db8097320abffaad7b97569c84f173f182ee350002dc5a98ef8b6762f1a92030

Sharing

Copy URL Twitter E-mail

General

Target
Install-KAMI 2-GooglePlayGames.exe
Size 39.4MB
Sample260815-vtqrlagh46
SHA256 db8097320abffaad7b97569c84f173f182ee350002dc5a98ef8b6762f1a92030
MD5 3a5a513b16589223b65c1e778038e521
SHA1 ceebcd8e567cc342439c352afdc8f374e5c0f258
SHA512 e59f04cb3be470d8474ae7509c3c1f43f48ff5410eb483fc71a2266a43bf84163d4e65cf5024a06015c001d2658f17ed69275ef2faef72ac25631749efd80180
SSDEEP 393216:QVUj4kSMiohxJdVJiuDygSULgjBR2QCPLKsq+YpWhTlilBS+y161FdDEbBLhVACb:QVqvn+uWgLpX16JoY0wDzK
TLSH
T12A97DF13BA9190BCC49BC031E27F53355E327C964F319ADF4194AA182F79BE02B39769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  Install-KAMI 2-GooglePlayGames.exe
- Size 39.4MB
- SHA256 db8097320abffaad7b97569c84f173f182ee350002dc5a98ef8b6762f1a92030
- MD5 3a5a513b16589223b65c1e778038e521
- SHA1 ceebcd8e567cc342439c352afdc8f374e5c0f258
- SHA512 e59f04cb3be470d8474ae7509c3c1f43f48ff5410eb483fc71a2266a43bf84163d4e65cf5024a06015c001d2658f17ed69275ef2faef72ac25631749efd80180
- SSDEEP 393216:QVUj4kSMiohxJdVJiuDygSULgjBR2QCPLKsq+YpWhTlilBS+y161FdDEbBLhVACb:QVqvn+uWgLpX16JoY0wDzK
- TLSH
  T12A97DF13BA9190BCC49BC031E27F53355E327C964F319ADF4194AA182F79BE02B39769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  metrics.dll
- Size 24KB
- SHA256 e587392700a1d897c847ff6768ea892c05bd8fe7ad80c52c5a1d51d823c8f400
- MD5 dd07830ab9e4098867ad7d1e013e2d7c
- SHA1 a1daa416fc8cff6e926ccf9de261494f1292d12b
- SHA512 8e8d7954f13bf6e2b10a76062524358a38ffe8d6e4b36d25685e03c47ec566978b67e2370ea1a7beba29353614d23ad184d31924cab1cb198e6795f5274d05da
- SSDEEP 384:hCaZBCSrz8YNo61JpoUJ3baQaLvcMeuKyMuP9ej2AJZ3kLoRniY0xJggKvB6UfO1:hCaZBCSn8/61BbabLpeuTMuP9ej2AJZW
- TLSH
  T13CB2D784B3E88D55EEBE4B327DF50A044AB1F8A25935C74F45995CEE0E33B982E11713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  metrics.pdb
- Size 14KB
- SHA256 16327ed0bbbf3d837bec49fd68e88e88f62a8661f0e9590627338b1a6be0c8e5
- MD5 53cd241a89f4f01a5c1cbfc996498e3d
- SHA1 7066e4bef142d194d4d5f4aa4fd1b6f50b6ab9ce
- SHA512 ad3f0f3e6366d19f7ac33b15b47ee08453259c0574aaf5869bdb40e2dded7131db278212430d22d7ccb6c92aadff1297fc7bc34ed13f7ca8f32fe3ada831f1ae
- SSDEEP 384:QMtHSXFNv5w3L8hmFYtrPcdHp9CX+hPTaNrjLOMv+eiMiPH0WH7OwcfloqcLQAzX:rZSXFNv5w3L8hmFYtrPkWRGLVHkoZVj
- TLSH
  T160623C33AB488665C42555760426C38F2B7C83012A49BF7EF2E43E54FC9F38B0BB6161
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  metrics.protos.dll
- Size 948KB
- SHA256 482e0463b88c056522fbb57d5812df5e6128507d9317b763a129b34ac179cdf6
- MD5 c7f140762a5fa692d5cd356292e171d9
- SHA1 4d5e5e43f492ace4a93b6ae90a5a565fd5179f7b
- SHA512 4168cc7367e30ec8041a2a6144b2a27dcee9a005c428537f9d08c9ce15056befa0aa0e0d67f7bfed72dd09b9cb0b47ddc433a58ca275de497f68f0e5ebc77e4b
- SSDEEP 12288:nKTHAklcgTGk++0+oQDVpmAPM2pNH+gsrDp:nKTHAnF+0OVHPM2pNH+fD
- TLSH
  T16925E7243DBD4039D25BA7306CD9791BAEB0A2172116A77F5280726B5DC3F42BD422BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  metrics.protos.pdb
- Size 233KB
- SHA256 c7bc036f23ec59ef950851336b95becd8df5c9769a752d5784c988ae4baefca1
