23d3db4c0e97f18a91e5c2cba47c337f1e1d7f899a0cbbd18514afa324b68b60

Sharing

Copy URL Twitter E-mail

General

Target
HyPrism-win-x64-3.0.3.exe
Size 218.2MB
Sample260801-b6vrjacn4t
SHA256 23d3db4c0e97f18a91e5c2cba47c337f1e1d7f899a0cbbd18514afa324b68b60
MD5 c367a96510833316b395e084237aface
SHA1 b7751f33013d1ae294d22b3999811eae4d84d54f
SHA512 cacec376b477db3ea80496846ab144a99fc5f1dc437175f5bdee721a247b11bfcef60f29763ad4832f0852f234112adcdb31af86d118b963d76e911dd83fe3c1
SSDEEP 6291456:vG0O0ReZxzP5NeeV7QJwjFKSTA+2E4S7nj09cWONaDkoM/v9fmjV:O0Reb5NFkuA+162HD/vtc
TLSH
T167B83329E9D88536D0FF2B30687956924DBEFEB14F30D9976600CACD5A78084CF98367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  HyPrism-win-x64-3.0.3.exe
- Size 218.2MB
- SHA256 23d3db4c0e97f18a91e5c2cba47c337f1e1d7f899a0cbbd18514afa324b68b60
- MD5 c367a96510833316b395e084237aface
- SHA1 b7751f33013d1ae294d22b3999811eae4d84d54f
- SHA512 cacec376b477db3ea80496846ab144a99fc5f1dc437175f5bdee721a247b11bfcef60f29763ad4832f0852f234112adcdb31af86d118b963d76e911dd83fe3c1
- SSDEEP 6291456:vG0O0ReZxzP5NeeV7QJwjFKSTA+2E4S7nj09cWONaDkoM/v9fmjV:O0Reb5NFkuA+162HD/vtc
- TLSH
  T167B83329E9D88536D0FF2B30687956924DBEFEB14F30D9976600CACD5A78084CF98367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 217.2MB
- SHA256 8cfd81804596260ebdca6f0baf14536795086416192e87aa82c75d1bead18bff
- MD5 2d2017ae393087dda6d2b728db42b5a7
- SHA1 a7db40d0ed2099839d7e4c41d83b4ebe6cbb7795
- SHA512 e3e7b428d584b89b767d1825691bc6d9ee36fac3f790ff4d21caeeb1d6df3c2e224e79f32ccacd752272d5ed40db58467821ff8763713e896699cdd9c679cdad
- SSDEEP 6291456:4G0O0ReZxzP5NeeV7QJwjFKSTA+2E4S7nj09cWONaDkoM/v9fmjQ:v0Reb5NFkuA+162HD/vtB
- TLSH
  T181B8337DDCCD963AC0DF3974649944D28DD9FAB28B3069D2A810CDCC966D0988BDC3B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  resources/bin/DiscordRPC.dll
- Size 172KB
- SHA256 650fc02dd7a5ec204cb9d1ca224c8d506ccad03a3811750f36163d36a904dc24
- MD5 98972734c48a01fadc056d3c4b67e6a3
- SHA1 18a400d0595ee4dd908184d969aac6b03acbb44d
- SHA512 8d7a02f8b7d0a3838149eb615a1263a1035f2edb7046bcb3496ab84ed9e9371d65ecbdac25bb4038ca73cce46d9681051ca64d08576c5c236208b47ebf747758
- SSDEEP 3072:6/LVgc3WqOmqm0Wb+AQt+O8BSQ1wITOFvd0+lgGo9b+mJsYqcz:aLVhGqFqKb+VRF0Ido9+m8g
- TLSH
  T1360418AAA7E84512D7BF56BC90B34200D3F3B9562721D2CF4580998D2F477C1BE72BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  resources/bin/ElectronNET.API.dll
- Size 880KB
- SHA256 8d56410471ea87306e5fe267ae4909583e28aaa988231c10e6ef7b28a8723d0c
- MD5 f7b650464f5cce0e57bcdb4e13fd3651
- SHA1 f412419143ce3f02f7cf17ddaf0db2acf238fc8d
