5457d8e364e67982d276481fddfba6ca806803a56f7010789aaf794a3ddf7ace

Sharing

Copy URL Twitter E-mail

General

Target
Install Negative Lab Pro v3.1.1.exe
Size 970.6MB
Sample260813-mn75paxepd
SHA256 5457d8e364e67982d276481fddfba6ca806803a56f7010789aaf794a3ddf7ace
MD5 ba9f6ffa14a6cc7e55eb3fb71a042fca
SHA1 94be51ede677b3256c072867cafedbcaa237bb76
SHA512 3fde45327e09fa07b55f65d3ae2c6fabf10e299d9ff17a93165ba235f9fc67a03ed9b19849618b34591787adf424d4a1f180b03317a592c7691d5a683342ed0c
SSDEEP 25165824:FA3IvOmxzPAwd0aiRq1hdjGrCa0ruVE1NGKUBIg2qomogzWyxt71fUTEknv:Fjzyxt71fUTEknv
TLSH
T11CB933432A9FB59462092C4EBE975F6B70D0F2DB45F26C9293A38DFC60F7574CA20429
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Install Negative Lab Pro v3.1.1.exe
- Size 970.6MB
- SHA256 5457d8e364e67982d276481fddfba6ca806803a56f7010789aaf794a3ddf7ace
- MD5 ba9f6ffa14a6cc7e55eb3fb71a042fca
- SHA1 94be51ede677b3256c072867cafedbcaa237bb76
- SHA512 3fde45327e09fa07b55f65d3ae2c6fabf10e299d9ff17a93165ba235f9fc67a03ed9b19849618b34591787adf424d4a1f180b03317a592c7691d5a683342ed0c
- SSDEEP 25165824:FA3IvOmxzPAwd0aiRq1hdjGrCa0ruVE1NGKUBIg2qomogzWyxt71fUTEknv:Fjzyxt71fUTEknv
- TLSH
  T11CB933432A9FB59462092C4EBE975F6B70D0F2DB45F26C9293A38DFC60F7574CA20429
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
behavioral1
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/Geotag.pm
- Size 56KB
- SHA256 bf4815d362004deee30f7bd0dcb0c76b90f9f2c4e5006dd5ec3a004cd74ed5d4
- MD5 f285c29b6aece8a6564490da7ad204b6
- SHA1 88cfcc88186f9dde5af0cf14f64ddf231bb0647e
- SHA512 c5012a684e1cee3e3cb846ec246cc9843014663afa1211917a522dcf415b6ee9e6b87992040f88cef7492ce5da241acf0e8992490675553986b00f9a77e66c8e
- SSDEEP 768:0pEQKOpoNpkAcDO5+T/LcXpDGy+c6WHpUCUlPBwARK6zcEqPLR+0xXBi:+EQxpoCK5+T/Lc8Np1qc0xxi
- TLSH
  T16F43E8523DD312355253F02A9BCE5858EB2EC1A757C8DE2878AC81C83F41978E7BD7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/HtmlDump.pm
- Size 32KB
- SHA256 6adb977d8e71bf1b90c82a277829e1dc3ed58ce485e70cfdf6899339166bc25a
- MD5 1c7addb640624b1f09882a0fd315f864
- SHA1 bf8a1fc573a012270d056d17dd1631eeaf98bafc
- SHA512 7568febebfbf956bf3a895aea9d00e1ce110571d0fb99d9e85fcf015bac70ae34c5a4ab457ec23c439fcfc2eeb20ed858e5d356cc34f4c0db74a797fe70ae03f
- SSDEEP 768:X8juNmQp5oKDzgQtMwTjHVVsut7S5Ij8u4EfYZIjrsG:MjuNmQp5oKDAwXHrsU7S5yZV
- TLSH
  T1F7E2D61A7DE3016694A3E42A5BC9A214F77AC0836208CD247CAC81C46F95F39D5FDBDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/ID3.pm
- Size 52KB
- SHA256 e38aefcb7ff853495a245e174205620dbb5372cd01cc66e6911a674b6a43da0e
- MD5 245027b83f92dc72a17b7821586afcbc
- SHA1 822dd562c36c1af037f33ac985f6ecc09de35ff6