- MD5 07a4440a63d0cd543200f0757a8b0d44
- SHA1 44bda09cf1a78effb639792c99e1c117ad7eb263
- SHA512 0e62d660e26a059df47b80e1d0c285a7cc96a5246a9ab69f58589e9a9b4334106abc078bc3c0b04910f79e34d95fd7d8814e2f88136fb55c5315dfbf23e5cef5
- SSDEEP 3072:/HA8jQ96nRJr12kqkNTHP7+9V0Hgfv5wn+jR1MTV3E+AFJo0R2:/g8s96nRx12kqKzAeERL8
- TLSH
  T18D3483499D2976FCC915303E6A7A03164BB5101BAB82935723ACF1F77C69BF8132E274
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  microsoft.bcl.asyncinterfaces.dll
- Size 21KB
- SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
- MD5 48efe61d6ca3054309907b532d576d2a
- SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
- SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3
- SSDEEP 384:O/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjR/uPHRN7Y5slu6o:O/f1IDjV9UPPpWRMkT
- TLSH
  T189A26B11D7AC4317EEAB3FB19679D1062E34E7D6A821E32E108CE2652CD73859731739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  microsoft.windowsapicodepack.dll
- Size 111KB
- SHA256 21e140dcafa3e251373a712423bb111570737e95e4dcfb6f56868d7086af7686
- MD5 5d7da47c86475dd23094ce4bbb6c9001
- SHA1 af31272c451996c8eea7b2e56a79b8088c606c3b
- SHA512 cd193963d9c5a5959a8ec2503224079c806804d049ed927d654fe241113af2514d24fabf05489801ae283578f384224ecd1fb887a96123b19c70be0600e36faa
- SSDEEP 3072:ApN+OsJcYnyhiV6WPCeC0ImL6HKgqYw3Flih:Ap0OsPnt6WPCeUHxZ
- TLSH
  T1E8B3392577F8162AF9FF1BBCE4719120CB71B9826A13E72E0F94716E08A3740D858767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  microsoft.windowsapicodepack.pdb
- Size 271KB
- SHA256 93d4566f27122cdab36dba72444953ea79f1b1734a11fe0da4e916c27a1f3651
- MD5 26ade834468a8fef7f147ddb21541ff7
- SHA1 ab71a15477c254d2fb760e61a9ecfc8b49555fe7
- SHA512 dd78e0cfe456fe1d9313b4ac74d1370ff5efbe86a10762c308fd974908ae3dd5ef8d543998f12ee7718bdab21426d2f45ec8c14f3f0909472803878a15b2c739
- SSDEEP 3072:zfWHbWxHWFEdMCW/Xf/L4ALtDCZ7nUxlu/:z8WFMNkQtGnUx
- TLSH
  T193448263BBA4C632C496C93C6ADB0F2E537CE1C9978357AF4698B06C7DD235A1C86350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  microsoft.windowsapicodepack.shell.dll
- Size 574KB
- SHA256 6ea25be49a4e96c43c20bc29eb1ced078f4e0bcec4673ce722271c77bc2fa121
- MD5 f6a0bdf17dbfdc16cec93537731571d4
- SHA1 22ef1d17448c01f9d06eddc0a4ace8827699a877
- SHA512 c665512ac8cd86b93b2f60061cc6101222709112a6f10b18bed76e94aaf6730aaef100c10bd28b71ee96c704f3576ff0641b13af618e1f3d4c2515109771789a
- SSDEEP 6144:PpXcF836yvCI++R1yjRbcq/9NlKCuAg496KqMbwFkguan+W86b8c3v6n9c6KwZE4:PPVCbbcC9P96K3wFvuI49Mmn
- TLSH
  T17AC429247BF5951EF09E977CE1AB162297B0D311F103DB1F0AC026AA1CE37514D89AAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  microsoft.windowsapicodepack.shell.pdb
- Size 1.5MB
- SHA256 6eaa6468666ecf851ca10ed8ab61c22cc2e2e5aa4be899c4f060d4b2386e22aa
- MD5 cfaeb739e73a9cbcb43482cada6110f4
- SHA1 3e4374d22287863c6b3015fbfb525d721b92d55f
- SHA512 c8dbcdc55fbb7f48a5aeffc3f3ad64566f8740baf4fd14a9ec4a1f680d97aaaa214a057df9819f64d9c87e2bf8285b53276c81225f62b1cdbd3276ed3bd79462
