8d2f55aa0f64eee7955ba11f58db09415347b26ab7b3cbda0cfa6e447e1ada7d

Sharing

Copy URL Twitter E-mail

General

Target
5EClient-8.2.7.exe
Size 175.6MB
Sample260802-pqzbnsaa94
SHA256 8d2f55aa0f64eee7955ba11f58db09415347b26ab7b3cbda0cfa6e447e1ada7d
MD5 7e13cbc32dfde5309dc1232ffb1039ef
SHA1 d35ee2689b9ec5bccaecfd8c3808ba21ae36a925
SHA512 3362c69d50f45b18717bd6e183382b088208e37502291aa9b6f914e0d6e1f492adb90893a7f704332f8255f3519e26ac50219c1814d136bde9b9d2223278cc49
SSDEEP 3145728:fL3F4Ihf4HBuuAMNwMLEU6OW26WIPMQ3XR/Q+4G8K30UdPgQrTjtDVSaxs8vwh4R:z6AcuulNwIEGWXWeXRI7E30Udo0BpS47
TLSH
T1C69833C24A36A6E9C487E77A437468A48355CB192F00DCA7C1F470E3FBBCA54B75B186
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  5EClient-8.2.7.exe
- Size 175.6MB
- SHA256 8d2f55aa0f64eee7955ba11f58db09415347b26ab7b3cbda0cfa6e447e1ada7d
- MD5 7e13cbc32dfde5309dc1232ffb1039ef
- SHA1 d35ee2689b9ec5bccaecfd8c3808ba21ae36a925
- SHA512 3362c69d50f45b18717bd6e183382b088208e37502291aa9b6f914e0d6e1f492adb90893a7f704332f8255f3519e26ac50219c1814d136bde9b9d2223278cc49
- SSDEEP 3145728:fL3F4Ihf4HBuuAMNwMLEU6OW26WIPMQ3XR/Q+4G8K30UdPgQrTjtDVSaxs8vwh4R:z6AcuulNwIEGWXWeXRI7E30Udo0BpS47
- TLSH
  T1C69833C24A36A6E9C487E77A437468A48355CB192F00DCA7C1F470E3FBBCA54B75B186
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  resources/7z.dll
- Size 1.8MB
- SHA256 5bd20fb38499d95c39594f41d4781b6181b3304b7f1f4d06b0182f514e7eaa74
- MD5 043204dfab6c5038c07de8de5186d122
- SHA1 f3880a7556176bdf2ed3afb394982f70ab0dcf8a
- SHA512 f7e0e8983b4899cfb7b5dc2609a6f6bd0d16f20c04bcde310c51a93be8ff4d0c306032203b3d6e6e99de6419f7ec53e14bc4aed31b368db9e1e7e631c6ab21ee
- SSDEEP 24576:rPhmVlNWQWOPmmWxW+r7iZ6uawz0n6lCuVBQVjzpi5TtP6BsP:rJmVlNnW0mmT+niIv6lHVY06
- TLSH
  T151954C5AF6748270D0B7C075C5E3AB9AEE7134868730A6CB1285DB3D2F17AF58639720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  resources/7z.exe
- Size 562KB
- SHA256 4cd7d776c686427226a151789d2d61f0b2ed2c392148cc4e69c0238362fafecf
- MD5 cdcd6dd1e369e47103fa3e37027a5b48
- SHA1 63949b0a3490db904bcb7875fcca725a1159edc4
- SHA512 4988053962855cfa046c34d4487ac7c4e8a31fe42ecd0c5ce61e421ae26a5225a4239f843a3d72dc11900e34aa01c88e4667eed8fc0ba105529b9114cda434f2
- SSDEEP 6144:5acm/dssUvELldbZSSOIueI0CdmqDE4d6I/S5xOa5GXPkF8RoGaAYTXhk+lDFyW6:5aRssUvEbZNFZCDII/jIGtEuqucpvb8
- TLSH
  T18FC4F825F6748331D073C0B9C5D2A69AEE7230865B3189CB4286C77C3E676E6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-hotkey/build/Release/hotkey.node
- Size 144KB
- SHA256 ac61ee35e6682f68ee9f8327a0375f3141b7267f4eb42f76a3e00b3b536d2da4
- MD5 3c33c8011bd9edc737be6ec4e80071e5
- SHA1 546853e51d2f7a836f4a4fc9e9c65c5fc904ed7e
- SHA512 f9bed085f8c3819a8dfc15be5c8dcece784c7949ae0c706186d903d66a86da7d02ffdabffd778fa51c95665d26a64809d4457331c1dfb4b6e748dee653ac4249