- SHA512 730d1ec7827c0a9821a497331898c40fd436cdda8115bab5b54f29e4ca885c2de64c5ecac0ff70c541902ef6fcc3a316708b159b79798864ab29005b828e3e8c
- SSDEEP 1536:H/UFOwwrUI/laNrdBDtyo111Xs0IxqJayHM:yOwwrUI/lWDtyd0IMJayHM
- TLSH
  T1D73395361DE345646252E02437DE6802EBA9A1C70E94B923BD9CB1882F0DE3CD6FD759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/IPTC.pm
- Size 39KB
- SHA256 c95fd30b92dd2eaabd5438226144fe24f345a4016516bc5290ae093e9d4289a5
- MD5 915c88ad94b95ab8dbc39d1c7447e93f
- SHA1 34230ca92aa8a517b6a548035cb06094f983963c
- SHA512 09651a68f9c7c4874803c0536d50bbc539631611cd2a36e4a9295e1a9e7ad261a0e532f9b76085a20b108ada0336ff9933ee15864a296e335156ae00f8598647
- SSDEEP 768:a87fQUlr0UtR+JxavH/kU0cGkGZDwXQiv5M610EsDCLczQuPVi:yUjv/kU0zy5MipLczQudi
- TLSH
  T1C403CD3A0CF140689153E0761B5E6505FA6A60EB4EE9BF23B99DB1483F0DE3C42BD719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/MWG.pm
- Size 30KB
- SHA256 27a7802d01f22de9261611f775b291001a64f57e810b7443c18dd1f12f828561
- MD5 ea31dda4e3c1961e025534106ea851b6
- SHA1 c8d3fe1091f73cbb7e2486e25344600ac07a51a7
- SHA512 859e2aa31028f091c5205166fd21e060581a0e7d4b0692bf3dadd15435be2979174caf086ed757b4ad7159adc091eb75d4ab9f64b6a9fa2d803e3ff711594b36
- SSDEEP 768:rWaozXRTkgoi3qUjhjzjojVs9CPVnHYZD8yaIlKumBi:CaUXRTkgoZUjhjzjojVs9CPVnHYGyZii
- TLSH
  T1D3D265175DE256A80A63D0673A4F9006F628A98B4D5E7A26FC6D600C1F1DD7CC2FF394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/PDF.pm
- Size 88KB
- SHA256 093a8d2134740f6c9ecd7f7e138416d97427ff87be5b943d2444cd1e473e60c0
- MD5 301a40cd46bfb128cfbb0a505aa6a46c
- SHA1 a30290afd3714a153b39dddf0277c31920bd9ce8
- SHA512 4e0df41d1aaf21705abd709453fb2c619c74683815307fa29a27011a5c1418864daf41c6fa3f11d16bcab22a00bb08574a77ef915741e66784adfced94ad8fec
- SSDEEP 1536:Rq7HyEY2jLMmXahDYF3PP1RYqpcNd/x+Ei:RE5/XDFH1RYqpcNFwEi
- TLSH
  T16193B4492DE3992592A3E03517DFD101EB2A90970348BB10798CD1C86F06F78D6FE7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/QuickTimeStream.pl
- Size 71KB
- SHA256 9c1a65990e55be3cc566a7d4091a97bf84ddbb3bc157a262265d7e4b8e935f2e
- MD5 f31685f5782281e08c0999459c244383
- SHA1 c414ffdd722264715dfc910a77ef0aae09d45a29
- SHA512 150bfb8ce6eee47f1d1370a871b7e8290428378ef3efdf1b68c16a6f0830d4558d86b2bbf7661df50d7f8be6222f72b08a2556659c72e00d7cff6e7b78e18fdc
- SSDEEP 1536:BeaXemIj42BWJHkrNgzq2NjIAJLMjOqQV+8zzKl8qExoM:BeaFIDBQHkrNgzq2NjIAJLMjOqG+8zea
- TLSH
  T13173A7023DE75019F163E1351BCDE402DB6A61C31AD8DA91B98E72C4AF05F38D6BC79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/Shift.pl
- Size 23KB
- SHA256 a7ebc5ec69b3a4be01b661f4b55a2fe917f8116514dd7c05ec01289a29462606
- MD5 f397757cccbd42cda59455e85555aae3
- SHA1 2defc006f43dd685ef8039ac6757148f3a3536fb
