be8c8f4bd6f7c2b77421fa3a0cbf5d52ff08c3c3c5ca520379110b773d2f12b0

Sharing

Copy URL Twitter E-mail

General

Target
PineLauncherSetup.exe
Size 159.1MB
Sample260811-lmhyqsdf58
SHA256 be8c8f4bd6f7c2b77421fa3a0cbf5d52ff08c3c3c5ca520379110b773d2f12b0
MD5 6210b5534f2909050e2a589bfeb0d453
SHA1 b28d00ed1305db058860e533795c98da4527ccb1
SHA512 37cfa664b04405e7559f4c11fe3ce83e33b3679c917908a6d6185221ab2bc987969ed455a35e7847b36648873c9fe28e81d444c18b2264fb939b1d91ac619132
SSDEEP 3145728:9APYPqkzIavM8+GYEz2smEb7ICPYR89N6k+lAUhJAYexM2KAaXnh1OvHn686vCVN:2P+qq5vSPEb7VPoC3ZUjAYexaAaXh0/b
TLSH
T1908833C38038840FD8F62F3821B718A44F5257A95B4C89D942FB7A7AEB395747B4C4AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  PineLauncherSetup.exe
- Size 159.1MB
- SHA256 be8c8f4bd6f7c2b77421fa3a0cbf5d52ff08c3c3c5ca520379110b773d2f12b0
- MD5 6210b5534f2909050e2a589bfeb0d453
- SHA1 b28d00ed1305db058860e533795c98da4527ccb1
- SHA512 37cfa664b04405e7559f4c11fe3ce83e33b3679c917908a6d6185221ab2bc987969ed455a35e7847b36648873c9fe28e81d444c18b2264fb939b1d91ac619132
- SSDEEP 3145728:9APYPqkzIavM8+GYEz2smEb7ICPYR89N6k+lAUhJAYexM2KAaXnh1OvHn686vCVN:2P+qq5vSPEb7VPoC3ZUjAYexaAaXh0/b
- TLSH
  T1908833C38038840FD8F62F3821B718A44F5257A95B4C89D942FB7A7AEB395747B4C4AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 81.8MB
- SHA256 cc9760bc9438699959c7e2640a73c3d0edfd2d3ef029de859b49b15904098bc9
- MD5 a76d1b6b678319efa3b11ec28320ad74
- SHA1 d115cdea880fd6479f954591ca38128eaa08bb35
- SHA512 08675c74062359dca4e761d0513eaf171ca2f8695ecec0d83d8a7fbccdfc155de948dbad66bc67c3a5dc0e6c444030c802e1e7da6d7f4e6ec8bfb4cf5bb23911
- SSDEEP 1572864:kZy2uBRhDpE9+CVz6xOkzbTt+vUYQJBFMYek9Smz2EXDkaXnh48OvHnw1NW6vCrM:kPYR89N6k+lAUhJAYexM2KAaXnh1OvHk
- TLSH
  T11518334390792017DAFD2A7CA6F208A546670BB5DFCC89CC46FAB6FD5310465B3B80E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Pine Launcher.exe
- Size 201.1MB
- SHA256 dd3b2beaed6bc3d6f84f8f9364cf05152d44830bd998683b5a84dfe65786aff3
- MD5 b2f96a821d74630d38609e1311d9bd14
- SHA1 6799317a9e2632c55d99970dd5a03498b0626863
- SHA512 7f3459693d9c85cb12fd81b713a8dbbbb1720c8e4cfe87e34f39ab532b2fb564838e6e50fc41fdea63f1ac427664356a6d32d059a75e0e76507fec13d2d9ab15
- SSDEEP 1572864:Jti1A6CiLvokEeZ8MvXqwKwG82nVGg9o1QESuVbER3c/L+fkYAOsAiYaxzPfOfV1:qWEswwyfOA
- TLSH
  T179A88B03E29A41D8E05DD1B5975A9633FE71B8094B28A3DF2B5407522F77EE82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral13
- Target
  chrome_100_percent.pak
- Size 112KB
- SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
- MD5 e7bbddff3081eeecf7f56e76ce1d48e4
- SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
- SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
- SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
- TLSH
  T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  chrome_200_percent.pak
- Size 182KB
- SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
- MD5 1e1744b9410d29e7d1ed28c4f67d6317
- SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
- SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
- SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
- TLSH
  T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 d59f53e6c8a0a02003c414ce3ca11f973b31809008f0c94cf3c2559687a5e6c7
- MD5 ecc57b936cb9c9e85b03b51efbd36898
- SHA1 f785440acd292dfb72a6057eb84f9bafd452063b
- SHA512 00a9fecc54b57a16361fff5117e7f9057197a83077eefad72ab6cd026e0b2e30cb65a801fa9848f04d212b3d4122f0563418384807af57b7143a26a9df5ce23a
- SSDEEP 196608:T+kiCf+BWW8fUA4BejnQI180uNJSf4iIJwEMWRsKHvU:T+kNf+BWWyUA4Qjnw6+RsKHv
- TLSH
  T1594729122246D49CF059C878C3678626CA6C34E73FA779EBC0B461252B7BEBC5B39135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 f3705d563d2d8f93a0d497233c01506d5e4ecc66476022588d422d7509694bca
- MD5 34ffa11360b885c0c0af62195b1401b1
- SHA1 2517c2f77c03238f70a27412c63f32f6a148d321
