96b09d3c8deac6e7694c8a37ce45b5359fb7345f13e824c808831321eefd5f01

Sharing

Copy URL Twitter E-mail

General

Target
java-qEKUrj.exe
Size 66.0MB
Sample260804-3slegstbpa
SHA256 96b09d3c8deac6e7694c8a37ce45b5359fb7345f13e824c808831321eefd5f01
MD5 eaa14a38f0f9d65a9db6f0cceee1a914
SHA1 52574c16aa7af67ea08be9ed4fde7b0e74602cf2
SHA512 ca50db2296f15d64a3f14ad36b7e91d4e88f2fda9ea5b1b6ea691302f7758d5b75e0111c26f91175378b2fdf8c3b3b2769e7c737e7681fd12410ded865060cd3
SSDEEP 1572864:UzXH/d3YYrS9SXDmcoOoz0Q4RysehXQKapNFHuPBdgoEEAd07:UzX1IYrvmcoFzyIIp+/7
TLSH
T10CE733C919DEA47ED6686BFD03312876207CBFDA7FA5C91468C580C7680976E8C32D72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  java-qEKUrj.exe
- Size 66.0MB
- SHA256 96b09d3c8deac6e7694c8a37ce45b5359fb7345f13e824c808831321eefd5f01
- MD5 eaa14a38f0f9d65a9db6f0cceee1a914
- SHA1 52574c16aa7af67ea08be9ed4fde7b0e74602cf2
- SHA512 ca50db2296f15d64a3f14ad36b7e91d4e88f2fda9ea5b1b6ea691302f7758d5b75e0111c26f91175378b2fdf8c3b3b2769e7c737e7681fd12410ded865060cd3
- SSDEEP 1572864:UzXH/d3YYrS9SXDmcoOoz0Q4RysehXQKapNFHuPBdgoEEAd07:UzX1IYrvmcoFzyIIp+/7
- TLSH
  T10CE733C919DEA47ED6686BFD03312876207CBFDA7FA5C91468C580C7680976E8C32D72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution ransomware
- Renames multiple (224) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 7.9MB
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH
  T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 e1ab367644f72ebcdc8eb3fcfe829ff51719559ac2a43a1600e712b16871ad65
- MD5 d5e1f1e9d0ccfe7f21b5c3750b202b4d
- SHA1 74144ac93c0c58a9b9288bce5d06814c9a1b1dc2
- SHA512 dcf70d43f1a83c424be99c38e33e520c72115c3d30945980e5e394d460462251bde309e543213b2b08dcbe9769d11d46792e1cc99aa42777fcc34d6f3361a3d2
- SSDEEP 49152:EZ2KxYmwFfgQQs0ShPrF0/zO6R0gRhPj3hTUctrRhuwSnKxqgI5IN8N3lzl3hqzb:Aofp1Pyi54wnKxqg4INhhd
- TLSH
  T10DD5AE07F6D640D9D029C174869FA233F63134468B24A7EF1A909A252F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  java-qEKUrj.exe
- Size 155.8MB
- SHA256 eb0379d9abb2f294c9d8cf3fe41a6dfb37a5f89e807c6a1ce0fbca6dbcfcf644
- MD5 72d3a666b5e88f03b14fd9c8f49c197d
- SHA1 dd6b42a020b6512aa5bb2e82ebf96291562edba8
- SHA512 e246ea48784252cf23aa13c2f69cd8aa2d6e006f3b71119fdf9e63e5e1df48837d6a1a69fb25a7c409f3fd3189758b125052d69d513d7c14af64bf1c6361f095
- SSDEEP 1572864:MVU4t/Ct6JMgabao+nh+bw4FlWMZBZHuoM2t52kOUeEbaVO7GJbdHDexdypGT+LY:KYUJkH0sEQ
- TLSH
  T16F788B03E29A40E9E05DD1B587578237EE72B8864738A6DF2754075A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 469KB
- SHA256 e142752e073c0051a0beb963981af70263ed673959515545521a7941d3230838
- MD5 dd78b86b3c92d61c37b44ef5b157cfe0
- SHA1 4dcf9ebc3ff5ca552c0e83469b921153b29aea1f