- SHA512 fd97b918ffad93a2d3c660f215c8251ea0d6541a4c534a91da523f72a9dadd7c887476f047ce625d5096eae6d0ec53c0588e41f945441e9e40c5e1708f44a571
- SSDEEP 384:36FJ+IuEPJyiuNt9rsnaKO7SawCDiMh+g9bDnc94ne0eV6QI0X7ekXWvE:qiIuEPJyiuNt9rsaK+1wC2y+g5Dw0eVR
- TLSH
  T151B296126E8310287673D12157C97599F7B9C067B24B9B98388D41C82F82DB8D2BF7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/TagInfoXML.pm
- Size 32KB
- SHA256 a62af73602273b2da9059e131b486959d1d6cf2d806c15dedf5b3eb355e2f889
- MD5 bc1280e02f570fc5658d2799a9e05651
- SHA1 cc40c9bbab3f3c35fca04c6711811287a4490115
- SHA512 a75b3ae9fc8b16cabc478702990dfdaf14820c0cb00c12dede5e0db3d8cb79467eca4ee029ad2e50515a4f95bc63fe2d3768766f8723a330e93c199aee6ccb17
- SSDEEP 768:2itmnET+drKLKRoF7ee6w3wRY7wAAEvlaL:XV6rKLK7e6w3X8AvG
- TLSH
  T189E294127FD35564665BE0362FC9A004EF2B89834605FE21BA8C4181AF46E78E5FDBDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/Validate.pm
- Size 27KB
- SHA256 95be621d16770c339977521e9a06ddf95bd28bd8ed17c0ac4a19a840cd0d7b89
- MD5 567b6f36a1a5dff330bc333a27a7f426
- SHA1 92ab3963c5c6921f5bd752453709605ee3af92ec
- SHA512 d6f43630370630c0d376e6a5d45f78d7a9d2f72adf4902366400cc4c6d71a5065306962283da796d04eb4660550805c1c49697bb267453537f2fbcb10c028266
- SSDEEP 384:k2sbIYLJlUSGL5rhPfOhAal2efFwgdjAfAnPAOBnAc3xoAwzVEcM1YLc2PMZlsLQ:QI6lULLEIa7xcwf5F
- TLSH
  T159C26F190EA20665D243D02922E49C04DBE4C8B75AA89D17B5CC74C47F6AE3CCAFEB5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WriteCanonRaw.pl
- Size 24KB
- SHA256 5825af3b26af1a55aa71af9c40f87c5e45dc25f2057dc9b6d2b30dc9b3dfa19d
- MD5 4444db9c0be91cf612338233729ee767
- SHA1 1aaa5437aaef794fcaa6402d4eaac0b4d6d4cee4
- SHA512 7f5e805e4c709162e6377b9e1fa70c8a0d9336c8b6d3d7c3658d29abc59266fad6846b0138527b366cd93fc99f0213b6b3f95d743b8002c145ca488d1360ebcb
- SSDEEP 384:H6KpAzWvOy0BL+FmObMG2B5Ap9s9pd0zeQmF1:H65RF7OYJ55pd06QE1
- TLSH
  T1DCB2B5113E93A1B4A267C0292BD59405DB6E9893054DEA68FA8C50C43F06F79D9FE3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WriteExif.pl
- Size 129KB
- SHA256 6d04a1177c3aed5f10670ddbea1016749b8e79fd00db642d29aaed8f7e698cb7
- MD5 13c3b07cdff8bee0bf6205c55e483711
- SHA1 ff6476168db047d155ef2de2057894ea7177d537
- SHA512 0c9ab38731a1b5792158127a5b4759ffc32cd96963a537413fa86b59648d98e7341d6aa080bad074360e2c37e65f74401b7868fb43005361d25fb5c5274b97c9
- SSDEEP 768:8acUYgq5nSznvnI0YoAmIyjBN0JhLoAEhfNC/6EC7vMixHDU/Py+vQRk5t41DNK6:NASzvLjX7Z7vQy+vQS4rKSIbUWSA6
- TLSH
  T14ED3A5063E9751A59097E0391BC9D806EF26D0634288DA24FC8C92D03F56F78E9FE7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WriteIPTC.pl
- Size 29KB
- SHA256 588f13f487f9d5c6c80bc07c283cd8e42139fc9379ebbb1de02b255391d05bf6
- MD5 cf3ed634d0192a3016241c13c177d94a