- SSDEEP 3072:96to39wiiLLUjAjMqAqZdnQ2z/cMR2mEzwSxlc:ht5inlLAqy/Fx
- TLSH
  T1B0E35C6BB3A510BBE1778179C9530A41E772B8614B60ABDF03A043B91F237E45E3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-hotkey/dist/index.js
- Size 200B
- SHA256 6fc7109c705daa0381372eccdd0986b9cf8c02a70edee1ec4839934602a8e89b
- MD5 e9bb04819e00ab3565074937cfc08d25
- SHA1 bcd6fb5aa3233da85499c73b6df7d9772f3d66fd
- SHA512 8cb7896a3c30c2f9db9da4727871c4d3cb85395feab5e2c0d4fcd534ad71dfca2a427a9be90f9abc2e1ee14781ae4230bc6bfa1a9f0cedccde0f939ce72e080f
- TLSH
  T12AD022EDD6F8BC4267821272E02101C37EFAC14400088A75420C64E71920DB007B3C9E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-hotkey/dist/node-hotkey.cjs.development.js
- Size 381B
- SHA256 89de72b17f55592308bcd36ce017dddf3f0c57f6dabb0e7b1ab080770c2c814e
- MD5 29c853d7d9751602f9f5487df44261fd
- SHA1 970c1389f05a21cbf45d683c8ae88c5548eaa2ae
- SHA512 ac1547eba26b71e2d08bf110b5df42e7490e1585d29e906812c146974ee33ce1b6c5023e046125f2a42a71c938ba955ee5a674bb193ead31e5089494a14643aa
- TLSH
  T19DE0616578B5CD70D3E014D75D86E4C076D9483D5056B554924CCBF48090C4E9510F35
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-hotkey/dist/node-hotkey.cjs.production.min.js
- Size 240B
- SHA256 cf5b0ef64f64ba2f2b4a2e86a9d8a89a7a17172e89c88bf76f3f263b0638a607
- MD5 1564ce7800d3f3bee1222bf50297f068
- SHA1 f69b9cea9b5ca790e498c4a976afbb175a07ff98
- SHA512 dc1bc99401003899a98ac78e61097fe7939b5d317afaf68c73a300afe935a7030bfc11b1beef20e5c80dfe7eb02980cdbfbe69ee4153966a798ddf425537d48d
- TLSH
  T158D097AA70B0CE806642409508120046B8208C798031348923ECD9F18560DC95124201
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-hotkey/dist/node-hotkey.esm.js
- Size 151B
- SHA256 307dc04799406d2d4e2feb2bca1c632c12824db37410bd070d3e0fd3ab91730f
- MD5 27410e3cf9300c0ba631667f62719cac
- SHA1 43e83c30219da1cd4a9dd7ec08449f68fe661712
- SHA512 fa10f00d02e59bbe37092fa6be3d253318302ec79928660e8fb0c91e1dc4be72fd881469b03044e82c98748cfc88db52584a6d54bff6a3416a6df69b0f4f011a
- TLSH
  T141C02B35BC394A58BAF200C24EC6C0070F40D0F8FC8778CC060ECAF041B090135A1414
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-kmevent/build/Release/kmevent.node
- Size 164KB
- SHA256 96600ca9c8d5ce59283b7132553322ddb01eeb65fd1f1776bc019795417dd060
- MD5 382e38ccff4c80063fc23eb0f22bd026
- SHA1 fc8d9ce50b62d04bd6d67bcac9d40e70429f0a09
- SHA512 bea49026e434650ac538494a5480488c083f97b1aedde27f43523f22719a9bf1d93409c2910e83115596bb7133ea4351bb13ff9804253f53696d75635154a3a5
- SSDEEP 3072:FKyvUHfzw+xeOPclk2PUfP9fXCSWgW31/1:8yc0eklQfMGWF
- TLSH
  T1F1F35B57B3A500BBE5778235C9A30A45E77278150760ABEF03A4477A5F2B3E09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-kmevent/dist/index.js
- Size 202B
- SHA256 d78a00cb08f76deb4b7a37b81f5ec722008e01b87d0f0ff98d2be5c5f200e0c8
- MD5 764ceb80d5ba3a380a09edd6828032d6
