5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f

Sharing

Copy URL Twitter E-mail

General

Target
windhawk_setup (1).exe
Size 11.0MB
Sample260819-hl8afsdf67
SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
MD5 a1a8fbcbde2d70638957f3e69a8e034b
SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
TLSH
T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  windhawk_setup (1).exe
- Size 11.0MB
- SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
- MD5 a1a8fbcbde2d70638957f3e69a8e034b
- SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
- SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
- SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
- TLSH
  T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery defense_evasion execution persistence spyware trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  UI/resources/app/extensions/windhawk/dist/extension.js.map
- Size 848KB
- SHA256 812f06b603751ef44b48c60da723d60e5f042c6e6f051f867d1484b954661a82
- MD5 91b870c753052e30456fb3ba8f3ba1df
- SHA1 1fae1dd6c326f1c7e3f63cd4d85f497503738bdc
- SHA512 a23b6ff054c3a18fa986908dabe5da8d5652efcc0396052a2de35cbc90131993ca4462d7b8dd5adf4175f9f743433828995be05a2186dc8b2bf49b319fa08882
- SSDEEP 12288:BdWPoWtQq/lMpotQuBbrSRCdYlLB1WW18rXPRkFGZxP:BudYlLB1WW18rXPma
- TLSH
  T1D90508B62A7BF5390E1217FA6D9A4041B62BB84931205130B84C745CE3CDF69F2FAD76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  UI/resources/app/extensions/windhawk/files/mod_template.wh.cpp
- Size 4KB
- SHA256 9bc5f34a36b0b403fc47f39c25025d5f5336fa2680d502491768e2f1945eb2a2
- MD5 92d26d05eebdf8fa51bc1f71cd0807bc
- SHA1 504e451a5e991d8bbace73867ffa78b89748a6bc
- SHA512 54c09c8fbb9effc1955957b2c0f06c0bc7d4775cd1fa2e23ae825b846cd21397805a7815183184984a2f5f501c2407491b2487cdc382bd342793a7d801835e1f
- SSDEEP 96:EgQ4tYAYb5VL0z/HGsJTLWFqeBtAytybXcEkfV9wMni:VPCWygbMEwwMi
- TLSH
  T16FA197AFA55653B40AB30E7DC64C830CE7773D9B2A028705749C82986F355FC92A2DDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  UI/resources/app/extensions/windhawk/package.json
- Size 15KB
- SHA256 fb9663b6cc3e46b85275453a31026ed4211c12d174c891066882475e33244a5d
- MD5 225dc86a246d1804921437130b9709dc
- SHA1 b4374623102fccad205f92aa16bc0bbdf068fa58
- SHA512 f2d8ff25d3df6c1c153582d1c9ee51c2c09f54461235afa8b73bd3454938cbb74ce963d5d5e8cbd1ee18398627ebe2b13c5d918771da6f0fa075fcf1e35318e8
- SSDEEP 96:k1hk0urQulrQfdXGdonTmpkDuV5mBEAe9MpkDWdon6h8+K59AnoEy5c79UNKxXsm:rHjCNXAN/mFV
- TLSH
  T19A72A6E7FFED047B4448048A90BCE0D2868FD7DEC2D61AF5702239BDA0AA1E5527B705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  UI/resources/app/extensions/windhawk/package.nls.json
- Size 118B
- SHA256 c1d4d4ab5ad385c6c27039eacbf9a57b7763f69f8b5fa163787d1266f9a264b7
- MD5 e428d9a2dc2cb0d44541a515fb6220c9
- SHA1 b376e05cc93945a89061a33e5f467c5f7fae4bdb