- SHA512 9e6a85e4fa81360b200b2d724033f45134a48f36b78b7561f3979553ead48181d201b26a14649c07c028a1bdb87181bb9e25d04015cc9f0ef38a1f5b85516af0
- SSDEEP 24576:+dyUpIg4JoHu9Pg4trU14fG/aVZQUfRP:pUYA4fWaVZ9
- TLSH
  T1B2154A19F3988616DA7F52FCE6AF4613C2B1A456A321D2CF0108E9893F17BC19B75327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  resources/bin/ElectronNET.dll
- Size 4KB
- SHA256 d6e797ca7c580e3f32f46a65a3481a7bb6950d33d9682bb30669f6d1c6f39e19
- MD5 17c99695b84808bfe3ccc2f463ce309e
- SHA1 57cc3bd635435d252b2215e311274e4f2f2ec828
- SHA512 ffc5bdcea482c398d8eee361ba8ff65f0888832eb9015a197a1a88b1c816d87532cc2f4a5226c0957e6c5a7a7e6056b2d6f95e39a1eba2157477b0193a8bfd81
- SSDEEP 48:6/ApsbrlT3ytWKmHsJkNVqXvue3JSLakAPsPn9Wy8J:Kflo9CTZA69I
- TLSH
  T13B910011D3E4422AF87B9B79ACF39B4516B9FA10BDB68A1F0845000B5C366648F31B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  resources/bin/HyPrism.dll
- Size 2.4MB
- SHA256 be1e5f4e5c30ad41b892a5fc547eaa5dd330ea3769ee9e8ec9ac153686431ecb
- MD5 6acd655c2eddfced31b0f1ab55d6ccf7
- SHA1 7d2f671c1b4a355c942d5ac75fffb526305a627b
- SHA512 5bf1b6c2b4d83d66a5e6132478800aff4f59b743ea73431e74853f046d874c71ae366819a6f2d3484934ae3fcba42a37fc8a9abb4f1c34a17c4ef4302c5fdb50
- SSDEEP 49152:xVxXlzpYuRGM22n21XkKXwU82jRcf1vN:xVxXlzpYE9kpWt
- TLSH
  T1C3C55C04A7C44B21D77EA57C96660422D2B2B8564F6093CF214ADCC92FEBFC25BB171B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  resources/bin/HyPrism.exe
- Size 321KB
- SHA256 cb7d1d924b3c7258e0d9d22dfad2a64fb922b861f460d49d9587fcc7ef1b9ffe
- MD5 0a1b3c049e69ef993c1c748c36d2ce0b
- SHA1 79bfc5dfde42c97f1c4a7f885d823a9242c6d2df
- SHA512 528dbefa9f4a26686d038d7f03d828d591dcfff3741fd77b94d159685c19c7bd8d1037d35c6928c59b05d54da4e8b50597ad61cc2f234a9163dba70aa67ab04d
- SSDEEP 6144:JlxnlRLfyQXN4XDM09YdZJgAE7uVxYSl1V8u:JphfyDYfFEKVxYSl1Vn
- TLSH
  T16C647C83F18811EDE476DA79C5664C41E7737C2E876166CF23D07A720EA36939A3A703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral11
- Target
  resources/bin/Microsoft.CSharp.dll
- Size 958KB
- SHA256 c56d26a7cf3a5d117c4ec523d76df56774b2001a3e1e9c6c42312d252a34205c
- MD5 afa73fe7601c3a38ac6c035d271f9338
- SHA1 32ec373f7b3d8a105aa984debafd316b648f2359
- SHA512 76290bbd4936b4c6bf666ffb29e8236b5ddd143559409dd31fb3b9c13a76a08cb262b87ff72bdf6be4b324743708e33658fe9aa6363861769ade65481cc5d1a6
- SSDEEP 12288:I0d1linUIUQzr7fYhRzRvhDkVv4+X6MR7Ea3Vu9yHxQVWz9NEF7tuB62:jd1lOzrchRHkVr6Wl3Vu9yHiVWzTKpu5
- TLSH
  T17F257E1493D80E16C26E837CC1538A12D5F6A443336796CB48ACED742FC77CA9A77A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  resources/bin/Microsoft.DiaSymReader.Native.amd64.dll