- SHA1 42de20900c77d0fd7f949bc1b890702fac4a5887
- SHA512 bc7ada214408851aefdee0189032ac12c02f9309898303f3e62f403d07343568c28952470c8a4124850d7aa7ce68124b06180b707383046b1a1fe75356c7c3cf
- TLSH
  T1BFD022CD96F83C4246BA1276F22101C37CFAC1404248807142086CE71920DA007BBCAD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-kmevent/dist/node-kmevent.cjs.development.js
- Size 383B
- SHA256 bf1ece92b3628c8c24c016389f1b4c03b16f26d2a1a88b2766d5dbde0b3b3562
- MD5 eb416359fbd1bf7dc9c1f462a54504d5
- SHA1 c5496e3ecd14b21e55076b25d9f70bd013d4c9c6
- SHA512 3a7f2d79fb4b8b98682f403f8ad4f972cf31107ec510b013cd19ef2a04061646dec469372801a3874afd0c69f739b928432fc9c8f753a612e3a19633c1962156
- TLSH
  T1A2E0686578B6C9B0D3F018AB5A86E4C079F948799066B290E248CFE980A0C4EA814F35
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-kmevent/dist/node-kmevent.cjs.production.min.js
- Size 242B
- SHA256 3dec4dfdcd4d762aff2e8c2af4005c611f4ba1f60311a01a203b447e0630929e
- MD5 38a6be18bef392af9503f1140bb5a2ec
- SHA1 f44a10ce73c89334c3b7397a9166236bc0197c2f
- SHA512 3563890fe78b719044586e898f8f9d8f0a91543bd7a13690abe1f776b694f3e11b65b79bd51aade1b719a9947bc5dabade88b86443ed89c1fdf225319ce37999
- TLSH
  T131D0979A30B18E80262A009916120086B8318CB9C071309163E4CCB284608C96028200
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/@5eclient/node-kmevent/dist/node-kmevent.esm.js
- Size 153B
- SHA256 a45826d100a861378028810e6c0e66d1c7820db7ab9ee5fbb5bbd1ca89ed95cf
- MD5 d95246dc84f1262b741296afd166633b
- SHA1 988812a8e4ca714ec7c92d85877d7eea4c3e2e57
- SHA512 975b3f3fab75ecb989281b54f0d6424e54b01033f86d96394df651161ad2d757ffb39180a0f891a4a15891e02be30668e0480780f8d99d97ecd99af229a46d52
- TLSH
  T136C02B35B83B4258B9FD008A43C6C0421FB090F8FDE774C4450ECE7080B01013494424
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/bytenode-worker/dist/index.js
- Size 353B
- SHA256 1334a0f60b6863b32426098c981389912106e619ce492f23d1dfda79d8fa9912
- MD5 7df517305632a679e8297db925d9d805
- SHA1 0d92083713acb0621bc2ed136a185f21a91e424b
- SHA512 9c2a84bf067a1fe3cf81cbf86b2487e5650569d5e1fd5619033c6683e103297de13db2e7df7d541db7a639e0f1ea2b6053f7bcefc43f80f059cb95614ce21b30
- TLSH
  T19AE026416BFEAFF547A489C8A1A653237883D4232098A444FB8CC6F20FCB4C874581E9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/bytenode/lib/cli.js
- Size 5KB
- SHA256 24a55246e1183b53ec2f926d1d90958e7fb0a813575bf88d3ca8b895a27fea29
- MD5 fbea827b80fab18279151221306b238e
- SHA1 321fbf0f9b9b96f8ad34e899b39e791c2233ad53
- SHA512 614e6eedc8978b801821e122593dd60c8dbbdf1abffb31d19e5e3dd55105cc226fb1c50307255d97ee46aa09b95179ba60e35fa7b1d3240ac0842804099fb8c9
- SSDEEP 96:iqhoaU2pZh3weaU2KgMaGCxc+ymWM97U51+dZNb1nCt9Lx9O7E6E4AL1:iTc+B7//Nb1nyfr4AL1
- TLSH
