4c8250440ceca5b86e6be13e13b521bac98387c332f49c26a8f83eaa38fbc3ea

Sharing

Copy URL Twitter E-mail

General

Target
JeevanPramaanInstaller_v3.6.exe
Size 2.0MB
Sample260731-mlt52sgf89
SHA256 4c8250440ceca5b86e6be13e13b521bac98387c332f49c26a8f83eaa38fbc3ea
MD5 59d9844cd6919459d5492d0b23eb8635
SHA1 1fb20178e519f8871dda12056b3a4c9f507d0469
SHA512 457c5fc8b6ce185aa1a2539623119ee5dbde39295c6c70563de0be813e98decbd76c29052d8981c1fa3a4915b1d82a627cd852b23bd0976f9956175d42a54c0e
SSDEEP 49152:Evy7L6gG84GWD0qUPYe0sEcwT2qcnUqzHLrfAPVH8TJ:Eve6gG84GWD0RPYe01cdwc/DJ
TLSH
T1F6953320FB83B4C8E1D581B1485306F71322DC4F57562B73A7F47AAA5C9538B6A318BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  JeevanPramaanInstaller_v3.6.exe
- Size 2.0MB
- SHA256 4c8250440ceca5b86e6be13e13b521bac98387c332f49c26a8f83eaa38fbc3ea
- MD5 59d9844cd6919459d5492d0b23eb8635
- SHA1 1fb20178e519f8871dda12056b3a4c9f507d0469
- SHA512 457c5fc8b6ce185aa1a2539623119ee5dbde39295c6c70563de0be813e98decbd76c29052d8981c1fa3a4915b1d82a627cd852b23bd0976f9956175d42a54c0e
- SSDEEP 49152:Evy7L6gG84GWD0qUPYe0sEcwT2qcnUqzHLrfAPVH8TJ:Eve6gG84GWD0RPYe01cdwc/DJ
- TLSH
  T1F6953320FB83B4C8E1D581B1485306F71322DC4F57562B73A7F47AAA5C9538B6A318BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 e560384c5298ee2123e8340e716b2c4680f51b4d0347995ba3290dbd1130c6c0
- MD5 eee2912bd1ee421cf1f1dfb1cc327d97
- SHA1 c5d3741ddb195718c9b17923eb6abfb7a732bdc1
- SHA512 1808a068386c790d8ad5096d9fededcfa6e5688e3a68f2499418456c9cafd7b837c811298e6570212155b4a3d6038c1749cfcd9d1b86f090f66d1a5301adecb2
- SSDEEP 192:qcOqh13v5z+dHeMR2QwHu5S9i/yULWWBZYJCSJyejPK72dwF7dBKEw:qcD13v5SdHeMRRKkwsejP+BV
- TLSH
  T1A8622A51738488F3DBE6013EB85637076B9E5166B4925E93CE271ECA6D3708D7EB2302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 994eb5c54f6e2f4c0328e6eb667a82ca133800964bea7a0ccae8aba60c98e966
- MD5 5831d36066b6daf42fbf2ab1773308c8
- SHA1 6122ebca175efb3607013edc67d3f5e3d4143f3f
- SHA512 d741b4ef4396e7acb7496e223bd131ac4be18d4666556fd108660dd0098a1e683e244b35a5faaf06466cb78186f8f31858aec5b8fe9d507cbf639ad3d4d53ea8
- SSDEEP 96:WgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1t93hhEl7y:WgiqVPgK8K9eIdE9B/thhg7
- TLSH
  T145F108BAF7C006B3CB8F86702853BF075B56E630535561A79A5341CA75D18B3ED38721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a
- MD5 d9a3fc12d56726dde60c1ead1df366f7
- SHA1 f531768159c14f07ac896437445652b33750a237
- SHA512 6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51
- TLSH
