01022dba96ebdce7cb7e3316383af447e76dc8ae93d9c6bf36b742efe9688292

Sharing

Copy URL Twitter E-mail

General

Target
stats.cc-installer.exe
Size 82.4MB
Sample260812-knh5fszthy
SHA256 01022dba96ebdce7cb7e3316383af447e76dc8ae93d9c6bf36b742efe9688292
MD5 366afc8f53a71aeb6bcfc6533b701016
SHA1 798bfde2a03811174224902410858ca0f3b5a62c
SHA512 cb595355960438bd2d324505aec227de478ea5bf738a6a49f5183d82ddb971da87f801ae84a61081449ae76657507636199cfc66b0e4e7b853358bdc52179f35
SSDEEP 1572864:rG2/RlgypLijMHV6oEV9g9f0hZNZZtCXjNOFYoTq2Jh+Rr0:rpjijKtGg9shZNtCXQXTq2s4
TLSH
T170183352A7A8C6AFE5218D300814FB3E52FC9C6B1A671E26110BB9EDFD3C518193B35D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  stats.cc-installer.exe
- Size 82.4MB
- SHA256 01022dba96ebdce7cb7e3316383af447e76dc8ae93d9c6bf36b742efe9688292
- MD5 366afc8f53a71aeb6bcfc6533b701016
- SHA1 798bfde2a03811174224902410858ca0f3b5a62c
- SHA512 cb595355960438bd2d324505aec227de478ea5bf738a6a49f5183d82ddb971da87f801ae84a61081449ae76657507636199cfc66b0e4e7b853358bdc52179f35
- SSDEEP 1572864:rG2/RlgypLijMHV6oEV9g9f0hZNZZtCXjNOFYoTq2Jh+Rr0:rpjijKtGg9shZNtCXQXTq2s4
- TLSH
  T170183352A7A8C6AFE5218D300814FB3E52FC9C6B1A671E26110BB9EDFD3C518193B35D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 84eba87e0ac3a3b3bb09a1fc184823af3d5bed105aaa4894d223fa863b7ec935
- MD5 2849a7df7b605383b20ec1af7c806bfb
- SHA1 c81cf8713bfe89760f35fc4c9ebd31d721839e85
- SHA512 c4edb0a4b28e6742b70b26246588f044ce874fa719b35bfad0a8971bc2a7ef8a47450f8e91f8184da328f808ced3892f1eb68670f1fd5c9bd502cbf0afda92bd
- SSDEEP 24576:s89dQ06p6h6j5LwRCXjYmfT6k6mjK64jK6gjK6e6cjK6feGjl68pq:7peGo
- TLSH
  T12A96A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 8d1639ee1be7b4cf8b99afbc0dda4167e67029d016c4514410e0cee0ab0ade1c
- MD5 d75a391fd7ffe0c9a486622bf88c5a0f
- SHA1 2e4a213293ebc442d3481021bde34e156f275925
- SHA512 6fdaf85cc5d94e1a146b3edf0e29e2933ac27e46fd732b580dd1e915c6fabeab3975f0c9b30ac54237b3da816cfc67c14153a1976f762e22447e41fd51125726
- SSDEEP 49152:LCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNW:SG2QCwmHjnog/pzHAo/Ayz
- TLSH
  T17B367C5673E640B9C1ABD178CE879213EBB17814033457EB4190C669AF73BE26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 256400ecf84c97824493becea95888af70ab1f2dd2747354d24b2c2308b90b51
- MD5 10e5a82c3e524390e365c41628baf404
- SHA1 2d4a35b453b97af7b5b6fa1ce92fbbba93224780
- SHA512 e95b17524a95e15ceff7290f53bb64121da1e30245e4349fe781d13996cda487db152f70dcb42f8e1924734ad084e8be4cd24d268d498718b13ebb70c4e8a953
- SSDEEP 49152:cm0Lk2gYTI6yD7UIwUzNGH6qflRvVI/fighoiX:cmqk2gYU73UIwUzYAfiziX
- TLSH
  T101D5AD03F6CA50D9D029C475979F9223F671344A8F1166EF26E05A202F67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libEGL.dll
- Size 504KB
- SHA256 d07fa3eb9daca2b6cec748f26c6ddf0360a5d3f02b3f93d8e84e7920d14a381d
- MD5 3330ee5835b4d21789eb988f59250cfb
- SHA1 1a9083383dbbd3901710824449668675f0a98a52
- SHA512 0bec1313f3de715841e1fb4d05ec70d8f737c9343c9c40da5a1e9fd37cec2f0643dc271dbbfcbf0ec2c6d2453368bdf769b8710f019da60008db806d2677c89c
- SSDEEP 6144:vn3fGC/pwYCMYkVTfrSRiNZjShRRr8RKiAoDznikVEBij7Ek+yAd/UT/Rx:/P/nYkVTfrsiNZj0ehHznikVEBcxT/Rx
- TLSH
  T157B49E15B7E444A8E06AD434CA534602DF76B4920F69FBDF02E492792F77BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libGLESv2.dll
- Size 8.1MB
