88d44a82b73c7001250459df8e6d748f8bdfdf553af9c335ba93c8f2dfb6533a

Sharing

Copy URL Twitter E-mail

General

Target
Debug كرت فسشضي.rar
Size 4.4MB
Sample260812-dcrtwstygx
SHA256 88d44a82b73c7001250459df8e6d748f8bdfdf553af9c335ba93c8f2dfb6533a
MD5 fe8e1e4da3b6a3595e07bcaaaa7401be
SHA1 8681c070f3f44112783f412e5423db1ab67d4b7f
SHA512 a2999999ea12420aaceda807b2006b0ee1fdd4b35dd059fae9dce0d65846eb16da47a949d735861b1c743ad497b129294e4049068fa7bfbe1457d001f06c5f47
SSDEEP 98304:fpbggF52j796Bk6gJki+coUxtKLFOZD+Mbqn9Lc5OXLlFwAUQ4raHK:hbgW52j7wG6gJkjvUuJM6saLlRKOK
TLSH
T139263301622F1D8DA3DD2279D2CFA5EB311B7EC4E09AE8D05707FD92DD86A9CCA584C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Debug كرت فسشضي.rar
- Size 4.4MB
- SHA256 88d44a82b73c7001250459df8e6d748f8bdfdf553af9c335ba93c8f2dfb6533a
- MD5 fe8e1e4da3b6a3595e07bcaaaa7401be
- SHA1 8681c070f3f44112783f412e5423db1ab67d4b7f
- SHA512 a2999999ea12420aaceda807b2006b0ee1fdd4b35dd059fae9dce0d65846eb16da47a949d735861b1c743ad497b129294e4049068fa7bfbe1457d001f06c5f47
- SSDEEP 98304:fpbggF52j796Bk6gJki+coUxtKLFOZD+Mbqn9Lc5OXLlFwAUQ4raHK:hbgW52j7wG6gJkjvUuJM6saLlRKOK
- TLSH
  T139263301622F1D8DA3DD2279D2CFA5EB311B7EC4E09AE8D05707FD92DD86A9CCA584C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Debug كرت فضي/Debug (2)/Debug/EAX Console.exe.config
- Size 189B
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- TLSH
  T17CC080454054BD274D334B1357518539EFB073A36424140CF42FA7560F3114D4657377
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Debug كرت فضي/Debug (2)/Debug/EAX Console.pdb
- Size 161KB
- SHA256 7203a8d8f03200e481a81514e096460b44c4a42d82ab044be802275766a06815
- MD5 683def7b1d2319ee8fc29f836f3070e4
- SHA1 32d726e675c40ee518e29ffe3c36cba2b9ffa936
- SHA512 62bb5fab975b9c98f3475a53bc47f8deec6bd9ad27d8cdd280ad59f3af68f2a076e250291a171dffcdeb6e29e102defedb5711fb254d291cb0181cb837225196
- SSDEEP 1536:ZcnQAF0t7LGn3Lc8Qau/NGlC6drjIU/EFSUubmzYM/jO:nAuG3w8CQ3JAQZEO
- TLSH
  T11EF373A77720C173C44482F64DF3AF740324EE91AB82C7CB6799A19C6DE27925F86361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Debug كرت فضي/Debug (2)/Debug/Guna.UI2.dll
- Size 2.1MB
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH
  T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Debug كرت فضي/Debug (2)/Debug/Melanchall.DryWetMidi.dll
- Size 778KB
- SHA256 ad4ac36ecd26a0dd9c79ed0fadd6a9a18fcbdef0032af22f083e9430e1c84e87
- MD5 ed0dc7a819ba3e72503409b1bc3f7b66
- SHA1 9e2ead3d137005dd19573f2695657eff3015bbf0
- SHA512 b4709a51d7da713f1ae0828664f9dd622ad6f8740d0d0c9872f3ab54a9bd61d01fb7c9bdd1b24f012880f16e86034f2d0926c02c73276ddb1ac55ea5643db9f0
- SSDEEP 12288:vwUNlhmD+rq4sdOuxyuD63PdQAdPYfFRvBR:vwUM+GC1uWPdG3BR
- TLSH
  T19B05591237EC8E3BC6AF163BD570129963F0E846B393EB4B2314A6995D96B425C403F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Debug كرت فضي/Debug (2)/Debug/Melanchall.DryWetMidi.xml
- Size 2.1MB
- SHA256 f2da1cb18492541cf59455162ce2bdfdba18a98d7a0a8089c5912b6a1ff08446
- MD5 89a8c4eac38d71c3d2e033b98f8ce1a7
- SHA1 d7fa6faddc8d55817c8423dd901a32ad38cbcae0
- SHA512 e40391cc737da6c037ffd7d419c93890006fcd4634705abb92bf3f5ddca5e21e3b6626729bf5cf8361d4ad9b295e813c8db6ff1909c14c83c0bd3c3a044b54e9
- SSDEEP 6144:TrmzbvjQGhekYjTq++Omo0CcqkY8WO0+S4OgC8Wtt57uwqOC+gaOwgUaAW2uPecb:TA9bNF
- TLSH
  T164A52134B2D04A170AB702971D2BF484FE720663648D186971AC5F6B3F7AC935AFBC61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  Debug كرت فضي/Debug (2)/Debug/Melanchall_DryWetMidi_Native32.dll
