c2ad60221899f589fb7712ff712b961bfede781b1bad39496f14c12e89f79bc5

Sharing

Copy URL Twitter E-mail

General

Target
mindshub-cowork-latest.exe
Size 100.8MB
Sample260813-rhvdvsap6t
SHA256 c2ad60221899f589fb7712ff712b961bfede781b1bad39496f14c12e89f79bc5
MD5 6f30355ed0d2514f51412b2eb9dfd8c0
SHA1 4795bb662673637dd74b7c3ef0d791d71f9a77ef
SHA512 61b2af60d40f4e83a6e02dc7581768880e3e29b80933a5936ba738887e23db19eb3301f4554b6a165e5f955eb251213487116cca7133aef9f3a96b9fdcc8b55b
SSDEEP 1572864:hQOLNwhzZKD0rwy2uBRhDpE9+CuQzuyr4R9K2FMsm6GA29ugaRX1DmGYIZc6Mv:hhSyrYR89qaubR9K9eGlugqX1aGo6Mv
TLSH
T1533833430A0076A7CDE1FB3979A3FF760B022942CF9ED1DC42E963B506AC4592B6F165
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  mindshub-cowork-latest.exe
- Size 100.8MB
- SHA256 c2ad60221899f589fb7712ff712b961bfede781b1bad39496f14c12e89f79bc5
- MD5 6f30355ed0d2514f51412b2eb9dfd8c0
- SHA1 4795bb662673637dd74b7c3ef0d791d71f9a77ef
- SHA512 61b2af60d40f4e83a6e02dc7581768880e3e29b80933a5936ba738887e23db19eb3301f4554b6a165e5f955eb251213487116cca7133aef9f3a96b9fdcc8b55b
- SSDEEP 1572864:hQOLNwhzZKD0rwy2uBRhDpE9+CuQzuyr4R9K2FMsm6GA29ugaRX1DmGYIZc6Mv:hhSyrYR89qaubR9K9eGlugqX1aGo6Mv
- TLSH
  T1533833430A0076A7CDE1FB3979A3FF760B022942CF9ED1DC42E963B506AC4592B6F165
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 100.2MB
- SHA256 61f0f15aa6cce8b8c4d766149c7641663c40567c18f842a2a7ce44e3b8081406
- MD5 30363d02a24c9827c205dbc2ce95bc6f
- SHA1 77ca4383784ed74887ff8494f2a40b4a3d1e2052
- SHA512 4dbc2af586d8ab292d4d5ba5f6958760e9e4de7e8504a99a3b3de317e8045aec3bcd7595867f03147969a29777236c07edb8059b1eef2d9ab104006fcc99f1e5
- SSDEEP 1572864:POLNwhzZKD0rwy2uBRhDpE9+CuQzuyr4R9K2FMsm6GA29ugaRX1DmGYIZc6Mf:8SyrYR89qaubR9K9eGlugqX1aGo6Mf
- TLSH
  T1863833430A007AA7CDE5FB3979A3FF7507022942CF9ED1DC42F963B506AC4592BAB065
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSES.chromium.html
- Size 14.4MB
- SHA256 f9c475876b01bb4d654b8f630f11219cc96198efe91d7f2602a97f0f3c86c3cb
- MD5 bfb383dedf6aaeab3061c79362a85ff6
- SHA1 e536a576ae468795949e3a124b7038d0a9c96510
- SHA512 963a3f806237ca758361cefd5b836e51743d7b4c350b75286d8387a20040f9ea05fef0d8b83ab6f35e312309d96f33ae3c1cbb1eea99b6b9c28c6d5e7c212476
- SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDGKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwBeXEn8mb
- TLSH
  T170E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  MindsHub Cowork.exe
- Size 201.2MB
- SHA256 d2431af2c63666b725810a5671a0594a5a5a2916416d0af4840919517b570e83
- MD5 166fc5241993d84b1ea3a3bc4219c361
- SHA1 fa450c69bc648726eac828aaa4d9e8a3034c9dd2