- SSDEEP 12288:+3HfrHhIlIAVBlyekhcmQZAtnNqWPcq/89KRF3i5pFyKp:+XFIl/tyekhcVGrqWUq/89KRF3i5pF5
- TLSH
  T1387541937B91C631C496C93C66EB0F2E6378E2D88B4257BF578DA02CBDC335A1D85264
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  microsoft.windowsapicodepack.shellextensions.dll
- Size 37KB
- SHA256 c21bc4847ac3c75db64b5f7afeb0fcb0e22ba436b7db80692523b4810b046d22
- MD5 7f616473bc928975d2d8e9897e41d1e3
- SHA1 6b665bf91c0de499b3c94ea94be1e9c44aab0abc
- SHA512 d7ebd31e30fc266fc2ca8d4e9f6d3ff2c595cd4f8d2cf60cfd662db2902e8f262f805da0236110979a563a09c08f7908cf66e327761c2e075580c0fd47466d02
- SSDEEP 384:3fSzdiw/AuYKDW/SSg5qGhei0kLmmZXLVyRohwhxrqwmzSgaVAap944G/NW2TslW:vI/ARK1Sg5nZXLVyRohe4zFABkMk7
- TLSH
  T1CB031A0457FD8637D4BE4678FCB2051047F0F543ED43EFAF4B94A19929A73A4C891AA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  microsoft.windowsapicodepack.shellextensions.pdb
- Size 73KB
- SHA256 5063907c80d2c9c213e4aea4e87edcdb6a84e665a18169eee3615ba75f898e9d
- MD5 e3cb1ba8979f22cff9ba6279ff9979c0
- SHA1 569f77faa0af367e69d4aeaaa5856cbe9b818c56
- SHA512 102af11572fcf006e9176b53f01a180cac5da54e5282090f8fa6d0cd1faa900c8eb806a63a8422f91007a89f6b3c1e0c89278a2eaa9b8feaa4af11b835dc2419
- SSDEEP 768:akevjx+XXUpqs3h+b0a5z50tcrdr9+fIKhwE:arEOT+b0ab0+rdrmhwE
- TLSH
  T187732E47BFA5CA32C46AC538AA9B0F6D5778ED949B825B8F5399B01C7CF334A1C81350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  microsoft.xaml.behaviors.dll
- Size 143KB
- SHA256 2ee6a286cd255d180bac4a5cdb97c5f27de2be6b3beb3451f8d77bc94fa59538
- MD5 17ce3e7564d93ad1e96f82044f4ecffd
- SHA1 f6e9dd67bf6f156c3a8c4ad8e05df8945eef8e9a
- SHA512 9b21e6e451b67931b09a32a09f979b009a2e8298deaf53bd29dd39c985996a83d56d7de910c80471fef8e8b30276d646e59237d6f7523178d7829037e51456a8
- SSDEEP 3072:7r8zYnrXNHgxAVop9i8eC1dtcLgEEjn5rCyjYJ:v8zYnbNgxAVop9ZEf
- TLSH
  T1A2E35C6653FC8A29D7FF1A35E4B451208235F743B963D78D5E8492AE04E3782B6112F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  microsoft.xaml.behaviors.pdb
- Size 471KB
- SHA256 90703707fa383d60f00b104f107a5448d5cc4e4afb64d7db494c0ec3d1e813dc
- MD5 19d1503d88d0c06045ec346f10074225
- SHA1 638bfae7e669203edd62264bfd0cfc7608616cf2
- SHA512 fa8cee1df2246a891839a8aba4a59cbbb51c21694318506c05f738025580d1e15aa47381972f278fbce015dba1398a45544f0fcf53932307dda0bafe8639d157
- SSDEEP 6144:IaW1eQIbt/UHcniHIdmOp8KtSckD9FIdYKtSckD:9gbOps
- TLSH
  T1F9A4B223BF44C633D91A94385ADB4F0D123CE2CD5B83AB4F6B85B11C6EE23996D47294
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  newtonsoft.json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  observables.dll
- Size 72KB
- SHA256 66ab0daaf11fcec582d9eb89b3a389619d3d8eff17c54fa726a633150bb509a6
- MD5 fdd556b472460769a094c454ac55d6ab
- SHA1 a9230e51362c85c71d725cde42ae622782c069e9
- SHA512 5e1155053b4cd48e577ca97c3729a4de6ee1dbc798afd197683c0aeaa1cabd81fcf42c6f973db10bb827a0b9e72317e9549d3f63c972d411dcee480993d32404
- SSDEEP 1536:K+dHzBn8sLJgf/GTJMpOMcqUHmopuJvJ4Fvr7cUYLnbbhxTM:Fddn8sOONLx7chnbbA
- TLSH
  T1D4735C00F3EC6A16E5FF9B3FA97411414F36EB4AE063D39D19CCAAA91C833468C65752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32