- Size 2.2MB
- SHA256 7f8dcf37d9d66eae14c48a79fa2fcd447bd0f38a21be0203a9c4a89398aacf28
- MD5 a71cd05c01f0fc603c0bd782516f806d
- SHA1 c15e261d5e7318875d324d28ab70a883cd434c81
- SHA512 ce53f6dc1f02889ed6fb1f8df226f9badbb039f79505cdbd599a00a32b6617da5e19f2ad7f76bb8134b3ccad39fab2209ed8ec6ae42cd30402c4e450fc19fa88
- SSDEEP 49152:jH+fGgFyzuNiG6H0n8D1gkrz/OAyFAopdrq/c/:+GgFQq8DT/ZyFDN0c
- TLSH
  T1A4B58E87A6E841E8D57AD178D667520BE7B238010320A7DF42A4876A7F37FE50B3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/bin/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 128KB
- SHA256 f73f9676cd78cb8c61202b01ce361a1f37ee3e5ef478eb1a8892f29b15069af8
- MD5 3e76814909502908d62f384a415d6180
- SHA1 6d161a88eb9b842de7ed0a09a6e233c486e54ff9
- SHA512 186ca77cd62345586d07e7c968e7ee69152ac4a130d241ac25597357f510f570cf1b6165f1d0e53ac367323b4d3ef41f5a8743c8d3157cb4c021e149e464e529
- SSDEEP 3072:VsVtlvqXAQQEeJQy4nxQRkXEs+6cB+pr1C:joEeJ4xQ7L6cgprs
- TLSH
  T1FAD33A2CB79C4201C73E86BC96930742E6B7EE1323119BCF1456C5AD2F87BC5B9B19A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/bin/Microsoft.Extensions.DependencyInjection.dll
- Size 200KB
- SHA256 f125fbd0c3e2aa7f1480672ee57f5f07708502c77f8c5bcadd5e430b8fc9bd7e
- MD5 98f6e9b8f1281879b14d9effc9ed1aeb
- SHA1 dfd1b5bfa72d7eabb9616e15ea6877bb25ae09bd
- SHA512 82e8cb6fda548c3b7821705a50bc0e3428217f01d538bf1a667b24017e44e3bb9af378ebbd8e01f6acf06a452a397b25ae0e70347d85d01cb9c1d79560eb2aed
- SSDEEP 3072:P0IGvOQH25QdDMN45Pso3L+VwbyslXY3D7NFVLZZrut7H9PdHGiCC:2vxMNSrSVQYHNFVLZ4lxdG
- TLSH
  T14214393793D84A0AE7BB457C91A3C201E7B765633301D2EF0AA4D9451F93BC1BE72296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/bin/Microsoft.VisualBasic.Core.dll
- Size 1.1MB
- SHA256 331ac20fe9a41ebae155a955f2dea34bc247128a5bd8d299d7a6cd0da01acd87
- MD5 a250070e475c67a07fd1555303277d77
- SHA1 9ed13e565eed6af450f225898d2c928b0f7cc631
- SHA512 ac93d963f17ea3d416e32c74bf5a7e2a41cec2dfa9d808e4fa0c0a2b6528a7d1819920982a837fbb420ef7807541aadd7d2d5d745c034134bca168372e41c5f7
- SSDEEP 24576:wyZKmvH5MjbvtN5cao3Qj8q15vV2Xgulf6qd97x5Omm+:dYmvZMjbvtN5cao3I8q15+d9l5Omj
- TLSH
  T1B1458C09B7C4CF1BC33BA6B9C7568762D274E5625751A2CB1440CC362B4BBD3B3B12A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/bin/Microsoft.VisualBasic.dll
- Size 17KB
- SHA256 ee87b36e158bce45e4a892fbd13051daa7e997e4548d25b3dbc795aff3fb0477
- MD5 a2c589e142adaa7126a238541100a4ea
- SHA1 216c98cfb1d47082fbc9831dcb143895dd41c844
- SHA512 f9309c9cecb80d22a83524fe641a6812578bfc6ddd7e6209095355f5d277e24ed435225afde19cc62e50919483d16fffd2a99abf8387ae8627019ca1b62af063
