acf0127ef48337d84b6a89e77391812ceb03961cb251df5c164a5d784ec03701

Sharing

Copy URL Twitter E-mail

General

Target
PrimeHub.exe
Size 100.5MB
Sample260810-3pgxwsbr7v
SHA256 acf0127ef48337d84b6a89e77391812ceb03961cb251df5c164a5d784ec03701
MD5 77240590176e73a1631c5dc1bb0ec09a
SHA1 fdcc0c4370bc6436f99e09186aa18e6b6c4a9f9c
SHA512 448bb02bbd81ac748ce36d5b1bec1dc1a322810353a41fbf580516f66cf5836fc87a55267e268574218767aba59bb21a61b96c275729147330894b927b3aad1e
SSDEEP 3145728:3UKEPMAbtMC0gRWHi2tzxFeYatdKxoCP3H07:uMbn8WHi2tzxFiK7P3A
TLSH
T1D438333E35F6C316CC66913F68F0B623F69CEB3B0EB5B85B9682510861D07A411993E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PrimeHub.exe
- Size 100.5MB
- SHA256 acf0127ef48337d84b6a89e77391812ceb03961cb251df5c164a5d784ec03701
- MD5 77240590176e73a1631c5dc1bb0ec09a
- SHA1 fdcc0c4370bc6436f99e09186aa18e6b6c4a9f9c
- SHA512 448bb02bbd81ac748ce36d5b1bec1dc1a322810353a41fbf580516f66cf5836fc87a55267e268574218767aba59bb21a61b96c275729147330894b927b3aad1e
- SSDEEP 3145728:3UKEPMAbtMC0gRWHi2tzxFeYatdKxoCP3H07:uMbn8WHi2tzxFiK7P3A
- TLSH
  T1D438333E35F6C316CC66913F68F0B623F69CEB3B0EB5B85B9682510861D07A411993E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH
  T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  ZihanSuite.exe
- Size 180.0MB
- SHA256 4a0ddb095f5707650cd8558828972577a6fcaf683eb5811fede4fba5aac60924
- MD5 12ec152df40df7127c5ff94e0f686de8
- SHA1 d8c2281fbd00094696d3f670e73939ca5eeca8bf
- SHA512 adb0c121252e14d7fa502bae4ed7dd45027db80d87f3a46eaecba9b3f4f49d4f5aa185ee642ec4e3f8d0c0016b7199b1d47079054f93fe8dbfbf6352e4a1dee1
- SSDEEP 1572864:pH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:esok+hK7
- TLSH
  T1EE988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
- MD5 e3bdb59b37b730647d4a1e44756a730d
- SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
- SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
- SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
- TLSH
  T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
- MD5 c13e55ae6200e74c0b121cbd5c1d323d
- SHA1 098675729109e19a0b6cbedbbf45398265ab6644
- SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
- SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
- TLSH
  T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
- MD5 a3bf08772053b66ec34701037f120736
- SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
- SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
- SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
- TLSH
  T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app.asar
- Size 250KB
- SHA256 45761ed202c37da6caca9b8db1566a60f0a6b425570dd74e030507e5c564f90f
- MD5 82eeaa2f8c65ff6292d35d8f8f8cba4f
- SHA1 9cacaed2512a7b8e837245991213a8bb571d974f
- SHA512 fe9538187101de6df95798d0a7a530cc60e55f39d5ae966b05321a71841758bc5b32488f970804723d9f9b4357258dc6f01638fb33a7b671600e73aa6af7c030
- SSDEEP 3072:IR9Rf6LCPMUgwJp30msR3dcq6QdqP+ZdlUF7ohP+i3S5SzD0G9egU89BEE54:IVimErwE3dcLQdqP+ZdWdo+i3MKIeXG
- TLSH
  T10A44050137D9A88A13E78BE9125B64C6FDD639AB5C518D4BEC11FF5068F0123EAC39B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/7x.sh
- Size 235B
- SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
- MD5 8a65a1ab93601ddecb93af2a310dd68b
- SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
- SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
- TLSH
  T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral16 behavioral17 behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
- MD5 9fe8a485038be54d687ad7dd9dff80d3
- SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
- SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
- TLSH
  T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm/7za
- Size 983KB
- SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
- MD5 601642dc448c3b398e92ec0d19e447a1
- SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
- SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
- SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
- TLSH
  T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral22
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm64/7za
- Size 1.1MB
- SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
- MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
- SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
- SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
- SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
- TLSH
  T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/ia32/7za
- Size 1.6MB
- SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
- MD5 dba8ad5c0f1a27e9e387817df9ceebbd
- SHA1 33b7ae00c218a250c30588fa134dc9946665147b
- SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
- SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
- TLSH
  T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/7za
- Size 1.4MB
- SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
- MD5 6a2e4039a2f56265369f22ecb1a19fd5
- SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
- SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
- SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
- TLSH
  T146657C43F9B6547DCE9AC775821E9232F678F44906309F37B284EB302A52E60DF69B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
- Size 266B
- SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
- MD5 08025b57ddf3df9bc3e2844d86e4135f
- SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
- SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
- TLSH
  T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32