fec6f2a9740cc714202740babdf4cb63d5f314e9eef78b06c33f62802694fc1b

Sharing

Copy URL Twitter E-mail

General

Target
JeevanPramaanInstaller_v3.5.exe
Size 1.6MB
Sample260731-mepxra1vbv
SHA256 fec6f2a9740cc714202740babdf4cb63d5f314e9eef78b06c33f62802694fc1b
MD5 6169172066eac5899037e7e3836785d9
SHA1 3db524513bc93e857106b993913225c783b234a6
SHA512 cf8f359c5d1f739dfc62a649f51866daa266cbbedcaf99623d863bdbdfeca0fde74ebdfde9dc02723dfbcef92bfa624f888f5ab5cad4be2f96aeb9b6b88cacd7
SSDEEP 24576:hQQ5xDQgyOmeJR7uPNxq0L0LPVwNcwTqugzucnLDJGqmMP2kHLOsPHoYhPViskxP:vmeXaNs0sEcwT2qcnUqzHLrfhPVH8TT
TLSH
T145752330FF87B898D2E400B1985705BB5322CC2B57456F73A7B4766A1C9638BAE32477
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  JeevanPramaanInstaller_v3.5.exe
- Size 1.6MB
- SHA256 fec6f2a9740cc714202740babdf4cb63d5f314e9eef78b06c33f62802694fc1b
- MD5 6169172066eac5899037e7e3836785d9
- SHA1 3db524513bc93e857106b993913225c783b234a6
- SHA512 cf8f359c5d1f739dfc62a649f51866daa266cbbedcaf99623d863bdbdfeca0fde74ebdfde9dc02723dfbcef92bfa624f888f5ab5cad4be2f96aeb9b6b88cacd7
- SSDEEP 24576:hQQ5xDQgyOmeJR7uPNxq0L0LPVwNcwTqugzucnLDJGqmMP2kHLOsPHoYhPViskxP:vmeXaNs0sEcwT2qcnUqzHLrfhPVH8TT
- TLSH
  T145752330FF87B898D2E400B1985705BB5322CC2B57456F73A7B4766A1C9638BAE32477
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 e560384c5298ee2123e8340e716b2c4680f51b4d0347995ba3290dbd1130c6c0
- MD5 eee2912bd1ee421cf1f1dfb1cc327d97
- SHA1 c5d3741ddb195718c9b17923eb6abfb7a732bdc1
- SHA512 1808a068386c790d8ad5096d9fededcfa6e5688e3a68f2499418456c9cafd7b837c811298e6570212155b4a3d6038c1749cfcd9d1b86f090f66d1a5301adecb2
- SSDEEP 192:qcOqh13v5z+dHeMR2QwHu5S9i/yULWWBZYJCSJyejPK72dwF7dBKEw:qcD13v5SdHeMRRKkwsejP+BV
- TLSH
  T1A8622A51738488F3DBE6013EB85637076B9E5166B4925E93CE271ECA6D3708D7EB2302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 994eb5c54f6e2f4c0328e6eb667a82ca133800964bea7a0ccae8aba60c98e966
- MD5 5831d36066b6daf42fbf2ab1773308c8
- SHA1 6122ebca175efb3607013edc67d3f5e3d4143f3f
- SHA512 d741b4ef4396e7acb7496e223bd131ac4be18d4666556fd108660dd0098a1e683e244b35a5faaf06466cb78186f8f31858aec5b8fe9d507cbf639ad3d4d53ea8
- SSDEEP 96:WgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1t93hhEl7y:WgiqVPgK8K9eIdE9B/thhg7
- TLSH
  T145F108BAF7C006B3CB8F86702853BF075B56E630535561A79A5341CA75D18B3ED38721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a
- MD5 d9a3fc12d56726dde60c1ead1df366f7
- SHA1 f531768159c14f07ac896437445652b33750a237
- SHA512 6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51