- SHA512 c08e64e429215a73f10816534e2b5fc5b854835c00c97457a8015fe4d5b322bd5e4950b01b3014071f6746dea407d980fff3abeb15f7a909382d72ae2bfa5753
- SSDEEP 1572864:Zti1A6CiLvokEeZ8MvXqwKwG82nVGg9o1QESuVbER3c/L+fkYAOsAiYaxzPfOfV1:6WEswwyfOA
- TLSH
  T168A88B03E29A41D8E05DD1B5975A9633FE71B8094B28A3DF2B5407522F77EE82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral15
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 d59f53e6c8a0a02003c414ce3ca11f973b31809008f0c94cf3c2559687a5e6c7
- MD5 ecc57b936cb9c9e85b03b51efbd36898
- SHA1 f785440acd292dfb72a6057eb84f9bafd452063b
- SHA512 00a9fecc54b57a16361fff5117e7f9057197a83077eefad72ab6cd026e0b2e30cb65a801fa9848f04d212b3d4122f0563418384807af57b7143a26a9df5ce23a
- SSDEEP 196608:T+kiCf+BWW8fUA4BejnQI180uNJSf4iIJwEMWRsKHvU:T+kNf+BWWyUA4Qjnw6+RsKHv
- TLSH
  T1594729122246D49CF059C878C3678626CA6C34E73FA779EBC0B461252B7BEBC5B39135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 f3705d563d2d8f93a0d497233c01506d5e4ecc66476022588d422d7509694bca
- MD5 34ffa11360b885c0c0af62195b1401b1
- SHA1 2517c2f77c03238f70a27412c63f32f6a148d321
- SHA512 377aa1a5a14796db9ee8b6e2adcb0414e6102262bc5edb6e1a15094ef538a951beb97f517da113df3d0a72eb83854d86818402ea080f7c09352fc73ccb540af4
- SSDEEP 49152:UESTAZFzTxMIP29EeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGH:UDaTSEYht8OnZGNxcO6IhgiS9Nol7Wtu
- TLSH
  T135E5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  libEGL.dll
- Size 492KB
- SHA256 df2581628fdc5e9ce1a7faf61e1c685730802e31ef828f2e6eb6aecbfa00b02a
- MD5 995ba006ea8bbac389a3b24ce87cbad8
- SHA1 1966c885195901ac4004d029309863b6b37a8254
- SHA512 03b499a0c2aaf5f4a971d3dc1dc91733a1b7f1edff699646321c4cfb9c138a81dc7f4e644f1a3d7dbdad6cdaf890daa752bbe890530269c68d94dc5ca3351fe5
- SSDEEP 6144:itqwvC8uRreZw/ebZyu5sIAeoZPw1ODZ6R3/8cWqR/H2p5HoSyhg:EqwvC8SrZmNEIsPwa6R3/8cWqt0HoSZ
- TLSH
  T1DFB49D15F3E945A8E06AC4348B534603DA7278560B65FAEF03E092793F37BE45B3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 08888aafcffd55b349e528f9979c335276ad0fd8c6ce92448179f97557c03ea1
- MD5 b3e0d85fece0bfa2068639e909da82fd
- SHA1 d23f86bace9f6b041df8ebcd16b1ddab6bc36f62
- SHA512 9c59f7128b94e5298a4a832508b08ff27b12f9cd2bb464f0fa78a9dc2d0f96258a745446e791306f3d8e47d5a07679f6b14dafca5dbdc77e58be8ed56fa6f3e2
- SSDEEP 49152:PBI3qD4nxsy+ODwZe37bJ2MBnibd9/HCqF4J/vsxXP/6BN+ey8+OjDthQDxkLvb8:bDqE9C0X8r1tjNqXyzXicliyUpLe6
- TLSH
  T116867C03F68581D8D05DE2B8875BA227FA31B8490734B6CF2B9413152F6BBE0A77E754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  resources/app.asar.unpacked/node_modules/keytar/build/Release/keytar.node
- Size 691KB
- SHA256 90e35de89ab5e5f9290e4ff1bbadcf221a82b2aa0d9b922187dc980adff3c831
