5a412667e52e4007bf8d2c5d6e7b2f0e91841bffff5d05c706338b63718297c6

Sharing

Copy URL Twitter E-mail

General

Target
PulseConnect.exe
Size 76.8MB
Sample260801-adcvkstcpd
SHA256 5a412667e52e4007bf8d2c5d6e7b2f0e91841bffff5d05c706338b63718297c6
MD5 541da7dca2673b2c43466e4f76f2416c
SHA1 75d965de70903b3c080446355dcd9e25118a47bf
SHA512 1c30d52af03210dbd5c6552c5c8a260108c04705411371ad75ee4ecb0b0e8843e8f4d2ffd844240000df6c0fe20c21bd8c0d7504e04e34f8e84ef691d60c9de1
SSDEEP 1572864:L0e4hdV6xf/i+sLHbhynQ3Y9GF0J2/3M4fvHLTkEg8u6CRJH:L0e4DoxfdObII/0A/3/vHL88pOJH
TLSH
T1620833339E2D59ADD0CA22BED1BA00F2894F144F1B49949473BF53AA76F5F060E72187
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  PulseConnect.exe
- Size 76.8MB
- SHA256 5a412667e52e4007bf8d2c5d6e7b2f0e91841bffff5d05c706338b63718297c6
- MD5 541da7dca2673b2c43466e4f76f2416c
- SHA1 75d965de70903b3c080446355dcd9e25118a47bf
- SHA512 1c30d52af03210dbd5c6552c5c8a260108c04705411371ad75ee4ecb0b0e8843e8f4d2ffd844240000df6c0fe20c21bd8c0d7504e04e34f8e84ef691d60c9de1
- SSDEEP 1572864:L0e4hdV6xf/i+sLHbhynQ3Y9GF0J2/3M4fvHLTkEg8u6CRJH:L0e4DoxfdObII/0A/3/vHL88pOJH
- TLSH
  T1620833339E2D59ADD0CA22BED1BA00F2894F144F1B49949473BF53AA76F5F060E72187
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 76.2MB
- SHA256 42b6db6e589bc1aa9148dac2ffec7ebb261c07e248abb15aca99e6f70028d03c
- MD5 275051cc112f9fedb10ba4889a185e8d
- SHA1 4c65a0877904660017f95266e5fe867d83100a4c
- SHA512 0df5c47312e92332b7a77edaa46ebcc17587cdb9f4260c14497de7513dccb98d70bc7830f16dce7616c2f1ac94fd07dd0ea650bbc18c864c87bc251162b467b6
- SSDEEP 1572864:5e4hdV6xf/i+sLHbhynQ3Y9GF0J2/3M4fvHLTkEg8u6CRJj:5e4DoxfdObII/0A/3/vHL88pOJj
- TLSH
  T1B90833339E1D5DADD0C932BED1BA00F1894F144F1B49949473BF93AA66B5F060E7218B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/koffi/cnoke.cjs
- Size 29KB
- SHA256 82fb92e7b2ede9c1671f6f5c60754c656d1c2271f1ef6d492052bd0c25feaed6
- MD5 443bc033018f467dafb001acc29c4b4b
- SHA1 7c8ed03d36d7f6cfe95f94c2fc7bd1cfff4eaa7a
- SHA512 6dae34aba91f0bd5e593921dabc2cb8225cf9994f48a3701855e62cef16d00ac5f7c084938c6519368d729639f034a0262d50b5b4c9f693a5462d14a2c502e79
- SSDEEP 384:TrNhn3rfJz0r16Ttv/CjLRMHVBEq7Tgln9gt1ARrNAB3tiOB5qEjKEkBXFaCYVHE:TrLn3rBz2MHOlnDRjcjKESfo4u69p
- TLSH
  T175D2071666FB25230363E47479AB94057AFAC6170308D85CBE1CDBC42F9057486F7BA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/koffi/index.cjs
- Size 50B
- SHA256 a200e15ec168d00cb3155794808a98243051c61dd7f6989c23c57ee220c918b9
- MD5 57993c7e641cd870fae9c777d50809fb
- SHA1 b25be4b38b547961a693f9a97957675c0140b5eb
- SHA512 81c3435ef3a1c17765b9753b3378b1103977ff9c12d5264faf0fb780949d5b136d4ebd2aeb457b9c00bd11debf3f0a3e9bf92360515b3fcb1d8620fc8f923dbd
- TLSH
  T1DF9002A33599734122054594DA5B551316D2C4940404500041454DA915C5890057A8E0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/koffi/indirect.cjs
- Size 53B
- SHA256 f36c7fd3caa9c43da3db45e1ee272892087b4001b6f575fffb76dd80574829b1
- MD5 8d380c9a11bb3d8e4f5f59af630d8576
- SHA1 48ed0d8ca326ce03fb42949bab32ed64ab875cd4
- SHA512 c21c61d9c540a7dc07a2fbf3e634747d1307982b30cfaa893c1b005f03ef3f0a3edee6b71065b28a7d621fd5b4e51653f241e2729bcc11c70061b69a745cf198
- TLSH
  T1DD9002B339D97A4522054594EA53511325D9C4A00408501441454EB9158585005728A1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/koffi/lib/native/base/base.hh
