b73f6a2c757bdd6951cd73578b9baa4f0ae32d2c78cb6b83ec1c2cffd4def191

Sharing

Copy URL Twitter E-mail

General

Target
DX-Light-3.7.21.exe
Size 73.6MB
Sample260810-y56tqsswhy
SHA256 b73f6a2c757bdd6951cd73578b9baa4f0ae32d2c78cb6b83ec1c2cffd4def191
MD5 d02ee4700ed14aa42804ad6dda8c63b7
SHA1 410450e084d514736aad3659b56d99a20218ae66
SHA512 03b8be51231aa168a62d590880382559163ea12fca2d5e67637b9b6023592c6c3697800d018d8fb5d0531c3b181bc0b34f508e9bebc82ea54eda1e5a941c0db8
SSDEEP 1572864:UG5kJoE4EcPO/QcTe/FEd67As/ph6/MTuo3yfYHldq4h:UOE4JO/QcTeOd60shqMaoQYHes
TLSH
T1120833922D782859F9D5CE783385DA1219EE0D00A49E2F4FF90C76C33A3AC59167B67C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DX-Light-3.7.21.exe
- Size 73.6MB
- SHA256 b73f6a2c757bdd6951cd73578b9baa4f0ae32d2c78cb6b83ec1c2cffd4def191
- MD5 d02ee4700ed14aa42804ad6dda8c63b7
- SHA1 410450e084d514736aad3659b56d99a20218ae66
- SHA512 03b8be51231aa168a62d590880382559163ea12fca2d5e67637b9b6023592c6c3697800d018d8fb5d0531c3b181bc0b34f508e9bebc82ea54eda1e5a941c0db8
- SSDEEP 1572864:UG5kJoE4EcPO/QcTe/FEd67As/ph6/MTuo3yfYHldq4h:UOE4JO/QcTeOd60shqMaoQYHes
- TLSH
  T1120833922D782859F9D5CE783385DA1219EE0D00A49E2F4FF90C76C33A3AC59167B67C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 72.9MB
- SHA256 b0b96b2a77e5fa23832cdff8e426fabf3ccf6f4c15dcfc00325dd603c1d7a120
- MD5 8f9b8c728dc6e37532641dbc52ffb6c0
- SHA1 d83901f641b9f3eb9f4ded07a5240b1a6278cf41
- SHA512 15b247c9a9cacbd03df4eacf3a8b4cb7eee800a37dea34e30656a60223b3a80a010f24af02eab2d31fd7a3ef349b2860a1facf31f262074796e262ded54631cb
- SSDEEP 1572864:a5kJoE4EcPO/QcTe/FEd67As/ph6/MTuo3yfYHldqS:CE4JO/QcTeOd60shqMaoQYHeS
- TLSH
  T17FF733E33D582869FAE9CFB8338AD61019E90901E4D3165FD84C7BD7253D8AA164FB4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  DX Light.exe
- Size 150.4MB
- SHA256 f88b6d6d957e06d01ccb9a0add93434f4d93d1c61ed9b0b28fdca0c7eabd103b
- MD5 74ca84482cc6cb655041dd23bcc035e7
- SHA1 26ce94f851b5a0a16d0b5fd616ce960ebc99f420
- SHA512 895f4bc114dcfc42cd59660fd5bc51d726feacc38d63f47acfd968a5b104c34ad3a85b09e92e96178b75dad978f355cbebc3a836f6aaa8d5243f9eb142743664
- SSDEEP 1572864:flAhthKM29V6LLWANUB9IinJn1cpGN4vM+JlhrZnQ9I4FdUrczKrk4ZeUOC2+:UtSD64Jnqrtbv2
- TLSH
  T182788C03E2A610D9E05DD1B5874B8637EE72BC460728B6DF265427562F77FE02B39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  LICENSES.chromium.html
- Size 6.5MB
- SHA256 9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
- MD5 796505037e030807d9ddd01c93eb353b
- SHA1 79a1eac3b505e6d94a6206d4a5198d3cc11ab038
