1e01a841d9f2c853aa44ec1d8e6e28a6471af089c3a842364263f7a76ae0f9a4

Sharing

Copy URL Twitter E-mail

General

Target
JadexVault-Setup.exe
Size 14.5MB
Sample260805-qjty2sycld
SHA256 1e01a841d9f2c853aa44ec1d8e6e28a6471af089c3a842364263f7a76ae0f9a4
MD5 5c4713e170b8262316300e2219845ed6
SHA1 df790959191b80eea65edb0439c41b47dfb8633b
SHA512 b9904a7b41f9eb83235c5c602e56eeadbb3457285cc325769f148b1c9c3de40151d7eabc07ff5f48d508d8a5b6199ad8ff48c08976852f42dc13452dec7854a9
SSDEEP 393216:OYCjpqLUj+fvjNHEDvWSRVwWo0dL93FPBmHCV2CKdDjeo9:OYCjVa3jlCvWS7wWoQLl5xFKNL9
TLSH
T12EE633D070F7859AD1149E3C4FEF00A4A0FAAE7B9B5B9DB63441322DDA39A4B4373125
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  JadexVault-Setup.exe
- Size 14.5MB
- SHA256 1e01a841d9f2c853aa44ec1d8e6e28a6471af089c3a842364263f7a76ae0f9a4
- MD5 5c4713e170b8262316300e2219845ed6
- SHA1 df790959191b80eea65edb0439c41b47dfb8633b
- SHA512 b9904a7b41f9eb83235c5c602e56eeadbb3457285cc325769f148b1c9c3de40151d7eabc07ff5f48d508d8a5b6199ad8ff48c08976852f42dc13452dec7854a9
- SSDEEP 393216:OYCjpqLUj+fvjNHEDvWSRVwWo0dL93FPBmHCV2CKdDjeo9:OYCjVa3jlCvWS7wWoQLl5xFKNL9
- TLSH
  T12EE633D070F7859AD1149E3C4FEF00A4A0FAAE7B9B5B9DB63441322DDA39A4B4373125
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  JadexVault.vbs
- Size 1KB
- SHA256 a50468ac5b0007b7e94ebae1ca4e939210581bc237c50773c37f0d7b6dc4c7cf
- MD5 65445fffba306a45c446ebc556e7cdfc
- SHA1 062ee60f0b5e7e9f79a9d01ab1761ca8534c1b80
- SHA512 3a6ab730ad18e892538f8a222400e701a1f969905b14c6239be522d0af9804b9b0a4be8d71fedf94c793222ae280dadfee1c8b486272a86507953f58ca07c2c6
- TLSH
  T18D214146942F927009DB23820ADB8C7EAFC3D62C927C95268B5CC80277C47ADC66A592
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  JadexVaultServer.exe
- Size 59.3MB
- SHA256 adce97b71c9f36752dee6d5d1b308407083f60e287f721cd23c49019c57c8e15
- MD5 1d712b0ec6d9a3534b214f48237ac937
- SHA1 e52a19e41825b969b91b830008000fc70b34a2a1
- SHA512 1e3e7351d5e74953b13e126eacb30f5e5d35e339b0d12b52156f85f9976924c3b9cc625249c4ccd428daf3eec112ad811140076081d770a5bb884400fdddeb02
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfW:fMguj8Q4Vfv/qFTrY70M
- TLSH
  T1E2D78D1633F604A7E5A3A2358AD74002EB72B0576734DACB368C43142F9BFF49A7A754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral10 behavioral9
- Target
  Start-JadexVault.bat
- Size 73B
- SHA256 a8017a56a0656fa73fb77e7dddfc146d22beb02b74bef352cc0c85142f3fa074
- MD5 4de93e0b42564ffa25b39b4ce1d768c6
- SHA1 914ea1b894ba2c75434e4fdc2328813d6833313c
- SHA512 4d46d701769b83945231891bf96cfef5de962a920b32f1c919aa3a8e9e9bdc85e508a58b0bcc56f94fa8099063d99c020d183e38416e50e5dca4b81c260b9223
- TLSH
  T18FA02202CCF8C800002B2A0000AB02FCFC0F2023E338EAA820AAB02880C8B80C20F0E2
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  Stop-JadexVault.bat
