699f439d4fdd2507c0fd7424b7bbdad92e75975249164c8f21043fcc5a1a705c

Sharing

Copy URL Twitter E-mail

General

Target
DuoHacker.exe
Size 65.5MB
Sample260803-lr59tstfpb
SHA256 699f439d4fdd2507c0fd7424b7bbdad92e75975249164c8f21043fcc5a1a705c
MD5 73006016dedea6cb910b4e65f9e4ff4d
SHA1 b3f6ea9db6febb855971df3071ca06aaf4ab96d8
SHA512 84625786f5ab5e03b270ded0e6e10252c1981f802ab8188af992bd78253190c5aa71ef91f5ddb60a4917a5f4a2511990d66f68dd0cf900dde6659ba9fda772a5
SSDEEP 1572864:2uky+ptA+NklHaArQ2ocxSG3oSi061S71zyV6yrh8+c1qVBrYaNy:2byUa5ppnYG3Zi061SZzyc9+cfMy
TLSH
T199E733F968DD1F71F691E0F43078631DE04AE425AD52BA1790F62D0BDA0390ECA8D5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DuoHacker.exe
- Size 65.5MB
- SHA256 699f439d4fdd2507c0fd7424b7bbdad92e75975249164c8f21043fcc5a1a705c
- MD5 73006016dedea6cb910b4e65f9e4ff4d
- SHA1 b3f6ea9db6febb855971df3071ca06aaf4ab96d8
- SHA512 84625786f5ab5e03b270ded0e6e10252c1981f802ab8188af992bd78253190c5aa71ef91f5ddb60a4917a5f4a2511990d66f68dd0cf900dde6659ba9fda772a5
- SSDEEP 1572864:2uky+ptA+NklHaArQ2ocxSG3oSi061S71zyV6yrh8+c1qVBrYaNy:2byUa5ppnYG3Zi061SZzyc9+cfMy
- TLSH
  T199E733F968DD1F71F691E0F43078631DE04AE425AD52BA1790F62D0BDA0390ECA8D5BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery spyware stealer trojan
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 65.0MB
- SHA256 a17dc01e64bf33bf602def45fa7868d5853ba690ba5d6a3ae2aeba989097c134
- MD5 3a1b8807b373a60f2dafa3446806640c
- SHA1 209c27147822d820064fe74a887b99123fef4912
- SHA512 95a10ee033f90e695f07e0f2dff172f0708d276bf970e5e821b432b4c2eb0a79432d1f1930f0a623e0a6b47d44f9e0a89efefb6e725e99af6cfff87d4d167a82
- SSDEEP 1572864:yky+ptA+NklHaArQ2ocxSG3oSi061S71zyV6yrh8+c1qVBrYaN3:XyUa5ppnYG3Zi061SZzyc9+cfM3
- TLSH
  T117E733F968DD1F75F691E0F43078620DE04AE425ED52B917A0B62D0BDA0390ECACD5BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 126KB
- SHA256 bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b
- MD5 44a69827d4aa75426f3c577af2f8618e
- SHA1 7bdd115425b05414b64dcdb7d980b92ecd3f15b3
- SHA512 5c7bdf1f1deb72c79b860bf48f16c19cb19b4d861c0b6beb585512ad58b1bc4b64e24edfcd97233e5b91dcd0f63ed1c7b278d22ec062fd0dfe28fe49cae52049
- SSDEEP 3072:DKzwqCT4w/qzOovg6/Csp7O2o418Gb0+VRLf0ld0GY3cQ39Vm2I:DKzwt44yrgKpyK18Gb0OV8ld0GecQ3f2
- TLSH
  T1C4C3E0D7B3F5EDBDCA5355B3A12640B2ECB246351A92034A478FD8362A3674DD8C8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 175KB
- SHA256 b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48
- MD5 9c379fc04a7bf1a853b14834f58c9f4b
- SHA1 c105120fd00001c9ebdf2b3b981ecccb02f8eefb
- SHA512 f28844dba7780e5f5c9d77ac3d29069dfcd6698447d5723886e510eadd51d6285e06adbda06bf4a69f841afc161c764cb2e5b9ad2c92f0a87176709b4acd2c13
- SSDEEP 3072:oDQYaEQN6AJPgqzOovg6/Csp7rfR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNN:oDQYaNN68gyrgKpngx5GMRejnbdZnVEd
- TLSH
  T19804E1DB63B4DD7DC9630AB3A22901F1ECB1123559B6425B53DFEC353A56B8988CC283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  icudtl.dat
- Size 10.0MB
- SHA256 b75bd14a3d9a174ee44eca8c62b89c65d9836fcf62c28d103bfa300c02cef255
- MD5 25d87a2bb3581bc3597dfb9008516710
- SHA1 e3f59f1de852cde2204256c7a8b1580483ab907a
- SHA512 59977fa5ec1dbda7cb6525c48655d6e8f3d7b00408e973efed1f2235d1d7fd88eae443fdd5e07d52f31ce83943aba050c31261baf2798c1b10aeae67981685ff
- SSDEEP 196608:y5zwSv9AAyse6liXUxCGZHa93Whlw6ZRnGO:yyKlysTliXUxCGZHa93Whlw6ZRn1
- TLSH
