7403be7427bbe1936a40dded082829b6e217fc4f5990fee5cba501f0ae055afa

Sharing

Copy URL Twitter E-mail

General

Target
EqualizerAPO-x64-1.4.2.exe
Size 11.4MB
Sample260809-pr2s7axgjh
SHA256 7403be7427bbe1936a40dded082829b6e217fc4f5990fee5cba501f0ae055afa
MD5 410aab9749ae4673b950bc29a4eb226f
SHA1 f599c3a16d27864d330529a012fc23a37abdd06d
SHA512 85c31ae500384e168e15c8f1089cb9570d7e72df7f8b2d22e76de171399550cfd775f1bfb539654e287340cf2b3638bb442c3f804c5aaa81b44272e44f05e244
SSDEEP 196608:ZeChCgKhSkiU/msfpFBNGGF2gYntzw+wHX2N5OzauxUeBd5LUOMbDfzS:ZLQSkiU/msf12gYntzMda+B
TLSH
T1ECC633288DD0D0BFC49C8EB3EC31A4D8FB572678B64DB66270110D7D897DAC63D69682
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  EqualizerAPO-x64-1.4.2.exe
- Size 11.4MB
- SHA256 7403be7427bbe1936a40dded082829b6e217fc4f5990fee5cba501f0ae055afa
- MD5 410aab9749ae4673b950bc29a4eb226f
- SHA1 f599c3a16d27864d330529a012fc23a37abdd06d
- SHA512 85c31ae500384e168e15c8f1089cb9570d7e72df7f8b2d22e76de171399550cfd775f1bfb539654e287340cf2b3638bb442c3f804c5aaa81b44272e44f05e244
- SSDEEP 196608:ZeChCgKhSkiU/msfpFBNGGF2gYntzw+wHX2N5OzauxUeBd5LUOMbDfzS:ZLQSkiU/msf12gYntzMda+B
- TLSH
  T1ECC633288DD0D0BFC49C8EB3EC31A4D8FB572678B64DB66270110D7D897DAC63D69682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 a6919f5f3b53a9c8c015413babe7a9872491a2583e49bb3c261e60785c3c3534
- MD5 26836307758e048d1ce0afe754d6a972
- SHA1 23a8f45cf5e2ad78add3c4dd3b3cf15fffced2cc
- SHA512 aaf7cfbb9c6951b65bd377db401617812f1d47960a01ae99164183c642fbd8f1ce08720bc92d26b642da5433b80720dfcd96280a162decf678139966be132746
- SSDEEP 96:IgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tk3hhEl7y:IgiqVPgK8K9eIdE9B/t8hg7
- TLSH
  T15AF108BAF3C005B3CB8F86702853BF074B56E630535561A39B5341CA75D18A3ED38321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- TLSH
  T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsArray.dll
- Size 12KB
- SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
- MD5 0917ee492308b691326e6581e8c793c9
- SHA1 ff689c8051ffca7657461ac828bc46e303ab8e59
- SHA512 2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5
- SSDEEP 192:L+QMtjhIz23Tv7QpAXXcxwtXexpnGOO81h2xXP:SQ6nDv70AXXcWtXexpnGIhW
- TLSH
  T1C642090A1F6082F5F8F201BA557A2B355A1D7E19971E1EEB07A314142E209C73F39BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
- MD5 1c8b2b40c642e8b5a5b3ff102796fb37
- SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
- SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
- SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
- TLSH
  T13012F8135A4454B3C9E6223A31AA2F2EDB3C9324D0627D02C7779E5A2BB42167D3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  Benchmark.exe
- Size 619KB
- SHA256 ab9df4be7234c2574937f00fcd5cc7867fc3882b746499b6a7801d77f03984d3
- MD5 c23629263c7882501ac8fcce90eb865a
- SHA1 f2f039f65337e30be6f69c3883022813dabb6536
