c7d6d9248826f3d2cba95816ceda608f9375406a70824713fa36ba5118ff0822

Sharing

Copy URL Twitter E-mail

General

Target
OneClient_2.1.1_windows_x86_64.exe
Size 17.0MB
Sample260730-wjpl8atgra
SHA256 c7d6d9248826f3d2cba95816ceda608f9375406a70824713fa36ba5118ff0822
MD5 0819f24afbbb4e4eb4cf6abf2657b3de
SHA1 7e940fc00661cc751b112539fca59ec5d77343ab
SHA512 1fd060a32348c6c8aaf4a95d1fded018955571c5f1fe95ba8a57271d26e8a7bb31cfebc515b71afd045d2fe1778a6b4fb6a307ead8fc2390188fa846d1bc24bb
SSDEEP 393216:LoROJEW1AMsuNCk7uLj0VleJFT8cUfWZ9NNUnAwWfgpTq7K8wJ1LndzYyCTfaSjO:LjyajqkTeJ54wNUAwWouQLnd01Thvm
TLSH
T139073354DFA8B998E2140873D52FB27BDD135CF980F613E4E2E3B9092E12205596E3ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  OneClient_2.1.1_windows_x86_64.exe
- Size 17.0MB
- SHA256 c7d6d9248826f3d2cba95816ceda608f9375406a70824713fa36ba5118ff0822
- MD5 0819f24afbbb4e4eb4cf6abf2657b3de
- SHA1 7e940fc00661cc751b112539fca59ec5d77343ab
- SHA512 1fd060a32348c6c8aaf4a95d1fded018955571c5f1fe95ba8a57271d26e8a7bb31cfebc515b71afd045d2fe1778a6b4fb6a307ead8fc2390188fa846d1bc24bb
- SSDEEP 393216:LoROJEW1AMsuNCk7uLj0VleJFT8cUfWZ9NNUnAwWfgpTq7K8wJ1LndzYyCTfaSjO:LjyajqkTeJ54wNUAwWouQLnd01Thvm
- TLSH
  T139073354DFA8B998E2140873D52FB27BDD135CF980F613E4E2E3B9092E12205596E3ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence ransomware spyware trojan adware
- Adds Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/ApplicationID.dll
- Size 198KB
- SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
- MD5 91c2e2f34b5bba068e9a6178e13a4e5c
- SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
- SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
- SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
- TLSH
  T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 110545415a59402635e1c9439acba15b44bab268ed02ad2a262ce12604a47855
- MD5 a8c86996c4230c2209f5927f21321377
- SHA1 45ce0ab93cb6a3a594e54878cce05df724024393
- SHA512 69ee73496b916777936b0dddd2cc4a4f916e393f7d0b167cba77a4a239ee1e3f645d9b90dee1627c42a23eb6c3403e4d086546b9f78b3a2e4999c8f92f6a3bc3
- SSDEEP 96:mIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/23lkCTcaqHCI:bhE+A0+sF6piUFkAylncviI
- TLSH
  T154F1C776F3D20673F9AB427428632F231B2AF521576581A6490316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH
  T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- MD5 1d8f01a83ddd259bc339902c1d33c8f1
- SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
- TLSH
  T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 1.1MB
- SHA256 0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
- MD5 1e38f56aba852b737f2866c48b823165
- SHA1 53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
- SHA512 5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
- SSDEEP 24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
- TLSH
  T1E545AD81FAC29AB1C94F1674105FE33BAB3558084756CFE3D7809E31F8673A25DA929C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  oneclient_app.exe
- Size 46.3MB
- SHA256 5ce93d2fb70f827a607552d1e94190ba0bf61738d6995937d50dac54b112b080
- MD5 6ab1264ccb87ab26a176fe0d4f299640
- SHA1 ebb39fb828467fc4208ff0c424f109e9ea8462d4
- SHA512 7590d6ba6521e6d103ee124a2fc463a0ac1c153ba9777c1b4c1e59df9f623f79fc78575ba4d73b629319503fa37c9ce5502149dd7f1ea3c4204f86589bad8aa9
- SSDEEP 393216:CALcgKq7D6NZHCHHKQ2q74P9FPUmIXE+wkpHiXUxY/iJ53IWhlVjEeIZHca4:CxE+m174B9uCc
- TLSH
  T1F3B77C43F2A384E9D0BAC57486DAA233EA717C4D0B3465EB07D04F322E76BD06639B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  uninstall.exe.nsis
- Size 618KB
- SHA256 d3d4b3a37d8e824e0d984d71017830cdeb7986ef56bc6bf38461c7efb4cab909
- MD5 cb1e817ad4dd54c2749210aeb7500883
- SHA1 b5239dc7948e8b6132a01943530d12024a3d4681
- SHA512 78fb49470780ad9d7552128ba5bf23938d3e008d587b1c5e758c6910b0b3a262854d1f0501d0138b066ef3f3eb4eb8d304f2c756526c93bb68a2654dc82f89e6
- SSDEEP 12288:1TrOC7Ix2KZ8Q2HuAVFBSefRea510GV4zJInBpJp5BL7j3:1f1M21QCTvAw1UkBp7/Lv3
- TLSH
  T1C4D4234803312F4BBAC4E1E6495F7A619DD6E90CC92D75EAC4ADAA5F70E26035C1B3F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18