  T143B62907A2FB4DC2F9F7AF30D8F552679567BD496E32805A01442F3B1C337A08661BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/af.pak
- Size 327KB
- SHA256 219d94355d0c460516f9baa83f4b8dcd3353ce13e7648f019810047ee8eecb41
- MD5 f78831d4aec1d0e1735ad630f9e8f4ce
- SHA1 4afc52c9d2e0fba6aff22596bf876621a7d88a27
- SHA512 ffbf51a4ff656edd65575ae4d1f489281e3ef08e1e5bb05daac9786958d1af832520e6ed77ed197e0160e368fb56bf303f8779bcdcbe77d995364a433024d65f
- SSDEEP 6144:ZLgVKc+kVWlEvC9Z5D49Em7kLjB6oAYxjYgDbwxesB+xSK1qA3y25tHwDwv22iGe:ZEdclEvC2im4LjB6oAYxjYgDbwAVSK1Q
- TLSH
  T1B8641B0ADB80273D05E07696BA0445F7BB9CB26DD770B2BADD9D81321962EFC01BD1D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/am.pak
- Size 531KB
- SHA256 f62791089b07bb9796292e5e3fd81eb1e68f3adba0fcc88fea4df744dbad6775
- MD5 8e8fbaad0de95893785875e20cfbe5f3
- SHA1 f179e4db197a974e1e428f0bcb9cb1bc09df04f4
- SHA512 93cfc2f82d3f83dd992ba758d067055cc26bae5c2e9b1ecd6974f4143c22da405bc6845d2d2a811ff043ff1cd55929ed04a6f929ae01ac211c781d4786a90246
- SSDEEP 12288:oI+uzxX8xMzKsE1gI5z9SBeuWqQ9x30jH8+I:oIVX8xMzKn1gI5z9SB6qQZ
- TLSH
  T119C4BA547DF9F7170F8E8A1994221E8E9594AD4692813C38C35AE3FC2B2DF1B4CDE219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/ar.pak
- Size 573KB
- SHA256 c28e612cae27402f2a75c9699268f1781b286748b0590d396e0a538e3aa67e49
- MD5 cbeaafb259a3a0ad76739186e9b2bf75
- SHA1 11b348534a84c9648eb86c9790bfb7703cde242f
- SHA512 2c91f17343d947cd4eb4d8d339e5932a3331445b4e826915d54196c29ce548b7e98a9b5f9857146a9a956ce20d3e624fb04b7c44d3c1a2593e8b6e2cb12662b0
- SSDEEP 12288:eCYtqr0jXjiRp/DvYUBuGYurA5SNbr+ATg5Y3MgSENFh:Z1Cuk52+k
- TLSH
  T1E0C48BE21B2584720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/bg.pak
- Size 608KB
- SHA256 6c10b64d31e0dc2c4befc6703ac17343ca473b4350cfb3c6e01833f505b69590
- MD5 96372403a9ded96f3a699262029a4580
- SHA1 07069b20fe303f6eef1fb6c8c0a19266a0c705c9
- SHA512 0df60fe13818f0c3c6838e77686c5de9fa03b97cbf0943f7a2a4ae2f3a0890d3d64b3a7652d8c81c23de876ac92e4c6b71d584fb106c3520c96ef76ba30250fd
- SSDEEP 12288:dPnB1xlYrdAs1alUDpzaVVwsl867mFyY3SKN3rsbDxXs7Jfu64KGzrFSZp8VqJ5O:dvBjlYrdAs1alUFTsWoY3SKIVcdu6pGB
- TLSH
  T1D1D433A15B9A689F0101F45F98087E093CEB54FE3FE7879241642DBD39F20B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/bn.pak
- Size 780KB
- SHA256 297d52b252df0912490ddf26fa58706895e70c2a0f3f09d0dc756706720095ef
- MD5 cb203032925be270222dc2c20fe771e2
- SHA1 2f2f20bbbd07ee01cc996247bd9c2f40037dff80
- SHA512 052be75c51051949c84216566b462733b61026ba74e212b000cbed7d93cb852e74ae83d64d2eaadc3093af4265b6783184cf8e0368a75e077d4b75daba40f9b4
- SSDEEP 3072:Kw+ZjJj+E7z0eC6HcvR1kgBbdawSU5ZwXll4:4tJXZ78vRNBbdz5ily
- TLSH
  T10405EE209C6E91B2A8D5CDC9434C6370C1236E9B9B61F34DDC17A24938ADC7C8DADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/ca.pak
- Size 371KB
- SHA256 9058aa0f327ff79b62e730d72a06351380b21dc9217f565a94acffa73abfe2ce
- MD5 6d6f760b1fd64e4b83536a1ac4713e4f
- SHA1 929a965b0ad9b8062c64ae940064260b13d05c2a
- SHA512 ffb2fa6d6e809e4ff527d682a9eec422f2a123826529793b85ea0fdfb3f358d1e321f49ff707fe3777494e4043019ccf0e0f545670d4d29216a8aba56c7951f6
- SSDEEP 6144:moaCg6tj6OdSIs3cehEYBC2l3nbh9aGHQl2SwAGwXZM0dLbpuQRBtryBocaGIleR:Hg6tj6OdSIs3cehEYBC2l3nbh9aGHQlO
- TLSH
  T1DC840B238BCD3B7604D2220AFB46C357F08CA9847B16D295F5AF0B5622CCADCD673695
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Uses browser remote debugging

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32