- SHA1 532eca89f34ef2509d6c31404b8f8fa279ecd08d
- SHA512 ef50d596cc1d169eb8784b7940e1d7630f11f968afa7b09ba4729cabbbf6b0f15058b9c72af5ee6f43305e684f6b7c64909e088999d262bf74ceb315aa417399
- SSDEEP 768:5nPVwAOAieKns13VcTP7OujTZjHIWLwkn:5niRAlyqawQ
- TLSH
  T133D2A4053FD380B5A6A3E12617CA9448EB2AA0675349DE65789C42C47F02FBCC6FD798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WritePDF.pl
- Size 28KB
- SHA256 ec4f3080690c6eb8b669c09f6224cc208772e6dcb7324abf8826655d576a608a
- MD5 1316c5d7ab9675e6eea5af892dd81dfa
- SHA1 85705034f5ce439f4c53dbeed87f77fcede25bca
- SHA512 2b9321e8df1dca92b7fa012149300a82f7f92b7149ecf3a53742bb06f55ab081aa8f91c075b59a239677aceaec25ec73f648c24c6a13f2d254ff882ee4a4c9a5
- SSDEEP 384:5yA6lXw6eDlxan/hdhc+zT5Lrr1M0vYdTN07Bt2Kz2XU7zx5sVUkMBHihSbp:5clXw6evan/h7tLrr1v7tlz2O5ahSbp
- TLSH
  T1F6D283052DD3D6956AA3E07D5BCAD440EB6980578249EF54B88CA0C06F85F3CC5FEB8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WritePNG.pl
- Size 15KB
- SHA256 2cd7a1de1651bab12a92bc0d74489504695a90ca02f6dda9f7825cd4d8fa29f0
- MD5 cd1b3c553db68ae3d24113a88e488c8e
- SHA1 23ca99e924641279928764f04b15a691d52ada6b
- SHA512 82ab8f6ab536573cd5a082dcd2182cff735dfdb731ae29bdfb7a14a348ab6e640776b644c67d800fef08485e60341b53ecabd950be5d9cdfe9183b8d22d5bcc6
- SSDEEP 384:/mbD1W86enOtS6teLekw/benLnt1vOL4VPXCt/sjmS4TEoTsCf:/mV6eNCeKPTenLzratk74TEcsCf
- TLSH
  T1B17295627ED754A4D263E8355BDAE804DB98E197221CAB28BC0C41D42F05739CBFCBD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WritePhotoshop.pl
- Size 10KB
- SHA256 b71427d4cd9ab04ef3b2e82ee0d06d754ffc3acb82f6a009b2aed8d69cfdadd7
- MD5 f4ef5792044c568cff29b1eae39e114f
- SHA1 cba623e9dd08b53d7754fa5858968fe11bdb1564
- SHA512 952f9b7014afed56f909b49bc73f9545ea4da53bd273df7cc502d3642302f3c560686c58b719b22830605f743255205a8666efaec3c3a8da01d4f53be5c2983d
- SSDEEP 192:Fs/SyA4rYJYDZRzaB+km3Eo8Ck0BUd4l/SC38FyHl98xPoQfv0ThcB9:Fs6h4oYDZpO0Thcn
- TLSH
  T1A12273123EC745F0D6B3E0190BCAE105DB29A1935759DA94BC9D41803F10BB9DBBE7AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WritePostScript.pl
- Size 29KB
- SHA256 5bce7d89a4f4bcacebe8bdd91fcc2d118611b33627b3d5e25b49ce88b3b6e168
- MD5 ab52f3799d7f56d56a2b6a3e5879ead4
- SHA1 758a071ca15d5b0c26350ba07af909314e7aac14
- SHA512 1c6d9e565225389ee67c73bd36d5310ee16b3c8de289d67e83627139045e23412ab27c843f4af45a009ad7e15c5ab03704d97bf37c9434e6f92f104c1cd95b30
- SSDEEP 384:ozPEx7oDuaS2hzCEu2AxvRvt+kO/51coEC5QCe3zLXTayjwqaR0r5eqn4DQJ3AQ5:oz0QgrpKcohCzn9yWew4DQ1MXAlpt
- TLSH
  T1EAD2C61A3CC794948153E4295BCAD891FB99D15B5348EE457C6C80C03F01B39EAFEBD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WriteQuickTime.pl
- Size 30KB
