72d9b13247d9f9b59612f70a5c730cacbeea2a3c082a633ca64ddba708559d16

Sharing

Copy URL Twitter E-mail

General

Target
NewLauncher-2.0.9-windows-x64.exe
Size 101.2MB
Sample260804-rq63masfkc
SHA256 72d9b13247d9f9b59612f70a5c730cacbeea2a3c082a633ca64ddba708559d16
MD5 16e066fa76c191f5ce2a0a0a27ac1860
SHA1 fbd47e88c462410d6b0bf06c3d0e8943cfd81cee
SHA512 60e3a4cf18d741c9e553fdd243db84e4b50641c64ebc4ad20a9c370e99bd4e9a1dda64083c49bb5f1cc5145921991c0b3996d08ba259a8c62912da46a0352fea
SSDEEP 1572864:aic+fHfplkpKhXOZUVNBvmjl/UC894a7Y8ni+A5UsFoZRI83i13VPM2q96b:aicCttOyT+2xXE8BA5hecVDq9I
TLSH
T1923833F081A52C1FE658BBB35F3E8451F1E517EF2C06832F672857B8D1D40CB86AA466
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  NewLauncher-2.0.9-windows-x64.exe
- Size 101.2MB
- SHA256 72d9b13247d9f9b59612f70a5c730cacbeea2a3c082a633ca64ddba708559d16
- MD5 16e066fa76c191f5ce2a0a0a27ac1860
- SHA1 fbd47e88c462410d6b0bf06c3d0e8943cfd81cee
- SHA512 60e3a4cf18d741c9e553fdd243db84e4b50641c64ebc4ad20a9c370e99bd4e9a1dda64083c49bb5f1cc5145921991c0b3996d08ba259a8c62912da46a0352fea
- SSDEEP 1572864:aic+fHfplkpKhXOZUVNBvmjl/UC894a7Y8ni+A5UsFoZRI83i13VPM2q96b:aicCttOyT+2xXE8BA5hecVDq9I
- TLSH
  T1923833F081A52C1FE658BBB35F3E8451F1E517EF2C06832F672857B8D1D40CB86AA466
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/bin/lzmajs
- Size 1KB
- SHA256 f29aae866c7bb66e5424a730c473231c1329f6bb0636ad33945299a4c4957a50
- MD5 cdea38e7d795ce6e8274bef89c773780
- SHA1 7bf89bfcaac6964e4f551233f0daea7dc2f58930
- SHA512 401068503e0cefa4bae0c524bafd903f83ce945170a5a28fa5b8f3004c9b1afd09db188e416a071011276c836a6a2dd75ca5d9397e7d24cd1715b6c46e1b71e9
- TLSH
  T1F941873006FEA06E422340B73BFFD45B59B5983B1145DE69F99CC5C24FC0191199AEFA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/index.js
- Size 13KB
- SHA256 77d9568c9c5479953a4588875b9d5c4a06ce9f926f9fab96d7678e68a74e6985
- MD5 ff2e30ea41c50e397cc5fb516d633d2b
- SHA1 bfa32375a230e4c6b37d9dee9a94bd106af80bdf
- SHA512 bbaa0d96fa3b546fe913d0988dbac54c8d963b4a79f8459c22cf27920e754977f471ccecc07bf9936bd34a3b65dfc6517ae5e126dc260d68347f71f3106bb51f
- SSDEEP 192:4aBgo4Ls4gCGlqmPk4TPGwsVh6rLSvR50qjXryXN6gLo0OuLoC6lVlfuswTDo+Wo:eokBL4LSA6e6z9qrotsRdn
- TLSH
  T14652FF496DFB31624673B1754F9F9A0DB23DD017142CCE94B98C83E0AF905389AA6F64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/liblzma-build.sh
- Size 138B
- SHA256 ae56a4c3e521e37c5677e4d867e79ab46ac23b3f5682a7e2893497232a0326ce
- MD5 cd2e20d9a8384d3090058e3428d6b327
- SHA1 b3f90405a89eeb07ff6fc4243be8016ce2d6e1c3
- SHA512 d39514e34aea97b3b03b966b76affc5fbb740799bf15219935d8995029a1fbeefb59d3a2a356ede3cbfce69ed0d775680dbff33493d2585a7ab29b84cbb70527
