2e4ff265fb393ac764394f7f336c9c8fb77f4b9d441a3552e440b17ab4663c9e

Sharing

Copy URL Twitter E-mail

General

Target
Lolka Setup 1.0.105.exe
Size 91.2MB
Sample260730-w431cavelg
SHA256 2e4ff265fb393ac764394f7f336c9c8fb77f4b9d441a3552e440b17ab4663c9e
MD5 f32620a523f733cd48c1275fc5fb5e5e
SHA1 f95546c3ca98b000dc59fc88541d88149468147c
SHA512 86978e739f0f8130e1128b307b106234f968f51e34e25cead097c81b9f63cfe06256b9ee727a3dd688b4cd094e3214a6f16a5935210b3f78a22d364f9785e341
SSDEEP 1572864:HGJ3yHTePl+i04OZciagGDAG0I6GCnmw8qZvfaqKgk/5Bg7fPHUWrWLNQLnp:HGkHEl1OfG8NtPyMflKwp
TLSH
T1D628338450C0D867EE37DA3924B5CEB94667DF910B8F20067E18F6FC7ABE0C69906857
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Lolka Setup 1.0.105.exe
- Size 91.2MB
- SHA256 2e4ff265fb393ac764394f7f336c9c8fb77f4b9d441a3552e440b17ab4663c9e
- MD5 f32620a523f733cd48c1275fc5fb5e5e
- SHA1 f95546c3ca98b000dc59fc88541d88149468147c
- SHA512 86978e739f0f8130e1128b307b106234f968f51e34e25cead097c81b9f63cfe06256b9ee727a3dd688b4cd094e3214a6f16a5935210b3f78a22d364f9785e341
- SSDEEP 1572864:HGJ3yHTePl+i04OZciagGDAG0I6GCnmw8qZvfaqKgk/5Bg7fPHUWrWLNQLnp:HGkHEl1OfG8NtPyMflKwp
- TLSH
  T1D628338450C0D867EE37DA3924B5CEB94667DF910B8F20067E18F6FC7ABE0C69906857
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 15.2MB
- SHA256 1b345f43fc237cb5c2e966d8fa58434e696f054bc36a0adb85f7bc48761a0d7c
- MD5 57e3d2f2511d0a140fbcdf21f5638735
- SHA1 b12892f3d12f50977eb639ed491e51ba91c2ccad
- SHA512 0aa4461cee5ec1e4510d1815d6efac3a6ed3d9ae87988587c92f5bdfcd5aa4144a0a0936441c41e82833efafab112ec6096ba93935b526c174ef6814d97f470b
- SSDEEP 49152:/NQKqPgOqRpTYp2kGYCTNr8xd2zJQf8xF6DNgQdGxs:C
- TLSH
  T1ADF6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Lolka.exe
- Size 205.8MB
- SHA256 712f7de29c36b7848323fc661ae960128ce3acf86b3de75e3afad806201da640
- MD5 6d473dd3929bec45863d130bbf3a53f4
- SHA1 5bd852b408b60a8d28ccc1c6c1a92ae79ac43b8b
- SHA512 63439590dae87505f4072052666bd36e3842dc5abb04a0edadd6c8d09dbf24090610066cdf9e55451e4066c3cbb7a46d8e15bcb85f2ea65c93b17bbadc0e07e7
- SSDEEP 1572864:0r/ftFFxNhydxr/dZV2UKedQQi3i2XLQB/4DjAQFoLui2/nBjk2/tlEj4:EejrgptBlE8
- TLSH
  T1D0A85B03E29751EDC02DD175971AA232FA71BC094734BAEF1A948B621F71EE46B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 23.1MB
- SHA256 8e7fabb9dfa52a222fa11b281208ea0f610bc39297ab850f1aa48c18e894df68
- MD5 1d0a5613a99f1012c1f74f5a7a07e44a
- SHA1 8026c8b1f50e18d3060b57845b0a4b042dae5ae8
- SHA512 2dfbe63eecb2bb82400f3ba99081ac63a6d5ae49125f08f74740956f159cd79a22ee57e8bbb8c0c955de60dcb7bb7beee892d4b907b2cccbe3f0fc04a77fa2cd
- SSDEEP 98304:pI0342fDrf09UNKRYK2gp8/4fCG9X5+bH+dsDBu2WtwXNumi4wz/yqkmkUFUxpBa:pI0342fYYY8LbZlwz/PdkiaBJvc/52X
