f3897e43ee77ccdd6482b426ff977e5f20e66beeb87f904a0f320a23a0ad5f4a

Sharing

Copy URL Twitter E-mail

General

Target
Git_Set-Up.exe
Size 64.5MB
Sample260811-t7264stwaz
SHA256 f3897e43ee77ccdd6482b426ff977e5f20e66beeb87f904a0f320a23a0ad5f4a
MD5 e13cb6a6f44eca0741f3aab38a12a111
SHA1 5d2996763f0a73f5551e6741baf934833ca6fb24
SHA512 e12a961c31ae1ad8ce14fdffc3150f4d70f6f5afc3b3901fe47ec7aa75aaf027501cd35686f4828c2a85f5eaed99274f2fb8a1fc287c687cc05f8de292b060f3
SSDEEP 1572864:WLdk+P1fNGUfvL14kmbNHRh34AGXbgWbKLJvCL9lfQ:W2KnG8v54hXh34hXq0L9lfQ
TLSH
T11BE733D7E715C314C2034A756AB3B7CC7344AEE4869282B3289DBD5EF05C662188A77F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Git_Set-Up.exe
- Size 64.5MB
- SHA256 f3897e43ee77ccdd6482b426ff977e5f20e66beeb87f904a0f320a23a0ad5f4a
- MD5 e13cb6a6f44eca0741f3aab38a12a111
- SHA1 5d2996763f0a73f5551e6741baf934833ca6fb24
- SHA512 e12a961c31ae1ad8ce14fdffc3150f4d70f6f5afc3b3901fe47ec7aa75aaf027501cd35686f4828c2a85f5eaed99274f2fb8a1fc287c687cc05f8de292b060f3
- SSDEEP 1572864:WLdk+P1fNGUfvL14kmbNHRh34AGXbgWbKLJvCL9lfQ:W2KnG8v54hXh34hXq0L9lfQ
- TLSH
  T11BE733D7E715C314C2034A756AB3B7CC7344AEE4869282B3289DBD5EF05C662188A77F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  chrome_100_percent.pak
- Size 150KB
- SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
- MD5 b1bccf31fa5710207026d373edd96161
- SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
- SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
- SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
- TLSH
  T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  chrome_200_percent.pak
- Size 229KB
- SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
- MD5 e02160c24b8077b36ff06dc05a9df057
- SHA1 fc722e071ce9caf52ad9a463c90fc2319aa6c790
- SHA512 1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e
- SSDEEP 6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
- TLSH
  T1A734F1D763F89D3DC9674AB3522601F1ECB2013946B6424B03DBED357A96BC988C92C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
- MD5 74bded81ce10a426df54da39cfa132ff
- SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
- SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
- SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
- TLSH
  T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  locales/af.pak
- Size 478KB
- SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
- MD5 2602cd68ebe25f12f5d9892d5fa92b11
- SHA1 478766dcc8ce4427872bebd81ad929f7aef250a3
- SHA512 6bbecbeaa6e09857a5698a280475496498a88488249025b2f58ca7a8493a77bc13fcd783041a6198f58696f4e2a84c3dbee0891e89800dac6f3fb317f70c5492
- SSDEEP 12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
- TLSH
  T1CFA43C06EB84273D09A07696BA0845F7FF9CA26CD770B2B6DD9D823509A6EFC017D0D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  locales/en-GB.pak
- Size 436KB
- SHA256 ad460425c88be889d6d6a9b69d0b6f64e2e957bf8ac4f230de4d25340c75ba87
- MD5 413e4484b8aa83bf7d928af143340dd9
- SHA1 92b8dc474fd507f28c51b34014fe9f867af25531
- SHA512 e8ab41ca706d8a49b4a411fb9f50bf1c04627dab452a7aec01a5c61e4951fde42fc05163cbd193f034bfee378849353db9ad4b8a2db3f992df105df17bb146e0
- SSDEEP 6144:hR4GWUMzWjLCI7MP9ej7HXfaYISMv5n51SKBcWRnpM:UEh7Ma7H6N51SOM
- TLSH
  T12E943C1FF784226A069311727B09A6A2FF26D06CB35112567CBD802C33B6756C37B7E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  locales/en-US.pak
- Size 440KB
- SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
- MD5 8f164155d22029535cd60f47966a89af
- SHA1 19733935efe68f7ff3e2a84d28317e0391eb824b
- SHA512 4582715817bb9c99d875aa89b1efbd0f70b63dcd37dbfc64e3078d1d4d7ad4ae8fac5a703afe1fc65b9af2f5c0fe8d3e293e2f0530106a6974b38b4cebca9db0
- SSDEEP 6144:UVmES/piH64PrXGM0w3jMMP9eD3D9faYLbcNx54SbngP/eoQwB:Umz14XRlMMY3DzA54S+QwB
- TLSH
  T10CA45C1FF744222A069352627F09A5A2FF36D06CA35112563CBD812C33B7B66C3776E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  locales/es-419.pak
- Size 530KB
- SHA256 06d13ffc791bb7189f5afbb166b1dc2bcf9309f04b68e4f16baacd4b3f625021
- MD5 6e7eee3c0d7935b4b72fb529227413d8
- SHA1 64643ba51edca0c0387073716d68380df5e2dc7c