- TLSH
  T143C02BC1C07B00225B47021911463000CB148AE51A178A56C0C4C2E8C7251D9A61790D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/liblzma-config.sh
- Size 733B
- SHA256 100d04495f6b1804aef3983377d91509864758cf9aa7470d28a24b69f0bce116
- MD5 e886188759f08df991ad8af4bbc333c1
- SHA1 b9644330527cb91fc20e2d66a93c8380f71932ff
- SHA512 b4b30187505941eb75d44bdb51d4bc9ee778034d0850c7253a38ca636a620c9c6ae8954e43515b57ef409adcb6a91976e4e92f49b466c6c38e7bd33a79340ce8
- TLSH
  T1CD019C17E456365B2E2CC6A273EE6893EA05AEC26F2C551FA0803A7873BF5075610C86
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-arm64/electron.napi.node
- Size 421KB
- SHA256 99006146d3f02a3701a254dbf57d10175a2950fa7d85b4dee90b99c997d882da
- MD5 5a8ff3c35b7d2d367d4b56f016650860
- SHA1 43f00704db624630f2164d52e47e93d4430b764a
- SHA512 753b32f63a2638b49123b49876c8f0e336aebcaed128b181b7555de4646a9f3e1e2419b7489de61888a5b18f40790507367206507ee52afe92d19abc78129721
- SSDEEP 6144:MZMB4WEWGxBL/aJrxffqWCMFe4FQvYOBoSj9uf1iEENkC:MZeE9BMV3e4EtiG9uf1ik
- TLSH
  T1DD94F839E261D17DD04B947099DB4A0310B4B5F85A35200E3BCC9F6F2A77BA68B6D393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-arm64/node.napi.node
- Size 421KB
- SHA256 9a03f9e38254ac721d042561b23842c944db243c3c30fb21f240a577a34c8cb8
- MD5 c5ac962f6ef85085075bf5e761696f56
- SHA1 0574d6d3914d86027d35c5a4bcd36c9f23f426fb
- SHA512 64323a70a99aa2a018e5c4e43768a3c4b9897e8da4cd34a580cdb50d7657a54a3bf36ba4ddfa21f70a84b4800e788091a7c65ccce6ae58e18528c0b5118a1072
- SSDEEP 6144:oB4oEWvydo2tHAufixrHJMv3XlhYOkoNr1iEEN56:cEKydog3TtD91i5
- TLSH
  T11B94F839E261D17DD04B947099DB4A4310B4B1F85A35200E3BCC9F6F2A77BA68B6D393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-x64/electron.napi.node
- Size 421KB
- SHA256 99006146d3f02a3701a254dbf57d10175a2950fa7d85b4dee90b99c997d882da
- MD5 5a8ff3c35b7d2d367d4b56f016650860
- SHA1 43f00704db624630f2164d52e47e93d4430b764a
- SHA512 753b32f63a2638b49123b49876c8f0e336aebcaed128b181b7555de4646a9f3e1e2419b7489de61888a5b18f40790507367206507ee52afe92d19abc78129721
- SSDEEP 6144:MZMB4WEWGxBL/aJrxffqWCMFe4FQvYOBoSj9uf1iEENkC:MZeE9BMV3e4EtiG9uf1ik
- TLSH
  T1DD94F839E261D17DD04B947099DB4A0310B4B5F85A35200E3BCC9F6F2A77BA68B6D393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-x64/node.napi.node
- Size 421KB
- SHA256 9a03f9e38254ac721d042561b23842c944db243c3c30fb21f240a577a34c8cb8
- MD5 c5ac962f6ef85085075bf5e761696f56
- SHA1 0574d6d3914d86027d35c5a4bcd36c9f23f426fb
- SHA512 64323a70a99aa2a018e5c4e43768a3c4b9897e8da4cd34a580cdb50d7657a54a3bf36ba4ddfa21f70a84b4800e788091a7c65ccce6ae58e18528c0b5118a1072