- SSDEEP 384:P7Mu3c0m0xWmH6l9QdWNzPDHRN7/jHGTYAsR9zq7TD0w:P4uM0mJ17mMj9zmT4w
- TLSH
  T1DE822AA5D7388903EDA76F704EA2D5437EB833C74A319A2B1559E5051C53381FB3932E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/bin/Microsoft.Win32.Primitives.dll
- Size 15KB
- SHA256 2ac29370b9734bfd2fac7ea4037d759e81b61b5863dfd416baffc2d60a8079a7
- MD5 f0d06ce755b0e9bae40ee371bfb8ff32
- SHA1 fc0941ee7899bef6e9480165a44ff27be4982347
- SHA512 135dc668481722714ed44b307eb3a011b663b21daa0b13582419b28e65a27dec6cb2061fc52f1e7ecf2341e881ac10e4abbcdb50bd4966c6b84ec4c9c796460b
- SSDEEP 384:6jX23MOfHTY1WhPSpWU/hljHRN7nR9zQfOAD:CXUfHTYdDjR9zC
- TLSH
  T1AC725BD1D77C4243ECA75EB096B8D9833D3D27C74A009A2B0595FA481CA3781DF35A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/bin/Microsoft.Win32.Registry.dll
- Size 114KB
- SHA256 3a05fac1f2d66cda1b102b6989c38d397ec81ee0f77e67a1ba4be8d2c842812a
- MD5 302f32dae1288f44132cf370c35e1ab1
- SHA1 fa2430132091b04e07132258f67a2a212acb9a83
- SHA512 03970b72a8e28542c6240e46b261b6308208a7d552cd90f7d07c24064586458de1f0a7f80a3ffb4ce87f74dd1f5e5bdff3987e6fce8fbfa5e3a6e80d447ea95c
- SSDEEP 3072:SiuwrQx6bAYMteaJSvEdy7IVicYv5ZatHi+1L:JMVteaJSvEdEnRj+d
- TLSH
  T1BBB36B20BBC4410FEA7E45B89C734846E232F5965742ABDF0695C0DD2FA3BC6F632562
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/bin/Microsoft.Win32.SystemEvents.dll
- Size 84KB
- SHA256 47210be62907b111fff148987f5f2eebdfa314165c078d9e35b237138eaaaba2
- MD5 5bec382b5ffa8f5cd11f3c0a95f05295
- SHA1 b4e546f37eb2ee791954edaf24f47b107aafb06a
- SHA512 0834b71f7af3cbfc2dba3a4a25bcf8807da93498789c175366e9d4a690b396652684ac46b5a1e8bab0c1b294ec0f22d5fdefbd93d63fe7a8d05b238ab4a59abc
- SSDEEP 1536:IM4BNnbgauf+G9TjMS1UYdKCqN/4IGrtsDk6AKC:INzb0BTj/H0QIGr16AKC
- TLSH
  T1E583292273840736E6AE8D3BBE630A019534F4866723EFDF4086960A1F66FD6D7B5143
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/bin/Newtonsoft.Json.dll
- Size 1.7MB
- SHA256 97827bbeea14386f58c0abfdaa811f8b88f94768e49a2b565bfb6a6b24db5e2e
- MD5 8478b92803c6b9daf163c64afe72424d
- SHA1 5141b0f697edda3186cd7d9b6e407d8a3af4c1a9
- SHA512 06fbf95b9cbc5058e242e53921f6e9db6d5e5c1ebaa47baa90ee11bc668b6e8f64bd4119fc6f95a8b41c41e12ec767cfd2384564588baff8a1f5ac43d06d385c
- SSDEEP 24576:3V3Gpi9VVz7Mk7w+GKLfiKPTGuaJIXsZmOe4kBGybj9GBa9WQB6F:YIRfI+GTKPKuwJa4kBGybQF
- TLSH
  T10E857C19A3D98B11C6AEDABD912B4180C6F1E85743A6D3CF1084EE8D6F83BC19B34757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  resources/bin/Serilog.Enrichers.Thread.dll
- Size 20KB
- SHA256 3cd2b62c1bec4196536155bc954cb15b8360c659fa677144b557d0114d8117bc