- Size 59B
- SHA256 24c886c06d9b5c34ee49203cbb8d52c4abf2cc83e9b32ff7b4ab4e18a390b325
- MD5 57c2b6837f8c61747909df4aca0f943a
- SHA1 b1fd674d9154d565bffe676efafd035e98a3b186
- SHA512 0841db46ce48d436dce3366292ab407daef5f0bb4f542e38dc3444e8be1b781e0d0751bc5ef8c6c4829d564bd7a1c5571ac7617449f5ab328ee9a1e18e52da9b
- TLSH
  T11CA002451DB9E811505A1C00A47B51ACFE0B51C2E115A9A864A1F079458A789470B0DA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  Stop-JadexVault.vbs
- Size 525B
- SHA256 db955433a910086d56d69f186d616dfabf5b8be0b12d66dda3c3f384fbf575ba
- MD5 2989f7d64cd893e0325725ef99ceed0c
- SHA1 a0b6c47c7de0f8440da1105f09fb62a929ef067a
- SHA512 d02c795c9f858af3a3ee85c3eb413b017fe45111b45122e647c79aeab4de1352fb274931e96f2a5412ca97e98aa28b7a428d2d39ae9e00a984a0a896a0791d89
- TLSH
  T1C5F08406201ED56008DF13433293416B2F8E8B02333D22265B8AC7086FC0A68C2DC17A
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  client/app.js
- Size 140KB
- SHA256 4daf4b960991ad35476dc7b18b161a7ffd39370445fd6d6a9354cf9aebb0ceaf
- MD5 743519d8e92ccb40bace89abbc190bb0
- SHA1 4063c0e0290eebc51f911f5b79aaf90d56fc2edb
- SHA512 d152d6e1ee69741ca97290cc73c552623978ccd8ac17a7c315ae4f8cb4aa30ea894155dc1cb2052bdb28e28b9a33d6c3cd95520fe00466951607bf4ee981bd28
- SSDEEP 1536:0t41MAfxkP4HB5R+8rZnzxqTu2v/TsA7f1D6PW8SYcY2xu7hFF0vdkoi5tastjP7:0qMAvxzEq8zf1+O5RI7ei5ta0TqRRxY
- TLSH
  T178E309A471B62426096390F6923B911F7B28C5033647CE90B37C864C7FDAE31EA7799D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  client/index.html
- Size 59KB
- SHA256 9108f34bdaa81fb68dd5c4c758f30207c9588aa8dc0fdb398930d73faa0fc64e
- MD5 f6781401766e15c88646271db1a3e570
- SHA1 34f1971dd88bdc1241f672b4c12b2073b61e7433
- SHA512 ee8a41644eb58ca10cd2480f248e34427fdbb4017d41c82370f83ecab6bc6cfaf7ccf572f96273f25148dbd20591dd1d94ce16863a2bf7bd821882f64703d804
- SSDEEP 384:Q43xVgh2hn8aIRsS0GijSpiVbYD+0+N4FwzRgC6K9Dh7c2Rdg1g4rZMlx0ZFbm:Q43gUBH5ADc4yiCH7c0dGr1ZFbm
- TLSH
  T180530020A1F82577529B90C5B9A14B0B3EA1EB17DB5F1240B7BC9BD12FC7CA6DE07049
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  client/vendor/simplewebauthn-browser/helpers/base64URLStringToBuffer.js
- Size 1KB
- SHA256 9d248791ed9402f760191b2c564f07298349db8094fb46f6d6f5514ea841a888
- MD5 6ae659b74f40dba7cf4df4c489321cd9
- SHA1 373a303d5c722d8e1c85513f815f5457b0da69f8
- SHA512 6f91351c6a6c1239f39aba09426f984bdc98f5a59be1f173be041f37b9a1eb6da84377c80e29412e4cae823d03392e61201b56e305c096103e725e792f065483
- TLSH
  T170218E002BE5109460E6216BB74764C4CA58D55F6350F4DBBC8FA7390F65A9865F2ECC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  client/vendor/simplewebauthn-browser/helpers/browserSupportsWebAuthn.js
- Size 470B
- SHA256 380b32287f6e9939a9f7116695f75266303ef9554f97dc7174c72b47233dbe0a
