591843284a5b4609ab876512dab4564a0e9ff41ede6383d670aaa604391bb776

Sharing

Copy URL Twitter E-mail

General

Target
Vozolomis Setup 1.2.6.exe
Size 107.1MB
Sample260816-cwne5syve1
SHA256 591843284a5b4609ab876512dab4564a0e9ff41ede6383d670aaa604391bb776
MD5 cc81d880f486cf4a6829b49c7793ae83
SHA1 0fd79885fceae4297772a2b346e559e7a641ea1e
SHA512 e099a7ee52e7949e26f67a6425a232a0eebd8cd90b41ab35a2c3e09086a7565740db41f17059d2ca04c7a9f6dc01ae961398138f57d4209a555ad0cbf6de11bc
SSDEEP 1572864:m22Y/yHTePlTNuidHzeMwjaZHwXf/GWNMG4XbVJtlJE720/1Wr6JpCNX0iWUbzKz:m22YaHElxu8epGns20eApCSWbzKiu
TLSH
T18A38337F92D9B633D5AEEFBF4EAB5E840C62AFD4106063790F692C4D1868CA41351633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Vozolomis Setup 1.2.6.exe
- Size 107.1MB
- SHA256 591843284a5b4609ab876512dab4564a0e9ff41ede6383d670aaa604391bb776
- MD5 cc81d880f486cf4a6829b49c7793ae83
- SHA1 0fd79885fceae4297772a2b346e559e7a641ea1e
- SHA512 e099a7ee52e7949e26f67a6425a232a0eebd8cd90b41ab35a2c3e09086a7565740db41f17059d2ca04c7a9f6dc01ae961398138f57d4209a555ad0cbf6de11bc
- SSDEEP 1572864:m22Y/yHTePlTNuidHzeMwjaZHwXf/GWNMG4XbVJtlJE720/1Wr6JpCNX0iWUbzKz:m22YaHElxu8epGns20eApCSWbzKiu
- TLSH
  T18A38337F92D9B633D5AEEFBF4EAB5E840C62AFD4106063790F692C4D1868CA41351633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size 1KB
- SHA256 3043aeba077d86d8b2e7fbbd6e1ecc3438c65ab184a2bda9fa0179976c5b0170
- MD5 526095b58d1cf0113586690f4e449a40
- SHA1 878de5a556f1d56afdc1eb9e1eeeeda6b23bd7a7
- SHA512 000db3def9ce5a4cc615fbbd57b2b8077bc25e04cbb34744293ab18e89be1f6534c564d3b8d2ae3d515f6ee5b1c6b003a8601a39071caeba93c5cb8e5badb16f
- TLSH
  T1A121AC1B2BB19C76C223B1C3161AD412AE61813B2E19EE1D7B5C43EA6F14450FC82BB8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/@primno+dpapi.node
- Size 134KB
- SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
- MD5 5dc8861862329b3b4122314922be3ed9
- SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
- SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
- SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
- TLSH
  T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/freebsd_arm64/koffi.node
- Size 4.9MB
- SHA256 ed3a577e8d01f488590d65364ece2efb571e2bb19cc9812fcacdfd6f5d3b91cb
- MD5 d5858c4f7a763969fe697af51d625e73
- SHA1 79695e698c17b3c55c8d39df4c0c07d74fb8c788
- SHA512 af19dde48642e8510758d7ee8b7fd843bbe6689634af2fa37286cfb9d21966739a738314f9ed25b866854c2d606f8c777eb5c47b7626393639823d2f9b6658e7
- SSDEEP 24576:WcM+G3VGB5m962Jk/hdEDUAWQkqDxaqkrrzz+l8BmY5Ux5VukqS/5m9:Y+CU532JuEDpvMJ643q7LqY
- TLSH
  T18436C1B7A214991BF3BEFE7133A1037AD693A83323F45C01AC45691CD6D53F62A3461A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/freebsd_ia32/koffi.node
- Size 4.1MB
- SHA256 95a6f5c09aa8c1abed9c5779359af0d441f7f3e6aebd9cb435a41440c4bf7c59
- MD5 4f281b1e66baa8756961d3c26ad1b4b5
- SHA1 2a5eea9794c3c77a39c2b5e932d36dddc0d1bd0c
- SHA512 956945f1d925c9d99f241c8635b63b68f7b5ad89b09ea2e122cd1a3aa8a673572e7fc60b2a78f7207d1319179e2bbed9ea1a1cd2e662203d26ec436bbbb42759
- SSDEEP 24576:2MbSSlopXCPENyo99sdlD2JwZr749wQ2VM82bNmvhqQ30htJ0YdvLO7Sy934QB5w:Vopyeq2JY/49dK2bwJqQ30htP/Iilmd
- TLSH
  T15616F1439C4F0ABEFEE90270941B97A355683A073AE84C67CE117B0557D33B778B6A81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/freebsd_x64/koffi.node
- Size 5.4MB
- SHA256 e0ecdd7d810c293b16969a4ebd3460b6ac66dfcf69f4bcf4e651318d8ac78915