- TLSH
  T1B88151BB62A40CF3C0951BBB41D71CA71376DD702792411E98474E9A34C4A6FED6F705
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/splash.dll
- Size 4KB
- SHA256 b3c7a9947ee68e937d805012b4bfeb1b9efb5650101e95c20f7e481735d6e431
- MD5 cbc07e5cb9791d3b7e17aec4af55fa63
- SHA1 01f8876012714a99bd660c0b6acc4ca31ac9b3f7
- SHA512 0d830bc59c1b9aa43b696d9cc36a1a4a1bb40df642caf25f34fc2da0d851e110e8538ce0d3413223bbbe6a5408e64a0146e08a2d2ba803ce046ec8cd0905b46f
- TLSH
  T10B81603FB3D66AF3C56B05338D9322AA1764847133A0404C8EA327CA6A45D7BDC28753
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  BouncyCastle.Crypto.dll
- Size 1.4MB
- SHA256 566eef32e7c4dcb864dc4f7f9b26e84a334e7fda1c6272f6e9acecf04237f494
- MD5 26808ea489648b798a83e9591ca83bba
- SHA1 9718d9b875fb7d37bfca1d5a20b41700a6cd941c
- SHA512 9423c5d1e7e8376b0e69ebf5e28a09f3d8297eba60f127c3c684173a46402eada442af240e9c68043b014e5bef3269a6aca7aaed7a72595c99ecea4936a047b6
- SSDEEP 24576:KgBoAeHR/bI/LahLS55O6+DvV5R7XbBmFtYtKZAr3/X+pfYkw:JBozmOtLCZAr3/X+pfYkw
- TLSH
  T185655A183BF46B33E5EE8776C5B4082683F5E45AB263E71A29C2D2A90C53F409D417B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  ClassLibrary1.dll
- Size 7KB
- SHA256 98d6d8d829df5bd444c0c49af6a7e50d59fcff49ad16ccf81c3d7f8c21d1e855
- MD5 57434b839ae7c8426c718d2bf355de1b
- SHA1 d3abc7a5eafba95642b9503d446f9d44e7b48151
- SHA512 e2511118ca633f122eeac05fbf90af061ed951fda1529fe7e05353d62e01ef71e5cdc30bb96f67d5c35e91af3bed62393efdecbc06fb685ac3538884e11cc441
- SSDEEP 96:6OWwDVIeskkYB5R50eHSHV+tZaQJMDz93fhbs7xhvQPPYz3XII:1WwB1kYB5lHSHV+tZaQyDxts7xhvQs/
- TLSH
  T129E10818ABE48672DCF64B759D6283996734E611DCB3CF2B4DC1022A5C06F289272B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Ionic.Zip.dll
- Size 451KB
- SHA256 3b3e541682e48f3fd2872f85a06278da2f3e7877ee956da89b90d732a1eaa0bd
- MD5 6ded8fcbf5f1d9e422b327ca51625e24
- SHA1 8a1140cebc39f6994eef7e8de4627fb7b72a2dd9
- SHA512 bda3a65133b7b1e2765c7d07c7da5103292b3c4c2f0673640428b3e7e8637b11539f06c330ab5d0ba6e2274bd2dcd2c50312be6579e75c4008ff5ae7dae34ce4
- SSDEEP 6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
- TLSH
  T155A4BE0023DC4A6AE2FE5775D4B782A5C3F2B815793ECB8F9D8464EF191A780D6107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  JeevanPramaan.exe
- Size 576KB
- SHA256 908b5eee8bfeb4cfcf85623a9d3949e4164022040bba6cc24af0d98c015a2829
- MD5 aa3f5e14cbe936a23102586095652104
- SHA1 ff0a2b64d24a8248be495de4cdd2ab428c16e7bf