  T1B88151BB62A40CF3C0951BBB41D71CA71376DD702792411E98474E9A34C4A6FED6F705
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/splash.dll
- Size 4KB
- SHA256 b3c7a9947ee68e937d805012b4bfeb1b9efb5650101e95c20f7e481735d6e431
- MD5 cbc07e5cb9791d3b7e17aec4af55fa63
- SHA1 01f8876012714a99bd660c0b6acc4ca31ac9b3f7
- SHA512 0d830bc59c1b9aa43b696d9cc36a1a4a1bb40df642caf25f34fc2da0d851e110e8538ce0d3413223bbbe6a5408e64a0146e08a2d2ba803ce046ec8cd0905b46f
- TLSH
  T10B81603FB3D66AF3C56B05338D9322AA1764847133A0404C8EA327CA6A45D7BDC28753
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  BouncyCastle.Crypto.dll
- Size 1.4MB
- SHA256 566eef32e7c4dcb864dc4f7f9b26e84a334e7fda1c6272f6e9acecf04237f494
- MD5 26808ea489648b798a83e9591ca83bba
- SHA1 9718d9b875fb7d37bfca1d5a20b41700a6cd941c
- SHA512 9423c5d1e7e8376b0e69ebf5e28a09f3d8297eba60f127c3c684173a46402eada442af240e9c68043b014e5bef3269a6aca7aaed7a72595c99ecea4936a047b6
- SSDEEP 24576:KgBoAeHR/bI/LahLS55O6+DvV5R7XbBmFtYtKZAr3/X+pfYkw:JBozmOtLCZAr3/X+pfYkw
- TLSH
  T185655A183BF46B33E5EE8776C5B4082683F5E45AB263E71A29C2D2A90C53F409D417B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  ClassLibrary1.dll
- Size 7KB
- SHA256 98d6d8d829df5bd444c0c49af6a7e50d59fcff49ad16ccf81c3d7f8c21d1e855
- MD5 57434b839ae7c8426c718d2bf355de1b
- SHA1 d3abc7a5eafba95642b9503d446f9d44e7b48151
- SHA512 e2511118ca633f122eeac05fbf90af061ed951fda1529fe7e05353d62e01ef71e5cdc30bb96f67d5c35e91af3bed62393efdecbc06fb685ac3538884e11cc441
- SSDEEP 96:6OWwDVIeskkYB5R50eHSHV+tZaQJMDz93fhbs7xhvQPPYz3XII:1WwB1kYB5lHSHV+tZaQyDxts7xhvQs/
- TLSH
  T129E10818ABE48672DCF64B759D6283996734E611DCB3CF2B4DC1022A5C06F289272B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Ionic.Zip.dll
- Size 451KB
- SHA256 3b3e541682e48f3fd2872f85a06278da2f3e7877ee956da89b90d732a1eaa0bd
- MD5 6ded8fcbf5f1d9e422b327ca51625e24
- SHA1 8a1140cebc39f6994eef7e8de4627fb7b72a2dd9
- SHA512 bda3a65133b7b1e2765c7d07c7da5103292b3c4c2f0673640428b3e7e8637b11539f06c330ab5d0ba6e2274bd2dcd2c50312be6579e75c4008ff5ae7dae34ce4
- SSDEEP 6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
- TLSH
  T155A4BE0023DC4A6AE2FE5775D4B782A5C3F2B815793ECB8F9D8464EF191A780D6107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  JeevanPramaan.exe
- Size 570KB
- SHA256 87754574c1c796bd0f59f8af453e385b496baaf5f095f382d6f970be53de5d2b
- MD5 89bbb56d66807a92b9e6734726bc5941
- SHA1 c756d8e98bc9cf82df72763f1121bdb04c78105c
- SHA512 29eff75225fba16c31a6820d555aae577090953c22f4da63982fb54142b4177f41dce0c12fb09e630f05e0f50a919d0490859b0579789c1e2af902b63b93da22