- SHA256 e6bb35c46148e4640ba63925cbc006c6a5f1f67a4f54ff4628ea05816b49b29d
- MD5 70cebf6fe88fcea3b980ad6b78d59bc3
- SHA1 89d20c83670e31c2bc4fe07d0a9a742efee162ac
- SHA512 af3b5d42d2c4aa9f80451663eb208d9332a316cda8fc24fd497a9aa48924a85db729aeb04825eb10a0bd0882024712d4669e219e8a73cc6d4b736dac1f1e0696
- SSDEEP 384:QLWRKwZh16csWJy86vtjbU3aixVi8OCBMC7WYistuXjacHefQEy74aP:eWV/zUjbEvXOCBMWWYAzacHefQj74aP
- TLSH
  T124D282123EDBA1B1B2A7E0281BCAD405DBBA9597528DCE04784E11D23F01B7CDAFD794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/WriteXMP.pl
- Size 63KB
- SHA256 946527d00a8d5b62db95c59f0bf411685f15218e12d67c96a05d47ef3edcaab4
- MD5 5c0049625a04855a4419b4c7db5e3ba1
- SHA1 ee4643b55a1704012ce9c932c00357cb1dc2f98e
- SHA512 9d80de60a9e6a7a954dd59c08b07bb5a3028fae689907d31bb6d452c31e94a24391ab76abfbcd82692454cfffcf321a2f8962493b005b81b5fe3228d130a4ce4
- SSDEEP 768:Nn9tjOn01gyaNVP0Qu6yHMpNQ32vj+HjsG+0Ge+PkDHlS9QVk1X:t9dO01gyaNVcRVHmoSqHjs9efVkR
- TLSH
  T15F53C6197F838564A6E3E06A4FCAE404EA1AC0975258CE45B84C41C53F41FB8E5FEBDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/Writer.pl
- Size 288KB
- SHA256 9924eaf1cac3a2febcd37dbd9e92dcacc741513e1d27cf16ae11af4dad35337b
- MD5 7cc2bbf4396b8a3d59d811a50dac1e5f
- SHA1 3763e32c364b02e6926654b53e1aaff60d31802c
- SHA512 1351631a534bdf406593b14cee5345137d94ea9aae60be72b2b830b598699e2a99a60f14fa1fdb7b5ef74b9b4dd4d94ff84d9f4d23f75dc8c300203a2ca086b0
- SSDEEP 3072:5UWB51AYPZFjHIQoYB8++SVKaa6mNBVTyf1WSYsOKHH01wm09tAC8nHVS:95lFWp+7KZ3BVTAfmm8VS
- TLSH
  T1935482067FC3516562A3E4251BCAA004EB69C097968CEE14B89C81C47F81F79D9FE7EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/XMP2.pl
- Size 67KB
- SHA256 a497c993117bde775ec4fb6466f38198ac0be1395b945e3c7551b793775ca99f
- MD5 3d48a9bd14d7f70c2cb5ab4af0ace7b1
- SHA1 293675edc06d21d30e3fe4e7249cf381f4ca0a5d
- SHA512 d544a903d59f6bd3cc147d1029c9d31be92207934c25468c0920b05e56dfe1c3606ecf11091ab0e1a07bb263ab4476eeff80b7c3992b60f2c9cd8187cbe05d83
- SSDEEP 1536:d8s7ZzhINKJ6mDMpYAOmcCU5gNl+T/+ECNVh9PHbg0Wc/5y1XnDfo+Mb5mxm87so:d8eZzhI8J6mDMpYAOmcCU5gNl+7+EuVW
- TLSH
  T12E63DC2A99F0912925D3E1313E6B1902E5BD31DF1EE83A13799DB20C4F0DB3C2A7A755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/lib/Image/ExifTool/XMPStruct.pl
- Size 35KB
- SHA256 ba9e91c672882271fda388ebdfa181b21603dca6d43004af6e6562d12301389c
- MD5 08a74276ab2873cab3be73b7972d2e0e
- SHA1 b908ad45ed10f5dcda519d08bda49b4c2eab70bb
- SHA512 d150ec67db5d976a953ed3503fd838ada97e84b35d73cd1b0bd5e94136c7fd0481a59a5742a0888a0073e33789af51fdf365a151a2a9eb59b601fcb4d26d5d1f
- SSDEEP 768:wgtEvRH0awGOdSUAJNRI1dsJn23D6Ketlh7z/X0LqjbVi:PtakSUAJNRI1c777Xmqjpi
- TLSH
