3b0e98be7407f588b17ff51533ee43b5d54c151b0fa29267e17d1916785f5587

Sharing

Copy URL Twitter E-mail

General

Target
Mod Latino Sparking Zero Installer V6.5.exe
Size 92.5MB
Sample260819-c871bavgqb
SHA256 3b0e98be7407f588b17ff51533ee43b5d54c151b0fa29267e17d1916785f5587
MD5 4e2933262e970ba6f8f81d184cabaf73
SHA1 581209cb7146946f8cc30efc331c837da5f91f77
SHA512 af2922f90bfa6cdcd18f356cf2f4e5cbe34c25f0929e5d922c66f229d1d9560411980f54052c4a5b8b5d54ae3f8b1859a91f9ac794fba63b652d2edfd13721c2
SSDEEP 1572864:mYJGkiIEJrpL3Cn/3vePACA4hnVIh27dr2apNlg2fuq8I0GbjF5sZAMZlZ5l7:hGrfC/fePAmVs29rje2N8OnF5syS5l7
TLSH
T1F7283301B9EF7DEACD99873B66476B2CA408338941DEDC44E13D1270D2732997E2D6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Mod Latino Sparking Zero Installer V6.5.exe
- Size 92.5MB
- SHA256 3b0e98be7407f588b17ff51533ee43b5d54c151b0fa29267e17d1916785f5587
- MD5 4e2933262e970ba6f8f81d184cabaf73
- SHA1 581209cb7146946f8cc30efc331c837da5f91f77
- SHA512 af2922f90bfa6cdcd18f356cf2f4e5cbe34c25f0929e5d922c66f229d1d9560411980f54052c4a5b8b5d54ae3f8b1859a91f9ac794fba63b652d2edfd13721c2
- SSDEEP 1572864:mYJGkiIEJrpL3Cn/3vePACA4hnVIh27dr2apNlg2fuq8I0GbjF5sZAMZlZ5l7:hGrfC/fePAmVs29rje2N8OnF5syS5l7
- TLSH
  T1F7283301B9EF7DEACD99873B66476B2CA408338941DEDC44E13D1270D2732997E2D6CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 92.0MB
- SHA256 4ba7835b06fe756d5a097dc459b9ca37a82b76fca0100d8c5407a80f29f552fc
- MD5 da3cf0aed63dc739c851993007c697eb
- SHA1 5c899824ebfb6c9df29686ed4f1dec4207b1c428
- SHA512 b8a5db6c626ab20712c4aac89005fb971a7647b348f5598e8cd600a59714f53001108c50c38f91194c949b2312d1da28e43ff8a3a189bef8bcb513eebf430773
- SSDEEP 1572864:4YJGkiIEJrpL3Cn/3vePACA4hnVIh27dr2apNlg2fuq8I0GbjF5sZAMZlZ5j:fGrfC/fePAmVs29rje2N8OnF5syS5j
- TLSH
  T12E283352B9EF7DFDCD98463B66476B2CA008338941DEDC48E13D1270D6332997E296CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  LICENSES.chromium.html
- Size 14.4MB
- SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
- MD5 adc1ff1ecd313896455e610d15d4eaa5
- SHA1 22180374f927b9132c3963caff9c1f28155010c3
- SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
- SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
- TLSH
  T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Mod Latino Sparking Zero Installer V6.5.exe
- Size 201.2MB
- SHA256 6cd8e0f33b742eb7bab02b842a1e1c2ef9fa371a59ce9e9d8508bdb98e5e652f
- MD5 8d101c33293c2a0eb76dcd50e9dabc38
- SHA1 8b5cbebdca8c848d2b7033b31b3d7a367eb96b9d
- SHA512 073391b178d1a81a057af855288f2d23b6d07f554b7b46d5955b36c5618a5923182feedeb92f0be1ccf4ac2352af469995625e4d6f3cf3cb02fd3848739722c6
- SSDEEP 1572864:flstXKZiWIfzlBqAa2fthfqL9IkQ0WK5X46jkimLu8hAGCphsP1ym1jkToOpHKEk:nq2EdYcmv
- TLSH
  T12FA87B03E29601E9E05DD1759B5A9633FE71B8054724B3DF2A9407922F77EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral11
- Target
  chrome_100_percent.pak
- Size 112KB
- SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
