e04f2e4ca89a0fd81989af732d166239d5ba4a465868c1a3520fc36735b6bcdb

Sharing

Copy URL Twitter E-mail

General

Target
Plasticity-26.1.3-Windows.zip
Size 303.0MB
Sample260820-215mnazzct
SHA256 e04f2e4ca89a0fd81989af732d166239d5ba4a465868c1a3520fc36735b6bcdb
MD5 24a42095faab01551e515a428ade6c1f
SHA1 75434d369f93ddf1065705b1ae31b88a2b84cef9
SHA512 55e1ad8bec9e013e89d3d8a5de696c7ed7faeaa7d3d1d5ca9feab60a71385694bf057bdeedf00c896995ff07f8bc78d9a3598aa6563c95321c49b58ef61dc282
SSDEEP 6291456:K89CudyaAy6qPUgYMlsmatCdom7Mz6TDiB7TbGgALW/JZGFa+C:pRyrydP4bvAum79TYTbQqosl
TLSH
T12DE833C053FA263AF62A8F72FB8BC555C2A67119CD65F83ED9108FDB5B4829304919C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Plasticity-26.1.3-Windows/Plasticity-26.1.3-Win-Patcher-v2.zip
- Size 14.5MB
- SHA256 6763fa62e814495698cb73daf673cb8af41b05486adb6271a5706fa45e9c641c
- MD5 68165bad056299c1b59bdb370be8a9bf
- SHA1 804da7eef7d47f22dd6ab442937efd2fceb2f58b
- SHA512 66c95a5171df3fc136c6f6762ec51a9e736244b312e3a94e6025b480cdf27760525cb16bed100934a1e6397c8706d17aa78292b28044fd37f31a4630d784c6da
- SSDEEP 393216:Nf+Rw1MQv6qM9NxZxisCbpOqvM23jO+s1J5dsHksMnr:Nf+XQG9XZxisCNOqvMmjtY/GEsMnr
- TLSH
  T132E633C0827A1713F96C5A49E7858779C31136CFBCE1ED37F9A848A7AF506A702B14B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence privilege_escalation spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2
- Target
  patch.exe
- Size 417KB
- SHA256 a6b38c1ceab1dc64a71f2e1e1499ecad4a2da577cf0351e2394773c46604c144
- MD5 778c989a3f72a1896f4957ea082fb856
- SHA1 4e016360532d8f90c38ab6cba96fc4172ef767c2
- SHA512 79604812975d0b65d7c3d3ce79aaf50fd5b1ac077c755897e6608846e769dd1f330d4fc3a522966e5798668e3c31c64c887d470f73794d04e341ced8a7a1f61b
- SSDEEP 6144:vELXXsxupZoetSwGl8CfiC22TdHT0RoR7LITf:vELXXsxuNcwovrh0R3Tf
- TLSH
  T118942893725063EFC82B4731E8C7445277767D7683A32EAB1294B37B0D713219C2EA66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral3 behavioral4
- Target
  patchfiles\resources\app\.webpack\renderer\app_window.compiled\index.jsc
- Size 11.4MB
- SHA256 58c1eaca58838e61e0dd845fb3059686325252ed88c6a6efd4ab460862ee16df
- MD5 8380e443976f264df2e1b06df03c7a8d
- SHA1 ff99b7e65632cea85e8df514a9759de6ceeddf99
- SHA512 5f0e015c94c975c0b2f825914f94b220abf82bc005838ea9d56f3413b291859ad3e636e29a4133caf7ba18edc9188a96f42a50923a2fa46948bfb17a6f2cb0bb
- SSDEEP 49152:y50++lfd283ygDXK4FaoTuFeZfN52y9T7zIbtL9TH6VSkixo9YfZbAmhO72GtFZl:Z+kd2ayEnTbNZT7wtLZGSeVBwwRFXXvD
- TLSH
  T188C69F5493480F3FFE3567B784B701423538BB853EEFC64A5A804B3D0691BA4AD69E87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  patchfiles\resources\app\.webpack\renderer\app_window\index.js
- Size 6KB
- SHA256 d4c19a2676986c6cdcfd27cf61f599c17798c0b0039fa5ba4f8eb0956af301e1
- MD5 36c13fb4fbb025b4edbd3856fcc8b1c8
- SHA1 25b23472e9397b784a72459ec662de2d83856ce4