- Size 56KB
- SHA256 080346c638e219ec7cd4748e370e5e11931ed3a228c17f76d84c4d10ba9c9e6f
- MD5 1b976d18b403ffb7d670b17a871bbfd4
- SHA1 7e2022b1833f8ad6c4f4cc643d7068e013107ebd
- SHA512 1b676ca71cba6ed2fc9952e46038eb891217a7960d7aa10b37dcb0f6230e30ab2e62d1e36faf7c783785c7874173dd29ab947e8bcd4be8c36cec7277a2340692
- SSDEEP 384:ikfQAw+aLuu4N5ljtm8Xy9kjwJFP9TNaZFjnUmWw6w+e5XchXSvWZdTc2xv1Awo6:hft9RBi9kcfPmZFjHP5cJPDHthH
- TLSH
  T18343A890BE844C9AE411B37854E5C167B63CB9D5C6031F0766286F35AB23BC13EDA27E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Debug كرت فضي/Debug (2)/Debug/Melanchall_DryWetMidi_Native64.dll
- Size 65KB
- SHA256 80ca89af931e43642a125ec82e253d9bd7002088d000daba6e0661cdad89f5aa
- MD5 5326dfc6840947388f19f474c28e8c55
- SHA1 81afe328f00c500a7138c16c2a0ef200e2a122e4
- SHA512 4c0a1385438f26c1633c58c5e57f0f94ce704d8da52ec16f6111d2347e69cf8c0a3bdf9a4e737794110c02108ed70a4b65dec0ef67fca16d9103647e65a7ac5c
- SSDEEP 768:STukqEi0unSZFjZe7+zZj2WuLGIC1FyOJJnD19UkG3JSTEUb:G3dun+jZeyYaIC1drGoTEUb
- TLSH
  T1636350E12FD44C9BE925A23C52E6C232353CB9E447534B07963469321F13EC17EE9A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Debug كرت فضي/Debug (2)/Debug/Melanchall_DryWetMidi_Native64.dylib
- Size 88KB
- SHA256 aa08c542e77b045fa1e00d4feab21080ceb415c4b6c343b0dbc5704d1fb02f92
- MD5 a51c6118f789a4f373ab25d98fab2988
- SHA1 80eafcd0d5806bb6bc40600d418206b78f4240a4
- SHA512 333a70512c919ec4119e9ce30364ad5380655f9105c60fdde4a29de600d54985bee73b02f498cd9a90d0ded58d9ea4d9eb1ba76f1879b595760d6b5174b2f647
- SSDEEP 384:OwUiZX3J6yvvnVDytNa2ZHS60LuoM5W/pFA6Uxf9pVtjN/gDtgd/OC5zgtDH23Zh:Owd3CBUuL5WafVQ99W3PQdLj0
- TLSH
  T14E93F9E36BC8561CC58B62B4C85101E2F435F81613E6461EF3DCAFA5EC197C82646EAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Debug كرت فضي/Debug (2)/Debug/VoicemeeterRemote.dll
- Size 156KB
- SHA256 5d85a8e00c714a707a65671936fb49611f4e7751a9065c618804ed5ca47872cb
- MD5 79b4ef6b17d0a8bb825437773c1d8e3f
- SHA1 255fbeb8ad45faad93afeac2afa2cb7e7d78d079
- SHA512 0c76b45b3c311f34de0087755d63e7966edf24ad77360897475854ff66421ce55e93f35a78ea10f15cce8ccc505618d12dd6114eabc89b73a1e468f5b16799f9
- SSDEEP 3072:+cvA+X1yaikOLqMvbJl1rvVygoP5UG7GjSVX:PYH1rtyrQjS5
- TLSH
  T1E6F3AF1376D240F6D5813EBD14E7373BEF3AAA5648668E438B98DD521C31352BB2620F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  Debug كرت فضي/Debug (2)/Debug/VoicemeeterRemote64.dll
- Size 188KB
- SHA256 6c108f99c955ec963702dba37739d70c31c9ce4d77758b312c0233a1f435f4fb
- MD5 b16e2603eeee1099dfe97ecf987a1319
- SHA1 a4229d70f8471d2bf7df79c5d7b426aa0bb60b94
- SHA512 3c27ae44a7d9bd88c169721a963924901abecf30537582e44f9610054e19bb8cb6bed18fadf40d71391af84d327227ba9dac2785650dd4b664eef18659fee839
- SSDEEP 3072:aR8mc+AKYjdhTzhTq4UeT/AS5IGFM4W1CgmgReNA9KHVL:aRVXA/zhTWeT/AS5L6tTKAEHx
- TLSH
  T190149D8A329010FAE85B9238C9E76656FB73B45313755BCF166483761F173E22A3B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  Debug كرت فضي/Debug (2)/Debug/hand.txt
- Size 26B
- SHA256 aae4720fb818e25b0ae7bcd1bd3761730ed9c67a308b416805897ee13aae1733
- MD5 72dae589b0cd2214ff2a78d981b02427
- SHA1 89fffc23e5d5b13b5cdaec82ba442802264382c7
- SHA512 22169d8657d9c333ce9c33ab55e3e7b839e602c0b7f76b87791267003df2b40a758de2868bc2d8485c35a5a20b14510ecf62837743914c64fee5e3be7989dd25
- MD5 SHA1 SHA512
Score

