9a991b56eea365f412b590d0181768bdb0c54f602af352c49550710e7aee4d46

Sharing

Copy URL Twitter E-mail

General

Target
TeleAgent-2.1.4-x64.exe
Size 333.6MB
Sample260730-dpwnls1ze1
SHA256 9a991b56eea365f412b590d0181768bdb0c54f602af352c49550710e7aee4d46
MD5 183ec8fb976ac80e65720cb5d0d67fce
SHA1 264a39b0c9c3fd41bb06329395622818df6d6c0e
SHA512 86745a84e10fbe4efb1f8f1311a7ecf4cab44d006b8256b5c820871fd32d8ea0f0982d7762b8c1e7e222e032ff126b619a9cb45718c62c120caca1b922dfa623
SSDEEP 6291456:bJObCXtM+zahDaqY2gdLc2GNCIVOPg9Bc45MNy/oEHKZMjsTDOhFWn0PFdl2:b4UtzQ5srGcIVmg9z5MgcZMqOncMXY
TLSH
T1BAF83361D0C2102EEF7963BA9A9C53D211158F2DA45E67D3442BBABB71FE842FC93701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  TeleAgent-2.1.4-x64.exe
- Size 333.6MB
- SHA256 9a991b56eea365f412b590d0181768bdb0c54f602af352c49550710e7aee4d46
- MD5 183ec8fb976ac80e65720cb5d0d67fce
- SHA1 264a39b0c9c3fd41bb06329395622818df6d6c0e
- SHA512 86745a84e10fbe4efb1f8f1311a7ecf4cab44d006b8256b5c820871fd32d8ea0f0982d7762b8c1e7e222e032ff126b619a9cb45718c62c120caca1b922dfa623
- SSDEEP 6291456:bJObCXtM+zahDaqY2gdLc2GNCIVOPg9Bc45MNy/oEHKZMjsTDOhFWn0PFdl2:b4UtzQ5srGcIVmg9z5MgcZMqOncMXY
- TLSH
  T1BAF83361D0C2102EEF7963BA9A9C53D211158F2DA45E67D3442BBABB71FE842FC93701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.8MB
- SHA256 06225cabbcaceb458121bc1d69200c30b29405414df54e87d50ed196f54adc22
- MD5 121e0eda7a0d51d811c62be59dd721bb
- SHA1 fe41a4ce3dc525d829279d2d69511f7821c7308b
- SHA512 b2638602fb225556e8afddfbe5042a24818e0d718e3c26976ec0f2e801c078199fbc70b15c449b97c62a1eac764ed4fb03d86eafcd95e7dbb5c0f7e0ee72b45e
- SSDEEP 24576:ZysxTHxFsDodPQXj0XoQ43MU+yd5rX1PgfvQ5YHS0fz+JEPE0Y2g+3ZNx34vhMZU:ZyJL3MidH4Q56S0fzHNEqNxghARk
- TLSH
  T1D9958C4BF3B400FDC1A7C0B9851B560BEA72B40517749BDB1590CA6A6F63FE217BA324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/test_extension.node
- Size 90KB
- SHA256 442649dc4dbfbaccca9008406338e3ea4ec396b4b021047125d4a1c3b752e809
- MD5 502830852618215204bea5731f7a9a64
- SHA1 92f21a4774841931268394a4d903b89def35d47a
- SHA512 c0f67caef8975fc0ec505faec293318f2837e1d3583c2890d1d122907da65ee780b2a02c00a7c4a9ae37b68aeb6f176d39b4fb5517b159403f09afb15ff87ab8
- SSDEEP 1536:GFNtIPFfkQ7euScgrFMcn9brb3UJLDxsW7KId09dlQeHzWj4Y:GFNtiRkQeutsMcn9vb3U1DHTMieH
- TLSH
  T19D93385BB3A500BBE4364238C8634E19E776F81156619F6F07A4466E1F633C28D3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
- MD5 722c2b2dbeee143a14c7ba04edf8e3f7
- SHA1 88321c5c15ed00c72570b28e8183b2440bbf6419
- SHA512 0537a881c397d0bb0836ff74a881d650d59fc151f0e4ccb1c4f5a9fe84549dc9753b886b3e14534c551c167ff702fae71b58fe4fe90c78b43ef05a4cb2761855
- TLSH
  T11C115CCF4B4A2678E3F2B7C1EE21E94E046442E47A5A0824C0CC1DC139AB15A78C6DB6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/database.js
- Size 4KB
- SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
- MD5 952ebcfa3d8727e8b1d7b681c9f5bf32
- SHA1 6168b5f5ed77669b3c6c1f1d526f0eb116bd3a43
