de41a1bbb7c7d7719c5fc70bc543607614407f4115bb1565c29e39e5d6f06aa1

Sharing

Copy URL Twitter E-mail

General

Target
refleks-0.9.6-windows-amd64-installer.exe
Size 62.2MB
Sample260819-1saa4sthpf
SHA256 de41a1bbb7c7d7719c5fc70bc543607614407f4115bb1565c29e39e5d6f06aa1
MD5 fb5af12bbdad4ca8bc25b6cb6f495de5
SHA1 71954a4b7559ec46ca87d1a0f007ff44fe7e9b2d
SHA512 b2881bf84eecfcad430b9163ebe2c0b8992f47fc23f7120ab709c55816b28e2162b56fc8fa8eeaa2660c96e028902756f062c859fc9ffc36f91b4d14fa1c000c
SSDEEP 1572864:YAnBSzwydYVVAfyxAzC0u1d6LoMnfW5sfIB7TYigRCDtMrKXqaLjT0:brOhf1zC31d8nfW2w5TYigIDmrK6aHo
TLSH
T10CE733E4A6F9B0B8F063D4B9D2B7E5D747F958314F118B0B6350032B9B2A18BD27B065
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  refleks-0.9.6-windows-amd64-installer.exe
- Size 62.2MB
- SHA256 de41a1bbb7c7d7719c5fc70bc543607614407f4115bb1565c29e39e5d6f06aa1
- MD5 fb5af12bbdad4ca8bc25b6cb6f495de5
- SHA1 71954a4b7559ec46ca87d1a0f007ff44fe7e9b2d
- SHA512 b2881bf84eecfcad430b9163ebe2c0b8992f47fc23f7120ab709c55816b28e2162b56fc8fa8eeaa2660c96e028902756f062c859fc9ffc36f91b4d14fa1c000c
- SSDEEP 1572864:YAnBSzwydYVVAfyxAzC0u1d6LoMnfW5sfIB7TYigRCDtMrKXqaLjT0:brOhf1zC31d8nfW2w5TYigIDmrK6aHo
- TLSH
  T10CE733E4A6F9B0B8F063D4B9D2B7E5D747F958314F118B0B6350032B9B2A18BD27B065
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 31KB
- SHA256 034ab79a1f628ec24ac30ae4b3393880104d01d24c62eb8ca28bb65c1ab7d361
- MD5 e1c8a8b86f47f60b9db4dc97f460d1c8
- SHA1 77ed9ba90db069b693f0ff8ad178ee366f392890
- SHA512 834c34bd18e864403241090e04ecb3e89ab698f4fa8c088392c7c0f7f6c7502a68a8e5462ac148bd8491c9b2d3a9cbea27d58994b03eadfb17717216bcdf4331
- SSDEEP 384:X9a66tMa2teJA4nLzCEvqTHqYkf1HqLDdxYkvkr8pBex1Fs6rkSFaIS8pmGh0q8z:taE2Ao8ifdmDlvkDLsAaGMO
- TLSH
  T1DEE2290DFE82A5F6C532E5705AEBD3BB8A04B437D8224F47EE274F4A752B5B0650E211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 db6b3d7276c551221d55520dfc94acc175d2dcd7370ade38a667bf0fdf6a9cfa
- MD5 d04a06a05a6aee6b49baf107edc1eebb
- SHA1 7c74c9317588dcb9004746d288caa82cf788c0ff
- SHA512 3e7ce0e10164f1c80df102066cf2338498fa0e35f425abfb698a1a1dc95c1bb6460e2e5c2c53a7a5d3843bb4480308cca35ad23e852c28cc9731941b85ba6c88
- SSDEEP 768:0S7Mk5dmwtmKInwop3Rrxv8UeqYFahSTmB9K:z7Mk5d5mKIRpBqUeqyfk
- TLSH
  T135D2190AFA42CCF3D072D67488CBF63789166D3AA72A4677FE6F4E197C27650590D102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- TLSH
  T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 10KB
- SHA256 61f0e47b09316d39979c62a05403a3baa3ee58841dfd97cc00fb4dc086843815
- MD5 aac4f3facf83975d0cf2b02200ae8212
- SHA1 8ea89129df40923951610b6f003c10ab7c5cb238
- SHA512 b0d4a5f2c129ac39e55ee20ffcf8fe1306b0ba791ec9ade8249a3304e091941476a032089e22a7e1ffb709f6e0a591d026091707754a387e147fcc6af996336a
- SSDEEP 192:CCtx8+SjrhYnUMu3Oad9z3Ykv/RWwCh3srduaO4:vx8+SvhYnBu3Oad9z3YkvcwCh3srdu
- TLSH
  T17B2296C9BB0579F5D0639934B18AF12F4DA97C31CA2B840EE89A1E35B82F5E4571DB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral13 behavioral14
- Target
  ffmpeg.exe
- Size 138.5MB
- SHA256 3ebf49bddaec6425317c6d6fb1fefd0062807bd645b00edf1d6fe8df50f1c2ec
- MD5 d04832a064e7d5c8834d44d1d475d933
- SHA1 066332f9fde56967e0d13af8bb4e1e421ec8f6dd
- SHA512 ba1aaaaff0615bcf9e30be26e94da453122c398f0bb46735ff93996c4a48ee79e33472c231a7301f14d21f7d081c8d723381fb9e32575fb77fc5dc015b16bd5f
- SSDEEP 1572864:8sX05yRjFu8Cy5mVtPxBKC9S2VtMwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfaj:RjwtBx9P5
- TLSH
  T122687D8EF1E350ACC12BC4B0437AE773BA24786D11246E7A67D5DA302E62FC05B1AF55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  refleks.exe
- Size 15.9MB
- SHA256 28033cd8e6b1b1f866b4cafd8ac3823cd803f7536b6c5494318ee80fa8563c55
- MD5 c7bc8f27ddba46f4d94b38eca1894565
- SHA1 69e1ad813aa511d089f255e21fb45865b62603b1
- SHA512 758a0baad72f3f1bf6d67b95e0de2f842e94ecb572421878d4f27ae4bb3f150b726bdf4339b3b621e6f31da70408190048fe8bcbfc98bef7b808b17c1108ca20
- SSDEEP 98304:+AmoE6AI/xU8EeRQTld+YXDppWSGJf7MWqI7Ds/CLjZ9hgRSIuHSs4IluPCJAnON:+qlxUVeRQztaPLqKfhc6CYaBy
- TLSH
  T1A3F68B47E8A645E8C0AAD134C9A6D253BB707C485B3427D76BA0F6243F73BD09E7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery spyware trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral17 behavioral18