- SHA512 1bb3812d252dd26484c7eaad6020a88ddcc239577a2913e34ece7c8df2e012a56bfb991e753660faac1f364a630fd7835b7c530c1a4cf2f53ce1b2c33f063424
- SSDEEP 6144:e4dTN1aVEtk4eIrOh8TNBxvIpYhWOtV4dR6Xp+ALxJIAEnMonBOrGVrO7Z1auT:yt47qmTNBxrJtey9ExBOi4Z1au
- TLSH
  T1D6D42A57A2A901ECD1BBE1BD8A564902F3777C0A0775D6CF139046AA1F17AD09F3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Configuration reference (online).url
- Size 167B
- SHA256 0386aba953d745c338636da1acba1941be7a5e18042ba74b63c6c047d17e75a2
- MD5 b8ae8a09625a36105f78272736bf5e3d
- SHA1 51fefd1bb3076c704b8d07186e4580cc940c15f6
- SHA512 ddb257bfdc1223e4cf92c1dc06b643bfa228ac4fcd114e53aeb6303d462594afbcf9b8248d4668c6d8ac626dc36dc5c60e24e3edca6633ed943ba0b8ffe8da22
- TLSH
  T152C080DD4505C4E7D611464650B1B795481D739505DDD49CF155DC464C594C1D045F37
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7
- Target
  Configuration tutorial (online).url
- Size 169B
- SHA256 f655030c56476500551b41bf2afd2545e728aa8674fd254700beeb0a21f1bb19
- MD5 1e1d7502498c8afeb73241afc10c629a
- SHA1 e68df70b786feb6927c21a576b8617eefa53e778
- SHA512 59f198dcdc8b180be0a9dc50d83c004dcd1b5ec0013951faa451f64454c620f74da9fa675a98ccae713d69bbb2ff2727c66ce862933878b96d0c2596c9ac5bd2
- TLSH
  T1DDC080DD4949C46BD503470B51B0F5545C1C77D404C9D49CF1D5DC8D4955081E257F17
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral8
- Target
  DeviceSelector.exe
- Size 723KB
- SHA256 3e9f638ead596084cf3484ab22822090fbe58979bbf18c16ac95828bb73d02ee
- MD5 58f01e773724c57a7a994c3c96e28b0b
- SHA1 8b27897a8e9abc048952b32684f42b66b08c41ed
- SHA512 5818036af2b35bc94f0922dd364a1584c41ff622d2b8aa46f6d0a09c5806fa99b74313ce3a9a23b434621b5a4039d91e02d5ba7a9701aadf5463c7415868df18
- SSDEEP 12288:1u+7UxQruoiRuTY1D4jKZ8fFsqg30d5Z8f:1u+7UerxK4uk/g3E5k
- TLSH
  T116F49E16B7F92199F1ABD23E87578112EB3378494332978B5785BD740E226C9AE3F700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral9
- Target
  Editor.exe
- Size 1.7MB
- SHA256 77fd42c9eef32f5ab8d4feca0ddd7469d3850c9b443e47ad5b445a824adb78a2
- MD5 3cb35d4c65c10ad41a9c4b6c19b68857
- SHA1 c64e12dac2b3466a04f31e50bc8e8bcd14285734
- SHA512 7bd8aebe625d758f22ff07925b038368fedc45d85f8386a52260bd6d95255a2042dcc00507107a4ffa04f9e9ed54e046bdccabd8f1c57d71c7d4b3e97611179d
- SSDEEP 24576:pwbORyty5wTTDzKI7zilNwke74OBsEAkav:2KRoy5wTjKIXmNwke7AEA
- TLSH
  T168858D1BA3FD02F9E1BAD13CC60B450AE7B2740A47729BCF129689661F236E15D3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Drops desktop.ini file(s)
behavioral10
- Target
  EqualizerAPO.dll
- Size 632KB
- SHA256 fb73fc8b94f271464ae4f83918bb3cb3243c4f50a8035c07fa538ad16ad66aa4
- MD5 57058b608040688fb46294b1228b4df6
- SHA1 3b13ee55922c0aa1cf745ee9a316ad73a681434c
- SHA512 e46d4978657554082dbaf086fb02da5bc57123885e719f5345fb37ccbbea932158c459662a39cb05d2769a15ff508484a3ddbc70f99b524f48960d2e147728fb