- SHA512 263c5cd0a0f1befeb7e7d6ca9c51de8b5b77e605a60d384cf3e424087c50572a5c3e24ced0fdeea379bcf9e01ae632cf53cdb5ae34074891af7b852770b2e344
- SSDEEP 12288:y+ZcL1Yb8XD2y9K1t2jJN/PHGPOMhEXncvKbZBXj16Yiqe5a:yco1nn90Wpe5a
- TLSH
  T16BC4D4243AFA501DF1B3AF759FF479A68E2FFAA32716945D1051034A4B23E41CDA133A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral9
- Target
  JeevanPramaanUpdate.exe
- Size 63KB
- SHA256 ff88e440a21acb71e922203bfe6472c02b6e53710863f81c529839f76492c366
- MD5 429420421dc8e0d8724bf99acd74d7fe
- SHA1 c15fab2294e9960026d68d3b3c2963a2520df249
- SHA512 1f9cf390e0b578ad2264486e8881e6eda16b69ff2994ae106222660b9e70708c3e6f468b194399a0136bb6162bcabe42a78542356350f057e2296e483fc35d0b
- SSDEEP 768:DX4YCc2bf4qdKXKJY/UDeTWGEIUU7AzHpJWQkluiqmxodQuUPJXrS66Q1Kg:X2bQaYVWGDUOAVdkQiv6shS6L1
- TLSH
  T12053C69D736071CEC867D8729DA91DB4AB21BD3A432B52076077369DDA3C487CF242B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  LocalizedText.English.resx
- Size 16KB
- SHA256 35bcd10023d139426d4c79b050c95485326f351c7c03870640cdb86d399dfcd0
- MD5 18b3fc2fe0e3dcab48e32fa966589893
- SHA1 d6fdff60a0d56fa1de41e6542d1cc3d32435cc13
- SHA512 22689b786fb6fe1b4927ecffa58ace05a365e0c3b4da904f46bee89be71a3f5eea693d61a5ab46d61585b01a8617d8970715e3e2b251db683852ad01e34b407a
- SSDEEP 384:KjrbLPxsLvASvKgwyahFcJM9fsSFnxm7XGmOcvE7ZUQSqEhX7EZrSSZeY2Lbz4BQ:KjXdskSv6CJM9fsSFnxm7XGmOcvWZUQ6
- TLSH
  T19D727D49F0C4ED7D0977A138E5E2A583A694B13A53941C8B39CC358F9F77C847AE3690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11
- Target
  LocalizedText.Hindi.resx
- Size 20KB
- SHA256 a32dd3890cd9f659f6407d509e37be7654342ff5d563fcbc32c55f9d95ea45cc
- MD5 0d21ccb41f9ec2dbf9f394726a1a365c
- SHA1 4af037bcf8cf53177e7dc6bbbd523ad13755ba89
- SHA512 c8d26e087436162f65a14e2de8f569da2953ab8dd937a57bfffef437b1828d0dfc3603e854c0f594764bb2f564747b19b597ebb837a397cabb44b9c7f0a7a3c6
- SSDEEP 384:KjrbLPxsLvASvKgwyahFB008RIKmzoWM+7lqGQGEGLX1mEgBwasnjTRF2Na3UTIS:KjXdskSv6D0RuKWoWM+7lqGQGEGLX1mV
- TLSH
  T1BDA2794DF7D8FEBD0DBEB428B5925973E5A8B13653A41C9634CC328B8F26C9065E3580
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral12
- Target
  Microsoft.Threading.Tasks.Extensions.dll
- Size 30KB
- SHA256 7c1cc8f7445696648701299c132d98cfd861771042df1d5471354e539ad35ac2
- MD5 5e195f1c9b62f8037bf763bcf3702684
- SHA1 53000ea87f06a88edb8f5ae112515ead39af246f
- SHA512 aaf412dcc629acc9056d75cbf3226babcf29f4affef7f1d52a9c1b93fdfd79a554ebba78a4aefb636593bfff8ad09550b537151453f2c645813859638ada697c
- SSDEEP 384:PyqL9uaxv+fg8SA4nrzrwoGtOW1VnWd1q//0GftpBjz31TDFH3HRN7XClKO/Xeh:lMfmrwZtvl8iR1TBHFJ
