7fb9c527c10866b427e4b61fb414aecfb3ae83c43704ac9ddb8f00805679aa74

Sharing

Copy URL Twitter E-mail

General

Target
helium_0.15.5.1_x64-installer.exe
Size 123.5MB
Sample260817-ypbcwsycmd
SHA256 7fb9c527c10866b427e4b61fb414aecfb3ae83c43704ac9ddb8f00805679aa74
MD5 99933476a9e151c0b9cc136530ce7a46
SHA1 485c7795a918f68e6e98273a9e67c259f1fb96ff
SHA512 c90acdec157c6b58e303b051596f474ca478387e58c23be9002ef7291ab1a6ed12589be5231d4ded722ded7fe0d04567125dbf14353999fe63da5cd9322d0c9c
SSDEEP 3145728:ia5tSCklX2VjC/oYj2VMKl7jYkuFwQxxyO4dEpf:Yh2VsK9l7jduFwcaq1
TLSH
T16C583353F3A600A8D46EC978CF7D91225A357C4A47B493EF26D432E61A71EC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  helium_0.15.5.1_x64-installer.exe
- Size 123.5MB
- SHA256 7fb9c527c10866b427e4b61fb414aecfb3ae83c43704ac9ddb8f00805679aa74
- MD5 99933476a9e151c0b9cc136530ce7a46
- SHA1 485c7795a918f68e6e98273a9e67c259f1fb96ff
- SHA512 c90acdec157c6b58e303b051596f474ca478387e58c23be9002ef7291ab1a6ed12589be5231d4ded722ded7fe0d04567125dbf14353999fe63da5cd9322d0c9c
- SSDEEP 3145728:ia5tSCklX2VjC/oYj2VMKl7jYkuFwQxxyO4dEpf:Yh2VsK9l7jduFwcaq1
- TLSH
  T16C583353F3A600A8D46EC978CF7D91225A357C4A47B493EF26D432E61A71EC47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Helium-bin/0.15.5.1/WinSparkle.dll
- Size 972KB
- SHA256 adb1dac4dd8fb3891e6ee04b7fc938b28f3c27acdf31837afc590830dd5dfa95
- MD5 5f41cdcda500f027dab33fc9766d6085
- SHA1 83585125461edc371d1b07090c975ddf53cd7c43
- SHA512 d02ab4a13e27211fd02e14790e6a05f766752377916cc8d1be5565fe5db366f0e6699cbf4dadba1716d8e1d0c72a9bfc2ba64292359fbd09e2a20537db1586ee
- SSDEEP 12288:b8RmnDXtBZTAvv/IImyRhlCJLtXhRZrCb6ecUBOSkHc9wOaanQ1xh+s70Wc9eP9u:b8KBZcvfLqLxjZrCb6bZYaaGCe4eT8+e
- TLSH
  T113258E06B6D542EDC06AC43487578173EB61BC9B1B25B5EF02D0F2692F77BE05A7A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Helium-bin/0.15.5.1/chrome.dll
- Size 277.7MB
- SHA256 078cfed9f456f9fc94321fabd159bc24b0b2b847440f38d33d9c8c27842ed4e4
- MD5 0a4bbb5e53c7cbb27eea628d1633910e
- SHA1 f152880e3af19b53df8afb48cbd216a23aa6c1a1
- SHA512 0e622e5add171c11780c9da950f65bed5af3deb2148ddb67b2c36de8a868a00cdee6a8e1f170a04301a13eae703a89413c5f2eaba58a672df5e7b9e3aeaf6c56
- SSDEEP 1572864:k0iLGdxIQX2uzSGtvfpwF8MNRbul/e+3PyIC4DBhnr31kW+eb2TpOgyUSB4LVbJW:LpwxNRiUeZDCyecTsxFxf8
- TLSH
  T162D87B03E29A41D9C05DD1799B5A9633FEB1BC484B24A2DF0B5057922FB6FE42B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Helium-bin/0.15.5.1/chrome_elf.dll
- Size 2.6MB
- SHA256 a2170eada4b7bd1fa314b7bb9c11749afe73f16d290a0d38357b9e5ed0fa09d4
- MD5 d7c9cc03d45fdf270c56b45fba8821b0