  T1F3C12218ADFD8A320353206A065A5C0AB35AE0173508DB517AEC8359FFD19F584EF6ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  resources/app.asar.unpacked/node_modules/bytenode/lib/index.js
- Size 13KB
- SHA256 47fda33afc49480633ebf910e44c16b395925def2a910cff49c120b65a0cdfec
- MD5 d566b3c97667cf13bb73da55735b98b5
- SHA1 ebcad50fe17e4100f95946e85a76236f5947c158
- SHA512 7faaa75829bcf71026a42225b79fd2adc8eb0459d357372162e2268bd9b3a4823b9cb0fc02f816d82c17777ff0df496dca094ec52114cc8f31322d71d2449349
- SSDEEP 192:pCG3TuS7gIuC+rVuxpBhdYe08FldUuk/tYMe62oqjE1EjLMdAPL1WtnlerqFGDd:UMTu3IuCgiBrDFlyucT46OMdSLcpBGDd
- TLSH
  T1DD52854D2FF9B171422774D253ABA85E7628D007311EEEC0B9CE9B887FD5078C4A69D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  resources/app.asar.unpacked/node_modules/gme-electron-sdk-v3/build/Release/GMESDK.dll
- Size 13.9MB
- SHA256 173b5f38690929e01fda56b24ed083a134eda7f86d823d77e3f391c50cdc6d3c
- MD5 11c37c1e33fe4f19d29ac5e777245021
- SHA1 bc17da9dfb8d3d3c3cb170d6c8c4d802ff914313
- SHA512 f9e3fbf13498e17f03d4da41fac53ed07bc8e808063294c55b7161d22ebbd6945ffea07d066a01564e75ade273b0c2460e683de9654d0f115619412935e47de7
- SSDEEP 196608:A93JHr7LDQmkTJlB0MGDuUmLIy+GeOlNh8yh8:A9Nr7AZ0MGDuUmb+Gecv8N
- TLSH
  T1B1E67D03E19410F9D4DAC1B49B5FA927EA31788E027475EF2790AB612FB7B607B2D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  resources/app.asar.unpacked/node_modules/gme-electron-sdk-v3/build/Release/gme_electron_sdk.node
- Size 421KB
- SHA256 c6ff25279d372b94f5bdb01dffb18ce40628b670185cbe139e65b029930f615b
- MD5 703c0c7020b7bb87fa7fc9c00c0a9245
- SHA1 077770e61670f8d21604f6d7d8602920f5660d8d
- SHA512 e714629b6ec557d4759dcc3f86654309065b0f12980047f7a6943c1878aef1d07be37b400df6d002dad0097b0f76055b7f31c78f6329495ae72610a18834b836
- SSDEEP 6144:R4U8VTWQmqPS4EjTybXpAIG4SXZ+G/G83nTa1m607eEP8T:R4ZPWIG4IksnW19Eea8
- TLSH
  T12894331F462191ADD1BBE1B8392359C1F26C750A03A0CE9B07D049BB6E987F5EDAF341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  resources/app.asar.unpacked/node_modules/gme-electron-sdk-v3/build/Release/txffmpeg.dll
- Size 8.0MB
- SHA256 4d05a622880c09a9e9a119bf6cb0f8b9ceb327dc93929145dc0c11ac9e1a1cf3
- MD5 5759aa3eba7506f26f2f527bad05828c
- SHA1 0f5bbf4c5f36099e39d1dd3a45419b689088f137
- SHA512 3e8e7db577bb2f889e83b96123b44928c116f933f387200ae63fcd0be1dfa31e34b38386dc42fce4be3a9838ae900273bb989de91019a26d981d71dd35555f45
- SSDEEP 98304:yPRka7/zWPQYgmJkVKqxmgLsx9Y3pHv7/0cw9YYFaiqIYIcGEbKhmMf4na3OzXVQ:yJzzWXqxmgV70cGEbK94na6VY4oJY6pn
- TLSH
  T116869E0BF1A341E8D81AC4B4879B9632F620784D472469EF17C4AB353E77BD05B3AB46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  resources/app.asar.unpacked/node_modules/gme-electron-sdk-v3/build/Release/txsoundtouch.dll
- Size 153KB
- SHA256 fde4119e9c79a8371bca88948ec34d242bfa002d510469af468edb4e3bda54ff
- MD5 c1b71dbe5ceac28c8461e86ebca64760