- SSDEEP 6144:oB4oEWvydo2tHAufixrHJMv3XlhYOkoNr1iEEN56:cEKydog3TtD91i5
- TLSH
  T11B94F839E261D17DD04B947099DB4A4310B4B1F85A35200E3BCC9F6F2A77BA68B6D393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-ia32/electron.napi.node
- Size 619KB
- SHA256 e73951d1d9f4155cadbeb530be14dd32e1abc4ad9332527507ede586ce41e095
- MD5 8e7adb376ff87a10990f783562b06a4b
- SHA1 924bcdf667dcb58767efc662068ffaea2f40e7f3
- SHA512 6a18f6f71a55eacdd4dd415e3a39ff2fd551594d332921e5e68d717142ec75595a32dab7d40aa82b33dc33c27661e7382d622dea4173a1deb88fcfc976621e23
- SSDEEP 6144:GaiFHaev+gFh4N7UUBSgaAng6PM+FMi83y9OMZMduqpLLDg3KF8:riF6xgAN4Fgbg6PMWM9uqp1F8
- TLSH
  T1F8D48E207894C2B2FDEA20FA01ECB637029DD4B0075496C756E81BFED6606C2BB37657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-ia32/liblzma.dll
- Size 148KB
- SHA256 37c4a4277ac066522402c71fd03bea5e8900fefd505ccf9b6399128c92182780
- MD5 29e433f0ecf0cc28fad655baeff3d006
- SHA1 9948f1638d3afddf346d901a04a9e5a83df5b9b4
- SHA512 98bf4ceb9a04d50cdf64dad0fdd40e5fc61a2ffd7032aa4cefbcda0fa8dc33988902b5ecedf7f7ff5e32fde729dd8948f6561f38626d2140fa1f36ce7fae4e3c
- SSDEEP 1536:pw/AmC0uspt8PwqmZMnDBQQP7J0MG5diyJg5401Tlqb97MruNGn9mNonE2w62:pIAG8wqxDt7J4PK5/Q1MH9mNojw62
- TLSH
  T11AE30884E9D7FAF1F6579D70D852BF3B85F05B028110C978D68C9BADE82B762241930B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-ia32/node.napi.node
- Size 619KB
- SHA256 ab5e095b49f13ef86a3dc83f0c11b9bee1fef24a4cf0616b0015d0ebabd443e5
- MD5 3a706e64b17cc01d142794436c95805a
- SHA1 f1bb6751517c517681bab11e5c47a9a141e659c7
- SHA512 f839493cf238c735b7937d361bf08cdc2ef3381ac88accc759096baf0c6063660ac9771d18de8c3af94b5b8abbb1fa079bd60824ec48996946fdbac6f5f92ac3
- SSDEEP 6144:ZFjUvSYDEMcss+lN7UUa65u/XW4QxAiBbsp6qE+pKHVQiWuqpvKg3Kg:ZpUvfEMfN485eW445bsp6qhuqpmg
- TLSH
  T1D7D47D207884C2B2FDEA20FA16ACB677029DD4B0075496C756E80BFED6606C27B37757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-x64/electron.napi.node
- Size 797KB
- SHA256 5c7dd24a625d806e37cca949e52ec348ef0054a902e8700f9fdb61cac44e4c9e
- MD5 b872a2c94ff78af34eb7c14c71f7a784
- SHA1 e8016fafa0a91176d56664d9218abbc286707411
- SHA512 df93b9c2e8b118d3e01da7dd63af83e4bf0c36d835ee49167aa49b3a9459b6f21b0802feeb6ed52d7eefc0c1270128a7748487ead1bee82f2039745599a80262
- SSDEEP 12288:BiHbpT41iFWTMg60IHCEqooN/vnbCzkEHN3YbmMxBIfOPB1zjetJR:Mu1i+MgPlrfetJ
- TLSH
  T1CE057D666BA816A1D0B7D13E89D78F56EAB1F804433467CB01D0459D2F13BF89A3F722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-x64/liblzma.dll
- Size 147KB
- SHA256 fc7348418be392d5ecebd7b9f07c1ae5bc530260fef923801b140088eddce96e
- MD5 2e91129e126d90edccef94ebf7abd6e1
- SHA1 a8d221d3475216c11f4beaed8c9b9f33ccee32fc