- SHA512 9d071568dc56db2ab93d034d07a11a477aab8ac50d9ea3c4db3ac4866fcd3c2f3002ba7a3f2c55589a9d68463181fc7a03327dc164310d7e80e30cc6f6bf2423
- SSDEEP 6144:s4itlpEJVqKqK5Z5UibKsBHI0Sfnx+lXGpeOQHA93GT3sm:s4itlpAqKqK5Z5U+jBolfnjIyG
- TLSH
  T120A48D15779544A9D06AC434CA534612EE76B8920F35FADF02A4E23D2F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.1MB
- SHA256 b0ff1bad8e2f34b12dfcc4b5387bdc042f9bc2f963e11dea1758397ca0e907ea
- MD5 af3792b63af63408a40604184ea6ef7f
- SHA1 b4d577e1c7ca0d4d3a34e2edb919cf58e6b62952
- SHA512 d413c52f7c82dd17f06002f3ca6bc3efcf4e11e88379d989d982b2f9f47b71643971c4988abee2dc1212027b2cea148a8849bcb442dd4dbcd8e26ea892dd7a58
- SSDEEP 49152:x2b3imtb1uWsvZRUCXQNMBbGUa/XFfOpvQnDwX+xjA7LAIgRg37QiI+id3pFJs7w:x7RWft4NV+sduHox6gWE5lHaFX
- TLSH
  T168767C07F2A541D9E05DD2B9CB4B9232FA30B899473072DF6A9817213F67BE06B79710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app/main.js
- Size 352B
- SHA256 bcb7b5c9503f07e409ddbfb40a0b4b0c5e05695528f66e031cd6a2fb7c179869
- MD5 a7543590fe59b8780ca3b13c8d0caa27
- SHA1 1ee977a5e3b2834975f5410c0de213ea11216c3e
- SHA512 1e81a91c2b16986376446707e7b835aa579935ce668e742312469d80065a67e27d44532efbd33ec76162806e843def3400d8046ce8bb58d7acf02c657e62380c
- TLSH
  T12EE020C13AFB5738E43651CD86059B652133D28362CDEB90F0CC36DE6F413951965551
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app/modulos/real.py
- Size 38KB
- SHA256 751f5fb6fa94c0be82b711143eb0c8c41ed0b19ffa2bc09f20a7b4307eed4776
- MD5 dc2f513e0fa64d4e1703894b8ab50dfa
- SHA1 cb7490550318e4bdb66acdbe83ccc3b65d8d69e6
- SHA512 430dc45dd8ea7905014d0c6d6dec5b51c8376d3da70345f2ab8adb2bd90a9faf92e37491759caa97d32c4b650ff15132b970bdd782171838f70ae0bb90c5f72e
- SSDEEP 384:MOpT2sJf2sPBTCuSSOvdBr5AqC5jlLoXv2XpuarLqVrqtDloBX:M6TCsPtJiXr5lC5jlLoXpryoV
- TLSH
  T1FB03A656AC6E6042E673F64D997BC804F6056303D0311A13FFFC81642FB2539D2F8AAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app/node_modules/@gar/promisify/index.js
- Size 967B
- SHA256 a4fe100eb176ab95328881fe9490ac91e72d3d2992ac7fb2b9562d264156a8a3
- MD5 e3a489bf3a07d37a8e6a679b00cc03b7
- SHA1 a5aa156ae6257ad645789dc0d8536a3f17bda2ab
- SHA512 71d4700578136443f0a95886f5205abfa05464c5a69d28adfb3b3917b993de23c002b8a3dafdcd0dacbdea7f510f313761e1737b1186edaf05be0c0fcddf79e8
- TLSH
  T13B110D8F76E2E0DB5357B468684F510EF228A452205E1910BC5D4B60EF554F816D1A6D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app/node_modules/@isaacs/fs-minipass/dist/commonjs/index.js
- Size 12KB
- SHA256 2c934649bd1f847982fc06b02721244cb3271bf254afd71f23f9d20c14f9b59a
- MD5 6761f436c3f24cdace7046842f5c764a
- SHA1 b7d67d4cc66f606036cf0f934e21afa07e171463
- SHA512 38336788e546b7692a364789c37952c2c25874b1f2e4e98d03616d8c2b125f1fba84436bbe4863eb8bc95dd83e7649065cc1e41479d3807fded613bdf25fe3ee
