6b326fd1cf9a586d8ccad6395afb180f69351b313443501f2866099f2e02b73c

Sharing

Copy URL Twitter E-mail

General

Target
Era Setup 3.0.9.exe
Size 149.5MB
Sample260808-lnc4watgqc
SHA256 6b326fd1cf9a586d8ccad6395afb180f69351b313443501f2866099f2e02b73c
MD5 29aa22e73404ea3ba76749b43c853b2c
SHA1 44db0ffab8ecc915e1b52cc5268341f79e28c40d
SHA512 2eba84e45559dc98e150919244421a14d44600a68d85f10d01521b2041a326be27809bae76e93efbc4306722b2b6d2443d9f18c25d0f65c5d5d80de5357f92c7
SSDEEP 3145728:pLwCzwwpkOvHUMcbAwROoKrumGLWsyK9kEv/LKPXD0LADLo:lZtUMcbAwUon/WsyK9f/uXoULo
TLSH
T11B7833C7CC159C0BD521F47E87A06EBB0D413C6BD68136839B62FDA0A8F7891DF68856
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Era Setup 3.0.9.exe
- Size 149.5MB
- SHA256 6b326fd1cf9a586d8ccad6395afb180f69351b313443501f2866099f2e02b73c
- MD5 29aa22e73404ea3ba76749b43c853b2c
- SHA1 44db0ffab8ecc915e1b52cc5268341f79e28c40d
- SHA512 2eba84e45559dc98e150919244421a14d44600a68d85f10d01521b2041a326be27809bae76e93efbc4306722b2b6d2443d9f18c25d0f65c5d5d80de5357f92c7
- SSDEEP 3145728:pLwCzwwpkOvHUMcbAwROoKrumGLWsyK9kEv/LKPXD0LADLo:lZtUMcbAwUon/WsyK9f/uXoULo
- TLSH
  T11B7833C7CC159C0BD521F47E87A06EBB0D413C6BD68136839B62FDA0A8F7891DF68856
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  $PLUGINSDIR/Registry.dll
- Size 25KB
- SHA256 4f585d4dcb449fc1b0e002d7e850a059bf254769aee0fb83841f73064ec63014
- MD5 5408d183e7e2098ffa0290a7a5f9af49
- SHA1 5e8402903bd805ea136796032115b72f2d728c8a
- SHA512 2f3936808a257aeff0c1daabc274abca583e04395287c2a60778a4c01b5449c9364c6b42ef6a1588dab6823456b4f196ed22a7a911eb5cd65806a01da4d4c398
- SSDEEP 384:wUsbaKAjqsQZlJee0QwFJM5LPnnqutjZGmaZUjeVRVKY/raQWBQqLN9AYUVf:uBAoBwF2ZtN77j0KUeZBQo9AV
- TLSH
  T17AB25C8171D1D4B2D09F1579AB862F19E3EFAD603270E85211A67FCB33918A2D379B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 148.9MB
- SHA256 680a328514172bb58b4add35282d651ebb9dfe7dd92a6c2fe373baaca8324766
- MD5 e8eb2c9f6d7d7f8411b70cb85a083215
- SHA1 d2bc5fe108701d118bc5116de66faab1515805ac
- SHA512 999c40561063ff2b1fbe5cee727f4edfe914d47346970d9589ee55806978ccaabb34a020ddf00fe75d8d17fd68d4cf921e4a0e16e5829ed2c5e8abc2aa7142ec
- SSDEEP 3145728:pwCzwwpkOvHUMcbAwROoKrumGLWsyK9kEv/LKPXD0LADLH:pZtUMcbAwUon/WsyK9f/uXoULH
- TLSH
  T12B7833978C291C07EA51F87D93D077BB0C41381BDA923683DB639CF0DD66C96DB68892
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral8
- Target
  chrome_100_percent.pak
- Size 112KB
- SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
- MD5 e7bbddff3081eeecf7f56e76ce1d48e4
- SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
- SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
- SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
- TLSH
  T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  chrome_200_percent.pak
- Size 182KB
- SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
- MD5 1e1744b9410d29e7d1ed28c4f67d6317
- SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
- SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
- SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
- TLSH
  T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  icudtl.dat
- Size 10.0MB
- SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
- MD5 4171402e385f07007de57f45ff540e9a
- SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
- SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
- SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
- TLSH
  T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  locales/af.pak
- Size 567KB
- SHA256 ebfdf1ca739f74b0b58a7965094274523fe2deb44fa0afff5bed98635b70326a
- MD5 b5f869b49f8c3889eb01c015694acea1
- SHA1 7388d387be5ed74c3405c2c164816c3e9ada6622
- SHA512 1fe89e4e22264e3f292b041ffded2a9c123c5e04281a0f4dbdcd62f8ef0ab740c1eecdb53b7db8851859566fd363bcc1fc6749831316f8061fba9a4ced6a9dfa
- SSDEEP 12288:KZGxy8RXxgtRGt+vWiRwONM8KuY3GB1sz4H2Jyn9N+saAQGmQo0v4JIAga2NF+UL:5E8RXutRGt+vW+wONM8KuY32sz4H2Jy7
- TLSH
  T110C41B0BE781173D09B07696FB0845B7BB9CA26CC770B2B6DDA982320966DFC11BD1D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  locales/th.pak
- Size 1.2MB
- SHA256 45a573589f11c1694490913c00bbff65d57e232d33ca2270ac2e443207b971d2
- MD5 79b81841fde5ef8edcb46d2ba86dca09
- SHA1 7d9fe5a44d137dd4cecc6009d597f77587e84c7d
- SHA512 31641437d3c012ab0a88db26539731c7c60d141d10646c4b457691c0827f0a0459adf479579b52263e6d4c46728642cceeaf6ba59a2249ff76a4c7bd5c59d056
- SSDEEP 12288:lvJJLN9LyZYAhzYLz8AsShukJUseTPsO5eXffpbDFDS6Sd2N+Qj4B1qsl5URqE3D:9J0O5Ssf
- TLSH
  T114453BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8432EE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
- Size 11.7MB
- SHA256 e3df9ac4efa1a8407bab95beaa2adde6f7addb39312c37796d9f2c9d12441a0a
- MD5 1eb21fe71d38e4c109d078a538dac860
- SHA1 4039dd99d8b8e10d07e318c5eecc07ef4cfac740
- SHA512 e3274b609e9a1930b212da70b55b1cfef8ba7cab6b66fe7052415b977fc15efa3a804aa3acc259d8918b1da9e02a802506e0d42d3db8f326a12e41ae5ab90033
- SSDEEP 196608:SvvpkJAxXEouPQ20C/vgS6HlcVe4Ei4eGUae:SHXEoohZvgS6HlcVe4FgUae
- TLSH
  T192C63943F76291D8C06AC174835A6232FB71BC4D47307AEB5BD08B212F66BD09A3DB59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/binaries/FortniteLauncher.exe
- Size 52KB
- SHA256 31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66
- MD5 aeaa6f47b71614437c0d47828da005ca
- SHA1 f9d016d3817ebbc28556967b8b8c05d120acbc58
- SHA512 6785eb5ae5d6d78a9c2f004ba5c91dd6603fd8efb39cb50f4bc3ac16d7377fb1317ba12658b63d575c17de04696b88c09c8a812340c4c40394196dab99d41a60
- SSDEEP 768:XvoQcESFi3EadmMYDH8B85W2Fb9bCm/fOhgrv3B+o:QQ5AijdmMYDo85Wkb9bCm+Wbb
- TLSH
  T1CC3362D43AA89CDAEA10527C40FAD331253DB6E0865347576A30B7320F13BE17AD725E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/build/Release/dll_injector.node
- Size 121KB
- SHA256 dab11fce07f57a740ae7c9d58dec72433794eabf2d672c82d5d48795affba111
- MD5 d021187e242f1c4d789c6a8004e9f593
- SHA1 c93f9cbf02956f675a6c9d58e0226adeed6f8b45
- SHA512 4ab021d5bb96a37d2bb3041c9d3ace2afe6a9cdb11ca241ab26b4acea32efe954c8585959a6d0b16f24cd0d7bddb58b53e8fe3b8f673b04a2bc9ad47bf28b310
- SSDEEP 1536:gRZ4STUtKwik1O+tSYmKjhpSRagSNiJoxOlKw9cirW5KzhUsWUodw9dlLSCdXjGX:UlUHfrqG0RagAtgKw95CKiA1SYXj
- TLSH
  T160C36D0BB3B900BBE1778279C4530A46E772B8451A60AFEF03A406561F637D5DD3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  resources/workers/diskWriterWorker.js
- Size 8KB
- SHA256 61dec2a88c00909e9a41b4e8d26310c3667235c3cb6ef38c81845d4ac31452fd
- MD5 4a3d4ab4d552940217e3914e76813c79
- SHA1 28dc56d0fd2f5c1099568cbd84667370180b69d1