  T19DF260153EB3C56682E7E0354FCAD804FB1E9093851DD924B94D61EA6F40B38C6BEBD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/liblzma.5.dylib
- Size 154KB
- SHA256 e2a7d6dfff9a0e766807b6e3116d48091b81534a4ac508b31bf2f46ad9c1b845
- MD5 736b0934e4b810b48edea41fa92fdee8
- SHA1 6abd4a4ce2c0ae058cac9b1c553a249f1a492146
- SHA512 7fd9f07c09b403f279541dba6ed765fb03939a48f26ab2f1da4884cde7afee94209ff58ac91cb72065f4b20129fb288b61881af7765bfdb6e8f9d927983559b7
- SSDEEP 3072:D+6hW93V5Em3LDAnBoflI6RI3TJn+FR80xFYUv0lApKS95mYuX9mNoC7T3Yn:Thq3V533AoflI6R6TJn+FR80xFYUv0lv
- TLSH
  T18BF34A5B29A0F495F2A5CC30C26ADF2292F6F4565A10565A27CC436C2F2FF70BB29713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/libtiff.5.dylib
- Size 913KB
- SHA256 5a79c9a1af7cec54a3bd6118392b59d9db135bbafeb13bf9bcff4769c593568a
- MD5 a3baf42bb6e228a3983a27e4d805d556
- SHA1 53637e79bbbad9cda8300c1eb848eda9265c9410
- SHA512 084129ffbfb478319fe55ab1f932191fedbc7007e40bd12fde9cf28b5de2754925c522c8f56582a8cc0aaa40b466c4a260d745c4d56496616eddd102db69dde7
- SSDEEP 12288:y8XdondG55NBKv6yO/v3UHG/Y9QIIDwX0N2KTUYTcD6d7C:BtadG55NBKv6yUY9SlTtT6
- TLSH
  T110153B26EFD1582AC935813053AF8731F336F4953B119B276284F2313E66B922E469FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/magick
- Size 5.1MB
- SHA256 a3613a90ce3382649f9c3108aeeab3505dfa83a554f790137780a5a2ff4aa93b
- MD5 15687425800d57e6dac34d55ec467b19
- SHA1 e445f6c99b4eae37f76d2f0f5cfb354784503eb9
- SHA512 9710a0668df1c9bad9a6a64e22a38afc7ab9d03505185e4c9fa47f67470c33568d5c4e9e678eaecf3ce60e934fa19e0e8bd7c051565a36465ea2f7d93a8347f3
- SSDEEP 98304:bTn3hxzPvhMOllaWyDRgQjHGqabyslZdeXC19kOpmFziBAg:bz2kaMFL
- TLSH
  T12F466C1F62656C5DC11A937113BEE367B621F83273303AEB3980BB651FB58109E5B722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/magick-arm64
- Size 5.9MB
- SHA256 098eb374ff7b7838d57f7888a35157fabce4fc3e2b96f2b3b6f719e90f5f96b9
- MD5 294128e3bc0e2db710d0278b8bd1528e
- SHA1 5e6cf385b9c7c4a81fc84e4928e73fd29841779d
- SHA512 e32e37fcff68dbfc0d6d29fbec59381f15eba9bd3aaceb68bc9a8344f8b37a41918a7d0b6c0d4f139cf5dda950864dc68ab351ffcb81d9342861bd16c70a7915
- SSDEEP 98304:h987HZzYcHb7QUq4/UISD2OjzFeVd4Sn1/fEzWHiyrBruPEz:h987xYcHb7QUtUf7FeVd11JiyrBruP
- TLSH
  T1FA567D22F75E1C21D3B862BC5B194768B47FF3207690C3AB3918819EBE817161D6B7E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/mac/tificc
- Size 414KB
- SHA256 01bb2c81f3df30a6b6883788692c21d887d933b2e3d7fa2a0428d37b5f7dd654
- MD5 05c2455c88880c14b0f94ed2badf67b3
- SHA1 383754c917f33cb3fa2275d05cf638b17a495682
- SHA512 45c871ee0c4d6045ad4968d2511fd35da3967d82c5fc7c9152de509745add4389d84d1df7db7f5c4db9ada477a137bbfdd466507e7b80f1e3e41b86ee88fecdd