- SHA512 9435273a4541a579a427a295be47af8b81133896f50c97bab1d8ab391089f90186a7fd057b53e8b74829e4747e98428d8b4d242eb6854b1304a94a2891c2fd11
- SSDEEP 24576:8Pjy5WjWSpgDrAV8gmfwN6i6w6C6g6T+gH3BMbp0W:oJDN
- TLSH
  T19866942F7B48037306C602A2AB8BA5CBF21B903F3B565654345CD1681F6BE2543FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- MD5 cb9807f6cf55ad799e920b7e0f97df99
- SHA1 bb76012ded5acd103adad49436612d073d159b29
- SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
- TLSH
  T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559
- MD5 00ffabbb9438a0da15a021451a9c2d0d
- SHA1 4bb79fe2b09962c6c46b70d7dfb1f9d9604a22dc
- SHA512 989d8d0afd3ce64c65a90d1046f28b19e5b125f8b5a565b76b8c950d152d3b9a57d68126888321c7cd8a4985249c1ec649c453e7501aaa4ff60d9662afd85f34
- SSDEEP 49152:cqMAAYNDEmcTfAZMHkwfPYX6Edxhi1uGaVrFY7Q9b5hpN3lzl3hHLNoJX:cGDfRMHR8rFYU5hNA
- TLSH
  T1C2D5AE07F6D600E9D01DC574879F9233F631384A4B24A5EB1A91AA242F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  libEGL.dll
- Size 473KB
- SHA256 85f238fb7ace3cbdf7c29c72b01307c440f13491b07a509cbc5b9f257a637164
- MD5 ef4291ace01485ee773183ee3c1ed5c4
- SHA1 9c9d32813a733ebceb25c0dbb9f85ef27f6e0a0f
- SHA512 a98bfe1845a712943687f0b20d1904bae1b6836ea37f8a2053872f938dceb2f391fadd3db034c0b8563c0b1ab3d4506d13b613ed51780ef10e813c085c830f82
- SSDEEP 6144:VTv0fq4dz9B4x4w/jvtGW9ZST3BypG48yOnb4pgsHVlAYnReZRO8:VTN4dNw/jvtGW9c3BypaagYnKRO
- TLSH
  T10FA47C11779954A8D03AC434CA134612EA76B8960F35FADF02A4D27D2F77BF85B3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  libGLESv2.dll
- Size 7.2MB
- SHA256 25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
- MD5 60e42e83b260582fc96aaf43293d99e1
- SHA1 c548a10873f9a57e18c7fbb1fe89685f4cf1ba84
- SHA512 6a905e2b9427fb6e4a53080afdc2ae9dc32c54aab5460f88f7d3fd16e7e9a841d332057f58942d54defe91361a54d3cbedba295399cead754f353f80f92f238b
- SSDEEP 49152:Rs95E5fqF3q/xEpLJgw7yQj1+lSWsucneTA4fwEmN428bbvbgNqay6q/iyGtxJe5:2lq3ZieHhogDbBztUecv7r7frgsOMG
- TLSH
  T179766B07E6A581E9C05ED2B88B5B9222FD30BC4A4734B2DF266437112F77BE06B79750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/win32-ia32/node.napi.node
- Size 175KB
- SHA256 df91e6a6764481b58c95f07a7f81193ae4f99877d1e3da26a05f99664b2f2b23
- MD5 419592c27ce0f6fa145bd380461b9e9b
- SHA1 486426243606d1dd4e0205ff74ad49529f6e716a
- SHA512 78a0536db2ee219e9ba4c688923520cdba438f3318035f583daad931c9918fdaed23e541879b87647cb7460ae6371757d148f7367b847c2d7961ff7272fa3b23
- SSDEEP 3072:8wrdwjhJOzx/eHEfq+0oIvuyvwNfds0ETKn0M7WOzfKPSzr74Wvq:7ZeHcq+iv5voFoTeJeSz/rvq
- TLSH
  T1F6048D11B280C23BD66F1634112D9773593DA8300FA1B9CB9B9A1EBD5E742C39739B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/win32-x64/node.napi.node
- Size 224KB
- SHA256 2d5d112e2e57054034fa9454e9c33dc306377455d989644f7d4c1b43027eb006
- MD5 05a55ec538c75c3210a86bf8b1eb5ecf
- SHA1 bf35e20173d7f2cbb6bcb14d299cf10d9091c203
- SHA512 43e6423e1a7f7da4816271bdf55439f59b375db24c26f71e0fb0512133585620295ae5e1d5222adda1a087011281438b51ecf27a7fb50ddd3a879e70db6d0c86
- SSDEEP 3072:3atD8NJGcBG67Im/oza9hco0gyy1B23r699WyBg3IwIVEiLlaL+BVS:KCJGh67N/oza9hbyy1kM9TBg8hy+bS
- TLSH
  T1EF247C49A2A40DF9EDB7C13989C3DA02E672BC504370DBDF136046569F277E2A93BB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/@warren-robobloq/quiklight/lib/binding/quiklight.node
- Size 301KB
- SHA256 169cef7996649a6481bb93cc41db02b8574b0ce4b3a1f4b74549c9ccc0211e37
- MD5 2cd7fd1b75ee95c15cc283c810ad803d
- SHA1 775291e0223d54c9e27b0c418d4708ddafde1d7e
- SHA512 94aef3787a0034e2c627d26fad6871b96eef17dffee2a43e195c021df7c85d7d59fd1a27ae45775c49ad4a7351647d615a211d7eb592e8bb27ec1c5ef47400fc
- SSDEEP 3072:JBWXOOLi3GJOp6ZOI7kbo0SYN0mfC3pyjBqyR6rPgDhQPWSn0Vz39cwsVcIU0BoG:JBJeO80SYimq3m42hHS0V1lsZPBF
- TLSH
  T194646C16F3A510B9E277857CC9534902EBF27C5647B0E6CF03A04A9A2F237E1563E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/@warren-robobloq/usb/prebuilds/android-arm/node.napi.armv7.node
- Size 259KB
- SHA256 cdc351468846e4c03205694d09c09ba4a8d6cc20ca58e9138d1505db82615270
- MD5 cd2c875f9c1745918a70498a8f988e7d
- SHA1 28827d90a28e509aed516bd26e8e7032dcd072dc
- SHA512 94ecdc6b19fbb9f0c459c6f4afe1d14ccfe6dd0c8e6973886971a771db85835b4d8b4a49be030fdf49d110d532480d94c69ee709852a039dd5d530a4f7f4c079
- SSDEEP 6144:IxFK4EC3xuUwyqFzylBuKky9bLwU7cTAC3kn8:IH3xuUwyqFzynuKZppYj
- TLSH
  T19244E75FF895DA02C4E5257BB55AC1A83257A2B482DD73028F07CE383CEB5CF0936686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  resources/app.asar.unpacked/node_modules/@warren-robobloq/usb/prebuilds/android-arm64/node.napi.armv8.node
- Size 291KB
- SHA256 1f4f296237737fa01cf31790ec1bb0948c7f32015ef3b9ab90e1f3090786c011
- MD5 e07bf8a9220d1a8c148f4c09b947e6b6
- SHA1 77d749c32537ed3aa59db49458500e4c4381d0dd
- SHA512 54813e32ec752574ec8124528a384c938b24de23f4e8d78d00f6a162bab9b036260fe413580b70505007203432a9a451e46bc71c97bea96c5eac813512a2cccc
- SSDEEP 6144:+3gFKGYQrH5vGAAI7UHXsOGs89wjrCijmu7:+3oyI7UHisz1f
- TLSH
  T161544C06FA6CAC33C58AB0BE4E464BD2F12374B14714C3FD6F16454EBE6A2C6E505B92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32