- SHA512 dbae0120c0b3709811fe9a738a4d66da4b47a1d09f0e5be373a77330d57fd87068963c76f294eac81723856dac500e3b824e7def828a1646fef611230d42898d
- SSDEEP 3072:SLkFJu59WjUfFwgJEvCSYuw1flpY9mNoWPwx:fFJu5EjUfFxqvCj76YOWPw
- TLSH
  T101E3F756A292F4D9E767CC34CAA26F33E4F0781642206E29539CD73C2A6FFA1161D713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-x64/node.napi.node
- Size 796KB
- SHA256 c738ba03c84330556184b07d4f9a94bb875807834f46c0b49ea42c8e45df714f
- MD5 218fc90e5725a6a7ddfdd1edb760c12a
- SHA1 2fd9c618e6105a81c1f812d55f405a947b61fe3b
- SHA512 7d6d0cef3b33a092d9a8f37e2fa2f3ec44b843f4bc0d3415d832f3c183318cdfa3d05590d94c552a1ef322de2d67bcb24864c65f4fe43293891755b94bd8062a
- SSDEEP 12288:7vWhpNRexpxqf8qFl9CfrumyKlAsppNDInGPpbn+JY2ef5HDek7hEDi:LKRexefIek7hE
- TLSH
  T16F057D662BA812A1D4B7D13DC9978F56EAB1F8144730A7CB01D0459D2F13BF89A3F722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 d50b5ed41356b540e1f1d3525837effd4045220cb4efbfc2b913fd7d7edd0999
- MD5 3007dd886e26b72242062241cbc44433
- SHA1 f6983d1db8933923b3b175cd074881d6ac395190
- SHA512 2e1c0594cdf42c72b8e411b528dd6b2614df035670703598a438ef4960022c738f15a08dbca8c5f5d1dfcda54e078d0d47c554e785fdc8e269bfe3e827df1a3f
- SSDEEP 49152:4+et2UcrN42sf0vTrWny2/Gh9qIHGZpVZSbiP1VFz2ZtIgrduZsgP/m9vqjfc2c7:4Jt2vI4gmlml3pCIn
- TLSH
  T1DE463803F28681E9C06DE5798B5FA623F631F8840B2276DF56A00F192E66FE0673D715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  vulkan-1.dll
- Size 932KB
- SHA256 35b0d20574fd7f4c8b959e4789cd75950a37cc6106119f89210d086e7f15b47e
- MD5 ea97e3c4fcfa72d6cbea16f651d52464
- SHA1 553589c7cabba29adbd3d4ac38c71d52427c2d6f
- SHA512 e5e091b20169b60b3a2a7f5fbc250e181788e9a87b17640691756bab70a817a55c2c028455c84099ac4202d24e9acf98e7da113db6d8b91f0f35d554274733c5
- SSDEEP 24576:UNpbzkO5J/Yv3kG4nolXqOZ6dSn6Z5WGc9DYsHQDb6g3P0zAk79oOHiYOjF:kpbwOvgv3kRUX1Z6dSn6Z5WGc9DYsHQ1
- TLSH
  T1F0158E12DA544AA9D67AC074D9D28A0789B074821322B8DF12F817147F6FFF47B3DB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $R0/Uninstall NewLauncher.exe
- Size 183KB
- SHA256 d6c9e11f27dadeea2467d5a7026c39a80667d9b249bdd6e4e90a4da836ef0f43
- MD5 df269d06c1c492360334b673e1466def
- SHA1 419ab4e330dad70e8039fa9f9d43d07b642570b8
- SHA512 d014a58b07a7c89721816c8eec5c59327d2fbebea12c3558d6eef2b2c1ee0820bc62a293957c0e3cbab7b5c1f86a1efd999da9d8e9107e14129b12dc525e5b8d
- SSDEEP 3072:in77v00hEoDEtauromMB44x1J/Nh83SO6EHd0wT1tsR1zG4a2MNUa8b32tvhOEAC:i740I9eha6EH2QtyS42Ua8T2t0EyL+yW
- TLSH
  T1980401047BA0CA57FAB70F3106A553E71E77F601213A9B8377C2278E3856A86EC5E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral26
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32