- SHA512 03c25850b59efa2c11f8dd5985e74e013116447deed6c2d96d89c2ae132401b60106bf4a5bafe685df11828801c939efeff7e933ca190735192758b55218293d
- TLSH
  T19FB012EA4DFC0E1B01063EC44CF8217451A3079724420DCF9071BCF4D642F000C85031
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  UI/resources/app/extensions/windhawk/prebuilds/win32-arm64/node.napi.node
- Size 913KB
- SHA256 78538a9e2ccf20de7d2edd39ea78ae4a01831d3a0502e92d0f90e30ec6b6a20d
- MD5 6d92041e57d4de4a942e55d13f36f42e
- SHA1 6c9c88879ce2daeadf6a3b818c475354086c4317
- SHA512 9a9c0e49f8f4a233635b1fcc53b0e78821dc7302540b07c13126ee2dff364748fa0384bb65c1ba6c9665fd3cc492f7a2da0c288387aa6e6cec456e28056194eb
- SSDEEP 12288:2+Lq+2Tfkk1RAkO8GedRIf51p1TvA/mwVIwTVpjzDx3W07Pl4iEMeExd1l:q3Wcl
- TLSH
  T15F1518D22B5E788BC6C3D679CC564B80301F66FD8432D48B3183126EEFDEAD595B520A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  UI/resources/app/extensions/windhawk/syntaxes/cpp.injection.json
- Size 4KB
- SHA256 910b353d65859d7cfb51b67e2c64a93fe659529fe52575966796dc895b63f26b
- MD5 440a485789013ecdf4a83b970dc7ef73
- SHA1 46f694715845942d34fce02417948e105e45e546
- SHA512 08121f6b86294b727172f8501de311d89b2a8c0a63f4b648cf4b5dfe8951dfb74984ab335ea535e0e73676ce23cdce670e4b08658d27cfa7146d8724fe639848
- SSDEEP 48:AdfG6nwh7IvXYhYwy8G0IC2PFUBGo0YYmYwy8G+CS/xldGlsYksYwy8Gz/xlAmGe:NuwCw7yDXo/j7yDNS/4lsls7yDz/ie
- TLSH
  T1C68123BECC692C6705FA77B468BD8382F926023B0B458C0B797D058CAFB78475645F89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  UI/resources/app/extensions/windhawk/webview/3rdpartylicenses.txt
- Size 169KB
- SHA256 d9f38ed6a479a7b573c81223dec20f5c4cf335a52213fea981d2f08b0e1537bb
- MD5 b56ba739c7fb4b8c48e4620f84b8d8c1
- SHA1 c5ac36c9fb727026d90521a28f17b25a5134ab9b
- SHA512 0d2cd39f8170aca80eaa559bf4cd4db0cfe2089c4cd500ccad7c309ff464c0ddd37a86fb1e563c3b82f363e32097e611bb51c4079f515ded2685db516a5fe415
- SSDEEP 1536:tLenVD28gIkOr4ArheKK21WQVerQNaBbcUtf8ALwhxCBePLciUBmyh6yhySDnhvL:zIQJrdcDy0yQ/GH
- TLSH
  T19A04951EB2600773189613705579ACC9F26BB25FBEAF2A88146EF345633B46CD5FB840
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  UI/resources/app/extensions/windhawk/webview/Oxanium-Medium.7098beb1dc0482713448.ttf
- Size 28KB
- SHA256 eb595ff7af9b8a563a670a57e15fbee6649285c9895da7e05acf0ee21c11e7b3
- MD5 a4129138f9d7ae92e41c3b8409c30da2
- SHA1 2c0470283b0632d00b32492d95a7bdf24d6e2e53
- SHA512 fa9d4b276f540b461a472d4eced7122fbd7c155ac981ae733624ff0f2893e95239e93fdce91fa44234d9273079b796de56df58cb582119b00ac9d3af517b379d
- SSDEEP 768:DhoA2GVJvIdesWLvVIsERbu/ZSjmx4EJjIbzijPw/H:9fbv7VIsE1JXH
- TLSH
  T1ADD22A16BB240311D8902F3152B6D3E9B7357CAAFF27C71B73C93EA27D261063925A05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18
- Target
  UI/resources/app/extensions/windhawk/webview/codicon.4c354c82c52ca6cc2543.ttf