- SSDEEP 6144:0Fj38OfiqlfJmZb/ILyaINlnkXEOhrAGhnRCGX7uIINT4ZATOjhn3zAHp47lqJ2p:09huI9SlnkXEJO9XDemDrYLQXY44aN
- TLSH
  T1EFD43917A2A901ACD1BBD2B88A974912E7B77C450772D7CF039146AA1F23BD49F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral11
- Target
  Qt6Core.dll
- Size 6.0MB
- SHA256 653a445d56044410903499952a2cc1ae575e059a75603a2b2a37b10d15db51f0
- MD5 7ec4e096a94814a74f65529bd0114938
- SHA1 943682e0c49925525d9ca8afc3853f7311950436
- SHA512 a59431899e75ca7526bbb3962b2ef96073c611fda690e6001d10c61de87c8bf9749a9154ef75d77528ac97d818504f115703ba3e024033173d9d93a7142fa285
- SSDEEP 98304:l76sZMr/XenfejKFdu9CwJsv6tCs/3E5T:kbfjKFdu9CwJsv6tCs/3q
- TLSH
  T195568D1362F60195D8BBC039CB579503EAB3B8160321ABDF01A466596FB7BF51A3F318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Qt6Gui.dll
- Size 8.0MB
- SHA256 f710aab637560f64e759b2932fab383d01002436c73885a6d19b317e54d86bfc
- MD5 2d4d3c6393fd7e75889c97af05cd0b99
- SHA1 e915d346a0d3f5a94fe5dab213c19ed8f38163d0
- SHA512 6a5ea4fc1feb0a27d2e4f215d61cd9a55b37a1b5fb53b73055eb4f5fee4bb0702b4b4a2aa5fe2d1a5398564794aef60816dcb482a91ba38e71a1953297605672
- SSDEEP 98304:LXoXe4OGtMCLvbdJMzx/DrfC0JDOyat+wUiMq:LXo3MyBJmPC0J0
- TLSH
  T106869D5773A901D9C47BD239CB5B9507EBB2701503629BDB02A4CA552F23BF22ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Qt6Network.dll
- Size 3.8MB
- SHA256 b9abac7aa2aa4598fdf93d4f69aec363d54cbe91331b23816158eed1c31b2a88
- MD5 8aa09036ca576ce41c913b7cf42ccc91
- SHA1 8a0428d9fe2738c70d0ed77c0f26ead5ab75a839
- SHA512 0ed945186d93540495fdf9eb5c366e8b74492e4f82accf3976dac4c2b78f6f47e6b03ee15b26c1fb43e398dce2d996daf7b9b099776ddf7f54abf7a98286cfe7
- SSDEEP 49152:SR5+Y9N93GkJS6Qi+i2dpQCIcqEI6NQP4u7Q+rxPmfzTmPw:6GaWiiCSIMNHm
- TLSH
  T197168E57BBA8019AC86AC23CC65B4707E7B2B81163719BCF06685A791F73BD2173E314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Qt6Svg.dll
- Size 481KB
- SHA256 88194a929933800eac26bf9f9e06489f71ffb8a56e5f9a184c2eb2d820a0d4c8
- MD5 c9a0285bf33b8baf5e21c54cf152b1a1
- SHA1 24026508ddccfa2f41c07b668eb3d3239cd937dc
- SHA512 99f06b7062efaf7ad2628c161caf242db1d5fdb014cf141884fe9932e913e8b3e11796f1b1e203867df80bda9ca3c233489991c8e7d90b820b9cae369600942f
- SSDEEP 6144:vx247y4nlG9aK8+RGLid5hAoHVMLIf4fFfKRcuB0JDmbfCn7tTssW13DhnCdJY:wfKMlkLidDA5KRcF
- TLSH
  T1FAA45D5BF3E20686E46BE13CC65B8812E6B370041392EBDF41558E646F63BE13A7E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Qt6Widgets.dll
- Size 6.2MB
- SHA256 f9ee5e7968633d05f157d0b63a3ce231dda76e9511425c585bffd7d504981666
- MD5 eba4b1ca47653bb73a51f84fa8a90ac5
- SHA1 8523c7c479231111d4ae47e52ec5fa430e51eed8
- SHA512 192741e49d43ba0b0d392b8ca8edf5a6a792fbf26c3a1a2351b06cc5a421d85b2434e5f4099e99056e150352aaad136ed954a893d3d6a7a33ce6eb2196fe97dd
- SSDEEP 98304:hGnn0bhngZ4tBaVEk3VzPRBsVIQV7u5Qp0haTjh:g0b944tBaVDlzPRBsVIQZu5QpC8d
- TLSH
  T1D4567C5763AA0186C46BD13DCB5B8A13EAB2B0044322DBDF1165CE552F737E22E7E760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Uninstall.exe