- SHA256 91218528bf93522d9bec3ffc33ccb67ec44287f46e59b547f3fe8bb776a07f29
- MD5 af892d7667b8f9b6cf811c8c2ea43691
- SHA1 bd8053b13233da2da4011d9d80ef854b7b4a6a5e
- SHA512 e097962e793cfd2f06b2907420105a0d493edf43b8751814b7ca7c139a347a2850af0fd6e65f7cb0ae34b27fc18c6c4ec8cce32f510799191d1f6fa4cd679218
- SSDEEP 49152:4AmfHML+M8jvS99Xfpcaa4yZBnrjUyTrMRvQqihTvFmNG+PV2OL1W2MGTNwedrcS:qjqz84NihTt4c6LwZFBljlJX431deS7
- TLSH
  T177867C03F69580D9D04DE2B8975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/elevate.exe
- Size 127KB
- SHA256 17a48de6d296a172be02d55581d6f70e694173e582c80029b5f544dd15935e9c
- MD5 c8500bbf8ac14f2b8f0907153e059b81
- SHA1 e4a6d73086186a175ebcf9eda84d3934445a4b86
- SHA512 937cf05d4bf30ee47fd6108ea0f9cda2a4dc6105f0cc8f3578f00f304ab5ba7230e5a7986aab5b8614d920d58f74b98350e3f17c919cbf82ec52c7beb8ae849a
- SSDEEP 3072:I/bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlX3K:mPrwRhte1XsE1lX3K
- TLSH
  T1BED37D1278C08471D9731E3565A4CA714E7DFD711E759EEB23A8027A4FA02C0AB29FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  stats.cc.exe
- Size 180.5MB
- SHA256 cd8754dbcb2dd09eeb37ed47ae0ebd56c7049e2355e8755d989d8695ca837c72
- MD5 6be423113cb277d3211511d1da0b1003
- SHA1 288136fb9e826be67dbde78250c3270b8b843f6b
- SHA512 fb0f83efccda413e3630714f9297c69821941dffea7fe92ee3e946080600ea79c3d03d97a4bbbd82ad4463ec9b736e636e8ffdee6ded89f953842c66cdccab66
- SSDEEP 1572864:gbj4QwSwQGNiFj9zSNMIHiCig2daw/pKq3E7zq+PdOKSg+BiY6K4Jj9FrC9DUhic:XOqc+Ofs9hag
- TLSH
  T132987B03F39A40D9E01DD2B58B479633EAB1B8854328A2DF275507952F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 be462b2596b5bb3a6bae678243408281276ada704d85edefc1dd66756cbccaf5
- MD5 62129c75cf3bd3d8017467d6733684be
- SHA1 a0b424bd9e7e0db590e6e0b6e540d71fdf76db28
- SHA512 32aafbdbd34a4f6fe66b8f39aef15fac573f08f9367d9ae54ae888d63c800242ba438d105536c767a8613b76762db5fec226a7605199d713b82b3f300db37bb4
- SSDEEP 49152:j6iIDu2nncsNY25w8WCSPUfgjqB93sN1smU1CXhvV5f+rJn42IS2oIQoBe/gplMU:ZH2ncgLz2WDovq9JgQPJctrX
- TLSH
  T195463803F2858099F05DE578875BA623F632B8811B72B6DF52A01F192E77FE06B39705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  vulkan-1.dll
- Size 896KB
- SHA256 b027b78b235c4fa2b1e21a38c07a312c7e79dd7709db375651ffaf2595cc36e4
- MD5 a52165bd6ef57b6cdd3836371d4f58f8
- SHA1 34fc7b57f6a5522a1df719940538837c5197efdf
- SHA512 24607752e9ceefdaee3a66ad7179928cc3dab15fc202384fdaa1aedba5c54fc271c11c6e2d71785d350a4b2882ec7669d730a503b6b34699d6b73ede347c0bcc
- SSDEEP 24576:wdHRIRETXMHTtsS8mzKPQ96Z5WjDYsHy6g3P0zAk7TUjEq1Qx:wdqETcztsS88SQ96Z5WjDYsHy6g3P0zx
- TLSH
  T199157C23E6648669E4768034C9D24A03CAF274921725B9CF02A84714BF6FFF47B7DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  $R0/Uninstall stats.cc.exe
- Size 610KB
- SHA256 b95a01cd1d9dd6d1308d0f0736250b5084c53d9c3718ef81447a19cd3e2eda03
- MD5 e8cda81f6ecd4bbf87ac0f2224bbfda0
- SHA1 c2adaea09ff717f782af4f0137f0503a790fbf20
- SHA512 e3c2ac34c6c79058f5835bf51c11b39ef0e27c13a1836b5fe3abb1b85fa1209826e08f8892c9e49ff6915cb937a13c7186d91441498242b980ea7c67f1e66bb2
- SSDEEP 6144:S740IMCTMFbEcs5CgdxxOzwE01oE2Ua8T2t0EyL+ya+mx:g2msQg5fobCLRKJ+mx
- TLSH
  T180D4F5F917E0C64FE7941EB01558EBBE08FC5C03A5A38E42129B7DDEEE3E6A15839450
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral28 behavioral29
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32