- MD5 b91a8d5f733644f5016c3524e5ba8602
- SHA1 bd9ade2ede24a7dd0bee49f923f55c57d3f58963
- SHA512 739d419aeefbdc80ad5e1fced1f193afd5edd67613be50dff2b3a9b9184fb66daea805baf36de7241bdfe2e874bae596a6c18a1bd6496c5a399ee7dba169f40f
- SSDEEP 96:cOx/q/WDd4X4ryWEMcp0oKW8pdhk19Xj2g+VhUC+lBH/v4P2DEOXDce1:PJsw+FFlIfkHXjcFQ6yJDcq
- TLSH
  T17292C791E3EC0652E8BA8B7ADC7E47669536FA029B77CBDF900186152E0B7E44730631
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  resources/bin/Serilog.Sinks.Console.dll
- Size 112KB
- SHA256 8facfdc262756d4069434fd76622c830ddb2fe15f8eb803c0901fe41a7178fd8
- MD5 7cf198cd10ecb3fdea49d22ec936ecde
- SHA1 9a2cd003704cc38ac0a0c525bcf5e47da0a4ff73
- SHA512 c088083f2112fd8cfd0c179276f00e58767bc71fc50aede54d0af17fc04fbfa88e44ee64b7e3dc7ca2b2bfc9161dd959acb11c4e2b7287d462ebc80ceb3400a6
- SSDEEP 1536:9KQ9uamtX5+WnR+LrE1hWyJmq1aow2dKdM564W8J6C8XBaUPiVz/RMSxMGzpI5BO:96hRRrV1/wUH6lRdKHx3zyT
- TLSH
  T15DB3289CB3888396E635467CD6438884E1BAF58B0302D7DF699CDC595EE37C1B3B1226
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  resources/bin/Serilog.Sinks.File.dll
- Size 84KB
- SHA256 76441df569230fcdc17e306cb128ef9677ffa936cac000d1236ed224018ed43e
- MD5 274161d69003173369d12547e6df1836
- SHA1 ee2810c2eeca9f23c8a290e26a4e93d75b292e98
- SHA512 f988d310bd206812410daadccd752f7e252647b5c249b1e7d2090cfa0ca5acb26105c1eb8c6d33cf9892984cb57df18b2eb4eb0a274fe8c74c65e18abf3d05ca
- SSDEEP 1536:y4CalIMPRF2YhYa7aZACos43kUBdz7cRjDASZsfxP:yJalIUVJeAHdk8SDLZEt
- TLSH
  T127833A2973C80397DAEE4BBDA5B69985D231F5A2D332D6CF30C4854C4E63FC55AB0226
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  resources/bin/Serilog.dll
- Size 408KB
- SHA256 6a443fa4592a9fcd250b807654064f01c4d61ffa00642c0f9a5f887e32f427de
- MD5 3e0ba5dd414ca58b3e3d164fd488f2bd
- SHA1 c61cd6ceae2e8a8a12d3a4f1cab16703c3fead99
- SHA512 3ebb290484267a0d5aa8444b75a9dc8408599468fcf1bc899ca95ba33b044ade078ca8753ea54dfdc696627d083561c12b4b4db2929cde6930759ebccc0c8275
- SSDEEP 6144:eNP9p9mqeA2UhM/iRjo/je2ueNOW679hJlRzlFJxHW1Ti7tJ0FIS0VUHSH828:eN39mvArjoXiX1lFW1j07
- TLSH
  T179945C2D63C80611CF57D2BD8117E442E471F35243A6D3CBC42A9F98BF4BBC99936A29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  resources/bin/SixLabors.ImageSharp.dll
- Size 5.3MB
- SHA256 8972ca49c959af46e0d6889b5b74686c0222f996d94449af51a3aec936eee5d0
- MD5 d7e04f86390129f2e357a0acfbff539b
- SHA1 5d03f1b10905a695fb5ed9aa2057327ead8e5cdb
- SHA512 04c54df81ab0d39520b83dc1d87b4adeb26379fcfaf77986d5854b582b01b3ccc8ceb2bdfacbbf7f53221d4c909a76617aa5f5613c81119406ab033068820af5
