acbcef83cce12e4c9d55013e1de4a554ce52dc0f31b6fcfd608ee1e3176164c5

Sharing

Copy URL Twitter E-mail

General

Target
Nightcord-Installer.exe
Size 50.9MB
Sample260731-1y7tkascmb
SHA256 acbcef83cce12e4c9d55013e1de4a554ce52dc0f31b6fcfd608ee1e3176164c5
MD5 ef6a910183bbcdf613f7b53f8babf980
SHA1 312212523511c02550b3bc5f5ab0d41743ed3b7f
SHA512 4cc7894a418e6b14fddfca2fd0e5d333aac1b2bbaa9338c689617627d681c2e617672e4c18634b4707e9389129ac6b0d0ea1685d29371435510fb7db43c40987
SSDEEP 1572864:LR+qvl5FCTaFObJhhr4ppuSNnAzBTBQ0xMbe7:LHl54TakJhgRuJBQFa7
TLSH
T1B5C73362B127EDBFE19DF2F4B9B101B637449784E0362943CB6E52897B23917032B1E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  Nightcord-Installer.exe
- Size 50.9MB
- SHA256 acbcef83cce12e4c9d55013e1de4a554ce52dc0f31b6fcfd608ee1e3176164c5
- MD5 ef6a910183bbcdf613f7b53f8babf980
- SHA1 312212523511c02550b3bc5f5ab0d41743ed3b7f
- SHA512 4cc7894a418e6b14fddfca2fd0e5d333aac1b2bbaa9338c689617627d681c2e617672e4c18634b4707e9389129ac6b0d0ea1685d29371435510fb7db43c40987
- SSDEEP 1572864:LR+qvl5FCTaFObJhhr4ppuSNnAzBTBQ0xMbe7:LHl54TakJhgRuJBQFa7
- TLSH
  T1B5C73362B127EDBFE19DF2F4B9B101B637449784E0362943CB6E52897B23917032B1E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 5.1MB
- SHA256 fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
- MD5 6b84319ee8a0a0af690273d3d2dcbaf4
- SHA1 857ca353e0582d100dcbc6cb6761bb4430d0cb90
- SHA512 26f9842bfdb429ef132cc1a930da9187071a339927eda402e8d54b5eb9e03067612cdadc3a2dad3d0977f8e6af18c05eab6ac91720221c6a0104f96638f85a8a
- SSDEEP 24576:yd97B+mnLiLsrDy2VrErjKCqzkU98wwg3QeXuh:0P+mLAqHBCuRoeS
- TLSH
  T1D046D66BBB49037316F282626B4AA4CAF31E903F375A1514345CD15C2B7BA2483FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Nightcord.exe
- Size 129.8MB
- SHA256 c350062f096f6ea5f74e1476fca0472185dfb74c2f011f77508fdc12077d6788
- MD5 eb1b498dabe79225bb1a0fd1e6a5967e
- SHA1 2ddde8ffc349abfedf0462858ad16169757256f0
- SHA512 295d26aaaebe5a259ae46486c691e8a72068e73b7f5bfa1abcd9de65947f532f27c21ec77b7d008d9dd20aac0367f5eb9bbc72c284c3ce802eecef4777527ed5
- SSDEEP 1572864:rmYWQRWtJ65M7a2iu4Rywh9hJyO9N+oJOTU8f/kmgZ2sI:a4M7a2H4Ryu+dNgI
- TLSH
  T1D2587C03E29610D9F09DD1B59B468636DEB2BC454739A2DF2690271A2F7BFE0273DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 39293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
- MD5 7c3c780de9ae5cc4abeccbd7cb6b367b
- SHA1 bda27b3c0b1ec023e2a0a97099a84b10e04cb135
- SHA512 80a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
- SSDEEP 49152:8MnbcrH9v7eCZPxX+qzohT99hDoapghnshy43yBcxnyKbZtjB0HVEMGJSj/8NOv:dCZpX+q27saesDSjbv
- TLSH
  T17CC59C17F6A644EDD02DC57483AF9233F93078454724A6EF2A809A252F7BFD06A7E314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 429KB
- SHA256 23046e7fe2bbf76ee2c5596b6beac723ad465fdbaa44266486102cdb292148a1
- MD5 b3017453d487a7d33445c1d2d9b9bc13
- SHA1 7e643ccb8984a4a92dd439eeb4bdaaeb62bd8862
- SHA512 fd583f4b95aa974d72628bcc548feb22bc86c5ab0fd1536995bd796e28422f56e6799d60e2c3bef9aed9a1080eaf12338a3b29b8c3d40ba5166030a219572baf
- SSDEEP 6144:67Udu1o3YnElXvzYhRk9o+3Re3wpcOQy5n+t7dPs:wUdu1NElX7QR2osJ5+XP
- TLSH
  T1B2947D15F79048B9D076C078CA634642DE72B8DA0F64EADF139492692F7BBE45F39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 dd74029716da56a0e4b64bc5cea0c169e1c4b31143ff39213d3c544792e8f2b9