- Size 67KB
- SHA256 d78b77d844ab05f576349beb931c16c155d71aaf09cae2d76c75029375ea5df1
- MD5 c0e3b958c47a25f123578b3eda56e7c6
- SHA1 23f328f2f183cce73660514331280fd40260ce0c
- SHA512 746eab75e45f1e771c406746e49ac8f536a9aa20edaeca5bbfd42a44a015cce8a61634fd1e8035bb6fce9d508b8b7b702d287e84b296d6ffe432f23ce0eb681f
- SSDEEP 1536:UErU9XLGOA9yMHI7jsOzDcpgdLeAyN4PHQJB9DS5gaTK:UEre7GjyCaFvcpceA7QB9WaYK
- TLSH
  T16663CF163390C4E3CBBA03300DB65BB5BFF5EA7910454717B7509B5EBAA22C29E1A193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral17
- Target
  UpdateChecker.exe
- Size 430KB
- SHA256 7d70461454beb04de6e2405442a7c1dfc12ae25edebe30a1e170106c06086b3b
- MD5 5542709c5fd95132b21d69573498960d
- SHA1 88284b5a03d94c8de97c15bc6989a8e6b1feea46
- SHA512 583ceda39f1351f098d43744d059dc823ea1ea002c8ce2113c86167fe987e804ba2b6e8beb8c79936f88f19da49dabeebd75422195cef7d3522e4b4c631e23c0
- SSDEEP 6144:G0AL+iRvOpc8NgY1DNartNueAODyQCk09/XNhzbOGF+0V/5AODyQ:l3RuNY1D4t9n65n
- TLSH
  T10B94AE99EFB82092F161D13DC3778201DB32B8AD56328A5BC75DBD341D6148A6E3F782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral18
- Target
  VoicemeeterClient.exe
- Size 551KB
- SHA256 9ca628a08b5e9d707874b8fd078080c9d4380bb7f3272be64c40cdc8c2c1b97e
- MD5 9ebb57d4c75c7cc43ac6ff1bf346b233
- SHA1 4637a0e0c9ef52b523479e3587d7e94d029e1567
- SHA512 f4177d0329cb767a815c3598b9b418f5dbba5bb68cab6259ad791b967bc2ecf2314a6cb91d03514bc81c1a30ef575a892dc34ddfe19867eb9b50bbd542c1d241
- SSDEEP 6144:uMKZEmxdgJnkkwMmyOD2BK/smzGzVoU/1OV8i4cVnXfvPIrcprlmSXjBX6uaB7A1:e3gDXmyODSm6VoUoJkANtXtX/aBcHu
- TLSH
  T16EC43B56E2A903E8D1B7D17C8A564812F7B27C450B72CACF239046AB5F23AD09F7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  fftw3f.dll
- Size 2.0MB
- SHA256 6c5df497751d694e9c617f4c931a7f870b64784cb1a0ef09fccc155bc86d1232
- MD5 6fcb132c57764f84ff8d597faf24f184
- SHA1 cf67d61ffce5f19a51568d26811ebf991cc6c1e4
- SHA512 5a0192b71361e4731e3e036cd192757f0e145d6b1035c94ab913e50d70d67863390149d788597754d6d6bde5fdad0700a7d724525e5bbf94365fea6ba6e221c9
- SSDEEP 24576:/5CZ2bxImP2gViRVLKTOv7yMZbgGr5oSdr9Vq0KVMfXoX:hC4KmP2g0VLMOv7yMZbg455rJ
- TLSH
  T14BA52B42B6EC8AC9F0356C3571DEFA0BF12234054B1505F7A3F20199AFA57C06EB6A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  msvcp140.dll
- Size 561KB
- SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
- MD5 72f3d84384e888bf0d38852eb863026b
- SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
- SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
- SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
- TLSH
  T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  msvcp140_1.dll
- Size 34KB
- SHA256 91cd05c16c61c39788c47434602a59c17f5b08dbb3eee04ce85f8d5b70e8e604
- MD5 34a0ee0318a6be3f4a17826e5c17f8e3
- SHA1 5b252d10138d6666892ca9da1e1d95af24de1097