- SSDEEP 49152:7/1yqnDUC/ZnI7sXGB+2lDv8C7WxVQwIghgQPdwpNiYOl0rGsXb2jTLhCu4zR:hB2dOjONRrGsXCuzR
- TLSH
  T138467B40F3C18B66C43EECBA9117593BE23178864365A1DF83E18EAA7E633C1D975097
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  resources/bin/SocketIO.Core.dll
- Size 6KB
- SHA256 2ced9ecebde88693a098614eb2654d193141726e4fd37e0f2bb3938a23eec5d8
- MD5 c256779132e3eec2d539ac905a24310c
- SHA1 189411f909f3d39be482332c0fa00aa3129e402b
- SHA512 ae2569f0ffb22ecd94b8455679833490cae949a38ebace5732dcb0a132ed238218cf9adcdfdc849c4f0b0fcb4497985842515fed2325fa45c98affe968cff228
- SSDEEP 96:/27k8HlIxXBVr22F+04xXzLj2mUyjiXzMCvzhLp8+c:KSXbr2G8CVw4FRi
- TLSH
  T1F5C18402A3A1C73BED720B79B9B353112378B6909E53CB5F09451E1EAC0B7159B21BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  resources/bin/SocketIO.Serializer.Core.dll
- Size 20KB
- SHA256 c03180a5c20c7a19f106f3ea4bd70206e349038e1783567fa3a3145e620d749a
- MD5 500a94c9f86d5b6b9a1d02a31fd4cb3f
- SHA1 49a0813ea5cbfa7fb85bc12a24273afeaa966522
- SHA512 d8766c80586883ecc0922a83d10519e7287cbf989d03e4911f4d7edae77921981bc84b38b6c48da2f2895973d8486f693d34b44fb0a3eef4aa27494fae5ec62d
- SSDEEP 192:KzHcOPq2tn0XHSTSbQjA9xcrzZtGJ6r0yyQL1h:Kz8OP/tQ1UjAvcWJ66QRh
- TLSH
  T12892C744E7A0C732E8798239FEF3379212B1FA4567538BDF842881977D017C46671A55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/bin/SocketIO.Serializer.SystemTextJson.dll
- Size 44KB
- SHA256 1ac6bc3d868df84b2fd8236a56fa95cc87ac9de6621a5a11b0cdd2a73bf66f0f
- MD5 1125bf74df08dc8b325fc3f7b220d058
- SHA1 dc1fc728bdad1731bd230153ecc5756c91e89d3d
- SHA512 262413b145bc2a403c879a40c005501788e4f36bacd8f93bedca5e9fcef25937f67b388aed76e466bf627ca036ac3199d94b38f3679a3b18472424ef08f1bfe8
- SSDEEP 768:hSdKo2shB/GYMt745u8GAaraqeWlo7faov+jWvju5O:hSds6YI0vAarHflo7falX
- TLSH
  T1D513070C43848E96DA7402BD9B337D88C5F4F9421331D6DF9E88998DEECB3C1A5352A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $R0/Uninstall HyPrism.exe
- Size 285KB
- SHA256 49bb889e4cca65ea623f1dc30c121bf52880132ecfa3e7df6d823877b0d91c3c
- MD5 e001f7d3672fb8001ed00ec2e910adf6
- SHA1 288b3d8a1cab6479d3a59a6356ba4ee51e497dcc
- SHA512 ee7112f2299e2401bf2ca82f3322bcea1cc814eb00db64e43315ce3739d8842c64d07650ad6f603e50f979655fec977cc62c1616250a8a17cf464fe8e758ab2b
- SSDEEP 3072:cn77v00hEoDEtaugceAvmR5yjQSNxU91JQu16Lz7PeEMX2dOk3NuZmJ9TDP3ahDv:c740IQmvmvcY/2dB3NuZ81zaAFHhF9vO
- TLSH
  T174542812A3F89866F1F71F35ADB6A7924E7ABD643E35C61F2301564E4830640EE38367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Contacts third-party web service commonly abused for C2

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32