1^/10
behavioral22 behavioral23
- Target
  Debug كرت فضي/Debug (2)/Debug/siledr.bmp
- Size 1KB
- SHA256 bae61b36c730e5d091ee74db10d530404b0399784a2b97d49cdd5dacfeaf24d8
- MD5 6428af1cb7c2f936153aa7a0650f76a6
- SHA1 bd5b24d5e04459afdb02b508da1e724604e47158
- SHA512 f6010b587ab6d71efb5599d81b5d2297c33d79da5a3cd32b39551eebbb19d9c1ebadac603c1aaa9a740579dd99871875e698ef8cdcbe166d8dad65747c872621
- TLSH
  T1F42105D2B77CD71BCDC150B1D614D3365555B50EC00794B3D638695CE48D34847472F4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  Debug كرت فضي/Debug (2)/Debug/siledr.png
- Size 256B
- SHA256 5ce19c025eb7e6dbab9566f9b53d4470afe0120f1ae1014b5a7f42b92dbbf5bf
- MD5 f0a15afc62b0669cbd33f435e6c3d46b
- SHA1 349ea4ae02c74d0c3fbc7bed62a830838fa7661d
- SHA512 c10d550f3c67667c320c2eb1130234c782243c48da8f554b5b921facba7e632350666ba03ed1f659435d4e3d6eefdd55fbf167251034000bca7de3c8767dd6f6
- TLSH
  T160D02B854B83ADCCCBC8003F36660420D057127B159880497FE8C21185AA95C4241712
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  Debug كرت فضي/Debug (2)/Debug/سش.exe
- Size 4.0MB
- SHA256 967c0585dd0aa756ce76ee84bd9675a4f51326655037c023fb2eb8ac87f12a93
- MD5 e4101132b5ce30569eef31cc426af12d
- SHA1 e1be335efe21c45be49b352ba2703c1a736a2481
- SHA512 112e068eb7d6225c26584f8661adc51861844a665c4bcd5e9c7367d04722e61c97e671dfe3526ad15f1a1c443808dbf698d73e98b1c74f94034ca159a6f7c7d6
- SSDEEP 49152:8oHa0o5IZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZAl7cRNgdr9YGt:GPl7cMEGwdbPqFtPaGC+S+6Y5OiH
- TLSH
  T1D516CEC16F8EF692E61771E02A2E2EF0A7D02D3587D91736335FF9A26A71071205AD31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral28 behavioral29