 e9bcf38447b97d1355e17037081f2425fd34ed335ecaf8764e5a85714adda1090f268518dbca8f20163cd5939e0298154a6fb3236a22ed77ab0b664405bb4fec
- SSDEEP 49152:S+et2UcrN42sf0vTrWny2/Gh9qIHGZpVZSbiP1VFz2ZtIgrduZsgP/m9vqjfc2c1:SJt2vI4gmlml3pCInA
- TLSH
  T180464803F28681E9C06DE5798B5FA623F631F8840B2276DF56A00F192E66FE0673D715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  vulkan-1.dll
- Size 947KB
- SHA256 a13e05455c82959e2572aa093d90a6062368dc42af1ccd238dcf660d42e1ae51
- MD5 9a219c2dc262a8fe7c33af2466d40a93
- SHA1 d55e041bc65c265519d6eea37694b643afef4741
- SHA512 d01a44ae6add4fabfadce35ba9e88d6582d5cfc36fe4d24096ba084b132fa142e11904a3e8c65314a2945cf914782cd29600bcd4ad77f69321895d3937168325
- SSDEEP 24576:tNpbzkO5J/Yv3kG4nolXqOZ6dSn6Z5WGc9DYsHQDb6g3P0zAk79oOHiYHjF5:/pbwOvgv3kRUX1Z6dSn6Z5WGc9DYsHQE
- TLSH
  T1AA258E12DA544AA9D67AC074D9D28A0789B074821322B8DF12F817147F6FFF47B3DB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  $R0/Uninstall Notion Calendar.exe
- Size 151KB
- SHA256 51f12705eb47be7042a2dd2431e97ca968e4138972c67054c52181497f24140c
- MD5 42a3d93f4cad73317c3ca6040a8867c8
- SHA1 f1cfed078f3dfc9d82a42b242028ddd880291e00
- SHA512 8ee85d736d47244544a1981603cb35809f253b053d3da05c8ebe3b18a2635d3370c815c9bf45e4cbb565a6a99c414f0687f01bb574ad20dc52b83fc539a51a1b
- SSDEEP 3072:Un77v00hEoDEtausceAF0uwMxB8fkZJZe4aH2tvhOEA1RJCir86SrSrv6Ia3WF:U740IcmtwMxBEkZJw4s2t0EyL+ya2
- TLSH
  T11EE3EF4467A0C417EAF74F7196F5DBA37EB9B26228248F133780A74E38927D1EA1D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral28 behavioral29
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads ssh keys stored on the system

Checks computer location settings

Reads ssh keys stored on the system

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32