9d27b55618d826438d1cdb2de8929fcd913bbc04d9905d000b76cf1fc142fb02

Sharing

Copy URL Twitter E-mail

General

Target
Nexus_0.4.1_x64-setup.exe
Size 85.2MB
Sample260813-2szrfazscs
SHA256 9d27b55618d826438d1cdb2de8929fcd913bbc04d9905d000b76cf1fc142fb02
MD5 77d464ef367ffda7052c82fe97ad3356
SHA1 7e1053ed971b79b77c209bf2223f6091f01fb4c6
SHA512 7beae1c8e353b9aa740d73effc7fd1b34682ccefdc776ed308debaa6f245ff5453b77f468c8792d57e580276b772d4e8881d9b61e10f024737bbe641b0a2c3ab
SSDEEP 1572864:tzvo1vjngB42I3VsVFq9Jz2VSW1tDoHPstjoc+QdAbt7hKD9VAG9sHaov7jOZm:t7o1v7gW2IuV49wGP6+mAMvAd60Kw
TLSH
T1F818330CBA60DD40C44B36B4FF2A92E445FEDF82CF2F112FA8219D9674753961629B39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Nexus_0.4.1_x64-setup.exe
- Size 85.2MB
- SHA256 9d27b55618d826438d1cdb2de8929fcd913bbc04d9905d000b76cf1fc142fb02
- MD5 77d464ef367ffda7052c82fe97ad3356
- SHA1 7e1053ed971b79b77c209bf2223f6091f01fb4c6
- SHA512 7beae1c8e353b9aa740d73effc7fd1b34682ccefdc776ed308debaa6f245ff5453b77f468c8792d57e580276b772d4e8881d9b61e10f024737bbe641b0a2c3ab
- SSDEEP 1572864:tzvo1vjngB42I3VsVFq9Jz2VSW1tDoHPstjoc+QdAbt7hKD9VAG9sHaov7jOZm:t7o1v7gW2IuV49wGP6+mAMvAd60Kw
- TLSH
  T1F818330CBA60DD40C44B36B4FF2A92E445FEDF82CF2F112FA8219D9674753961629B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access defense_evasion discovery execution spyware stealer trojan
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  resources/krosmoz/icons/action-changelog.svg
- Size 613B
- SHA256 3a806d19cabb0be5ba7f4ae631bdc82764c5f70e974bc99c6b00b388c8f2b791
- MD5 f93e6184dc051f1dd5e5c1b08c9478ff
- SHA1 1fd1fb32a01d19fff83d73b4ffc48ff13503cc17
- SHA512 fe5d6a3e03846c611f502a3e95e5339c9559e07f79abaff6cff3f8dd39e8e4355716d2627fe9f14cbbdb059b6e1a40071d957acc3fbdaa2870b47d93d517a09d
- TLSH
  T141F0288A23040D6CF112C768EB713774151821934E4E62159B3338B0530565C7D3F9AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  resources/krosmoz/icons/action-forum.svg
- Size 893B
- SHA256 618fde817d4eebab01acf5f0ce19c6f20d8fd5ee9a77de3f5a3542c56e2a3415
- MD5 77dba8caf37197abd3d011a0a8cdd9eb
- SHA1 06afcd1d88906b1596531b24cd8881948f5874d4
- SHA512 597bf6cddc2b4e7df85d58363beaef7f9c93703b304d876af890f237aae0efba4798e3e78390a66b1b90ccc5add2f9364de97a0853e17a4448ccac5c538ec90e
- TLSH
  T1A011595A33283E3CB12107EDEBA1313025386457DB6BBA19E9302836520DD6C6CBB9E5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  resources/krosmoz/icons/action-gear.svg
- Size 1KB
- SHA256 4b56cabf070d181697f7bd04fd2d5d08b265cd7605f740b391675aa529d8f6cd
- MD5 605394ee95cd139aa09fd24d036ccc92
- SHA1 76b1faa4a39f4f8cb28cb70902517c689d3ab223
- SHA512 2560d90757e8700d500f370e3ca54a788fe35c626fb166e1f1876f335645af67d7e3c347215f4a98d436f65aefb129d419774b5acc732979a1b272b45c543b69
- TLSH
  T1BF316E82BB3E73BDB002DF56C2977434375470B06559DD2A5BC3144EE98282D61E98F7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  resources/krosmoz/icons/action-shop.svg
- Size 1KB
- SHA256 bef10ae9f7f68a3a4cb8e024e305e42849de107e90fb9afc53c579b3ffac52ce
- MD5 8d3e138b15d36b50d1f50d9d65dd9920
- SHA1 bb87eb337b4eaea3e676bd5882bb007d88ba6798