- SHA1 ae648a47db6fe1a01c6c82a850432687a7b7fa42
- SHA512 f7e4d2ffbed4a9a88d221c7d69b2da14068dcc0bd03b3603bd411d7c4f0c5f806011cd9b565285f4e7bf65be7804628a8bfbd90211ba10ed1771ffd5a7ca8881
- SSDEEP 49152:z8HYbj1CTM10qg/AiCg6sZYnbjJDyNvJSKwx7Gi5WIAyYp:l31CTFqOWbT5p5rHs
- TLSH
  T1E1C57C13F2DA01E8C05DD1788B5B9232EA61BC854B35B6DF0A90B6561F7AFE4673E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Helium-bin/0.15.5.1/chrome_pwa_launcher.exe
- Size 2.7MB
- SHA256 3c0a7301c6a9b0e09cad482aa92fa49bb357d5b6066ba3a6d146a956dc58cde8
- MD5 504babf781b39a00354ee204eebcbc6c
- SHA1 b3e8885986a1de88318b8c944f5b47c379e95351
- SHA512 5b9290f71cff9cbf923b966e969a52428d68657ef50c61c8d7daccbb2fcb1f3571acd5469af0dd49ac65a2bbd743bd12ebef24c7abb4e866e6f12a9406ac4f5f
- SSDEEP 49152:OB4v3eujRTKeUcQCBWIQvFDh0OwbSIzJEgcdWqe/:73LdxJPcmEel/
- TLSH
  T137D52923B196D0D4C00DD074CF165BB2A6607C69CBE5A7DF06D87E217B36AD07ABA318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Helium-bin/0.15.5.1/chrome_wer.dll
- Size 122KB
- SHA256 ed97d0ab059d8e9ca8351fbb06a9fa15d6ff2d26cdcaa08fe72943e6f552ce85
- MD5 00a343d9ceb2ce8240ae121950103c98
- SHA1 1e65bd36f35f21baf933cbb51d8460f05d12daa7
- SHA512 8e00e12e936a0911a20285118743051a7d69914dc0713a80b9ffccf027e6cfc090540e90fd8ae75a36dd98258b4e1913b844b94ae433f0cead397a7cd61336b3
- SSDEEP 3072:KU10EZFpjpYbkOzrMeDEYNvhgeYnTVvC/8wZkSk0CzXh:F0EZDq7rMeDEsvuSU
- TLSH
  T10BC35A6B57A500BBE1B7863484A34E46F776B8520720AFFF03A4465A1F237D19E3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Helium-bin/0.15.5.1/d3dcompiler_47.dll
- Size 4.5MB
- SHA256 82981312525533c44822d54de548c1001071c78ab57a542f67472312612953b3
- MD5 d39d758f8705fe7a58dda3897e8ad8ba
- SHA1 ce22e2438f07b1b15039251b9f4b2fc23846e22c
- SHA512 d1f6a2293c52d2c09ba42dde2377db73551abed13a84587ac8a4a6ba9bdbeb646395704ecd3c255aa48217ae9562b799b3ad62551feaca6dd836ecf5e76f2a7b
- SSDEEP 49152:P6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/t:PUdeqt737jFm5wl
- TLSH
  T129268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Helium-bin/0.15.5.1/dxcompiler.dll
- Size 24.6MB
- SHA256 6a6656b26ed69c1c4fc7c712a3349f4ca41645fe68ab589dca765bbc7d608228
- MD5 ff4cf904aefa8c48def0f3bbe606d40e
- SHA1 4706c07a066adc044caa0da18561bf915772cf81
- SHA512 1d95a755bd3cc99f44e9d2675eb4ef9f08e0fcd3c712cd5e2a3291551f960cc65ad0368ef207adf2bde50c318f26d1b97dc6dfb3d5f248dd60933d2c1177b3c8
- SSDEEP 393216:lcDP4Rf8ThRFY8Pgy/GRAJdutUrhvu4fb5iq:fZ+Pg4JdCUrhpzQq
- TLSH
  T101472A122646D49CC099C879C7678B26CA6C30E73FA7B9EFC0F451212B79DAC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Helium-bin/0.15.5.1/dxil.dll