- MD5 e7bbddff3081eeecf7f56e76ce1d48e4
- SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
- SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
- SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
- TLSH
  T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  chrome_200_percent.pak
- Size 182KB
- SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
- MD5 1e1744b9410d29e7d1ed28c4f67d6317
- SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
- SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
- SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
- TLSH
  T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 f31d34105788f736a4056b5c076ae8ae632d9e720f0bdc13ebb6ef938c57a882
- MD5 2890c7f4f78d20f0e86a30e0efac0cfd
- SHA1 b5d79ce33553b9cc94651246d8b5347ebe384c1b
- SHA512 90b8b8655e4be6b3be73a05537aa186c0cbdb1b184d4dc94e97faee0d050f8a7c76f73a840ef785f5eed4913fcec61a76cba5c9099ef64e8ae8653f55ae03cb5
- SSDEEP 196608:g+kiCf+BWW8fUA4BejnQI180uNJSf4iIJwEMWRsK6vU:g+kNf+BWWyUA4Qjnw6+RsK6v
- TLSH
  T1594729122246D49CF059C878C3678626CA6C34E73FA779EBC0B461252B7BEBC5B39135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 0a1e5b188bef39f994d72ebf62e7c830e17152b546501bf03ed1a9ae81a474d5
- MD5 901149a33c43b9f2fdf9f8e222908a01
- SHA1 758fc436024c1466fe8b07ee2d06f2c95af37e7f
- SHA512 b8e2f030f1aef694f7bc0598b397458b8bdad165efab110cb3b28a0f2e6b5476de23cea40954d9461da2d7156b5765d7316c3f83b761ee873f88321a6fb0086c
- SSDEEP 49152:dESTAZFzTxMIP29EeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGH:dDaTSEYht8OnZGNxcO6IhgiS9Nol7Wtu
- TLSH
  T183E5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  icudtl.dat
- Size 10.0MB
- SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
- MD5 4171402e385f07007de57f45ff540e9a
- SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
- SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
- SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
- TLSH
  T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  libEGL.dll
- Size 492KB
- SHA256 8c1b3ea8455a676371419a66aed7cb9b9a6a7751c92b1a5c874f48948bc80413
- MD5 2ec183370499a3c9862766c2afb7b3a1
- SHA1 f2451b2c1e403af201919e1a7a60a0a6b64980ba
- SHA512 eaa8376af7a1b49bfb18a28161cf9ca069416e03148cf985d74dd590bdaa8d3287d614143bc37f726c4abf09c49309bd4ed97db08ba47edbe45f306ae0563298
- SSDEEP 6144:9tqwvC8uRreZw/ebZyu5sIAeoZPw1ODZ6R3/8cWqR/H2p5HoSthg:zqwvC8SrZmNEIsPwa6R3/8cWqt0HoSI
- TLSH
  T194B49D15F3E945A8E06AD4348B534603DA7278560B65FAEF03E092793F37BE45B3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 a59db2d9a1a4146e210c1942a9d7d791b372f5d0d3830392b45adabce373d0b0
- MD5 0780165d29dca765a7a980daa7ce6780
- SHA1 e6c4138167cdb991d703fae663b1280ac690d5e5
- SHA512 1bc10ff9fbe99794163ead5fb33e88fde0064287dddbc6c6150bba069083960c79582daf47786ba385b931c7527bb6cb39664ba75c0b0567372377bb474d9e1b
- SSDEEP 49152:Bh+XpQjxg3kJXrCtf/EbJ2npdfPHn7VHe1yTveomnSfb+5LDrpRXJDysxrY0U5Ao:XLMXVv/f+vplJLdPCuAYT7tc3az8