- MD5 c5c99144e2e1589628e14999ba59ad73
- SHA1 9c80f8de6b5cdaf38677d5368b5287bacb9e465a
- SHA512 0bcb99953397c6604d8e08bf2ba89248ee82f92436c2dcc779157b65227b0e1350927273a1b6d150a9db914d0a8830680df05ef651ee291b40657a3025a721c5
- SSDEEP 12288:cRInDhSzUpqDDa2XX05VNpk4th460iQlp1Qk5wUFPcvKKR0JQQ8jKOx8:cOnDHpqnaskrdx
- TLSH
  T1EAE48E6637E811A6D0BBD13FC9978F59EAB1BC140720A7CB01D442A92E13BE85E3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/keytar/lib/keytar.js
- Size 1KB
- SHA256 e858194902d632e217b60b913829865749568fd43aee2d65bf7ffcefd7b1d6ae
- MD5 c02c937c0597ff8d0fe9824fb7a7ae9a
- SHA1 ac0a580385a7d812c6e1eed071ccbd6c7ead4488
- SHA512 eb1cf4966e868c5997e59e7862d6857e0a6b85315e2e196704e999fb64523318ff160570aaba78b48dcc498667fde928fc26b597a1fb9122750a2cd6ac033d8b
- TLSH
  T117118E5126E45836231396D9BC978628B01CE4CB060D2A0EBBF481B86FF7D7F06C3865
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/assets/dmg-background.svg
- Size 9KB
- SHA256 c5b8c610321794342f4c833a167555049a88ff6bceb24a7615a39f765ef0c366
- MD5 acbe4fd39c07b346dbf1f376269f5133
- SHA1 287029b6dd6b618059e10c08863f44cbe5cf505c
- SHA512 8107e2996fc63133f350ca48b510a695a1e24fda9854950ff7c4e4b78ba8a2b3bd089b56dddf15509626b3babe45dfc8a5481b396fc96a32e00f96c5de50c4a8
- SSDEEP 192:Ewl7mWKqGIiYh6ZA+KcUvPCIvqOkpW4n43WQd2Qza:z4RIiFZA+AvPCIvdkl+Wce
- TLSH
  T17A125CBBDAD6D13D7A644185C36C98086F7B80DF91897FE0F28A3A1388382421D6B615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral26 behavioral27
- Target
  resources/assets/icon.svg
- Size 3KB
- SHA256 b9ae6b3b430f32fa995e1d451b408ee14a19f8b94527a310b500dda58462fb24
- MD5 c665b472fc1e271c695dad6a2359bbb3
- SHA1 1dca3348dd0cb15f224b0d59d377f83da35868af
- SHA512 027000b5b4e26a4c96bfc94f89d309202a1ce583421f8e6d839e6c8d24893a875ea9b55775e4e79164add4a941662f5bbfa23736b3cdc1df09dbd8fe74b0959f
- TLSH
  T16081FAD163C5B2E4F015F3FCC9127820B71669D31959C2A8F1E91D0E9A6508D898FD52
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral28 behavioral29
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  snapshot_blob.bin
- Size 394KB
- SHA256 eb484904e06c217beaafd2cd6847eb909225a5f0a4bf814cb1ec22653e6bd2e3
- MD5 2475efe9ad373a9ffd0da6ff9853a9c9
- SHA1 c63fdceef60f3409013df2af2802e681c71d982e
- SHA512 9a5fc21e93df7df65ed051eed9c522b42dc5e11b58f5b370b7d699d4be1de8709e8a066e5ec6bfcafa2ebe069981bc5c3a1fb41b5874cce6c80c216600de98df
- SSDEEP 3072:XU6QtROt+xeRvISYOoxs+Yi9qSkvpqE+IE3qfJjtN:X7t+OcTCvpDjz
- TLSH
  T13584A909B349CF36CE083A756CE887896526B18D6D96F31B7519772F38B35740E32A2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32