- SHA512 fda3ed81e4a0fbbc4b68f44a59654dce85ddb8d23451f514e007af68669adc8223d262ff0b5605e3dd04a98320679493d10442e1082464790494664acc98ddef
- SSDEEP 192:10hgA40Ujjbrdykk8QGP5Ft+Ifd1S3kFV59ItMI:a4Njjbrdykk8QGP5Ft+i40FrOth
- TLSH
  T138D1D8C827C4A4BE27B6A4D4C1AAFC1B72F64064302DD450D6CFCCA77BD188C8567BA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  patchfiles\resources\app\.webpack\renderer\app_window\patch.node
- Size 125KB
- SHA256 75aca42d875a82d83370efbf763435cd0a97ce6f52ab48538bc097a21d47db19
- MD5 d48f2f7eac548dc0370defcdd39709fa
- SHA1 582df34fce88d27f59ea932bb81fdd4ea41a3e6d
- SHA512 6b4effe7e9eda5b64e3cf84795d5cc74ae7ba266c05f88a4200b1ea04525d64773b575d52a0a34386d15cd998cfe66e0ab93546d9284a6073ec241b2d3bea545
- SSDEEP 3072:e0V5dNrPQ8yu7LREzGqIQbm+W2DNU5ugbkOs:e0VnNr7yunRYSMm+W2Duc
- TLSH
  T128C34A5B63E500BBE2B68274C9531A0AD76678126720CFEF03A486591F533E19D39F63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  patchfiles\resources\app\.webpack\renderer\pk.node
- Size 20.9MB
- SHA256 f027a0e284628f14d2bf86272b8b879aa3f329311e1940906ba76cbccaedbff9
- MD5 f6e905e6f634c96d12730bf5634495a4
- SHA1 754ea0bb5075a855f907cffdb6d83c225cb549f2
- SHA512 e0a8a857dbf054aa76c136efe7308a1f0cba6014f03d9ef5b82f0274190328ec119e68284ea04c478508dfc6f60b8f89ccc5bbac1e15b82224eb95b3993ce91d
- SSDEEP 196608:tG0A9vEGWU/4DoxmqWMIk3+lS669Ia/NCZDTfNbfLMHWOBCR:tGb9v+UwDocRMIkuwnIa/4RlfLCB6
- TLSH
  T1C6275CE630E056D8C4BAC179870BE927E66B34550335E7F700F19A5A2E26DE1F63EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Plasticity-26.1.3-Windows/Plasticity-26.1.3-Win-Patcher.zip
- Size 14.5MB
- SHA256 c68120baccf2de371e2347073b9b173328ca6c7512a678efdc98e29e148ab7f8
- MD5 70a071208bfe32fdc39ee4c767bbb1d9
- SHA1 d4bc989cf7b9f8c492208402b8fb4d445a60297d
- SHA512 d2e96a39d26905584ae799c1f855d7a320b879f7f00fdf7148d746984885973e317d11b11e9395d77acf58e2a0a09bb3a89cc89c451a8975501ae718ea65ba4a
- SSDEEP 393216:7f+Rw1MQv6qM9NxZxiLCbpOqvM23jO+s1J5dsHksMn8:7f+XQG9XZxiLCNOqvMmjtY/GEsMn8
- TLSH
  T101E633C0827A1723F96C5A49E7958779C31136CFBCF1ED37F9A848A7AF5026702A14B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  patch.exe
- Size 417KB
- SHA256 a6b38c1ceab1dc64a71f2e1e1499ecad4a2da577cf0351e2394773c46604c144
- MD5 778c989a3f72a1896f4957ea082fb856
- SHA1 4e016360532d8f90c38ab6cba96fc4172ef767c2
- SHA512 79604812975d0b65d7c3d3ce79aaf50fd5b1ac077c755897e6608846e769dd1f330d4fc3a522966e5798668e3c31c64c887d470f73794d04e341ced8a7a1f61b
- SSDEEP 6144:vELXXsxupZoetSwGl8CfiC22TdHT0RoR7LITf:vELXXsxuNcwovrh0R3Tf
- TLSH
  T118942893725063EFC82B4731E8C7445277767D7683A32EAB1294B37B0D713219C2EA66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral15 behavioral16
- Target
  patchfiles\resources\app\.webpack\renderer\app_window.compiled\index.jsc
- Size 11.4MB
- SHA256 58c1eaca58838e61e0dd845fb3059686325252ed88c6a6efd4ab460862ee16df
- MD5 8380e443976f264df2e1b06df03c7a8d