- TLSH
  T1FC373B122646D0ADC059C8B9C3278B26996C34E72F6779EFC0F452252F79EF85B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  ffmpeg.dll
- Size 3.1MB
- SHA256 ee94e1349363af1d8ff96bf08eb4e04dcf700d713e680735a23c4f66e5fd291f
- MD5 c0f2353061f8aaffb77a11caa88451bb
- SHA1 3bc0c9302605b0d2e8ba1e43fba421720350cadb
- SHA512 b6eda8aa3e65488eee543a58531b88cbae5445f37f5fe2e982db1794cabd08f11854ab12d0cd5b4a5eeb3630eb0b4b39dc85e18f9e21d7b033ec844256f756b5
- SSDEEP 49152:Rb3Z7+1mb6vDbP0QcKJzmS3UtR8Ski0Zmpa6iOaD2CxKE3i6S2o0QHoT:Rb3Zh6Lhmpa6iOaD2CA6Skf
- TLSH
  T1EBE58E42F6D291E8D05AC078939BA723F27178094B205AEB47D1DA313F62FD46E3DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  lib/audio-capture-win/build/Release/audio_capture_win.node
- Size 338KB
- SHA256 1c28ea0c9a4219813527fe2679c13589dc9bf38433be765afb733d78afcbd7c3
- MD5 d30f9a6ec646eedd09d9d1b6cbae2d52
- SHA1 8d39587617d932af6ad87838535c15064a87df92
- SHA512 15708a8ed949b434bde5ed5bb2ea6806720e341475263f7ed4546b371df7e177d4dab0a2ce803ed0e765d1d2cd677a723d0db24d77abf6f66d5b9b17195ea5eb
- SSDEEP 3072:mSPQmTL3Ng0M1TQy8lHn+p/U7WZTaAZjr6hAA6T2yZ0WuiloRdhFgDer3W6khiCr:mSPtg0Vy9e8/YAA6T2o0OST7WhOa175J
- TLSH
  T156748E1AF6B814B5E167867CCD534906EBF27C4607A0D6CF13900A9A2F37BE15A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  lib/gpu-priority-win/build/Release/gpu_priority_win.node
- Size 273KB
- SHA256 04f7f509153959a4645bd33131a4ec4b0951dac1434ab6c60daed685693d7bef
- MD5 a13307d65e33b2dd501f54338fa281a6
- SHA1 0c74db5014cafd8fb36c39f06614060c33b56a93
- SHA512 216e0349d82ded5917a2fa1d969b1a8d6234a4fc66aa91560d78297ff2d6dfde8c4554a810fe9f9c141a8017897d290ac582e20fbb72d311b772c199d31b54f8
- SSDEEP 3072:K5QQ+5MbcWOE+Zs4XN6ywUnXorlTiRBLUcBS02RG9VdmPtn3MTc5T7fng/+RDJiY:omN9wUnYZOFh9VdG5T0mjiib
- TLSH
  T168548D15B7A51CBAE967C53DC9434906DBF2BC4207A0E6CF03904AAA5F277E0563E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  lib/key-listener-win/build/Release/key_listener.node
- Size 295KB
- SHA256 3ea1f1fa2f5ccc1e616f585ef6558b60a62680736188f824bfb8781a5a70c4eb
- MD5 f809974a62b4f72ee4403ed77bc59699
- SHA1 bae5ea8bee24e8f73719ec6d8f26305a2cd0dd9e
- SHA512 f063b6c647e172bd2bd8d07984f8174c75138f96d80fa232f00f8f2b66d0d9a37be128d9d2db6f46b1791dcb32a66cd6af1baa1dcf1aa7df24d47573885137c7
- SSDEEP 3072:WgMnLQP1SAqsfiui2wqfYuZ0C7gq1dQy7n5w20MzFcbmX4gdZvbkjac6aqRSLC1F:gOqy08gq1WWntFyyxZmqI2v9B
- TLSH
  T1C8548D16F7A418BAE167C53DCD574906EBF1BC4647A0E6CF03900AAA2F277E0963E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  lib/process-list-win/build/Release/process_list_win.node
- Size 164KB
