acf0127ef48337d84b6a89e77391812ceb03961cb251df5c164a5d784ec03701

Sharing

Copy URL Twitter E-mail

General

Target
PrimeHub.exe
Size 100.5MB
Sample260810-3hdlws1dpg
SHA256 acf0127ef48337d84b6a89e77391812ceb03961cb251df5c164a5d784ec03701
MD5 77240590176e73a1631c5dc1bb0ec09a
SHA1 fdcc0c4370bc6436f99e09186aa18e6b6c4a9f9c
SHA512 448bb02bbd81ac748ce36d5b1bec1dc1a322810353a41fbf580516f66cf5836fc87a55267e268574218767aba59bb21a61b96c275729147330894b927b3aad1e
SSDEEP 3145728:3UKEPMAbtMC0gRWHi2tzxFeYatdKxoCP3H07:uMbn8WHi2tzxFiK7P3A
TLSH
T1D438333E35F6C316CC66913F68F0B623F69CEB3B0EB5B85B9682510861D07A411993E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  PrimeHub.exe
- Size 100.5MB
- SHA256 acf0127ef48337d84b6a89e77391812ceb03961cb251df5c164a5d784ec03701
- MD5 77240590176e73a1631c5dc1bb0ec09a
- SHA1 fdcc0c4370bc6436f99e09186aa18e6b6c4a9f9c
- SHA512 448bb02bbd81ac748ce36d5b1bec1dc1a322810353a41fbf580516f66cf5836fc87a55267e268574218767aba59bb21a61b96c275729147330894b927b3aad1e
- SSDEEP 3145728:3UKEPMAbtMC0gRWHi2tzxFeYatdKxoCP3H07:uMbn8WHi2tzxFiK7P3A
- TLSH
  T1D438333E35F6C316CC66913F68F0B623F69CEB3B0EB5B85B9682510861D07A411993E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH
  T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  ZihanSuite.exe
- Size 180.0MB
- SHA256 4a0ddb095f5707650cd8558828972577a6fcaf683eb5811fede4fba5aac60924
- MD5 12ec152df40df7127c5ff94e0f686de8
- SHA1 d8c2281fbd00094696d3f670e73939ca5eeca8bf
- SHA512 adb0c121252e14d7fa502bae4ed7dd45027db80d87f3a46eaecba9b3f4f49d4f5aa185ee642ec4e3f8d0c0016b7199b1d47079054f93fe8dbfbf6352e4a1dee1
- SSDEEP 1572864:pH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:esok+hK7
- TLSH
  T1EE988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
- MD5 e3bdb59b37b730647d4a1e44756a730d
- SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
- SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
- SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
- TLSH
  T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
- MD5 c13e55ae6200e74c0b121cbd5c1d323d
- SHA1 098675729109e19a0b6cbedbbf45398265ab6644
- SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
- SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
- TLSH
  T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
- MD5 a3bf08772053b66ec34701037f120736
- SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
- SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
- SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
- TLSH
  T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app.asar
- Size 250KB
- SHA256 45761ed202c37da6caca9b8db1566a60f0a6b425570dd74e030507e5c564f90f
- MD5 82eeaa2f8c65ff6292d35d8f8f8cba4f
- SHA1 9cacaed2512a7b8e837245991213a8bb571d974f
- SHA512 fe9538187101de6df95798d0a7a530cc60e55f39d5ae966b05321a71841758bc5b32488f970804723d9f9b4357258dc6f01638fb33a7b671600e73aa6af7c030
- SSDEEP 3072:IR9Rf6LCPMUgwJp30msR3dcq6QdqP+ZdlUF7ohP+i3S5SzD0G9egU89BEE54:IVimErwE3dcLQdqP+ZdWdo+i3MKIeXG
- TLSH
  T10A44050137D9A88A13E78BE9125B64C6FDD639AB5C518D4BEC11FF5068F0123EAC39B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
- MD5 9fe8a485038be54d687ad7dd9dff80d3
- SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
- SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
- TLSH
  T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/win/arm64/7za.exe
- Size 1.0MB
- SHA256 81f67048b7366870e5d49f00a8c570570c6a0dd11c05df7a09a8c52870cc83bd
- MD5 738047f69da7d4489bc085909a68e532
- SHA1 094c83b994177f3bac13f8d9320abca5c85b8839
- SHA512 d6bec8d71b6716a28e1c399e39c1652b354711d8081ecc09746184dcf0a28aab11144c5b893cd3d975564411929358d7a8af8c11ab45d415e864b5cbe5bf14c1
- SSDEEP 12288:eeJk5mmhxMpYcHwTR9rjJf19RVlGVYG4YQTukMef5vxW/gR5HD:zojYYcUlcY99AK18oR5j
- TLSH
  T1B3355B416E4CE891F1C6E2BC6DB78F61363775288A548287B127432CFCE2AD4CDB55E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/win/ia32/7za.exe
- Size 773KB
- SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
- MD5 dfd1cf824c781069def1d239a626d43e
- SHA1 bbe24cbae89166de829a7cf91eebfb518d8f45be
- SHA512 0413adecc5560ddb18133eec70b3a717d82738f304bdbe6eb6e2dad9ada57314c60bbd48ac0aa948af77ae76f7d522ada4f6089fffab88f882872c56bd12ca20
- SSDEEP 24576:fq79Al2Gp6BXGyja9hicoZ6ijJhyHiJT:yS2WUda9vy3dT
- TLSH
  T129F48E227AF5D0BBC24211328A1D7BF691F9E3190B3048C763908F6D6B359D5DA3AE1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/win/x64/7za.exe
- Size 1.2MB
- SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
- MD5 b7b7473472c9806bee3e7ae6c1adda23
- SHA1 2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
- SHA512 544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
- SSDEEP 24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
- TLSH
  T110452A56F6788375D073C0B9C5D2AB9AEE72308517308ACB1246876D3F17BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/app-builder-bin/index.js
- Size 641B
- SHA256 5c3a00e2192c7f1edb7cdc4ff7a972c1b3f27042bda18aedfb8dcf528881de53
- MD5 3103043a820ba85a415760816f0cdb6c
- SHA1 ec2f9166e3608abcdfbe1f5115656e4530be43e3
- SHA512 01042fe820cff1c986e403da1592474b95835d3ff53ed7858920e47de0384fa5b870a2d078937a89769bf47398e3c1e47f8326941e20932a56d4fb281ebf0b36
- TLSH
  T162F07DD66AE695348204D768353D4C29F479AC7323494E27A0D4A7E8B7B292083F15BC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27