- SHA512 d2dc310d2e4a491903988ed88228d35e9688e48c9b6180c797fb58f84d1105724ab3933ade92be0e73c8a27fb6f3064449bfe00cfa1dc92919ad53a81af2680e
- SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrtRxtjFvcLd3s03M:ac1ZFjQBG1oQZi9qSvNRBkLveomRz
- TLSH
  T1EA818388DBF5611247EB30D4A674A48D6234D27971AD08E0D8CBC3F531E60C9BBE3B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
- MD5 26660b3078523a953ee252b4e86e1c8b
- SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
- SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
- TLSH
  T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
- MD5 25fdd950809b2b22d0ba6917fe014c35
- SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
- SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
- TLSH
  T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/backup.js
- Size 2KB
- SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
- MD5 69638dc10c19961a0c05350ae333d6a4
- SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
- SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
- TLSH
  T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/function.js
- Size 1KB
- SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
- MD5 1036ce624efbb9fbbb387fec25fd1bcb
- SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
- SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
- TLSH
  T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  resources/tools/arxiv_search.ts
- Size 5KB
- SHA256 f35959ec96ce1394aebff613cacae8d0dfca6dcdfc3a24303dc26e0dc8b86af5
- MD5 3f09cbe21b64b01bdcad36e04dc09a64
- SHA1 83fc7170432021d83e2e91eb3d16cf52c5d35b13
- SHA512 9cb533fd19fc92f080954b47f9a116847298e4d84b68e8d44d3403143ba0fe8b3b65a1c18c095aa5e9c7826a02dd3b684c3caa545f9d16c906c613b7d85c8052
- SSDEEP 96:CXT/JrR7l8inqg2rhbDBO9bOTHcOf2ulaqlXAsByQTtJF3wRdJIoVLaLYvdrZGFc:CRWtDBO9cR2ulaixNdwRrIoVLacvdrZt
- TLSH
  T1DDC1621270F105A18B532168049F5462B122916B397EECC9FFAD07AC2F0A87DDB79BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/tools/injected-config.ts
- Size 501B
- SHA256 48d732271f36f368d03189781705b919481a86aa7be0cd551eb8de73daa5b2b1
- MD5 5ad5f353fadfd0b6eebb67cd80986f7b
- SHA1 769f04becc3540ea9440e93cb15c6887b924659c
- SHA512 556696cc304ff591586edf0a9de27d78b66f09bcd0de79fcbc933040a384493bdb1a6743f6f6f9956ce40e6886ac1046cecf49dad6dcad95e858e1f56b9713c8
- TLSH
  T1F8F0C0D01AF52730A755931130493436A169C0373B081DF9C2C8616DBBC077CA1E11D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/tools/memory_search.ts
- Size 4KB
- SHA256 72c8720d8777c67d306cd0e247a333b454717cbd85c03620688e4516c7a3a02f
- MD5 3d6ba220505213c6aac86ef19bd5fe3f
- SHA1 5f3691d2b3583ce63989a27e097f5820d15f7737
- SHA512 3130960893f72f5c7feb2cd4432fc06d4c723d0e7e4891b420dfd7f0d56bda4130ef00ef6deae72c8332db951f106c69e60cd25be77abbde39d031affea70034
- SSDEEP 96:CXTmRorczBaTVIi7PeQDqlEsVZEQnAtGw55t35Eusv3otEDFNNu:KSBHi7eQDql7VZEkw55vsvY03Nu
- TLSH
  T14B91A60184F528781B6624E8799F5089A23691433A6C8DADFE9C53502F8747CE7FAECD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32