72d9b13247d9f9b59612f70a5c730cacbeea2a3c082a633ca64ddba708559d16

Sharing

Copy URL Twitter E-mail

General

Target
NewLauncher-2.0.9-windows-x64.exe
Size 101.2MB
Sample260806-vgrs5abb33
SHA256 72d9b13247d9f9b59612f70a5c730cacbeea2a3c082a633ca64ddba708559d16
MD5 16e066fa76c191f5ce2a0a0a27ac1860
SHA1 fbd47e88c462410d6b0bf06c3d0e8943cfd81cee
SHA512 60e3a4cf18d741c9e553fdd243db84e4b50641c64ebc4ad20a9c370e99bd4e9a1dda64083c49bb5f1cc5145921991c0b3996d08ba259a8c62912da46a0352fea
SSDEEP 1572864:aic+fHfplkpKhXOZUVNBvmjl/UC894a7Y8ni+A5UsFoZRI83i13VPM2q96b:aicCttOyT+2xXE8BA5hecVDq9I
TLSH
T1923833F081A52C1FE658BBB35F3E8451F1E517EF2C06832F672857B8D1D40CB86AA466
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  NewLauncher-2.0.9-windows-x64.exe
- Size 101.2MB
- SHA256 72d9b13247d9f9b59612f70a5c730cacbeea2a3c082a633ca64ddba708559d16
- MD5 16e066fa76c191f5ce2a0a0a27ac1860
- SHA1 fbd47e88c462410d6b0bf06c3d0e8943cfd81cee
- SHA512 60e3a4cf18d741c9e553fdd243db84e4b50641c64ebc4ad20a9c370e99bd4e9a1dda64083c49bb5f1cc5145921991c0b3996d08ba259a8c62912da46a0352fea
- SSDEEP 1572864:aic+fHfplkpKhXOZUVNBvmjl/UC894a7Y8ni+A5UsFoZRI83i13VPM2q96b:aicCttOyT+2xXE8BA5hecVDq9I
- TLSH
  T1923833F081A52C1FE658BBB35F3E8451F1E517EF2C06832F672857B8D1D40CB86AA466
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 100.6MB
- SHA256 378089ec7134d8e4b763ab97c2fce4c23b613e14820c104b5886c5e0b9410e08
- MD5 bf7632cee874a4154c5966b0c407d492
- SHA1 ce9006fb006c52b078340cfc44d83cb583886286
- SHA512 7a2803e187ede1f7cd035caaac75b007ce63ca03f82dd55d562c851c5b789cefd27b73c5f215a5a9e1c95f16089b4d3f4c2adf9039b2c61a3c4738d3138fdca2
- SSDEEP 1572864:sc+fHfplkpKhXOZUVNBvmjl/UC894a7Y8ni+A5UsFoZRI83i13VPM2q960:scCttOyT+2xXE8BA5hecVDq9R
- TLSH
  T14F3833F081A52C1F6658BBB35F3E8451F1E51BEF2C06832E672457B8D1D40CF86AA46B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/bin/lzmajs
- Size 1KB
- SHA256 f29aae866c7bb66e5424a730c473231c1329f6bb0636ad33945299a4c4957a50
- MD5 cdea38e7d795ce6e8274bef89c773780
- SHA1 7bf89bfcaac6964e4f551233f0daea7dc2f58930
- SHA512 401068503e0cefa4bae0c524bafd903f83ce945170a5a28fa5b8f3004c9b1afd09db188e416a071011276c836a6a2dd75ca5d9397e7d24cd1715b6c46e1b71e9
- TLSH
  T1F941873006FEA06E422340B73BFFD45B59B5983B1145DE69F99CC5C24FC0191199AEFA
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/index.js
- Size 13KB
- SHA256 77d9568c9c5479953a4588875b9d5c4a06ce9f926f9fab96d7678e68a74e6985
- MD5 ff2e30ea41c50e397cc5fb516d633d2b
- SHA1 bfa32375a230e4c6b37d9dee9a94bd106af80bdf
- SHA512 bbaa0d96fa3b546fe913d0988dbac54c8d963b4a79f8459c22cf27920e754977f471ccecc07bf9936bd34a3b65dfc6517ae5e126dc260d68347f71f3106bb51f
- SSDEEP 192:4aBgo4Ls4gCGlqmPk4TPGwsVh6rLSvR50qjXryXN6gLo0OuLoC6lVlfuswTDo+Wo:eokBL4LSA6e6z9qrotsRdn
- TLSH
  T14652FF496DFB31624673B1754F9F9A0DB23DD017142CCE94B98C83E0AF905389AA6F64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/liblzma-build.sh
- Size 138B
- SHA256 ae56a4c3e521e37c5677e4d867e79ab46ac23b3f5682a7e2893497232a0326ce
- MD5 cd2e20d9a8384d3090058e3428d6b327
- SHA1 b3f90405a89eeb07ff6fc4243be8016ce2d6e1c3
- SHA512 d39514e34aea97b3b03b966b76affc5fbb740799bf15219935d8995029a1fbeefb59d3a2a356ede3cbfce69ed0d775680dbff33493d2585a7ab29b84cbb70527
- TLSH
