29cbd9d9bc6571d15d6a2b29dd2532fe6c7fb81d255778deb40f64dc79502bf5

Sharing

Copy URL Twitter E-mail

General

Target
CL-Eye-Driver-5.3.0.0341-Emuline.exe
Size 5.2MB
Sample260819-ac94pavvbx
SHA256 29cbd9d9bc6571d15d6a2b29dd2532fe6c7fb81d255778deb40f64dc79502bf5
MD5 64112c1df0d80d195d006da9c15bf710
SHA1 f0bfbc32171ecfb03614470b9c06ef34c07e66b0
SHA512 eefac2d69ece3ac07745a71c6e895200f1fb1b7c1f144ba44fcb658f9232bd613d894929bb81f24d86815eb09f87757b96277f7cd0aa40b1f092c366b54bc1c6
SSDEEP 98304:4cf1PgNuKGzp9kp2aqDNsmXWtKI/cdVo+J2v1I54UJV17j7MayZkxMCOaX:7xz3zApCXEtECd64eV1TyZkxJ
TLSH
T11B46332AEE8625C3D04764B4053A57F487E197D371A4600B0729FF2759BB23A1F63CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CL-Eye-Driver-5.3.0.0341-Emuline.exe
- Size 5.2MB
- SHA256 29cbd9d9bc6571d15d6a2b29dd2532fe6c7fb81d255778deb40f64dc79502bf5
- MD5 64112c1df0d80d195d006da9c15bf710
- SHA1 f0bfbc32171ecfb03614470b9c06ef34c07e66b0
- SHA512 eefac2d69ece3ac07745a71c6e895200f1fb1b7c1f144ba44fcb658f9232bd613d894929bb81f24d86815eb09f87757b96277f7cd0aa40b1f092c366b54bc1c6
- SSDEEP 98304:4cf1PgNuKGzp9kp2aqDNsmXWtKI/cdVo+J2v1I54UJV17j7MayZkxMCOaX:7xz3zApCXEtECd64eV1TyZkxJ
- TLSH
  T11B46332AEE8625C3D04764B4053A57F487E197D371A4600B0729FF2759BB23A1F63CB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware trojan
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CLEyeCleaner.dll
- Size 81KB
- SHA256 b6cd1d3cf1c570888aba3eb54a51352fde7fc8e0dfe0e92c6e2b89f7f9acb7ff
- MD5 cc59b63dfcc157dd8b964dcd2dbce1e5
- SHA1 18b387086f3b18a93da1358d8ad3d8e2f3e226cd
- SHA512 bda7c0ff5a95ee9e0764b2dd11b100ebc7d4c0477a22cc711cc6181c2d9c5f39d56e6c15eb99af6ec90a6b43cdaad62c9fbd0a1d1dfe1f1d03f56a1c12d52349
- SSDEEP 1536:3d4bBq3zLknOF403QN8OomqMDBsgsDPmkpyU598o76mmj8:3d4bBczAnOVxmTZsDPvL38o76N8
- TLSH
  T17A836C21B790C076D88A2A308869C7735B7A79619FF4C4C37F9517B96F603C1AB3934A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH
  T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- MD5 acc2b699edfea5bf5aae45aba3a41e96
- SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
- TLSH
  T19BD1E73D75C33DB3C54ACA762C65292B0FB8C9261B5402119B6716C279D5AE3FE29382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/wdreg.exe
- Size 142KB
- SHA256 5957f8a0bea130c6c4d91af8c5d6879943dc76faf1ebb50a70e3bd285fc8d86e
- MD5 d0047e39b0dfd11ec2a50e2a45c2d9be
- SHA1 7dd0c7c4689aa4c70e3ffad86c2336d0785283b3
- SHA512 4807e11cdff1f5fe78b7172cc0170de51fa97997f0096ef44e1c6d159df7e933889e64a368055cac5c57f5297478f1a035e0402818ccf33c540503f36305a64c
- SSDEEP 3072:pDsy3Iz27vf6Uz4wtApVzVH8csZm5Z4GFQeLn04gQAL/iha8n:pDsy3K2jfewtApTH9sc5Z70n
- TLSH
  T14AE34959736151B6E463C17EC9838786EB32B4158B3113CF136A977A1F233D2BD3A621
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Manipulates Digital Signatures

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12