- SHA512 db724051038dc37c3a4ad79846825c0c7832bcbd31f5122ced45f6252c8b41ccf18946b8871d6b2f4c30e8fa90dc1b66aa71e7c4df5dc611dbbbd94f618cb28e
- TLSH
  T1C921BB09158C3ABF543383CCABA9F2D33177109BE12975B811B11E74D30ABC52426EC8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  resources/krosmoz/icons/add.svg
- Size 323B
- SHA256 6a9a6b25d860b84cb9c94ea01a5c8355513a0a3662e4b2fd23c0489098b6ee52
- MD5 14c099c5000e84733622f8e33c1d5137
- SHA1 a5f7e7b978ca5d81b748c935189e0032fda2d1cf
- SHA512 8a7c2578107d13043f9895926f509714a704f6e5481683a260cedcae147815f915c24d924718b55c582ba51e778bb9c4aadda7e5e75b1d4604e6c964c5ab56b4
- TLSH
  T17EE0CDAA13044C2DF5234734FB543239803911434A8D6598DD761A73215565E7D3B6F8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  resources/krosmoz/icons/addCircle.svg
- Size 620B
- SHA256 6f854c91f8391b7b2db917105fc78c4e57c0b0052f5c2f5e20368360a774fb88
- MD5 08a944fce4ed95688df00c54117e75c9
- SHA1 990b90e89cad7119122dd51cf9b65f4eb0d28030
- SHA512 d87f99c6c13c56bf4d29ef4856cdbae2664baecc3847aaa535510612c14fd0bc597eeb55490ab6dc483b63de5994b103a438b76b6b7f7d5e3611ac6e5258b488
- TLSH
  T1FFF0ACCAF3C553728C49C33459282491E25F30EA3AA810E44336CDE934E0A674E8DC80
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  resources/krosmoz/icons/arrow.svg
- Size 475B
- SHA256 8851298972960d1ccfb552e52259d6ba2204ea25dc9f3cb32684217df9af960d
- MD5 a2854ea9da5a92e84abd6eb03a99fe89
- SHA1 2a545c1bb6a46c262e6a421096226881249e39a0
- SHA512 c7dd2f0679537f6d5d209a8bc1388dd6651ffe8673315ad3591eb4c027791da13670eb405343389c2365f099e6daf8ae2bbb54680f1d6cb59872cd4e536ab67d
- TLSH
  T19AF0DC95A1A6C3E330828BB4D17C0A912A6B54FC2A4ED60482B1C454BC207BE448C894
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  resources/krosmoz/icons/arrowlink.svg
- Size 857B
- SHA256 6b3a61ade6d336a9ce97bb2631e90b4817077d540d41c77d52b65a77e656d642
- MD5 d4c0df7260f50f45f204daddf643be4d
- SHA1 441133367f51e2332a962ceaa53efc8e530df971
- SHA512 a6de63cdde07bd9a417364542a01eef2c06db10bf6edc5f3ba59414558dd27bc44e309ac82c2ccd1ad1138553deaa59770c508f779e18c949dc852cc3e781e04
- TLSH
  T1DD11CE0811D8D13EF102A7449B33247A7B2670D3E29F2F08DFE48600655454F3AAEDE6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  resources/krosmoz/icons/chat.svg
- Size 1KB
- SHA256 3c312574abdacdb273538e9c258c64bd7d863d501c12bf321ce4be7d8c32cab3
- MD5 5b1403b1289c5ae63790e8580205548c
- SHA1 9c509aab7f18d9da822e6bceb3b9485a648b9e1a
- SHA512 605f20f7bcd16dcf2665bbfb9b74e045fc4a52d7772a663de3fa2c079e25ddbbbaa1085fda40a30a68b76d6d7dc08c87fe27a880e69f58854addabbcef1aa108
- TLSH
  T129116AB02314873DFA2D93E997297130B59630CDF18C256CD42B1BAAF265B473EE4AC1
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  resources/krosmoz/icons/edit.svg
- Size 1KB
- SHA256 63c880d96cdcf673d5b59349cd684c3d978a931d1e5d21e43d7390e24f77103f
- MD5 2b422284e1ed43f555a863387ca91b79
- SHA1 26acd55edc0dac17bc267fbd7948911e004645a3
- SHA512 ddf324d8b5c6c5e5d0176d4a519ef8bd4b5faea84c299e815a668b32a84e32af609ae01efa3022ef0c80fdf99917d235deed29d0dbd0831efb90d7d16f44c710
- TLSH
  T1C131AFDE9105C8E4F906F7F4DA08D9777E222ADD5A76D84C93938901F3A115E14BECC2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32