- SSDEEP 192:48uMZSCSnbUTlhTiaWTeNe7MAfhihGUiRFigtipIfC/ppkC4fEkgyi/C8kgyiZht:O4MsSRytaHaN
- TLSH
  T1FB42594D1AFF912186A331790F8E6013A1B48A2B759FAE94753C5324DF4D1389DECBB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app/node_modules/@isaacs/fs-minipass/dist/commonjs/index.js.map
- Size 26KB
- SHA256 a69e0d670a9d4b67852d613d0cf3132599a5046653b7641edcb1f7497132e869
- MD5 7bf2c4170b5f9b202ffea7a599175f9d
- SHA1 94971852cd8180b4d87d08f34ecd0264834a856b
- SHA512 69d4e1c85ce3ab75385c1557feb9e1177176105129161f22ab24ff3e445ea8bc7644f2dda52e58c793711fbfd9bffcb0f3d4aa08f8221d8f77b374a02bfb6cd5
- SSDEEP 768:DgBoOy46UcSTzPKOyF+zPbjUbdZzHATuxTX:kRznL8tX
- TLSH
  T178C2080205AEC937B65722871DCF50B37E20699D6D8A6701389CA311F3C6F3AECF5966
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app/node_modules/@isaacs/fs-minipass/dist/esm/index.js
- Size 11KB
- SHA256 6feab1ba6210a3dd4c2bf1eb9cadfca5674c82972d0d015a162bbeb097a886da
- MD5 10aa0e06f65dcb6383602746375d4e09
- SHA1 afbc3d19d08230fa19fd2022095343ae99925a5c
- SHA512 710092a036b09fdc29344ba5eb0b29a6da988e2ff34551915508bd7463cc16e86ef09e8ca074e5e601b986c38b138fcad67d93bcf0dda6789dba21f442db803c
- SSDEEP 192:8eCSnbUTlhTiaWTeNeyMAfhihGPiRFiltipIfC/pptftkgyi2C8kgyiYhhiEDTiC:r4MsPJ8Zwgrv
- TLSH
  T1E742164E1AFF512196A331790F8E6013A1708A2B759F9E94783C5324DF8D1389DECBB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app/node_modules/@isaacs/fs-minipass/dist/esm/index.js.map
- Size 26KB
- SHA256 cb7896bf7f5eac9b4eec3caffaac6fb122342b01c33c2e92bcfedd6b4a8c79a1
- MD5 d0600a4cbd4f6dcd99f486d87b8625ef
- SHA1 e49539b02e88d6ab4e785e969d89a78bc2085cf7
- SHA512 1e4baf3a0d8c4757f47872bee5febab4d080d007b3a5c36f62c11e14b1c122ca63bf8ca4ee91c57ba90016069f177dc292afc2fa7d731a66d9bbb7e093a5906e
- SSDEEP 768:HkBoOm46gcST9mAyZ+3PbjgoZQzHATuxTX:kNfnt4HX
- TLSH
  T10EC2180205AEC937B65722871DCF50B37E20699D6D8A6B00389CA311F3C6F3AECF5965
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app/node_modules/@isaacs/fs-minipass/node_modules/minipass/dist/commonjs/index.js
- Size 33KB
- SHA256 085dc9747f0f4b28a196353df3702e2ff8cf0bc883a02378df062525a7cf9a38
- MD5 4df3c0b5e2cfc8e050718482b2e65de9
- SHA1 b60a3f194bb06e650627ebb1f0662baf7d939e86
- SHA512 2b9dbcf32b12d5badff41bb41450060c49e5350efc15e53ed9c22765edb36e5540cb64c7e43af8a447abf901dc594b905a5e6809ee4d6962bfe130721a01d3a9
- SSDEEP 384:SvNrNgDZPXjpzESmsYn8pYCCJhOnGikh2fsVbRngQLKxHWq4OxXiA9OW5g:mNrNgDRpQSmsFbs2SOxXiAIsg
- TLSH
  T10AE251492BFB1232466370BA9F0E9043E335951B355ED854BC6D8B705F8AA344AB8FF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Renames multiple (224) files with added filename extension

Executes dropped EXE

Loads dropped DLL

Discovers running processes

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32