- Size 1.4MB
- SHA256 5b2923af6f4f075386b14696ade811db009b2927c2ce27ba99f51a770e18b0b2
- MD5 afa5667c953ab3aad3e93b4e269eb4a2
- SHA1 59ad99101539a258f9571c5882d3c7e2d7ed4570
- SHA512 f633df92453b3057d92b02d0905fa528887e3b273646010ace089f6b170d177bac762e5bfac4528431eef652867537029018a48753f1c808672f7bf6c861141d
- SSDEEP 24576:QcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/w:QsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bt
- TLSH
  T1B5656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  Helium-bin/0.15.5.1/elevation_service.exe
- Size 3.6MB
- SHA256 bff9f5f4e0ff360053225d84a49fc1901a4a218925ee85a06096f53dd624788f
- MD5 f1fe76f1d88ac04efbd50439fd24cdc2
- SHA1 d3ad508485c7e0a7fbe99a84cd966ace890674c9
- SHA512 afdcbf936ce56680d10cf3002fc5a5b663461a7cc42829cdb69dfd48f45a85f68f58cf59cfaec9dbeb1ab45c9bdf6bc2a4090ab723d6d0599ce225b74589c4f7
- SSDEEP 49152:J1lNQ9vhGYq6SFMMKJC0iuJqPnxOAP/pJLBNhY5tCw4DDSHYL0Irefb/fS1W41wd:jXYqy3kbrp5rUiwd
- TLSH
  T183067C13F2DA01D8C059D1B88B4A9233EA61BC455B35B6DF0B9077122E7AEE49F3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Helium-bin/0.15.5.1/helium_update_helper.exe
- Size 2.8MB
- SHA256 113c7f3f0ebbc520ae62d73e523f987ed53c4c99ea50ee6d8573bb5c6ba87d5b
- MD5 cce29a40bbc1acd9f7321f6585696eb7
- SHA1 e439662f337602a4e5e02b167a74c59dba16fa8c
- SHA512 a9ce468fefd03a1e737c9233b297fc467b6ecad185341d3b4c0c75e8b4c463f54953ab894f41b62c3d6617d3cd773debf875807d0ac040f3ccd173ccc426c960
- SSDEEP 49152:PdiYFr5OXjn94+kLXyilzyywfWbCfaiMMgKTW:5HOXJuZdCTM17
- TLSH
  T172D57D13F2E901D8E0BAD6789B6A9233EE62BC454B35B2DF065072151E75EE09F3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral19
- Target
  Helium-bin/0.15.5.1/notification_helper.exe
- Size 2.6MB
- SHA256 bd8ec8f34530bcce902e66b8240a34543f3ccdad7ccf9034a861dc12b88c3266
- MD5 58d2778fbbd1c90162e678cee9550213
- SHA1 b016a7642a0403dbc17556e3284552c71277555d
- SHA512 df190f612d5a06e0b133cbb777864c597543e1c7b3487a66244011e3d709e93a1985d1b6f8236ba97813de2c14b4333cf44d5d03339590d44a78e0d69431b325
- SSDEEP 49152:LMLCDzqTOjQ4B0OHEU589cnoE/ewaTLgmRrVlHg5l0ay/j:hVQu2JM5BulSPyr
- TLSH
  T19CD57C13F2D901D8C05DD1788B5A9233FAA2BC490B35B6DF0A90B6561F7AEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Helium-bin/0.15.5.1/vk_swiftshader.dll
- Size 5.2MB
- SHA256 1430f7d64632e20bb5a6a79d535599e94bcf5a8458316cf373751a693a5fb70e
- MD5 b1234a8397737068c7215bc1b514361a
- SHA1 63803f2ba2676d92d46bcc044f5832217a7f3a64
- SHA512 a54d1655d34fb79c7ebb80fd91c0cf2a7018882151d20fe3cf4a70a6b46064ccc9ea6ef8545d7543a1a1021180e26f193baf4cb6458140533fec16b7bdb64408