- SSDEEP 12288:MW1U/7JV24TzCP388VD2y9K1t2jJN/PHGPOMhEXncvKbZBXj16Yi95k:MW1EV7T+rn90WQ5k
- TLSH
  T165C4B3243AFA501DF1B3AF759FF479A68E2EFAB33706945D1061034A4B22E41CD9173A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral9
- Target
  JeevanPramaanUpdate.exe
- Size 63KB
- SHA256 5c469f8aba61e9c7315d8edfdef9aa6ae074f14d73073ce12ba44ee258218de3
- MD5 3d05f55e6c696976e51cfa1ac47a327f
- SHA1 c104b17a0e3e0d0c257b80778a53245d853607ae
- SHA512 86177d6fdff8cf661b18bee0f322c9bbdb433e1d3d5b957ea45ea080155f6d5a37f73162e6a7d5b341e88cf38ab0600dd1c958186a6e5d36d8f307a51b3f3c8b
- SSDEEP 768:bWBacN5mob7ArHpJWQkluiqmxodQuUPJXrS66QIKg:pcv3A9dkQiv6shS6LI
- TLSH
  T10453D9DD726071DEC867D4729AA91DB4AF217D3A432B5607A033369DDA3C487CF242B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  LocalizedText.English.resx
- Size 17KB
- SHA256 334a6dee802885c1ddf3e02ef8b526f3004f6c7eeca0db2055a54cb66654fc82
- MD5 c274d0a912e780121e705a42cb7f5068
- SHA1 51f3893e3953f3194d041f508a85ed0d9909c048
- SHA512 024b6d70de122a3d4bb9de7192a17d5d43cd43894ba1f1c805393a8f616cffd9d3711a607492abb11e630d1582483eb2f3d8c64bdd667e7070e9429c78976bc2
- SSDEEP 384:KjrbLPxsLvASvKgwyahFcJM9fsSFnxm7XGmOcvE7ZUQSqEhX7+ZrSSZeY2Lbz4IN:KjXdskSv6CJM9fsSFnxm7XGmOcvWZUQ4
- TLSH
  T187827D89F0C4EDBD0977A138E5E2A583A694B13653941C8B39CC358F9F77C847AE3590
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11
- Target
  LocalizedText.Hindi.resx
- Size 22KB
- SHA256 56aaeccce20378f1aa4d7304411b3cbf0fc14296f09261a59bac3eacb2daef97
- MD5 8271afcc925ec3a27f90705e7227b60d
- SHA1 81377fb1cd214f4106ee4dbd0dd6377400f16542
- SHA512 3462858943ee2488355153fa4e483a3435c97366de783984f22db52eab2ee5eb6bc72849c1e664a5cf8df28a7476b82ff98e66380a31db328cdde3e86993f8e7
- SSDEEP 384:KjrbLPxsLvASvKgwyahFB008RIKmzoWM+7lqGQGEGLX1mEgBwasnjTRF2Na35TIw:KjXdskSv6D0RuKWoWM+7lqGQGEGLX1mw
- TLSH
  T1F3A26A4DF7D8FEBD09BEB428B5925973E598B13653A41C9734CC328B8F26C9069E3580
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral12
- Target
  Microsoft.Threading.Tasks.Extensions.dll
- Size 30KB
- SHA256 7c1cc8f7445696648701299c132d98cfd861771042df1d5471354e539ad35ac2
- MD5 5e195f1c9b62f8037bf763bcf3702684
- SHA1 53000ea87f06a88edb8f5ae112515ead39af246f
- SHA512 aaf412dcc629acc9056d75cbf3226babcf29f4affef7f1d52a9c1b93fdfd79a554ebba78a4aefb636593bfff8ad09550b537151453f2c645813859638ada697c
- SSDEEP 384:PyqL9uaxv+fg8SA4nrzrwoGtOW1VnWd1q//0GftpBjz31TDFH3HRN7XClKO/Xeh:lMfmrwZtvl8iR1TBHFJ