- SHA512 ffd28202e3dd91b89b7d3161f33243e52e8a0b59d31d917c3cd0005c1e97cc818d1ebba9a4971e602164d31b42448c8fef8d0204618ef4134255876c7bd7fe5b
- SSDEEP 384:zLjh/2cARG7SIXvQ7Q9Ra09dSvWcV5gWWBCSt+eiBHR9z12zfq5yEFHRN7m3hR9i:XlWRGu7QHa0PSxadQr9zjgElmb9ze
- TLSH
  T1A0F25B95AB288042ECAB583086AADD833C3DB7D25B51D6DB1391F51C0CA33C6FA3563D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  msvcp140_2.dll
- Size 262KB
- SHA256 713f17b253d802d283d306ce75647e37d83a546aeb1a881e5d9e529e856c007e
- MD5 0c462afe7502e3646086ea7783022c11
- SHA1 b5a6f2d00b7903cf8f4d2ff26980e2ae612ade1e
- SHA512 6b30815c46bd54778e649aea48f8de64b4b7c49123060737a0cbdb13888669672aeef244a1e16c7c8c8e0d1d2a480309f30d51d2ab11c4debb3ea67f9337e0d6
- SSDEEP 6144:qwJ2pjLMT2arwMnwn3Veu7nqZC9JF7WYuWix7ZA:WaTQ3Veu7+cvWvW/
- TLSH
  T15544281276192EBFC8E7A8B04539B412FC2A36514731C48A1BC31C4DAF1BA577EE356E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  qt/iconengines/qsvgicon.dll
- Size 62KB
- SHA256 d78ec8068d5ce1eb6aabca785599dc3a699bf11834705ab0edbbe425ea0aaaf1
- MD5 c6bc45e850e42e563d6a48b6a138759e
- SHA1 b1757a7e7b8c01f005edf61c14e866331ab444b1
- SHA512 8827cc787ec82908cba6e4291b32f329547d809db5f453833b2e0fe6d70d82f064be6ec0ee22adfefd5d3d6b7d68eda0175726a5f3330801eeff985dfb3c55dc
- SSDEEP 1536:QC6qOzRHheJZdkDX52p+3xhfbx1mY/zmu82Pa2nfgT6C:BMpf3xz1mY/zmu82fnfgTp
- TLSH
  T156535B2726AD2159D85AC13DC323D647E97AF10573A29BDF038149326F33BC16D7AAA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  qt/imageformats/qico.dll
- Size 33KB
- SHA256 21547409bfb03b9863324cfce0151c7e32853ddd9627303d2e2256bb9b6c4945
- MD5 b2d95e59fdd4ee1b07e904f463278799
- SHA1 452b7c33176368bfaceaed030657bd7da11e967a
- SHA512 11aa34606639cf396e6e95328898d7e68dfbf45275b7482772ea2d4e3caf82c37412fb98edae9157adc7efd0ff5e91b7a4f2f0367131688da6436254c12ab65b
- SSDEEP 768:28s1et8gRQgd7iZtdyUzQ2wV/zOCeX3kG:TH/QgNiZw2wV/zOC7G
- TLSH
  T1E7F24C46B26A82E5E167C2B8C9074E22DAB6F1728713D7CF41A14A1E1F377D27D38780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  qt/imageformats/qsvg.dll
- Size 27KB
- SHA256 560abe5c4b7f117994823f095daf3d67e0f5e5486570c5bbe2a8e3700b574aec
- MD5 df73c9e6ed525c8493cef96483f193a6
- SHA1 a47aa648c943c4509638b43e2b7abd9765642db3
- SHA512 0afdf012532c8e3a671b62e1ffedf40d1b626d969d3909fbbe50b19514b59f0e79edfa7e36060683cf27a3409119c51fa3cf27320fe342c9634ff987c5d1f374
- SSDEEP 384:aqYwUXXP1rHPdxHmguyBRL4wh7+ou89y7to4XVg/ynW40NJMXVep6ADa:wvRHTVR4g7+ouC2o4C4dXVeEn
- TLSH
  T155C2081AA7694496E023C3BCC94B0E66D173F921475397CF41A6522E1EBB3C27D3878A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  qt/platforms/qwindows.dll
- Size 799KB
- SHA256 b5da606ab265c21a9e9b2ec3f98868bc54bc3089e36f0ef31a55cda1c09ba1bb
- MD5 ec1b0f7df878939ed427a3f6365f2052
- SHA1 d7b7d3f7f0aa5c314d95fe97f45cd9e4d60618b7
- SHA512 cae152fc967a08713cae5bf51488f4665f7daacb8a97ea3b09140697b8b35c3dedbf9618aeb4fc2c02667c316b214944927064b581b50330398820feeccf5aa5