- TLSH
  T1E3867C03F69581D8C05DE2B8975B9227FA31B8490734B6CF2AA413152F6BFE0A77E354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  locales/en-GB.pak
- Size 518KB
- SHA256 fcd664cd401781f6a42342e2d33349cfde02165cd276b43ca8cdcf37bb267446
- MD5 575d78aba7abe6b84ce9cea071e9eb4c
- SHA1 4aa78d3fdf3bd5bdcfef221a06572c1ec6acc49e
- SHA512 d19af6dd2d5803794f08eed03823d5a7c4f8f5b53061765bfa5a367bbe1b006ed7012228794987cf681f08cc78bf073df0ad95966f3c63b0f95d924c28c6491d
- SSDEEP 6144:VtP3yMooYayPq5rcuF4yVEMP9pQRIBfaYHHDjko5bZDG1BcERQu:H/hzYpPK/EMLQRI7F51Dw
- TLSH
  T13AB44C1FF784126A059352A2BB0AA562FF22D07CB35112663CBD801C33B6766C3777E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  locales/en-US.pak
- Size 524KB
- SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
- MD5 bfbb69222dcc50ca860b6a80a3da4f4c
- SHA1 51200c9bd18b0999ba38033662c5e319485e7420
- SHA512 940a2855b5de5f1545abbfed5dad0cfe81e74e847a60f65b4a8df54860649502062ff8941c0fbb248c203fbe6b883ecae8b21e91215b07c1231129a914008a28
- SSDEEP 6144:njtGVh0jMRG0PTMP9QQo94faYQ6TFB+5P2jdnngP8/s1wf:jEVhmOTMCQo9+C5Ojawf
- TLSH
  T160B44C1FF744122A05A352627F0995A2FF32D06CA35112663CBD812C3376B6AD3B77E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  locales/es-419.pak
- Size 631KB
- SHA256 6251e61696959a8ca7226d18008fcae74a9946086a00127babc98c5a5baa22fc
- MD5 d3b423fd4f40f3019a72924c19d4ad5a
- SHA1 8dbbf1a8649ed8df63f06e1f41eb8763db8993b0
- SHA512 80689e4b92ff6d161aa0cb240b002a4cd6785569825d9bee2b16e0d732d530fec710c2499a5f2159ecfc827c5924d32fbe1c775d2f280e890c812d364dee81da
- SSDEEP 6144:lgn098ILnwFFYjn3oZvV3I5iePr5AAoR6Cl:bIeyi5ielAvl
- TLSH
  T139D40822BAC81F5310E3A388B743D757E4D89545B408C29BE8EB876522CCF8CD967ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  locales/es.pak
- Size 628KB
- SHA256 e43beec501f60ba3b0eadf06669afa5ad57d678971e697f6c005d549fc78a14d
- MD5 82d5ae5524b8fa9f628a699ca584ef2d
- SHA1 17bf2188cd66eaa9d1cd98638de26ed7b1ebeff8
- SHA512 aa2e7e75f349d2f6fe63fa7c2c39ffbbb3e8b7b2718e29d540a317acdbbaaea3760f1bab996d86693f354fba51bf0b112c63e23f0393922a28da29a23691272f
- SSDEEP 6144:hUBHnnUpmJ9ocY1FHbUngtE++5Qh4Em3y8ji5JOvAJLlvJi8J36PZOW/:h0HnUpmJ9gbUY9h4Ly8ji5AoJJvY8ho
- TLSH
  T1AED4F722AACC1F6310E39389B743D753E8D49545B508D25BE8EB876622CCF8CC967ED1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources.pak
- Size 6.0MB
- SHA256 fab4cdbaeedd27c69bc2211780191bc340ff55038cdc37694c81a85a02e8e5d5
- MD5 6904691cd62b89b0710273c84e4b4320
- SHA1 e604ea08a75cd441bf8882a4fb01bd0bda8d7c59
- SHA512 10e95b93b6f9b8797a3991eb3626f42be298c0bd9642249b220d8fa7113f3d398934fb29c71ad2eef4ff182cd80a15a2d259c7f79509ab9556434f1beabf16f0
- SSDEEP 196608:zdBRklWj2+WkrYtJ/eA5hF/F7MeZFFfD5CcowhJT:5Tke2krI/T5T/BZfD5N1b
- TLSH
  T15E5633F3F360387FC44847B942D087755F3C999A2A4290270A9CB265CE5624F9B89B7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks computer location settings

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32