- Size 172KB
- SHA256 7e2378a390a72aa88285114936ffd4472d6b7b5a239f2af0337d86e1c4e3358e
- MD5 686d9b23799103c1274b5940cca33924
- SHA1 cdd389515c7f450ecdb41b05eb2fa2b938f643fc
- SHA512 d8b05b0e85d5bc8fb790cdb8a7d229b18a2f0060a75fcd553ad5ba900cf01c2b52137b11246027120c35d304ad0de5bef9178a33a575235e3c354dbe8b4d9115
- SSDEEP 1536:+MpROCqjC+2VvS1utnFuQsHGP+8o7sVqViLhq906CBlgOh:+FC+2jtnFuQsHgP5VxJ
- TLSH
  T12704B4546CE7604196A2D3BA9F8B4010F23894673769CDF5BD0E6220AF434A9F2FDF94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/koffi/lib/native/base/unicode.inc
- Size 35KB
- SHA256 a337b5e53a6c72534fcf093c58d7fbf12f7b1075f068ea83a09c91e34373b5a4
- MD5 f1f66eda83f40b659c7425dab7305ecf
- SHA1 97f601ec8a3f1374d92f7b50431fcbe4d30be63e
- SHA512 87a5dda3d6b7a3e05e44be3607b743a0b9d354300e595067306b0f2f7c0292d84f9d8adedc2877d4d2411b74bac12b0a8deef6eab2b1e3653203d1843b19aae4
- SSDEEP 768:LkS4TyQ5256j3IbWA6GPqv7X8IshABkbWA6GVPyn4EPH:Lks6p7X8UH
- TLSH
  T1EDF24368924D19C03513608CF314A523A2FC74736BF46F8BF62E5788EAABC4858B5D7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/koffi/package.json
- Size 1KB
- SHA256 ee85992eedf4399c4f0e8023be93630cb6501f5a5de42d2cebe906c5a31cd86b
- MD5 a9da03064818f105ad0f110efe61c573
- SHA1 1b9fcd9fcbdf269a9303dd74bd68c397e1b601c3
- SHA512 50146c589aa30a5c22d3a802b136e36fc1c29afb588c4a990e04b7d1db76e49917bbda2b420573d94c472052a30a14bb138b63500cac5e4ef61061d7caaed5cc
- TLSH
  T14731C627DDB01FD326841DB0B45E0056A33948B38C487949F76B166C9F4C5EF6B7816E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/koffi/src/abi/arm64_asm.S
- Size 4KB
- SHA256 9ef4d4095faddda9e5807137cbfbf40908ec2b373e6f0e2e3ee70e7b919d37b4
- MD5 fec17e1f7441d36de58217a7186b3d9b
- SHA1 d5d003c9eee08caa7d5c32e7d8ba35150e60221b
- SHA512 f849732fe753ce2c82a68b442196732bcbcdb99a4ed97fae9bbbed672c7940127fc44c380db5fd3bb8f356c4f67e1ad33bac78705c9c8c85f8b739d67c9e903e
- SSDEEP 96:ryCamFUTqcYK6KDsC+ZTDCuGTgIIlLPrBvgi4qHUYx5jYK6K8Dr0CBP2+ZTDCetQ:WT2UTqcYzAB+ZTDCucgIggA0Yx5jYz1e
- TLSH
  T1C9A15545BC0933390D15C136A4D69D16C69A68B3F2BE9518B30BA3CD2F42176B3FD5D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/koffi/src/abi/arm64_asm.asm
- Size 3KB
- SHA256 58053bbdc192f2191fceaba048798d9862f2fffbca992cd09ad1bbed8c61d4d2
- MD5 f01e5aa9ea327b07ad9cd5320a86848a
- SHA1 44f664d3ef43a092ad834334965f0e4cc4613d47
- SHA512 7c5a2354586131c0c386a69a4ad1b44d51375c8e21654fe53de3d18b93a477704d16755a9d733976d218c8704137ba94a84df79be8df54db6db90a7fa9c31458
- TLSH
  T18881100EFC0EA7652D50DAB8598B4F17D26A0997B2FD8450B30E6B981F4153DC7AC2E8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/koffi/src/abi/loong64_asm.S
- Size 4KB
- SHA256 5df3967e737eadd1509812e76b6ce4dcbfd8672797158a3fc37ac5f3755d14de
- MD5 0074a3a78bb59b658453085d49bb7082
- SHA1 4504fbd954b711db7c8e5f7b9f41cf3c19474b4f
- SHA512 909828edfbe92be325a4b5577271f6777b0782cdd86e667ebd714c26083b72cb1abe7fcf4817346ac0d1c6813e85a8e72fba09847ac9365dc9ced3cfd8f84df1
- SSDEEP 96:rPjog6WkD+Jo5MHyzx8As39uF8i4qHUkqE6jtUnmSwd6U6C+r:/ogQDKo538A0kF6GmSu56C4
- TLSH
  T10991CEC6FC0BD6170410E59AC98BD698CDAF299707A90C94F11E2FD43F8256DD3A91E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32