- SHA512 f55a55d9f23463a51f48bd16debcc6fca28eec4cefbb3006083e741795edd9a9efb8d1126210f4a35558bc698c8a76a43e9e56093a90145137a7854b4a2e44f8
- SSDEEP 6144:BJoGuBgJYXqY+clpuYsKBoj5z6gLFdUu2bR:BJqGiqQpPU5z62F/oR
- TLSH
  T104C4F922BAC81F5310E2A389B783D753E4D89545B408C29BE8EB876552CCF8CC977ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  locales/uk.pak
- Size 896KB
- SHA256 ef7ffd8792b482829f31924241e6bd12dccdfdf404a0781bb28747c308649c0a
- MD5 bc19ed011123ce8ce343ba2be9daa315
- SHA1 d588df92475bb650d1e2bfc15e558315e90c9425
- SHA512 6b0960807f27c7653e7d851d503f5564f773c9e4290d4745566a0c3911cc0ef12e90f47de883c541129ad7d294a766f226dc689aa343a00ad72049bf3d5c3713
- SSDEEP 12288:/T0LytA6d8Nj7RMRWYPnfzKj0meRi8ICN5rB3IjtAlLEpdcuPLNiXEqqbQS0w:/Ys8Njtgz55E5
- TLSH
  T1C115A9A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  locales/zh-CN.pak
- Size 447KB
- SHA256 374aed2859320a7287b64a8d1b150f7de05a931be3603a541b68ddd64ea361b1
- MD5 6af4d1577c142b87dabd3262f37634c8
- SHA1 1b6152757b163455e9e1304e1ba1c09dd6593385
- SHA512 7f0a6cf88634e852b0e3e3b6b8a0c703602f3f606b8b34183d129f55ea2ce120e1c4d2ee2820fe027f025d422ebd0dffe5f696303c1306f717129985cc0ef826
- SSDEEP 6144:nRAwX0s66VXNN5zu+E7/56aO/epD659+qjNFEwYHB07ulz:nRA3s6OXNzzt856aO/w65McNFEwmB/
- TLSH
  T117A47EA951ECBCEC044640D03729627D7C40B60BF667AF766DD248ED2BA2F9D0717A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/zh-TW.pak
- Size 442KB
- SHA256 d2c4aec734bc94fbe7d60666343b4e419be5e2cd1ff445a8bbf14fb4b8d3d715
- MD5 d6800784f1138702e4973cc5b074fe6c
- SHA1 a8938ced7fe5a35163c28214eadd96a6f63a8666
- SHA512 3ad3557908e4ba71a5062ab0be07832d553e6a3bd56bdd59a719df65a4d9152950af2de25c6c410b6407463a862c92d49e9d0ee863bef27a792aa128458fc7e7
- SSDEEP 6144:1K2A4c8ADmJUHGF2tuDasg5V5gjkzBMOZQyZV7zeXTA:8Z8Ahwasg5V5gjkzpr/7/
- TLSH
  T15AA47DA608FFDAEF0A01F884B7CD562E7C8B746CDD373736FC991C982D6AA540A51049
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources.pak
- Size 5.0MB
- SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
- MD5 54790975c932460ffa375cd0f0f8fff0
- SHA1 05b72ff82abb8ddac1a92471f765b87b7ff1e9fd
- SHA512 d74627207caa35602e68ad6c08a0ebf55fe062e191a1885eb38226755d382dd3407dea883e4337c5cff23c1f724d64e5598edf7a5ce93d4cc1ea6ea10c41aa0e
- SSDEEP 98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
- TLSH
  T1103633C77AB4443EE905633B401D4B752F29F2C61B612036705CB59DBF3A6ACAE9407E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar
- Size 164KB
- SHA256 422fc69afa07922ee7fb55101ba780a70ed3d1c40d695c21eec0ad922a123925
- MD5 9ea7b69b071c5f266fb4c7016f833969
- SHA1 d41ca36736e54ba94bfd55607a3834a58d39aa71
- SHA512 2a9b02317dd8ed90733be8a9c5e38b7f67a5c3a575592d4f75e27f45d985108e702525a99458392dbca5698bbfdcdab567c10e51c445985bab3f53bfa22296c7
- SSDEEP 3072:+sgGxs0RMq7f6/NpSmaYs+C5f+Xr7e63BsSCMZh/PW3N9fm0FL:+5cTMqWlaRTMXr7eZSCC3ON9fm6L
- TLSH
  T1CDF33A45B6C06550634B0FB7372BB0E1E56E2C9F3448489AF698BC68FF91211FAF1A35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  snapshot_blob.bin
- Size 299KB
- SHA256 c1da41052abe31791ae90a9dbe54442a641e1ecbb018ef35c44e7aed05b8f72e
- MD5 aedd1b80a8140b94c00db3c0b9485772
- SHA1 2dc8444e599438ed37a31ebfe7f8859af7fac631
- SHA512 3e06cb550f46285d8dc81d1f082732c07e9c9d81abe931e859262c7ba699d4eb9737581f5a5c5174e09bb0fc0561a9de46298714ced38f453f922f9536c67d0c
- SSDEEP 3072:ogusbBDoCIdRSt25iD1Z3yAcCLi9wfuwWMvDdkbMzaQ:ogus9oCM9OUYffnWYWbIF
- TLSH
  T107548746F646EA07C53435738CFFB5996924B8E96F164B0B3748933D7CBA2293B0214E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  v8_context_snapshot.bin
- Size 663KB
- SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
- MD5 0c259ecbb12e6f3f0e076e6200221489
- SHA1 3de53dcafdce24c151dd1812769b46acea77c90c
- SHA512 6ef39ee8b7d40c5e6c0e79f8c4e846d431a6a87711d025122e2e7f060c5754fff917771d5ede6adec3be909fb5ce0e8eb1df5e18142ecdb6339bdde8ce2c8398
- SSDEEP 6144:m/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPbIgTtLAkW/cB2Z0JZkQXEzBO+lZ:myMSZu/Bg90BuCzIP/+2ZGZazJlZ
- TLSH
  T191E46F53F749EE03C66939B389FAE9517674B8C8AF06471B7798533E3A3A3252E0005D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH
  T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32