b0e675fca3983e50d9a2ed5ffd37cf817fca544eed31733f82ebb8380a8c1516

Sharing

Copy URL Twitter E-mail

General

Target
Launcher.zip
Size 7.6MB
Sample260803-1vt4ascn5v
SHA256 b0e675fca3983e50d9a2ed5ffd37cf817fca544eed31733f82ebb8380a8c1516
MD5 97592d37d8f9b718530d87724ba47fad
SHA1 45085b7f40b63865f8555742c6c4ae041de0acf2
SHA512 3a6b09c1f30b3b237ea1613419f0212ee2e162beb809af9bd22e10e5f732dafe63930a1fbeaf755244f3740b6db719e5b4eec80ed75b5c20ce6ae8734902ded7
SSDEEP 196608:sxT98cLI6Can7uUHzM5uh9d8u4LQramSaOERGu:Up8mIHYuj5uhkuB3SaTZ
TLSH
T15086335CF77BA40CE61F933A308A006AF6644F15E9F9A71B039C60691DAE0D71E67387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Launcher.zip
- Size 7.6MB
- SHA256 b0e675fca3983e50d9a2ed5ffd37cf817fca544eed31733f82ebb8380a8c1516
- MD5 97592d37d8f9b718530d87724ba47fad
- SHA1 45085b7f40b63865f8555742c6c4ae041de0acf2
- SHA512 3a6b09c1f30b3b237ea1613419f0212ee2e162beb809af9bd22e10e5f732dafe63930a1fbeaf755244f3740b6db719e5b4eec80ed75b5c20ce6ae8734902ded7
- SSDEEP 196608:sxT98cLI6Can7uUHzM5uh9d8u4LQramSaOERGu:Up8mIHYuj5uhkuB3SaTZ
- TLSH
  T15086335CF77BA40CE61F933A308A006AF6644F15E9F9A71B039C60691DAE0D71E67387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  lualibs/lexers/lexer.lua
- Size 85KB
- SHA256 66b824e46dd60f8cb82f65bc111cc7fed29f07a7bb2fcd0c18639e9a0f89daf2
- MD5 8eaf330c29e627f1cd48cbf770af032c
- SHA1 4301dea6e5506527fefc98fb2605167d1c3d7e5e
- SHA512 bf0590ed246d603166ddfe9bedaf000d4b054f11e1635d39174ed4f80d2db2171411991889e35aa4aa12804879a622eb9e7dbb92ba660010398b8071e4dba3c4
- SSDEEP 1536:wLMBcApqQv2oQ9CCuX7t1YT6Byw5FlPfqcojvNEFP9qVWf:c+MWPYTcFlPfqLaqWf
- TLSH
  T1CD83C51BAA421730429B4A72E80FA261EF1B913B27AD61A4F4EC41D41F11F3D91F7BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lualibs/lexers/prolog.lua
- Size 19KB
- SHA256 2bf1e26747141fe3a15450a1c78621a701977cf612576538b173019ff08b69f6
- MD5 f5de1257a307ff59fc14e6d27c561fa5
- SHA1 f5e127101c8e10e78aec026c912829947afb485e
- SHA512 e8f69d78bb315237849a7a0293cdec493fbe32cb509697d7c0019092aeb71bd9a0b83ca687ddf273757486f68f4841b60338a24ba9a53b34266bf0abd0f026d4
- SSDEEP 384:V6J6dNaBsvuBZThYHC4R6iBf2r14p9FuJVi+ijc0z4yFOxe/bC1fSkEFuqE/B6:VBhA85E4p9FuXi+ijc0z4lQ/CTg
- TLSH
  T1AD92E811D07C4C3240DB9BB6FC5D21A666BEC1133B5C457AEAECC694520798DE2F3AB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  lualibs/lexers/rest.lua
- Size 9KB
- SHA256 35bc8ef3613c14e767576de103600cf1d02934345b60dffa68bf21f3997bc190
- MD5 726c384dfd41cb6bfea1aab316dd6b3e
- SHA1 a5be2be5dc550b4caf70c5f0c6ae103c7a6f800c
- SHA512 3520a930301badceb634a39a72c5395f8ee7a7d3595df77e915661c4ce358c142fb59c1bbf59a21de63fe5a315ecd3ef462bde00e2247e3e026eaddf5d979b25
- SSDEEP 192:wjkxCb35q4HB5y1qKOmMjZAjPj/GeW0VMtO:i1lqm5yEjZAP/5VMk
- TLSH
  T1A912903710A314C15342E1F3FD4A8161767B8296220E39F8E9E103845B8A78ED9FFB27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  lualibs/ltn12.lua
- Size 8KB
- SHA256 17ded4a93e07bfa74c362267e22a35c89b90c8a52a183f0d51d11dc202e7d2b1
- MD5 90547ae42ecd0e79dfd97a4421d3429f
- SHA1 73fe3f91d044321e202b78bb1dc3e96ee5989c72
- SHA512 9fdff01db01cda1033f1621c135931b9b2484a4f3aa7fd2cd0d675fe8bb641652b7a6709bf4ada2c1c9265a15440043174f2b64d5f17a61cd3fa15b974063511