- Size 119KB
- SHA256 9d25513c861704be650eacef8c4588aceabdc8b668857747b5e42b299e926918
- MD5 08382d8b5f4698be7e944684d67b5700
- SHA1 5c13a3b68f007e04954230e04f5b509588c1dfe0
- SHA512 ce752bd7db24883ef8f2da61e87818406bfd67778df75a9579380bfd5e710dd3df71e8887904831230d10ebd4f2e2a7c31a4a35047e0b2fb04a0c82ee67f57d5
- SSDEEP 1536:GpjQ3QTW5BnOTOsAQFloB0C0DTp23Pq0PJ7hMG1G95DEN8z+yZX+At:GpjUgW5BOaC84BSlR1WoNk+ot
- TLSH
  T1D0C33A5EE38A8E3FC36382BE4DD8932221E0F69032D779439D6DB158C5825D49DE079E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20
- Target
  UI/resources/app/extensions/windhawk/webview/favicon.ico
- Size 42KB
- SHA256 ea45fb75f7d0ec4ba87bc2d76234c426c60fef511410b27e11d75ba66aecb4f7
- MD5 1a472ade23817848a2d4b2c9900d4a5a
- SHA1 312b05a9f58059bed85ee7896566476666fca433
- SHA512 8ab180f4475b2cecf4e13b23feb9d9580527e1afa67650de1a0c693c280e77c65d231a02335be0dc6ae6ae9204206e48bc2491a22a277cbf7331e870d9cbd844
- SSDEEP 192:flxYB+e0yJVE7ACTqQSIPGL5KGahF9fTVLlmEwD6bxSqRuV83ZGpGooU9+OAM:4cCK7ACOx0G2F9bVL86bA58Mpx+O5
- TLSH
  T12B13E6D203ECC442E19092F1A2962B770115CCD2BFA9EF8E26E631BD05B91C74B6E51F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  UI/resources/app/extensions/windhawk/webview/locales/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral23 behavioral24
- Target
  UI/resources/app/extensions/windhawk/webview/locales/ar/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral25 behavioral26
- Target
  UI/resources/app/extensions/windhawk/webview/locales/ar/translation.json
- Size 16KB
- SHA256 7bd6a69d62cfc86a911401c13e8d09e95b847277dbc6ae3074bf53944c1c19fd
- MD5 4a739413a0238c4df146965e596c47bd
- SHA1 a5f4135580f51f25aeba674cd871aad2f292e5e4
- SHA512 b7490b150f6258e1b5fd5dab8fb12ba9cef2353993c70199e593c793f9542402b0175c55f0c707a43f93bb64bf87684d0596160734a4d217cf14b028f84aee26
- SSDEEP 192:KIlf/oOjVjRv6YBQC6YBBcmLZ0y6Vpx32IAupLV+EUjILcWoE50oOHlPwmN0Kn2K:KoXpRjM7YN6EIrpo9m+DZn3U4n
- TLSH
  T182725C9289258CB206B59B0DD0E62668F8719F3B9246FC23387F160C5FB7C63D64A774
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  UI/resources/app/extensions/windhawk/webview/locales/cs/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral29 behavioral30
- Target
  UI/resources/app/extensions/windhawk/webview/locales/cs/translation.json
- Size 13KB
- SHA256 0b1695f70fb85f17af3e2e5a3c21ea30d04857fe093785f63f74cae7f462d359
- MD5 66f78a329b61d40b6b7c64ef4f3dcae6
- SHA1 b9e9cbe7c3e063882fb4128059b73ff198bfdfd1
- SHA512 bd5918f01a456b1439cbdb717c7900d36cde00f27766d52e6863c7c8fc5fe2e974395d911353338ffce3d4f88af7053b4dc8fcd455376b7b55f03480ddecda7f
- SSDEEP 384:1SaOwlBlDELwKlhCNkLxlhotkGEKqxQDknJujCBmOKN+t++2K:1SbwlBAxQDkP++2K
- TLSH
  T1A752502BC8A99C2B4AF55754287C1A83F52A033F1310481B7DBED24D0FF3CB758A1A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32