- SHA1 ff99b7e65632cea85e8df514a9759de6ceeddf99
- SHA512 5f0e015c94c975c0b2f825914f94b220abf82bc005838ea9d56f3413b291859ad3e636e29a4133caf7ba18edc9188a96f42a50923a2fa46948bfb17a6f2cb0bb
- SSDEEP 49152:y50++lfd283ygDXK4FaoTuFeZfN52y9T7zIbtL9TH6VSkixo9YfZbAmhO72GtFZl:Z+kd2ayEnTbNZT7wtLZGSeVBwwRFXXvD
- TLSH
  T188C69F5493480F3FFE3567B784B701423538BB853EEFC64A5A804B3D0691BA4AD69E87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  patchfiles\resources\app\.webpack\renderer\app_window\index.js
- Size 6KB
- SHA256 d4c19a2676986c6cdcfd27cf61f599c17798c0b0039fa5ba4f8eb0956af301e1
- MD5 36c13fb4fbb025b4edbd3856fcc8b1c8
- SHA1 25b23472e9397b784a72459ec662de2d83856ce4
- SHA512 fda3ed81e4a0fbbc4b68f44a59654dce85ddb8d23451f514e007af68669adc8223d262ff0b5605e3dd04a98320679493d10442e1082464790494664acc98ddef
- SSDEEP 192:10hgA40Ujjbrdykk8QGP5Ft+Ifd1S3kFV59ItMI:a4Njjbrdykk8QGP5Ft+i40FrOth
- TLSH
  T138D1D8C827C4A4BE27B6A4D4C1AAFC1B72F64064302DD450D6CFCCA77BD188C8567BA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  patchfiles\resources\app\.webpack\renderer\app_window\patch.node
- Size 122KB
- SHA256 ef3b96646af41e863f4da11b458ac7623485c48607bf4f075ca02d4b1263e610
- MD5 8c00fc3be780b14bf73e7478335e2e24
- SHA1 11539910dcfb9a67d9c89e02f4bf79550c65631b
- SHA512 7a516f7960e392fd6a4c12210c3af13f7c05dac34834817d06c7ef09375060e90c77076a047c625f641e65530e9a1e225b92985e8aa7e2bf2e5ae66daa45077e
- SSDEEP 3072:ZDflpsNDqFGdMG5dQbu+mnx2YrXtWDbPM8UMch:pfkNDwGmwMu+mnx/jtpR
- TLSH
  T154C34B5767B500BBE2B68234D9531A0AD7B6B8166720CFEF03A0425A2F533D59D39F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  patchfiles\resources\app\.webpack\renderer\pk.node
- Size 20.9MB
- SHA256 f027a0e284628f14d2bf86272b8b879aa3f329311e1940906ba76cbccaedbff9
- MD5 f6e905e6f634c96d12730bf5634495a4
- SHA1 754ea0bb5075a855f907cffdb6d83c225cb549f2
- SHA512 e0a8a857dbf054aa76c136efe7308a1f0cba6014f03d9ef5b82f0274190328ec119e68284ea04c478508dfc6f60b8f89ccc5bbac1e15b82224eb95b3993ce91d
- SSDEEP 196608:tG0A9vEGWU/4DoxmqWMIk3+lS669Ia/NCZDTfNbfLMHWOBCR:tGb9v+UwDocRMIkuwnIa/4RlfLCB6
- TLSH
  T1C6275CE630E056D8C4BAC179870BE927E66B34550335E7F700F19A5A2E26DE1F63EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Plasticity-26.1.3-Windows/Plasticity-26.1.3.Setup.exe
- Size 274.0MB
- SHA256 dc77e9695434723416c290c0a0f5dad0c0dea8a2c9274f03a9d82b2f5c9fa55d
- MD5 26b3677ae6b29e233ec22147c9bd2022
- SHA1 3bbf13d06f550b5d57c8a0b0c08b05e687a5ede6
- SHA512 b0be48c16fdc5189f94eb5e80101ad38cb9b61174e1736aec87f62862d38964b416c105b97b56242f36b150a4dca3d5762e7548c76120799688bd708cb7da975
- SSDEEP 6291456:sBAH48WK9GU3KW4kCBoRMiTG/ixvO/B6l8v4hCBv/IZejS:smHjWFdbxGRMiTVxa6l/6QwW
- TLSH
  T198D8338463E59039F52B4F71EB8BD889D3FAB2248D25B87FC6115FDF1A582D20491AC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution spyware trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral25 behavioral26