- SHA512 55388e3e7f03a6216d1a4f9d1ee07cbdb31cf587f930155375bd3a238d27ae769ea774db1c726cad016b1c7a2d088d04e81948e5ce0c83130d8d1d3b134f576a
- SSDEEP 192:L+YA68hxpz9BVRGhwzJVgQktNV/i25aou+DEv4GSbEyQBod1mnnhYvVfKhLCUbS6:yrNhjzihwzbghrTQlSo+c1/XP
- TLSH
  T1D102535A0AF62B29806332562E5B5413362EC1675618FE98FBCC83F46FC413C9DE17AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  resources/workers/downloadWorker.js
- Size 920KB
- SHA256 40339feba98cfcbd4ec5531cac27c07c86515193b195da788d7b96ed7b2cd3e6
- MD5 0ad19db6b64cfeaf17947f4d255f3ebd
- SHA1 050ea0ae66bb828a4316e60cbf1f354de6d41292
- SHA512 098df16fde90462f4ebf4c43c727c97a73ba9e9dfca559f6e08c6e2b59c18736d1cdb47bda6530b1bf74067043a8d3195c8964836805453466baa268720d59c5
- SSDEEP 12288:5YtWXGdOnDK9IG4gVm72bICY6R27rlBtIzfRnxRDss:5YtWXGdOnDK9IG4gVm72kCY6R27rlMn
- TLSH
  T17D15F4891AF324129363B17E9F5F9402B134D003260CDE98BD5C97A55F899788BF6BEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  resources/workers/downloadWorkerPooled.js
- Size 913KB
- SHA256 8f2dfc494868f03681892b56f2e374fc7d5de5f822b0f57d3e26c5d06acf7e8b
- MD5 d83b422b059c0bb0a013ce088843cc41
- SHA1 b2c66d5a74e5abaee0520b31e5992a4a3e2968b7
- SHA512 52d6ff2b49770c5b592c3b106c03bf25e5a325f235086c108e393912957fa22089d0e98c97db498ac9ed79da12692a8b8cf360ff1c161ad2a572e9204fbbb632
- SSDEEP 12288:5rtWXGdOnDK9IG4gVm72PFpW6R2qil+tIzfR5ZRDsG:5rtWXGdOnDK9IG4gVm72tpW6R2qilHn
- TLSH
  T1EA15E4891AF324129363B1BE9F5F9402B134D003260CDE987D5C97A55F899788BF6BEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 461995d47666c0cfdaf8494f606b6511d96f4f1b50ae96c81c5edfb033b2c2d4
- MD5 40cfb8f567e63a2f5ccfff7f4b832436
- SHA1 16f7fd12d09ddcd0d9f3e9ac87d387e1be3dd13f
- SHA512 4b8183b3705759912455b3305082e349ae1e3c4f6424b983becf8726646bbdbdd99efff7e26c96060121a3a6ed82a32a0995baf6dbe0dfdf2bf960c0cd347f6d
- SSDEEP 49152:zvnCO26zzoxH35myRF71jieroxfGDZIM/swoJ030NLxGq9lBEw1vEkl1l6SfRP/0:TnCkzoxH35myRjoLt2HUOJ
- TLSH
  T1F2462713F28681E9F06DD679875AA623F231F8844B2276DF16A01F192E77FE06739710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  vulkan-1.dll
- Size 922KB
- SHA256 9dc9b00151609244872116fcc8150c6a4701ca376564cac58aa752263bb381c2
- MD5 cb21a3e77e11d533d05ef4e013c86d95
- SHA1 9e9e784d40803b279ab37d94b2dd92c36b7eae36
- SHA512 46cf3b9213cfd464c8a86f5cd8751806b58f8af5fb509bfba5895184f937602adfd3de4e9a81af26f2a5db6f021d1a6b1c514da0b7a1545aaf245fcc453d0c37
- SSDEEP 24576:806dvAb4CpKAvlSlQP9s36Z5WGc4DYsHQDy6g3P0zAk79oOHAF:8tdYb4CpKAvlmqs36Z5WGc4DYsHQDy6W
- TLSH
  T163156D23A65485A9D47AD034D9D18707C9B174822326B9CF02A81718BF6FFF47B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $R0/Uninstall Era V3.exe
- Size 255KB
- SHA256 2974846e48aa359753ac03e436a829c15164a890c64099b037b69876d0cb803e
- MD5 0555badd9e0f3697657636e1d138e4f4
- SHA1 d7ab03294ce964bff43f264a994da321965933cf
- SHA512 31ca15f7f8b09a38931bc51ea356bb12469c9ce9600d160a93622af209b1ae087712a833036f691d16b3efa9de84108fe17fcea1a840a12a0a3e7fe4ddee23be
- SSDEEP 3072:Gn77v00hEoDEtau1dPEmO4dWqPVnZ7NqNSaH2tvhOEA1RJCir86SrSrvrRbOa3s:G740IbPEJ4d5VnZZWSs2t0EyL+2ia8
- TLSH
  T1D5445AC7E292CC4EC43685774C390DA35A62ADB70280666D72ECF71961F75828C6B36F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral26
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32