- SSDEEP 12288:b2IrcMFSB94BAQTW0WVocjnmx5vO1dtttD54J:b2dMFXBAQTW1Voc7mxp+ty
- TLSH
  T104054B5BA7A80285E47FC13D874BCA22E7B370101392DBCB0161C95A7F377D22A7AB55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  qt/styles/qmodernwindowsstyle.dll
- Size 188KB
- SHA256 b92de57305156f925647189029c8178fa2c006303ea02d41103929c3efc636b7
- MD5 90512dd16e0531199cd0de7940a13400
- SHA1 36afc9f00ce726dd7de50a619c0cc258d7f5afa0
- SHA512 dc630d01fd62464ca29a7bcac6132797ae3eb02af087b44c79c581d1fd7b024afda583aa96495508f01cca2589a85ecbfe05f195006b07fb827754d1c2d0e40c
- SSDEEP 3072:yXfG8MixvyfAKNSF1DE0utNtIXzGh0/HquCL1gRljMhmeuUxIQuCPLUAu:yvGzi1yIQSE0PGh0qsHMhmeuUxIQuCPv
- TLSH
  T12414280373921296C127D2B8C66F1663F5B3709443169AEF0067CAB52F632E3FE3A655
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  qt/tls/qschannelbackend.dll
- Size 234KB
- SHA256 f4ba03056cc4b6127339470415c0a1a293bb80ac9c30a03c33c6c45712f744b0
- MD5 a4e3705226d88fa4642866cc218b4725
- SHA1 49377bbffea05fcc73794c67401b7a9e1597f713
- SHA512 6af9f446d6080e62ea4321bdb6a691ea7b7ab8b8907e5b553c1f5e290974ba0cb0926c2d4947a5fec79c2e7865ee46561ad0577e2620e6de14cd48d4b8e84e75
- SSDEEP 3072:LlzC0Q43pq852/JDcg/QIuj36r51f5NKXkEpi8M3HiiCgyjDtK6APA0BtzHb2RKN:LwDipTet0kEpZkHsDRKRLb2RK/8VqZq
- TLSH
  T12734286733940A95EC6BC0B9CA47C803E273705A5321EBDF06658D6A0F77AF2B57D290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  sndfile.dll
- Size 2.5MB
- SHA256 4e3bd2de8e1485110eaebef8e1239471f73d608773831c323bf528e05645655e
- MD5 d88ab95c18fae89be495e3e21abf5c1d
- SHA1 ce6f82ee525e9b0f23dc2e415f1dcd3355062784
- SHA512 090fd54318b26d06ebbcbf0e9edf3dc5d15ad38caa4d71a022291c50461ce265cab3fd15989ba39b51e1492257b9d176ee0c4ea5d3ea37ec3ace666f1bd361a4
- SSDEEP 49152:Vv/VBp9hCH5FGRxcfnfvrNubUAHUi425P5QxI5NG/8oRcjcQKg7yxWEHzY9W+V:6GIxIJg
- TLSH
  T1B0C56B02F2A25CE7D2E681348153F527E631786C83521AFB2794A6B87FA37D01F7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  vcruntime140.dll
- Size 117KB
- SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
- MD5 caf9edded91c1f6c0022b278c16679aa
- SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
- SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
- SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
- TLSH
  T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  vcruntime140_1.dll
- Size 48KB
- SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
- MD5 2bd576cbc5cb712935eb1b10e4d312f5
- SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
- SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
- SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
- TLSH
  T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Drops desktop.ini file(s)

Event Triggered Execution: Component Object Model Hijacking

Deletes itself

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32