- TLSH
  T1C6E24A91CF6C8143CD5B7D71A7A4DAC36D39C7D29C10DB66288CF0B41C973DA9E206AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Microsoft.Threading.Tasks.dll
- Size 36KB
- SHA256 26e67b42ce9ae8581bc452ff0f99807166badb416bc4b410d99e93a9d09a220a
- MD5 f725173a7b47e909f98a5079fd846106
- SHA1 bc5a8c4a18da4c650d336cf627884c4e598d719c
- SHA512 ad8616639d93d7e9e0201d92edcb2e2d72e0670e08af3ff1674ee90dafcbfb2e756890043561a8c0dfbe7a68e13c675cb89810854c7b11e85f809fa5adc84be3
- SSDEEP 384:8jCan21RTf1FuPIgbSVHfiWvoVZHL+8SBhE+QNEv4qXWy1cW31q//0GftpBjpZVs:8+e21RTrgbSpfihevF4q5q8iLZVH9q
- TLSH
  T15DF27C88C3AC4113DEAB1F7196A4D9836D38EBC34812DB1A7588F1E11C937D29F3666D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  System.Runtime.dll
- Size 21KB
- SHA256 125cdf18f9d657c8345aa7ef36f81fa29670124f5eaf2cc1c48053190107aab2
- MD5 2fa2fdfa8bbb84b36648ff3b28022a6c
- SHA1 843df5d90dad314c60f492435ac0954a04c47426
- SHA512 9be94c959338a9f9f1cca29c011537ab65e2fe42b309f5df802db0eab23963984aaec042edbc0367a0de039e0481db083895424d46e8ded5617df28d4bdecd5a
- SSDEEP 384:iNRimWMsMnJ//0GftpBj02FtAHRN7jDl+9qY:fUP8iC1UR
- TLSH
  T150A25C918B7C8193DD934D71A6B8DA833D3CFBC79C21952B1099F5D92C833D6AB24628
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  System.Threading.Tasks.dll
- Size 34KB
- SHA256 8985293978ed56444fb7c6c16851cb03ca64e038731ffa06aebbaa560396832f
- MD5 abb19bd517c6274551229d3a866ccd36
- SHA1 a28ac468905454da4865cd61c3d695b95ff9742b
- SHA512 6b6858dc183828206b576ab0d527cb19d5322dcb532f969117606f9cd4f21f875f5ab210e50fcf34d737aad3f192f7805dfc410fa02b3b209392a04c8985f804
- SSDEEP 384:OL0xHtrBefGMYRoY+hoZhOnkcFr32qL3UWUFMnJ//0GftpBjaS0FtAHRN7Ql+9qU:FVBefGLMoW9FrGxu8i8KPV
- TLSH
  T125F26C9497AC4103DD6F2DB1D9B4E5473A79E7C25C22E71A24CDF5A81CC33C89B2162D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  uninst.exe
- Size 164KB
- SHA256 c08991b95b9755eac3d502adde370247416046f893b6c8ef2ec784f1a1a09402
- MD5 2199faf8d77b019f3b684e35f09844d5
- SHA1 f71a396bb488eec0b20542d5a2d7ee63f4316048
- SHA512 cc2f9d3bac75d15e1384f29036fb97ef28e9741a810b9a2c7738aa868171a8ab99330639d936b57f2d503a9a9637450a76d87c2106d47692590813805d5f9fa4
- SSDEEP 3072:hg8Dsp+FNX1dFOvDlXJuyb9Vxk1sakJ4iICRCDA/SuOV:e8dNXSEyV7jIat/SbV
- TLSH
  T16DF35A31FF83B4E6C6E440B14C2655F71A22AC2B57410B73E6B0362A1DE634BBE36476
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

ConfuserEx .NET packer

ConfuserEx .NET packer

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17