67c86a34fef4fdfd28bd5b88cbfabb3b10137b7acf7992675900af6642a5cdbe

Sharing

Copy URL Twitter E-mail

General

Target
s.exe
Size 45.1MB
Sample260805-amjdqa1xdv
SHA256 67c86a34fef4fdfd28bd5b88cbfabb3b10137b7acf7992675900af6642a5cdbe
MD5 34df312d6422687c4d011af380552ca2
SHA1 2d3b93f946fee67097a2a9d18bcd9cea795d8cc1
SHA512 45b4d2636ead8a4cdd9fbeebb20e1eec2110f8eb4844d2ffbe03586d66a6effbe42fee43f8003ce2c05f44f3aa153aca681883319c0964a56a2ce75dd361eae4
SSDEEP 786432:o6r9nXKHgxNuq7BoXJJftMRX+7ipptsSPEP/wOujfeOZeBbEHciYr5KYSVVef6Jn:o6r97xoq2Xr1yAkIoTzeOZeBbEw2DJKE
TLSH
T14DA73354F7622B89C23DD2368191B86FC6948433E74BFF4A3C6D0779C24B9A65387127
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  s.exe
- Size 45.1MB
- SHA256 67c86a34fef4fdfd28bd5b88cbfabb3b10137b7acf7992675900af6642a5cdbe
- MD5 34df312d6422687c4d011af380552ca2
- SHA1 2d3b93f946fee67097a2a9d18bcd9cea795d8cc1
- SHA512 45b4d2636ead8a4cdd9fbeebb20e1eec2110f8eb4844d2ffbe03586d66a6effbe42fee43f8003ce2c05f44f3aa153aca681883319c0964a56a2ce75dd361eae4
- SSDEEP 786432:o6r9nXKHgxNuq7BoXJJftMRX+7ipptsSPEP/wOujfeOZeBbEHciYr5KYSVVef6Jn:o6r97xoq2Xr1yAkIoTzeOZeBbEw2DJKE
- TLSH
  T14DA73354F7622B89C23DD2368191B86FC6948433E74BFF4A3C6D0779C24B9A65387127
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  libwatchdog.dll
- Size 926KB
- SHA256 0d81bbcd85733e483c8373529c5d7b837934f46a00b2a8ef90ae784e22e691f1
- MD5 57eed897911756a337003d51b0551f3a
- SHA1 533800bc4dfd59e0e42cf0c870699ee6a8bc4ddd
- SHA512 03b93144175ff673c0d03432e647a70cef0cee91322e1882fc0972eb9514bc5a782f739b194c2dc2ddba3671b1a2ac03bb1c6705d05135bda03a8237a1a331bb
- SSDEEP 12288:ER9hn7f9N68vCGs76LyndcN7YpvLZgqAW5gduIzBOoMfbQm:EVZv66LydcN7YpvLZdAW5gIfbQm
- TLSH
  T1EB153B9253C76C7AD886E77829C36226D376F881C72DB77FA316DE340582A906D3B704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  monero-wallet-gui.exe
- Size 118.2MB
- SHA256 70caa7a79988f2f2f44d9eac6da76af7515e684e8337ecb8355e95da5e9b25e9
- MD5 e31b091617fbd723ddefef10e6b8a2d0
- SHA1 8a4901999374973d1ae48b377478feea65e7e7e9
- SHA512 abe50f0172ee9eb2baedbbcede5b893e8ce38ccdc45bc91343e4f8a64a08106f6369ada6c386fc247b015968fdeccae780761666fcca42e411cfe88529af772b
- SSDEEP 786432:JALlWiMKPPg+AAQYLgGiJ+4gPE8NQ4rTuQnfjx/J+rznP:JALlcKPPg+ZLLgGiJclrG
- TLSH
  T1D0487D83F1C95CDACDA7937085DB92327374BD46C7329A9B6244EB352D53AC22E2E704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  monerod.exe
- Size 30.4MB
- SHA256 69f38ca9bc6adb99b2ec3c2da4ef5037131dd2a3cd5d649e65c2d5b3b7437718
- MD5 48ce584b207ea54e31159da8c7b3133c
- SHA1 27cca2b884523f96cee10d310fd00b3f6257dcd9
- SHA512 28b866c3662305c248e5ad1615bd830624fe9070654d0f47e42f646e4bab456c96d76f28191b78296b7bdfb01d19bc57c34263a7550140b8c169aa7b8f6a7a94
- SSDEEP 393216:+o36vFYYR2lFihT9czjk5pWxByCav13uFnCPwUJWrzQn:+c6vFOFihT9cAcxGJWrzQn
- TLSH
  T162674D42D692AC9ECDC7D3B452A792323670BC8587351BEB5648DB382D93BD0763EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  uninstall.exe
- Size 99KB
- SHA256 862a9fc908ff0979013699febc6453ce22c1c550e8298956cd0ef6a2d20ec5c0
- MD5 48326b70b557b5e2cbbedb2cfd79a87f
- SHA1 e10ab17e9d5326531294fd5312fdc2862f5b1ef2
- SHA512 ef22cc4cfcd46e788dd99eba0974b9184f7d307027a61ed595ab9a7ee7d7ada4cf627a9ec94b348d25edc7314b683637d47734bab1d963f5d871ecdeda30f5dd
- SSDEEP 3072:7nRueTqR2L4rKTBu8LQ2CLa5UoqJ3P8Pa1np0:LRupKs2C423P8PaH0
- TLSH
  T1F3A36B1CFF1288F6D93791324987EABF862D6D3182594A4BDF121A23DC37A70953B2C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Checks installed software on the system

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10