- SHA1 a38a61e20e8b80f4c2adb7c61f234a9947bfb933
- SHA512 7389d63b2da8221f247d8cfe88f46bfe011474d84406a7f7ba3e1b996cceb50838e708bf9e747d5422784f24d792da98ea4f0afd4746bec9102a43932442d5e5
- SSDEEP 3072:AUiEB/aZyL36yVYJiVL9fZhfNJwJMso534boVL6K6cPKaEeBjXAOzte:AUWC6yVYJELtrjwWszboAehe
- TLSH
  T117E36A1B72A204BBE4729234C5935905E773B41007609BFF07A0876A6F673E96E7BB30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  resources/app.asar.unpacked/node_modules/gme-electron-sdk-v3/doc/实时语音接口文档.md
- Size 50KB
- SHA256 85b28497b6d457e0b856235d65f0e5672c1a0d897b1907a5ebb3d8256903b6d4
- MD5 b9b1a2aeb266cbf78523f5a258f3de53
- SHA1 dac370983d8ba3a470efc03e9e014ce89d3cefa9
- SHA512 4ae353547ee9c3a2107cca4a377268dfb9cecc2ef3febfe5fb3bc6dcf5396673ded5db874c88caa8620009be5b5fc371816889628c558f7449ca833d04d37f4f
- SSDEEP 768:n0ukyBdzYn6uU/yoW3TjL0cMaDbr7seihSjP7v:n0uky7zvuU/yok3L0cMaDbfseihS/v
- TLSH
  T18A33D8B94D90B9A31B37C2667A97260AFB1134DAE03FAD1E749C44743F9D62BA44D330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  resources/app.asar.unpacked/node_modules/gme-electron-sdk-v3/doc/语音消息及转文本接口文档.md
- Size 35KB
- SHA256 3d0df283ae937f655b025b7ca9543786403a519ea918a32ecc13e38c5005bb36
- MD5 a67721cda6a29d2034a83fc06dc24ae3
- SHA1 a1bbe28f15d203fbad5d3cec27a470fc63e066e2
- SHA512 1db34e6635c760446b671af997127fdb290d885eebd04e9d7716501b0ee1c34ae2953ea7d7fa7af9c5c364a0bdc212623658192ed32647396ccd859a6131248b
- SSDEEP 384:e6WJr6VXWOu4TYXE4GJkk7yyinrFeHPIuJDUdGTVjwzg:JNu4T6xGJkkeyinReHPnDMGTVjx
- TLSH
  T139F2C7A54C18FAA21B77C2233B5FB90FFE0538AD903BAC4A74EC41613F6521D985CB55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  resources/app.asar.unpacked/node_modules/gme-electron-sdk-v3/gmesdk/AVError.js
- Size 11KB
- SHA256 c7ff24b4778253462d243ebaa01b3b904e8bd3b626bcbb4b466eb4e3c8e1be46
- MD5 59049d02380c1edca3a9a14f51ae3bf1
- SHA1 096ebad5fb068a093b3d0d445f50bc8e0c9bd5d0
- SHA512 dff3f7bf081af906c622997636f35da57597771c8e4b9b71fe04d436de4d459e4da16f23d96750ab60c75e2b8d0d1e4b41a34f9c8ab5b9ab80ddc6a5d8530644
- SSDEEP 192:IiiUXxhu43VFohu8fBQ+mQwcc0TVDL6phxg5hJQeWbw/g+1kRv:9iIxh1FoM7xphxg5hJQ5bwIKkJ
- TLSH
  T10342DF84A3EB67923533074C575A60372931E5D7711AEA40E292F34B2EF8489CE27E5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  Uninstall 5EClient.exe
- Size 234KB
- SHA256 23a96d2541aa1f87e3db60270bf66ee870bdd35fcca3ddfbc626d03e8d003e8b
- MD5 fcb1d234062796e6da71169fd3a4fb52
- SHA1 b62e639074435214b7920a0e8b150f2bad383ae4
- SHA512 d76ab2775c31e25b08d5d84d36efb4117079ee8befa830f6d61a764e7e8641ad7f0f6e08597517200f3394ebb26c79a69717d5b777ec6a2b5426ec9a31b093a3
- SSDEEP 6144:9740IfZtNpLOyWxjD8nWicdwodUa8T2t0EyL+ta0g:9KFpLNiD8nWXw4CLRKEj
- TLSH
  T1543412109BE0C913FAB74F702BF596AB6FB5B115662087C37781235C39A2365DE1E384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32