- MD5 8c2000cea7a99c15b7110d58a7179a3b
- SHA1 f7292cd5092d2d3f0f859674c70e73bb67f30db0
- SHA512 f311869afcfbcfa8afddf300f803512adee70107b9e18d0d864fba08b0a35789e72e0905f7c7af954d10c70e495003073d447875d302e401db3858a76f715e85
- TLSH
  T110F0274434AAB3118D3020E8E71F80C3BE5499A35B9C5690F21E82542F56178532AE6C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  client/vendor/simplewebauthn-browser/helpers/browserSupportsWebAuthnAutofill.js
- Size 1KB
- SHA256 2c0af6c79d11d828e9b9e802c2afded2aa263152731faa9a1b61aabadd809cb3
- MD5 ac2491dacfd8021a923bad1bf1219eae
- SHA1 3ed36e4240866da675c1c6af2c6301c62ec7ba1d
- SHA512 95525f1bc893cf65202fa91909c5207e2613b40d28c0697f6d33a907b75b9dcbab9e7f0836a3600cc8c9dece938ef1f4643b7b5eb0bfaf14f758a6060acbc70f
- TLSH
  T1CD21F02130E5321AAD2170E8F10B80D7AE254C6B4FD89B50B20FC3247F17235B76DA9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  client/vendor/simplewebauthn-browser/helpers/bufferToBase64URLString.js
- Size 569B
- SHA256 88029dcea67ba140a49ef0bf1bdbe5332e11d5fb4d87727f698ec6d1ff3715ea
- MD5 d5fee711ef29b7017bf016ef4b1c913b
- SHA1 101a4dff6849a2f40fe76d260914e94f2277a090
- SHA512 fe18b71f7e899af2331b2da20f42c8a727fcef2481d6bd04b6591f94f119c880b4d5158851dd7c83a7120cf2ef3ab69b8829bb5aa19eb1e917025aa327df6350
- TLSH
  T1BEF0C0123CF207A610A33207A24F58DCD23852AD73E1C2D4660E66131FD945C71F9F9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  client/vendor/simplewebauthn-browser/helpers/identifyAuthenticationError.js
- Size 2KB
- SHA256 3761c6d753e74e4c15bc7a7e33b55e62e8697e1c281fb7585f4608d25cfc1d51
- MD5 99f64b67d26c59ea0330759a8355bf4e
- SHA1 40458e96efedb9654583adb0c8e975839bfeeeb3
- SHA512 ed8ca44d773beb11041ba0edbed62a5040a29e0001ed7942c545cd2dc97c323a0c861c93ace1fff2d0e318d80b70134b20a0f15dd78da8ba04b18735f78dc7f1
- TLSH
  T1D451F09E06E1422745A3B1DC392F60019A27C10718686E35F95ED7B1FF9C02A8FB5A8A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  client/vendor/simplewebauthn-browser/helpers/identifyRegistrationError.js
- Size 5KB
- SHA256 766cd394739671e945d0f0a86dc9c61e3e9db76bffdb1332c5be68502b0eebcb
- MD5 30d0bf69eaa790299e6d2dda4cee0ab4
- SHA1 0efd10c2e6392ac1b8d08bb7464aa853044f95db
- SHA512 ec0f7c08bc868d9611970bbda2cdd50944991300e7464cc6dd388847b78abf0e856bb0b0069d6886014d8f2293f029b7c115e26085caea113a53cf131bbac74e
- SSDEEP 96:E3NcYyUOS8iMXxLl05L31z4cnwsiZAhivFaoVQBweSQU63OyTYksGuikDr6i2hlr:kczUOS8icxLl0lFz4YwsiiQdaoVQBwed
- TLSH
  T195C131CD05F106238ED3B19D763B31418527C00718A45A78B91EE7F1FF584B98FB4A96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

Obfuscated Files or Information: Command Obfuscation

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Obfuscated Files or Information: Command Obfuscation

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32