ed76f841d866a82c26d0f5b59a41ea89deef85d5819f3ba9e7dcb0212c073e0d

Sharing

Copy URL Twitter E-mail

General

Target
ExLoader_Installer.zip
Size 23.7MB
Sample260730-tehl1a1gre
SHA256 ed76f841d866a82c26d0f5b59a41ea89deef85d5819f3ba9e7dcb0212c073e0d
MD5 a2a1f6f0c76f692a721292df8e6f779d
SHA1 d38d053bb541abdc1fbc5531d8c66aeb430b3d32
SHA512 748ce3e79b7c69b6d04360853739ce47823a0aab221ddff5edad50baaa12d048b3f12395d223b72ba9a95c1a9292d6a713cbff89203c862d8f2bc0ce031b0434
SSDEEP 393216:kN6+R5xTUGIk2iG0Y9mpiRwWvPUJ2bQ1GEfruhFIpmEsUX35pt8xtyPHjCQo6Cw8:kN7RFIkYmiwWvC20buTmm+Wxy+QumW5n
TLSH
T1D94733C1DB9160A7CD36A7B3857CB0B2D308229F62F35634859CC3606E4BEA8D615FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ExLoader_Installer.exe
- Size 173KB
- SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
- MD5 0572dd0c0fd63a372a10f14f5f981c59
- SHA1 d675b7d16da8f61cf5a219451d9286445ceb1343
- SHA512 bfc178a50e3560e0b672a935281501e18b8b6c71ac0a69d2a23706ee8614081f83d586d3e7887e7f2b3cd03f3ccd06472b5edd07a258cb843d09efe56e82eed9
- SSDEEP 3072:zfOnmYGioVzt/JUaD9QQfppuBsmx7Ho5T5VJdxJ0BwJ42o5oSMgbwUs5:zfOnaioVBxUaD9QWj5T5LL/J4Z5o
- TLSH
  T137048E11AB68C499F2F69AB4D9338905CD72FC961B34D6CF23912DAE09757E09E39303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery persistence privilege_escalation spyware stealer trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  audioplayers_windows_plugin.dll
- Size 201KB
- SHA256 2680c92a0203df659f00de9bb4c350a24096c3714fef18b6649d89666ec876a1
- MD5 e900064072e30b4017616d0a4ecd5c08
- SHA1 2393bdb97fd6e1f3ea88abf404e54587ee3d56fc
- SHA512 042bcd97e959acd17a39b7d2e1d84cfb9613d22770df11a5b5f62b8fb61118b342908777747e67a059d37956fd10d86d137d7d682b3fdb8d84993867daa4bff5
- SSDEEP 3072:s1GSXZSEkye+EkyNqQU+hicfZ6Nq4yOkMYYqtMH7wEy5v7tR7jEEZZ:iFXZ6lqSicfZCyUH7wEy5v7tR7jE4
- TLSH
  T19B143B2AB6684097E227D0BCCD474916FB73B8951B61A7CB27900BBE1F27BE45E3D500
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  data/app.so
- Size 21.6MB
- SHA256 bb87ccb65b9c9da39d4380451a0682337f3f7cc23342efdf961aedc103afeb13
- MD5 e7a5a612dedc1457e3eb0360b1d26705
- SHA1 d8417fe077f7d029222edbb2d28be3f7c2b1072f
- SHA512 a4b6fe63b7f54eb00d52409c912e3d22079c1c6883d982a5bccb4cd5646fc1c89392b796b30b9eb0c91bcba50cd691e391f0d5a1e9c3daadc455e8e9e0ec0d14
- SSDEEP 196608:T/NcxG5wmYwdcaENwQ79for3nG6PCJBWTEOPdfhbq2JWqCbTx:TlcI57lEEe
- TLSH
  T1D0373B07D0A44324E4B3E735F77FB9929E543DE84A30A68A16C617193A4ADF0979F332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  flutter_windows.dll
- Size 20.3MB
- SHA256 011e87e890b7bfbac89f63c763341ffb8393d2b4a617dd836c471a0cdaa1346f
- MD5 ae8508a20a3c598ae3668aeb39633755
- SHA1 1052c38074e8836da5becf616cbd147775e9400f
- SHA512 61781fad83efc462ae5dbb616e1b0a2a30e6f35fdb63926913c1c0172f8302f9c39f4e8c2bf1a9a18c0cdab1199eae03c5a4a683248a3e180cce07245643453c
- SSDEEP 98304:FE7hoeyV+kw1ULtPbwDggwZr3hH5epehPTuwTlckSTKZSx8tkvMzVdD+cWUN25el:F3IgBfefQzH7wpuIFybvI9YA4V
- TLSH
  T132276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47253F66BE01B3E754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  permission_handler_windows_plugin.dll
- Size 113KB
- SHA256 6115910d401645c079cd6a1eb76c27717d9692289b8747160fd152d702702459
- MD5 332193f149eb2495b5a3566a21972c69
- SHA1 8cb8ea1fa42388c5d0c590ba14214cdb8287f025
- SHA512 aa72cf2f477018742314859052c9cf157e21b48a269b2222117615f593ce1c826fd39cc23c331f178b99d9ac64913597092acb0645f3a84fab5776026a3c1ca8
- SSDEEP 3072:j2tYwQpJGaseTQiz8MxhogPdYC5vT4AzoGBbA:aYwQfGaeizRuC5vT4AzoGB
- TLSH
  T114B32B2AFA69416BD22AD57CCE974A05CF72B84517A197CF63500B9E0F23BE44F3E610
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  url_launcher_windows_plugin.dll
- Size 96KB
- SHA256 71086a2b5361259a8a45c7f009a38d8ee4be2d50ffe4bc28b1b8695063cc7fc8
- MD5 437e545ef64648d8b9b0affa2c265d74
- SHA1 9c2dca4605068824f8da3df65089f7f37e254c88
- SHA512 8e3a6ee86e8df21996c771ba4126795603c41572e3d5b85463a5734c653eecc5c879550bc4ec1074a22cc97c3ce68909b3156bb2ce0e1fc9f6f1986f76774a23
- SSDEEP 1536:f347yxZcZiRaWEi6X/j27otOgBUJZmU5rUVrJV1zO:fDxZcZWnEiibZgR5rUVrJV1
- TLSH
  T187A32A2AEA5D40AFE22AD4BCCA574D01CB72FC85476167CF27905EDA0E27BD90E3E501
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16