- SSDEEP 6144:gOE2Q0ygfQUqUkp7PieD/oXswckqdRiZxo:gKQ6fQ/w2oXswcPdIZ
- TLSH
  T10A945B3BE302A878C31A41B4638F57266764F1744A30ABE726D0EB791E77D106F16F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/win/convert.exe
- Size 18.4MB
- SHA256 717676e33c17f1b97c5ec62466aded91b5ce99d0b28e6e8208f7fceaa3862505
- MD5 6ddee731a772ec9f0195c8aead8d9a76
- SHA1 d9f4a0ee2272cef53640e8804d7004ebcd199d0b
- SHA512 c200788108633478f4a5bc8de18de6f1ceea759cda489c6ef0caf4b89a9259e5816c14ccac38d9c6a1db5aed4985fccea8866e8bab499943520d360e15bc64f3
- SSDEEP 393216:4FxDXnAxAaPJntNTXjpRTvWL3T+6IucYi:6gpdH
- TLSH
  T1E5178D03B3A414E9D577C078CAAAA707E7B17468077057EB1BA046DE2F27BD0293B746
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/win/exiftool.exe
- Size 8.1MB
- SHA256 24a30d6997802ba8040a749dd9328e2134147c4067754ca3ac6434013a391033
- MD5 a0c72b66fac2dfdc717bc2057f8443d9
- SHA1 19b3282a19473e13b789bff576205e4c6ca9e8ce
- SHA512 7022fb3f2e87fdadfec2206999ae82b21efa56e2502e781362a21c2ab61941d4ffe6b36392f5364806403bfbb0afe1f6b21d8e87ae2945ce4e83c75475b53f84
- SSDEEP 196608:rhT227p+VDtj4Z/X8SxFC/KnfzNg1mPvKQ2jptOjt6W4vklvJE60GEj8qV3zzJSf:7JhlvW60GM8a4Vma31
- TLSH
  T1FB86E180FACB01F1E95754305697F32F5B248203C418DFA6FD5CAA81FF63A728929799
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
behavioral30
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/win/jpegicc.exe
- Size 337KB
- SHA256 42586a5f4f1ce31a60c6fb2c41329f6de1c74c3cf8bb18609c46a1e2efebd3b8
- MD5 0268e9cc98db4e75da4894fa48ed171d
- SHA1 1960592d1b425aca0aac11a9bddf93026b25afcf
- SHA512 c224c1f278b8d0bfc337bb29b719fe7fd2d01d920ee71e3e23dcf8c1c78567efd4c5f5b8f35e59b89f99e4feb3495424e86bd54827dc8e0a21f3df13f1e44ac7
- SSDEEP 6144:TxraNxito8oBG6mj8ifBWqQyzy9hnDwleKucdYnSPdUP1R5WB/V3AOVvw:Tcim8oBPmj8ifBWpyzy9qAIdpPdUPLIU
- TLSH
  T194747D01E791E073E9D311FA82EF82B95A381730131984EB63D46FAA9F356D17D3252B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  Lightroom/Modules/NegativeLabPro3.lrplugin/win/magick.exe
- Size 23.1MB
- SHA256 c3d51340363255bf2abb89d7d6b47688412291c51bb5951cefb10b968f80594c
- MD5 c551af031f4237875c688e6adc23d3ca
- SHA1 9b6db09c3a32f1978924ac3abcb25a6d3fc72ea8
- SHA512 3a7d2b8e896bc74a520a0feadbca981f40d594165b3ef7bbd403f0f803f3b66bd046338219a72b3a95e025c32eab799488459adb2c5cd284c8b170f01abc80de
- SSDEEP 393216:/+11a2yJ+xNhshzKvO+oX4Z8VyaoM0x5Bd7LZ:Cnut+Y4Z8nK37l
- TLSH
  T1C6376C10DA409425F9E200F5DAFF97BD69387A300BA401D773986FE9EB29AD07832757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Creates a file in the Startup directory

Executes dropped EXE

Loads dropped DLL

Executes a VBScript file via the Windows Script Host.

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32