  T143C02BC1C07B00225B47021911463000CB148AE51A178A56C0C4C2E8C7251D9A61790D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/liblzma-config.sh
- Size 733B
- SHA256 100d04495f6b1804aef3983377d91509864758cf9aa7470d28a24b69f0bce116
- MD5 e886188759f08df991ad8af4bbc333c1
- SHA1 b9644330527cb91fc20e2d66a93c8380f71932ff
- SHA512 b4b30187505941eb75d44bdb51d4bc9ee778034d0850c7253a38ca636a620c9c6ae8954e43515b57ef409adcb6a91976e4e92f49b466c6c38e7bd33a79340ce8
- TLSH
  T1CD019C17E456365B2E2CC6A273EE6893EA05AEC26F2C551FA0803A7873BF5075610C86
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-arm64/electron.napi.node
- Size 421KB
- SHA256 99006146d3f02a3701a254dbf57d10175a2950fa7d85b4dee90b99c997d882da
- MD5 5a8ff3c35b7d2d367d4b56f016650860
- SHA1 43f00704db624630f2164d52e47e93d4430b764a
- SHA512 753b32f63a2638b49123b49876c8f0e336aebcaed128b181b7555de4646a9f3e1e2419b7489de61888a5b18f40790507367206507ee52afe92d19abc78129721
- SSDEEP 6144:MZMB4WEWGxBL/aJrxffqWCMFe4FQvYOBoSj9uf1iEENkC:MZeE9BMV3e4EtiG9uf1ik
- TLSH
  T1DD94F839E261D17DD04B947099DB4A0310B4B5F85A35200E3BCC9F6F2A77BA68B6D393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-arm64/node.napi.node
- Size 421KB
- SHA256 9a03f9e38254ac721d042561b23842c944db243c3c30fb21f240a577a34c8cb8
- MD5 c5ac962f6ef85085075bf5e761696f56
- SHA1 0574d6d3914d86027d35c5a4bcd36c9f23f426fb
- SHA512 64323a70a99aa2a018e5c4e43768a3c4b9897e8da4cd34a580cdb50d7657a54a3bf36ba4ddfa21f70a84b4800e788091a7c65ccce6ae58e18528c0b5118a1072
- SSDEEP 6144:oB4oEWvydo2tHAufixrHJMv3XlhYOkoNr1iEEN56:cEKydog3TtD91i5
- TLSH
  T11B94F839E261D17DD04B947099DB4A4310B4B1F85A35200E3BCC9F6F2A77BA68B6D393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-x64/electron.napi.node
- Size 421KB
- SHA256 99006146d3f02a3701a254dbf57d10175a2950fa7d85b4dee90b99c997d882da
- MD5 5a8ff3c35b7d2d367d4b56f016650860
- SHA1 43f00704db624630f2164d52e47e93d4430b764a
- SHA512 753b32f63a2638b49123b49876c8f0e336aebcaed128b181b7555de4646a9f3e1e2419b7489de61888a5b18f40790507367206507ee52afe92d19abc78129721
- SSDEEP 6144:MZMB4WEWGxBL/aJrxffqWCMFe4FQvYOBoSj9uf1iEENkC:MZeE9BMV3e4EtiG9uf1ik
- TLSH
  T1DD94F839E261D17DD04B947099DB4A0310B4B5F85A35200E3BCC9F6F2A77BA68B6D393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-x64/node.napi.node
- Size 421KB
- SHA256 9a03f9e38254ac721d042561b23842c944db243c3c30fb21f240a577a34c8cb8
- MD5 c5ac962f6ef85085075bf5e761696f56
- SHA1 0574d6d3914d86027d35c5a4bcd36c9f23f426fb
- SHA512 64323a70a99aa2a018e5c4e43768a3c4b9897e8da4cd34a580cdb50d7657a54a3bf36ba4ddfa21f70a84b4800e788091a7c65ccce6ae58e18528c0b5118a1072
- SSDEEP 6144:oB4oEWvydo2tHAufixrHJMv3XlhYOkoNr1iEEN56:cEKydog3TtD91i5
- TLSH
  T11B94F839E261D17DD04B947099DB4A4310B4B1F85A35200E3BCC9F6F2A77BA68B6D393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-ia32/electron.napi.node
- Size 619KB
- SHA256 e73951d1d9f4155cadbeb530be14dd32e1abc4ad9332527507ede586ce41e095
- MD5 8e7adb376ff87a10990f783562b06a4b
- SHA1 924bcdf667dcb58767efc662068ffaea2f40e7f3
- SHA512 6a18f6f71a55eacdd4dd415e3a39ff2fd551594d332921e5e68d717142ec75595a32dab7d40aa82b33dc33c27661e7382d622dea4173a1deb88fcfc976621e23
- SSDEEP 6144:GaiFHaev+gFh4N7UUBSgaAng6PM+FMi83y9OMZMduqpLLDg3KF8:riF6xgAN4Fgbg6PMWM9uqp1F8
- TLSH
  T1F8D48E207894C2B2FDEA20FA01ECB637029DD4B0075496C756E81BFED6606C2BB37657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32