- SSDEEP 192:KBvf26aY3GBkiwbbCk2ecK1PA45k7vTMUm+IYSUGoLhA4jxkKQpLMB6Y6Fdhi6zM:KBgXBkBCk2eY46TM42bBFT1+MuDzl2hy
- TLSH
  T1BD028D8E7D8275B10352DE98894B5805F569A81381690168F89D80D43F7123ED7FFFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  lualibs/lua_parser_loose.lua
- Size 13KB
- SHA256 c2a3176c1f4b2fa43d4c63d6bcee5e505539216c67645f91456b20c1743e69c0
- MD5 160f9554af5ccbfb0531d7b308c003e2
- SHA1 7b8034e501589e0db70afacaf27f9b61a01e3db1
- SHA512 81a79855417edae8cbeb1fcfac0d249662af2081e97a96dbba4fb1a4b4f7cb999524e8e65534e5b31592bba68c14a7c30824259ac376286ca84812be10a06b91
- SSDEEP 192:9OIYk7uJfTIqpJZA9LLNW9jC+zIQaiw8nNIvn1ISpB7scbms+s+iv:IIYdJfTIq/ZA9OCUaiTwI6iMvn+M
- TLSH
  T1EB52411EA10216B0851259BEED8F91016E397533261875387EFDD3E52F04B3CA1FAEB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  lualibs/luacheck/config.lua
- Size 15KB
- SHA256 04e84333f82600e3eba80b14fcc2db549ea872f1f4a2de6a4d6a6720998ed2d1
- MD5 6e0fbc77ff6fd930a67f377770c6857c
- SHA1 7c18f0da92a612c201cf069d9ce8f4beb2c10d04
- SHA512 7c9e6abfc29cefd061077508bcac8415f059fcbe6bef12a8daa3591cfcc887290603d652a2200d948282dcb0b6df278eb96934a3d5e7124b879d3a5c969a3610
- SSDEEP 384:MJEk2fc4WDm3ldDt/FyL4LfLIuALB03uY65WX/M72iorS:MH204WDm3ldDt/FSITiV0eY68XxiQS
- TLSH
  T16D62238B21062E331293DED8E6C79416EE69E6C321481065759E02D82F94B7DF1F7BAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  lualibs/luacheck/expand_rockspec.lua
- Size 2KB
- SHA256 966a9456394699d33114bed85bfac43a4c21d174c6fd71a3df4e41fb46236809
- MD5 9d7fa2487162c9c2252daa39addd50f1
- SHA1 caa654b0daf1f532933740e95dd713ec3898c1e8
- SHA512 fd510b57ee066f71212055cfbc8b6fd398107591e6dd17897c371c358190deadaa3fe3de4b58c7e697955544338992f0d6315e802058450b421d27c1a14e7be3
- TLSH
  T130511D9FA4F2997352C68594B0E76E93FD84C55B438C2036729D48E0AF6413A8AF6378
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  lualibs/luacheck/filter.lua
- Size 17KB
- SHA256 bcdeae4c6e44fcb874f08685749c9fb5261587e6de6687f96d1c34dae8fa0974
- MD5 7403418c1e876143bc1a8297b0ec76f0
- SHA1 22fd15f7467cae1a1fee0b8244e0f1904806758f
- SHA512 c746e879b2106429458cd3744ddb2349a9097f9586f95563ffa34c5561ceffd650cf3acc77f0751c76c84b8ebc87d8461166690fe7bcb79f0e1e597242f2094f
- SSDEEP 384:IvDVIldgiLxSHm5NhAfDK5IwFmSg4x6sJkXZK6DPm2cTnDtSL17wFsBEVVxKUrGk:ODVIldgi8qhIDK51Fa4x6sJQZcYpBWnL
- TLSH
  T1C382039AA8811A7009D241E5E9DF288369ACA923130D1471BD9DC6D82F5473DF3FBBE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  lualibs/luacheck/format.lua
- Size 10KB
- SHA256 b9689c8a90dd69824c85df024cdeb2b2bb6d93270f0793ec5146afa3f266db44
- MD5 f9a809a5d9614aac17d38e5f22ebe1df
- SHA1 bfadcf2f543e8deca6f446802be9cb6759de9fc6
- SHA512 cea2b855caccd67420a76966f9d43d40f4b97e050be02f24637a6e46b2bc20f9a18da68dc7c0f2c55284c1e9859be2e93a804943bd345c7f906d74e77eaa058e
- SSDEEP 192:TGLPradFeki3UTPEoKL6QVJK0CVZCPR0YRhOaG+KmlCuMcqBG0EmDoJTSv:TGfajekiEjKL64YeNG+tYi8
- TLSH
  T119223249D9892D301343C8EDA9EBA649BF68605305081117B6EE4B912F11D7EE3F7BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  lualibs/luacheck/init.lua
- Size 4KB
- SHA256 f1aae4322031aeff84405a1e191cd21b9ff4ffed51ff9558b81194894a18deb7