- SSDEEP 49152:OEjlXpakvNfUxoZZa/Rxhq0nbc4e2oNxzrwB2vF0aTkgkF3pilUo+uceQW+d+OYx:OEjlXMpbcZ3U64nqX/fYH+p
- TLSH
  T19E463803F28680E9C06DE579875EA623B231F8840B7676DF66A01F192E79FE0673D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Helium-bin/0.15.5.1/vulkan-1.dll
- Size 959KB
- SHA256 a9db241b67eea08c039282888a7dc4f59b36e5533dbfd04e52dac17c338c88c3
- MD5 117d70480ed7959fff2d527ab8c79d45
- SHA1 bb8570e1dfd64fc656582bf3cac0ca4d0128e09d
- SHA512 009f1545c65b8d2169604713e323ee79d08609d7e55e37b20980f0e2608ade3a317d15192d4d2358b6e0b0b3eabb5bbbe4bc5e7f03d1a63bbb81e0eb61908bbe
- SSDEEP 24576:4N/KQywiXpm8mFpCbdEbJZ+gkkKNlC1EoDkw7+DV6g3v0TAE7yoeHXVof:8W9Xpm5PCicgkkKNlC1EoDkw7+DV6g3g
- TLSH
  T1AC257D639A948AA9D676C034D9D18A03D9F074811332B6CF06B417186F6FEF07B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Helium-bin/chrome.exe
- Size 3.6MB
- SHA256 3e43e3fed800023c2aab5c51978996eff007467cdaeaca3484d4a4e946db6d0a
- MD5 3d1eb6f388b8b168939f3a40d2ecbf81
- SHA1 be7b9f07c2fb3275db25a17500a63aeaa469d8ef
- SHA512 7070a98a4d9c7aa8d9bda15f60bbe64a0d406c0ab8ed8cb12ffd133689083e120968425ea2d39d06e5cca56bacfc629d713be4b349fcd67013d4c90e16e96819
- SSDEEP 49152:OCcE9Y4jIMbZkVRknUgLiQXfXPJMLHh+mKw4qJBwp79J/IWcWAIeOjswHhn:OcY+1nUgOQXffJM/Pg0u
- TLSH
  T1F1068C13F2D910D9C01DD579875A9233EA62BC454B31B6DF0A90B7122FBAEE06B3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23
- Target
  Helium-bin/chrome_proxy.exe
- Size 2.4MB
- SHA256 268793a792e363413c958eaae932044f920f4277f489c737fc6d2ff922d22c11
- MD5 0b2a71abbd8ded16f58bc0a77212db6c
- SHA1 5f46c60c9d5e95b6cffa2ade9c9f12baeb68dff8
- SHA512 c9f46c7ab56294e5609278dee43bf7b96668c3dcefed9ae697a658a0532acc2412961be75ff9077c6f26c013de348b2d7967ff3c20258bfde5b148b8e564dee2
- SSDEEP 49152:66OJP5k/zclabUTdBRstU9sZ1wPb36g9DTzqB9:sP5k/olTlB3hfqB9
- TLSH
  T117C57C13F2D911D8C01ED1788B4A9632FB61BC454B35B6EF0A90B6561F7AEE45B3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral24
- Target
  $TEMP/helium_install/setup.exe
- Size 5.5MB
- SHA256 c69edb34a72da0d3854a953161f6e6334621ad91778760134a6a90e0baab51b4
- MD5 9bfe135fb72520a69105e7602a729d9b
- SHA1 50a2f9348e1029f0791dcb352f6ec6390f274ed4
- SHA512 32f386b811892a157cad50b87c8f5979a6f3dc709b5a6e4eb73c064a6698d43b393cccdd3e4ffc224171db783a4a967a3a83ae182e5c9f673e123309ee4098a5
- SSDEEP 49152:4CgiEe6qSSzGB6zR7x0nsToAi0dY534vQga10pWyY8u9v6yFcA2M28AR4fidjtP4:OPGUnX4EIXpIyey5LG6w9
- TLSH
  T19B465B53F2A511E8D06EC974CF6D91229A257C8A47F1A3EF29D436E11A31ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral25