e21a5d144d29e6f4a445171c2d31c1b668a86bfbee400eea55260ba956d1ce44

Sharing

Copy URL Twitter E-mail

General

Target
e21a5d144d29e6f4a445171c2d31c1b668a86bfbee400eea55260ba956d1ce44
Size 8.3MB
Sample260818-q4fl6atckc
SHA256 e21a5d144d29e6f4a445171c2d31c1b668a86bfbee400eea55260ba956d1ce44
MD5 aa63c3ec1a91fe98a17ed8520192a469
SHA1 3b8bc3705abde345c6da8b78e62d2d57c834760e
SHA512 6ff9ce9a72fdf651bd186cb64ab1cab0632f1fe2dde0b61c59e54f3dca3fbd14394279f6a39fbcfbe731509e1076c1355a1e7f21b0e063968d74a9801f37e1df
SSDEEP 196608:T770yAyMGAiGomM6wmYNQScloF9Pvx4tbgiNYel8tAzwH8A:TsOA/omZwpQJGF9PvaFlWHh
TLSH
T18E9633D2C46A8389E0485CF85C721C0CC870AC515DCD29473A66BF9DEB7BE899F7216E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  e21a5d144d29e6f4a445171c2d31c1b668a86bfbee400eea55260ba956d1ce44
- Size 8.3MB
- SHA256 e21a5d144d29e6f4a445171c2d31c1b668a86bfbee400eea55260ba956d1ce44
- MD5 aa63c3ec1a91fe98a17ed8520192a469
- SHA1 3b8bc3705abde345c6da8b78e62d2d57c834760e
- SHA512 6ff9ce9a72fdf651bd186cb64ab1cab0632f1fe2dde0b61c59e54f3dca3fbd14394279f6a39fbcfbe731509e1076c1355a1e7f21b0e063968d74a9801f37e1df
- SSDEEP 196608:T770yAyMGAiGomM6wmYNQScloF9Pvx4tbgiNYel8tAzwH8A:TsOA/omZwpQJGF9PvaFlWHh
- TLSH
  T18E9633D2C46A8389E0485CF85C721C0CC870AC515DCD29473A66BF9DEB7BE899F7216E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery oss_ak
- detect oss ak
  oss ak information detected.
  oss_ak
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
- MD5 7854290f8bc473fb9fad1917b0065731
- SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
- SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
- SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  roleplay-chat.exe
- Size 16.2MB
- SHA256 9d29ec991a2acbb9d9c2560f09931cb8004bac8a0e6ce2efff86f47fe884f396
- MD5 6e034b7407ad106a0ecd25499d989ec4
- SHA1 a64b33b9d75817c8a1aee84c2a5cd9304d47174b
- SHA512 0fc841bea157a7879ddd72bc9c8f3779eb031bdb6d83133da0fa6bd1e90c809dffd5eda812246b1cce42ee4ac02da3749a2bf18f9bb0cc9011b5b4348a42c4ef
- SSDEEP 98304:QjpxM/1FWP8TpiNZQdHybJwbdWFm43Ks9OijhFl/bi+5+niCyrPWVB1DWbkLzyfK:KoDWETSXmui+PE1DFyfd
- TLSH
  T1E8074A57E8A542E8C1ADC175CA329152BB713C894B3063D32B50F7282FB7BD0ADBA754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral10 behavioral9