- MD5 feef58edafbfa3473b930ab7dd1d354d
- SHA1 ee53d858e3a8c1900e85723318a5443443f947f2
- SHA512 54dbeb369d743990bc414087dc2ef0c73bcce4d2f2b52cb18ecda1068957d2c2f8d3a159786175ec229ef8fe19056f072f2e374e70c648737b565dc46b160b49
- SSDEEP 49152:BI7bbFWCGYlZQ2JvngPZIsX50CneZJ/B3O7L7XUKh3yzQT:BUCYlS2iG53O7PDAk
- TLSH
  T1274642DB620810B8C3BFE2F0786A5E17E5B5745776DC7D25EB4847000BEE7223A68B46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_arm64/koffi.node
- Size 4.7MB
- SHA256 3bee3cc0c728cda7285a8eacccef29c6762416666191e05de8213bf989e538d8
- MD5 c6ee214c49d7d469de05df4f15622acb
- SHA1 85550693aa78ddeb857293f06d2890523027c30a
- SHA512 a655682aaea44cd090eb778b5447ab23ecb0aff9ec8fd1887c9710219adba1ea9800bfbfb59ebff60d01e1d37727415f9f58b804f1193bf35422a7380b50c424
- SSDEEP 24576:pDZoP2TPJNU/6T0Ql+LRMatnykqwMgoIsXjgOjOthFe9KLe2TyNkR8R:4P+LU/6Ll+DDroIszgOMFoKLe2TyNLR
- TLSH
  T169360267A159AD12E3BFEF71726143BF8763A82333E15C02FC046A4817D52BA2F6C516
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_armhf/koffi.node
- Size 3.6MB
- SHA256 742aa4c9c007163dc3c9e10006036445b31ca381988fbfaa55836d9cb07ff069
- MD5 f7331b2f831e957f5dffc0d4f826c023
- SHA1 2dbee27a0dc6e22f6a015238ffb6a1f867c8e456
- SHA512 352abf123dbdaba5ef36924577e91b50f359a48106749d8829da7fcb9c5ee9784967c75b77e6f3ed6341967415f095ae0f507e525a6ed8ace10b2daf930ed383
- SSDEEP 24576:W1POF+5VJe7TdGFUpRb3H+Fr+xEOV2J8qyUUIQSW4di5RAL:WRaGSpR7H+FrU32J8PUdW4ocL
- TLSH
  T1EF06A002210FDAB4D7F949B5A0B5660F6C802F23BAC6DE05EA5455632BCBB63373D8C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_ia32/koffi.node
- Size 4.1MB
- SHA256 c59b226005144c66f44cfdea5ba2101222ad962bf9741b9da30b36098becfc92
- MD5 d97b7d4e2284aca231facfac932ef7ff
- SHA1 8a3c760ad7126d46d09e646dcc1ca9ed557bb06a
- SHA512 81fb0fcb9925225dcd0498f26bd54b66df5c0db7435ca357deecf5c80cb4012ae050176df96750e8e102416dcbe62971a8b6f534560b9df5b09606c41b86ea7f
- SSDEEP 49152:gVHd4l4Oh2RUj8spyjnMlgIVat3FXVkF5Fw:g5d494RRxjsg1vanw
- TLSH
  T176161253AC4F5AADFAE602B4641AD3A345443B0735FC9C72DE107B0977D23E378A6A81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_loong64/koffi.node
- Size 4.4MB
- SHA256 67e72e4b302683e14dd075b20cc23b5bdabe468f96ce638f476e9078c0052374
- MD5 83c2a03e9a67db73b63cb3db35efc11c
- SHA1 d99d479b619f397d4d69d0aca01e2db2165f9c62
- SHA512 10111588634975876ab4bbcc00797b2b4711fb44e8734112657a9e643c40f683dcd40a425b662d10821f793680b5260a17071c84adc3952d6be68942c683113c
- SSDEEP 24576:GclYSrOqlWOTJO6hBBj0wtPnER4FHoN84kH9kjHFjw42lgK9zmOunx6ecb6V:fAO3rjOfSwFjw42lgozdEjPV
- TLSH
  T16926E192B16D2DF5C3E60B31B8205752B9EA3D4BB3CEDE54DA24C2C317DE3A27406694
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_riscv64d/koffi.node
- Size 3.5MB
- SHA256 e665af5c870c8723db5faa886e099fa0ff23bbb97f66649f7f2b47d739d7e548
- MD5 4c9f43bdf2240f5d40ef708aa76ea028
- SHA1 162bb2198562b05b60179b9267a3c642bc79d839
- SHA512 90dee4d94eb20a89a8e0f2ed3ecf0abd155bdc1ee7e8857bbd6595135189fd0c0fbd0de7619833cf9c3dac8cd9fcc3fe3437a4208206f0659327307b9c031513
- SSDEEP 24576:AQv4BEJqJOPHNeeeeCCCCCsxmVMpcR2zSmoMAZtCOcE6fulg9D8F48Y:COvNeeeeCCCCCsxmVMpvslgaY
- TLSH
  T125F5D05A1C0958BBC7A71B32BDB54A2312E03AE77BE2BD518980331097D7763FD191E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Network Service Discovery

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32