- SHA256 cdd360f121b81c36c48fa6e82188af10898071c4490eb8049dfd7f5655830ed4
- MD5 57555ec0c17991cfb8f83f2b11f1f46c
- SHA1 90bf252fd6812aca7789b6abca17a2d28e87edb8
- SHA512 49d8ea3102d57f4322640928c58909fa8cd4d2bc89245ad555f3e6e8ee8f281bea72dc4b5da6d676ace4417025d64d38d23fceeb5a2ed60667d24f9631b99911
- SSDEEP 3072:BFef9K1qsOEjhW2vIz7TiQOuiar/lBlZAU4kgXwP:7qsBjh/vGquikfFQ4
- TLSH
  T175F35D17A6A5507BE267C939C9834902EB72BC464BD1ABDF07500EBA1E237D09F3D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  libEGL.dll
- Size 496KB
- SHA256 4c379914dc50ed01e1c662223c200e4205cf6e548c4a5788a3248952b29edfc2
- MD5 f435dedba49aa40d2cf32bad0f09a2ff
- SHA1 1bf6d3fa9fd2882b7335953da5a496ab9473ecdb
- SHA512 2d2a5d85bb8b42ea2baee630ed97d4ad4cf9dbe42d58e18748a92868d2ea4f1c402faea0f46c84cfa75642ecb25c72db59e80bfc4d06e45c60ea91f71c7d3dc6
- SSDEEP 12288:/Cl4u4DSmeKElwrQGUuz8o0kM8aUvc0BAGEaPrB:/Cl4u4zaGpzKwAqPN
- TLSH
  T19BB47D15F7A946BDD07BD13889138A02EB7174550B21BAEF02E4867A3F7B7E45A3D320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 c74eca69b84b437a231371f4bbc3c17380f7713b55d4e61025604a8c74a05172
- MD5 a4e712133a95e2aeecf50dcd2782244b
- SHA1 5364dc60da2c7d8603386f6bc12420ae050d160c
- SHA512 efd58146ac22f857ee0bea77db3ae930bdf1e4b7756812e1854947f5f5544c0ada893d47745326396acbdd49aa361e3954620b822c390f4d9259aa30d1007b94
- SSDEEP 98304:lG1o9w3Se7Bx3v2G8AWsnyUNJrFGbfHV9+jkOV:0R5ZFGbfuYi
- TLSH
  T13E866C03F79291EDC01DD1B8831BA627FB3078450724BADF6BA497252F65BE0A73A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/default_app.asar
- Size 106KB
- SHA256 a52be3bb35d4d12f24318f2fdf3d9811226ae754e6d052efa910c7b62151ec64
- MD5 d45f8b194f25b24b664c81100a95db10
- SHA1 50dd3cbad132c6613941869af0c3d92e861fd6f1
- SHA512 5252dcf0e1dab4853d49d971627b182f5d91bf67e94318207f303d65413c0a27a615dee8dd6f302692004c98a327f561a45577c433a94eebcc2342f7dc917cca
- SSDEEP 3072:ELvTvFRWrjXxs8xbKNkCeF1SBRbFdPQrZsHtxJjRF:Ez5R4XxRYmS7orZsHtxd
- TLSH
  T1E3B3E15012F11131D86B4AFE9FAF56367A392417728DC0C4B22E97609FA19D2A9D3BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/elevate.exe
- Size 117KB
- SHA256 c43dd677f78e735eb6bfb05e5f7cc05d402dfc585571a7a123eefa5ba702341f
- MD5 a6350c119106764ac637fe6dd41fdbf9
- SHA1 e3be9794f0d9867434d3a68f6e65afe2d30da2d4
- SHA512 7df763072ce7dcad22ef262050c75716470666c57fa1b93c9c1a0c3d925b8d2ec9270752bdae2cc37b3921f04120fa88eda3cc7e5d3378d62b1fa2a8946f6866
- SSDEEP 3072:nibLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlcgsw+G:iPrwRhte1XsE1lcHK
- TLSH
  T1C1C38C1274C08072E6731A3659B4C9714EBDFD710EB59EAB6398027A4F602D0AB39F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32