- SHA512 377aa1a5a14796db9ee8b6e2adcb0414e6102262bc5edb6e1a15094ef538a951beb97f517da113df3d0a72eb83854d86818402ea080f7c09352fc73ccb540af4
- SSDEEP 49152:UESTAZFzTxMIP29EeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGH:UDaTSEYht8OnZGNxcO6IhgiS9Nol7Wtu
- TLSH
  T135E5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  icudtl.dat
- Size 10.0MB
- SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
- MD5 4171402e385f07007de57f45ff540e9a
- SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
- SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
- SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
- TLSH
  T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  libEGL.dll
- Size 492KB
- SHA256 df2581628fdc5e9ce1a7faf61e1c685730802e31ef828f2e6eb6aecbfa00b02a
- MD5 995ba006ea8bbac389a3b24ce87cbad8
- SHA1 1966c885195901ac4004d029309863b6b37a8254
- SHA512 03b499a0c2aaf5f4a971d3dc1dc91733a1b7f1edff699646321c4cfb9c138a81dc7f4e644f1a3d7dbdad6cdaf890daa752bbe890530269c68d94dc5ca3351fe5
- SSDEEP 6144:itqwvC8uRreZw/ebZyu5sIAeoZPw1ODZ6R3/8cWqR/H2p5HoSyhg:EqwvC8SrZmNEIsPwa6R3/8cWqt0HoSZ
- TLSH
  T1DFB49D15F3E945A8E06AC4348B534603DA7278560B65FAEF03E092793F37BE45B3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 08888aafcffd55b349e528f9979c335276ad0fd8c6ce92448179f97557c03ea1
- MD5 b3e0d85fece0bfa2068639e909da82fd
- SHA1 d23f86bace9f6b041df8ebcd16b1ddab6bc36f62
- SHA512 9c59f7128b94e5298a4a832508b08ff27b12f9cd2bb464f0fa78a9dc2d0f96258a745446e791306f3d8e47d5a07679f6b14dafca5dbdc77e58be8ed56fa6f3e2
- SSDEEP 49152:PBI3qD4nxsy+ODwZe37bJ2MBnibd9/HCqF4J/vsxXP/6BN+ey8+OjDthQDxkLvb8:bDqE9C0X8r1tjNqXyzXicliyUpLe6
- TLSH
  T116867C03F68581D8D05DE2B8875BA227FA31B8490734B6CF2B9413152F6BBE0A77E754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  locales/en-US.pak
- Size 524KB
- SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
- MD5 bfbb69222dcc50ca860b6a80a3da4f4c
- SHA1 51200c9bd18b0999ba38033662c5e319485e7420
- SHA512 940a2855b5de5f1545abbfed5dad0cfe81e74e847a60f65b4a8df54860649502062ff8941c0fbb248c203fbe6b883ecae8b21e91215b07c1231129a914008a28
- SSDEEP 6144:njtGVh0jMRG0PTMP9QQo94faYQ6TFB+5P2jdnngP8/s1wf:jEVhmOTMCQo9+C5Ojawf
- TLSH
  T160B44C1FF744122A05A352627F0995A2FF32D06CA35112663CBD812C3376B6AD3B77E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources.pak
- Size 6.0MB
- SHA256 40af4117b0bd35da141aa599255b879013bfda5968401feccb5c43cb372cdae6
- MD5 bc041e16180d671ae720a4a799e106ce
- SHA1 b286bbcc059a31c8f44cca7443f88d60a4790737
- SHA512 da141f2e6c2ac36dc924f1c72616db08927fd6277c7d7b12ca97dcf43a1f6ce906d269d6b6d9cf9cd957c432f5374f9be126111e006d88644f5c98ca33309fb5
- SSDEEP 196608:ccLBR5ltjL+WkrYtJ/eGDi/F7MeZFFfD5CcowhJT:cOT5n1krI/7i/BZfD5N1b
- TLSH
  T19D5633B3F760243FC088477942D087755B3C594A2A41A0174AECF265CE6A24F6BC6BBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app-update.yml
- Size 92B
- SHA256 e8f6413f3ff6a6ecf1c500e4f263965c099eee57a0b2776ffa845ce3d2ade595
- MD5 11ff61628bc2137c1a32b2d927208e7d
- SHA1 82974de1c9c60e0ab87d547b17320d355a3faf45
- SHA512 c316fbb794486dcea4aaf553789dd2ddf97f684e4d62461825b22a81022b8835b86e3a803b423d7d419627c8b7288ce64ca9be3b2b04ad4e8e69b4de40a620eb
- TLSH
  T1B7B012118304C63901751958758C193500890471D481042495F55098808641C4E450C9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar
- Size 3.3MB
- SHA256 eefe7f4b68a51e0557ae5d0726daf993fd597d681a0d18f0e6b0c6dcb8647993
- MD5 890681cc57d4361005c79a69ae8b79bf
- SHA1 d0b063b8df061fef7c2762d11ece0264c49f5628
- SHA512 ef6f6fa6e9476cae1d45e517ceaddf3f7a0f5fb036d1f5d61cc241d40551ae54eee42740195d5de7dd5b871c35d68074d3e170e45b61fcf7cf265eb174e92586
- SSDEEP 24576:7bqU0UpfjRvrMP+3eGip0vK66GY3eGCEoSK66GMLcuuUQLsKB7fQyAumS8icH82d:Vp3qp0vb+3aEoSbSLcuurLsWmSNcxt4S
- TLSH
  T125F53B149AF2113217E261AD4E9F54867278A8176048FC597BAFC2881F8C93B51F7BFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32