- MD5 dd8d815769cbf46af41a41931e9b4572
- SHA1 f242fcc4cfd5030f3f543c22f141185cd86e7142
- SHA512 69a12f862157746ffc27b637941261a0c5c494175c3e674c7de4d0c4452a5b9358735944e8e0568b7279a7791cf178c9b1afd5ea4a781e93f28cd775a0a6096f
- SSDEEP 98304:p5a6GJCIf2Knqdu5iIBIcbWwYSqARSHoDNSv:pKIwBqARSH
- TLSH
  T1FC866C07E2A040DDE00DC1B9875BB222EA31BC491B64B6DF269477112FB7FE06B7A754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar
- Size 1.1MB
- SHA256 f423491977ef40558c43ea8543f6c09d9ca8a5f5052a514585fb87177df65ceb
- MD5 970b45565f937780425f8b05b234f1b1
- SHA1 969bf63c9ba7511cc4a7c38d729b473653571f4d
- SHA512 5574bb71dfc63ad8370c2f770ddfa01c3cf55ae5a59e7ac775d749df1ee6edff64c67309daf2adbe76005d13eb02abaed4f59db25fbb78c0e51b6f25c92a8d41
- SSDEEP 12288:7eSTeJaV0xsrDIFpVpZ3uQqPjSFxfPfViQtdYCOx:7eST3orltdjs
- TLSH
  T1A9454CBB77B296352A9617EA0BDF0184A1384116A911C858F81CF0CC37B5E2AF1F9DDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  swiftshader/libEGL.dll
- Size 448KB
- SHA256 b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
- MD5 038a73114d439bfc94be4732b2794998
- SHA1 4b7a9d52da1bd808af979cf5cfb146404494317a
- SHA512 8788e43de424e1d7a163d0b7f4d719c36bf8fdee9808d405aeb05993c446d4f2a595741cb4d98f5e9611cd16d09de9445bf72176a799f4189168bb8509b115ff
- SSDEEP 6144:/H0B/LCOJ7lTp0k7zKd0POc37Tta9pdEp2si0xnLB4Vz:/MCOJ7lFx7zxt6dEY0VLSV
- TLSH
  T105A47C16B7A044BDD066C034CA538A53DE71B8960F25EADF1394926D2F7BBE46F39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  swiftshader/libGLESv2.dll
- Size 3.1MB
- SHA256 2e10d308d0207835b07df3bb38bee88300aa57fcb214051e8654d29587257744
- MD5 38ec86347b3e467c5868e35ab48f89f2
- SHA1 4db17d065cc330b277a70f9fb8dff0c4b426f314
- SHA512 2b2405ed51ea1d232f2d60072e4f57e70f36f1a8f9d0a935772bfb9a3be50c1d6136cee496fde9fb3dda1f0d2f1c643cb9f162e0b68828ff854645eb1e8216f4
- SSDEEP 49152:EAtfKpPXV/5DdijA29+0QdjwSx+qovRYFDguXfol+4iduejy3bEW2ehvxLTL10dO:nwNynDyguydMVW5v1
- TLSH
  T18FE55B43E55980D9F06DC6BC874AAA2EE632BC81177272DF52A06B121E37BF0173DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  vk_swiftshader.dll
- Size 4.5MB
- SHA256 cc947f08b87f4636213211b22328c32d1986d49abc96a619799091fa6a15c851
- MD5 0d3deb7dc62ea45c6624aab2b1ed8071
- SHA1 0e4a7276784e3d8e6d6440669a65bd88f840b078
- SHA512 38b674e0a0fefe1fa61ae144e6707b0eb7cfb73a8d01315f2b984cd1ebeb017cddeb89e39daa0f5806cc295a540e826a97422a677c361ebab3f8e4767228e5e6
- SSDEEP 49152:53YxjaP0AETYj7g/yaI75j/7wiSmQEZLT/lbMnP3cuJUiId+R9iETUjdCB2KmGsl:UAbIASP1aRldQ
- TLSH
  T1BE264A03F6558199F02DC67D8B4BA622E631BC811B72B9EF12A03E051E77FE06B39715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  vulkan-1.dll
- Size 707KB
- SHA256 26460b9250e904a9db6e5e0893e746a84ffae21c02e083e3f33a913d7cc79111
- MD5 3cffcffbf394159458566fb79b9abd3f
- SHA1 7e0f09e9ea67e9e587305e2f740c8620dad12595
- SHA512 93a73aef9237d52119f9886ca6eff7975cdd6931d12087ea4c0397807b19c6195e24045d80b606bfc45f754c58ab5b1f789d95e91250828629724b9446501c55
- SSDEEP 12288:Dwc+2rLfirhAu07HvM5BSNraGMiuvo52Ap:D82r79KBSwBiuv
- TLSH
  T1DFF47D3A7E94015DF5B6C038DA074621EA71BC620B64B5DF13A0131E6FAFBE42B7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31