- MD5 119cacbd1c38d0b3fe19741f3c5df20f
- SHA1 3a27d81d42b9911ddc8114a0ef82536a9c5e11aa
- SHA512 227d22c4d576206f3d0f459453bc8d698b2979bb261150c83e8f9b86eb82b7019c4cb39455fb32a671f28fde0bb0c234c79651166031235bdf537bd96d656041
- SSDEEP 48:42gfb3RYYAk/Ml9+AdBfQyDLw1TZX8E9++L+js+e/uu/R8TTeH6/n/c+xtieFF+f:YfjakEl9+A3YyD8X8EAkcsf55WfE8S
- TLSH
  T15C91BEBA944D2B9027C3F8F499A69683776494434B0008A132CE43F05F98D7CADF7BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  lualibs/luacheck/main.lua
- Size 13KB
- SHA256 f969f9c80e4b9fd8f0c22a35e5a8c309e05ed1801859be062412099d885eaeab
- MD5 63d3b49809ad42d15b4cc596938f8ed5
- SHA1 38cfbe17108eaa3e61f0f4941ca8409576f7cafe
- SHA512 6c1512ab41a26bb87b264c4344f29f4bffb52d68a1c6d9d15a3e6d83ff892fe090e4938a4e206c0fc72c2eb50f666146ff2745baf132c24fa212b04b4cdf3d04
- SSDEEP 384:ShZMibLCE+b7pVdKiARFTxvxef3Vm57k+krZnlX8njLr/OE2:ShZJPNRPElMrOE2
- TLSH
  T17652641E59551DA307872DDCF9FF04126BB46197831D7808B16CD28C7FA8A2AA6F3B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  lualibs/luacheck/multithreading.lua
- Size 2KB
- SHA256 93ee314d06410f7717d0644d7a0a4e51f6c306892bd741d6120ccdca4333fabb
- MD5 71bc548f6ab6aca4b2c38beffac21b05
- SHA1 de721f04e616fd26b59336f1f379670945898110
- SHA512 75c2f84d1a64246857d69ba5c8aa4612d4ec7b12234bb412eb0eb2e89899e7c4e294c23db459849007b444089e33f94a378dcdb74e7580fade4507064e1379a3
- TLSH
  T11C510F8EADA678B503968AA0E5573A01FD451007D348949CB1ADB3503FFA62DD1F9A3C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  lualibs/luacheck/stages/detect_uninit_accesses.lua
- Size 2KB
- SHA256 cf0921b499ac9116c3b7483acd9e393b2fc6397d2c5259da7724fd3d45716700
- MD5 fa9046e6fbf15383c38b2472aedee729
- SHA1 c28862acad9de54f1c849a153d41176e2468a1dc
- SHA512 9ebe96abfdf104307e477417619a2a8e440d5ca739c32e41705cd11ed64147bb00557136d646612f6e6b2ee4883709e2ecf572f4dc27c438ddc93b67f0774991
- TLSH
  T1C041537F27011EB26680ED6219DF4B0A7BAC1107835014A4B9CE42893F2455D93BFAFC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  lualibs/luacheck/stages/detect_unused_locals.lua
- Size 11KB
- SHA256 053480b7c28b0b2fdccedae9d36dbf18f734d803688f009240d2893610779a3c
- MD5 b7389bab713df47e484c78fe14a7e4d1
- SHA1 15813010b28d7459fb345f64a1deabef42217699
- SHA512 a1a89c6eb1ebf85555c985340d366dc1f3e943db57b8c908d7e14e110cc3e5408fc7cca53346845061758014f631c319dbf9deb56cbe48445d09cd7f2b6d2cc4
- SSDEEP 192:j/JpiGYTcVI1xtoi6k1tg8p+1rA07AqJP1fD5HPcj8Gxel+NfbSJLWL:j/JcLwIztoi6kDE1rAMAmFDYxel+ECL
- TLSH
  T1B132FB6FF60035B522A2D5C7ACDF5625BBA85203521425F8B99D53842F18F2C42FBAFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  lualibs/luacheck/stages/linearize.lua
- Size 17KB
- SHA256 8674a8f3b4507776a16830ee14c24c1771b4e7766c49ca6b348332e04f5338eb
- MD5 19dbfaea03be9c676dec7d3082923d1c
- SHA1 47732a9242a6193859e843f79cb7c0d7e0472da4
- SHA512 3f8eb9ffea84c100b98da3d0ae5dd7c49f3a5aab0e9d34cee10ee0d2f7747bab6fccfe753f44ae1e3d985811840640c0510a405f93c9d719cf74fc7ac374c9e7
- SSDEEP 384:UNgdcKfM4HxpPPnoHfwiDmPEdTp4AlVAeCkkA6X2:UNgdzM4RpPPnoHfwidvvX9
- TLSH
  T183820E2EE01225925747BC617C4F6402B9AE1417E68C6CB1FA6D42C81F7963D41FBEF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32