- TLSH
  T1C6E24A91CF6C8143CD5B7D71A7A4DAC36D39C7D29C10DB66288CF0B41C973DA9E206AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Microsoft.Threading.Tasks.dll
- Size 36KB
- SHA256 26e67b42ce9ae8581bc452ff0f99807166badb416bc4b410d99e93a9d09a220a
- MD5 f725173a7b47e909f98a5079fd846106
- SHA1 bc5a8c4a18da4c650d336cf627884c4e598d719c
- SHA512 ad8616639d93d7e9e0201d92edcb2e2d72e0670e08af3ff1674ee90dafcbfb2e756890043561a8c0dfbe7a68e13c675cb89810854c7b11e85f809fa5adc84be3
- SSDEEP 384:8jCan21RTf1FuPIgbSVHfiWvoVZHL+8SBhE+QNEv4qXWy1cW31q//0GftpBjpZVs:8+e21RTrgbSpfihevF4q5q8iLZVH9q
- TLSH
  T15DF27C88C3AC4113DEAB1F7196A4D9836D38EBC34812DB1A7588F1E11C937D29F3666D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  System.Runtime.dll
- Size 21KB
- SHA256 125cdf18f9d657c8345aa7ef36f81fa29670124f5eaf2cc1c48053190107aab2
- MD5 2fa2fdfa8bbb84b36648ff3b28022a6c
- SHA1 843df5d90dad314c60f492435ac0954a04c47426
- SHA512 9be94c959338a9f9f1cca29c011537ab65e2fe42b309f5df802db0eab23963984aaec042edbc0367a0de039e0481db083895424d46e8ded5617df28d4bdecd5a
- SSDEEP 384:iNRimWMsMnJ//0GftpBj02FtAHRN7jDl+9qY:fUP8iC1UR
- TLSH
  T150A25C918B7C8193DD934D71A6B8DA833D3CFBC79C21952B1099F5D92C833D6AB24628
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  System.Threading.Tasks.dll
- Size 34KB
- SHA256 8985293978ed56444fb7c6c16851cb03ca64e038731ffa06aebbaa560396832f
- MD5 abb19bd517c6274551229d3a866ccd36
- SHA1 a28ac468905454da4865cd61c3d695b95ff9742b
- SHA512 6b6858dc183828206b576ab0d527cb19d5322dcb532f969117606f9cd4f21f875f5ab210e50fcf34d737aad3f192f7805dfc410fa02b3b209392a04c8985f804
- SSDEEP 384:OL0xHtrBefGMYRoY+hoZhOnkcFr32qL3UWUFMnJ//0GftpBjaS0FtAHRN7Ql+9qU:FVBefGLMoW9FrGxu8i8KPV
- TLSH
  T125F26C9497AC4103DD6F2DB1D9B4E5473A79E7C25C22E71A24CDF5A81CC33C89B2162D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  uninst.exe
- Size 164KB
- SHA256 c08991b95b9755eac3d502adde370247416046f893b6c8ef2ec784f1a1a09402
- MD5 2199faf8d77b019f3b684e35f09844d5
- SHA1 f71a396bb488eec0b20542d5a2d7ee63f4316048
- SHA512 cc2f9d3bac75d15e1384f29036fb97ef28e9741a810b9a2c7738aa868171a8ab99330639d936b57f2d503a9a9637450a76d87c2106d47692590813805d5f9fa4
- SSDEEP 3072:hg8Dsp+FNX1dFOvDlXJuyb9Vxk1sakJ4iICRCDA/SuOV:e8dNXSEyV7jIat/SbV
- TLSH
  T16DF35A31FF83B4E6C6E440B14C2655F71A22AC2B57410B73E6B0362A1DE634BBE36476
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

ConfuserEx .NET packer

ConfuserEx .NET packer

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17