44847056e68f16413c861e7db802b9f65a97629c83113589bc0b70c9422088c6

Sharing

Copy URL Twitter E-mail

General

Target
WhitelistBypass.Creator-0.3.8-x64.exe
Size 79.9MB
Sample260820-jgblcsscld
SHA256 44847056e68f16413c861e7db802b9f65a97629c83113589bc0b70c9422088c6
MD5 37eef81d6bf06aa48dfa61f616b46870
SHA1 cc9ddab5d7c2e689367e8c9a14ef7d4d85300fde
SHA512 860183c3bf0b9bf96af5d2e438b48f6c6424a8197c3d34cb6c749f2c6cc843b91d567022b4343efb552f175e4138770ff4b49528c3ae0f9eddda1654178802a8
SSDEEP 1572864:XD+BaWatMcjjA2Ik40adulsCDbYb9qm3gRIOS0jkia6xu98P8ALDZUS0K7:T+ZPcjjA2340adui9hENzu9vEZUS0K7
TLSH
T15008339148E9FBB0D80D0B7289F1F85353F1736214789E52E11D287CA462EFE6D792E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  WhitelistBypass.Creator-0.3.8-x64.exe
- Size 79.9MB
- SHA256 44847056e68f16413c861e7db802b9f65a97629c83113589bc0b70c9422088c6
- MD5 37eef81d6bf06aa48dfa61f616b46870
- SHA1 cc9ddab5d7c2e689367e8c9a14ef7d4d85300fde
- SHA512 860183c3bf0b9bf96af5d2e438b48f6c6424a8197c3d34cb6c749f2c6cc843b91d567022b4343efb552f175e4138770ff4b49528c3ae0f9eddda1654178802a8
- SSDEEP 1572864:XD+BaWatMcjjA2Ik40adulsCDbYb9qm3gRIOS0jkia6xu98P8ALDZUS0K7:T+ZPcjjA2340adui9hENzu9vEZUS0K7
- TLSH
  T15008339148E9FBB0D80D0B7289F1F85353F1736214789E52E11D287CA462EFE6D792E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH
  T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  WhitelistBypass Creator.exe
- Size 180.1MB
- SHA256 6abab82b49d7956b90eb5e2c3521583c287788a7bd8dafad9ca39014fe724491
- MD5 fbf1fe19ea5e13050839ebe277030c95
- SHA1 28e17e3df705387eb6cd26935f84443e9708155a
- SHA512 9091a7cb17b5b1a02b4fd28f32e940040ac59340b83d460cdb382c3554cde4374dddb7f4dafe11b6bf8e8655daa3ae2bdab802410710a66c37a72b4cd88ecb5b
- SSDEEP 1572864:6H0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:Xsok+hK7
- TLSH
  T114988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
- MD5 e3bdb59b37b730647d4a1e44756a730d
- SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
- SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
- SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
- TLSH
  T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
- MD5 c13e55ae6200e74c0b121cbd5c1d323d
- SHA1 098675729109e19a0b6cbedbbf45398265ab6644
- SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
- SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
- TLSH
  T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
- MD5 a3bf08772053b66ec34701037f120736
- SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
- SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
- SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
- TLSH
  T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  resources/headless-dion-creator.exe
- Size 10.8MB
- SHA256 7441e95939500c69bdf0b15ddcb2533fd79b11dedc31f193eb096755997163fc
- MD5 7ebf1af147824d581a7d597200c4603b
- SHA1 1c3c65b5ebe007791d4328cd8c9f886439238ca2
- SHA512 2c658d9d31cd17e7a723717cff4f9117b01558b69b5fab0b0ff7ff7036253d199b7c96c133cee4e2bda394ad63f5599022e034ef3e11e6cba6363e538672ee41
- SSDEEP 49152:70cwpFWmNlNqxF/3hKFGT8NsKkTffTCLVjVyHrthWGl5PkqcuYF1xRoi66oSGla8:707rVa0CGU81trWPj7jdcGjvGWBGPE
- TLSH
  T105B63847E8A555E8C1AEC131C966A163BB717C495B3027D72B50F6283F72BE0AEBD310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/headless-telemost-creator.exe
- Size 10.6MB
- SHA256 b84722716bcd40e7b88edc75176ee1ad0c6d293872d09560956f3f290ff97bab
- MD5 da54e41c18efd9984d0e77027ab85189
- SHA1 0865e9eb93b1752725ed559f913bb7fdeb52f319
- SHA512 610df20eb10557811b019ed19461952c33eaee247f9bdf36344fb96922f70db0e41841d1dd0960c954d1d558e01c8ace5cc23b4aa54167d948a8d8178de27a35
- SSDEEP 49152:I4ssm2hs0/o628u8n7if+QYY1lyOwkgowtRXjTdeXASuHokfFKiEZtBp4s3JIyyg:I4RVFHLP1Eu6ZqBR01iq2Pf84aOE
- TLSH
  T113B64A47FCA505E9C5ADC134C9A692227B717C494B3167D72B60F2683F72BE0AEB9310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  resources/headless-vk-creator.exe
- Size 12.0MB
- SHA256 094691d21b7df042af600d83f4a314398711e8fd38da71490833cc1c04aa2035
- MD5 9f9ebe9ed86a88a522c8c6638792241f
- SHA1 c798c0d14e84c0b4ce71d3d79466504af4989947
- SHA512 9b1f042e13959e34b31146a8b9ae454b2e244c916826d2c16700ec85fa659e1f7652479e554ddf9b97a655f1709fb10e6a7257dcffcc1bf6fdf63e441f37b02c
- SSDEEP 98304:hOtHxRyBMxbCneBM6Wa9okLM3JLp1FKsnze9E:hA+hfKU3JLp1FKTu
- TLSH
  T175C64B07ECA611E9C5EEC13189769222BBB17C494B2127D71B60F6287F73BD06EB9710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/headless-wbstream-creator.exe
- Size 10.7MB
- SHA256 c53f9a857995672b815caa1ba64c5175101fc46c865039e8f4a255b8ab680c8b
- MD5 996eec5bb22dc3426faa7fbdad353161
- SHA1 4ba6a5effb208fb735717c9843b0c1561b1f026e
- SHA512 68190690ff4ecf57e368a26d07907f9a575f44cd11d35a07b0132d6b979c1fbb6711516f1c8772cf15acfc2a4997fa3b59c4d6ca7f38d60458ac75e80f906dce
- SSDEEP 49152:ScvyI6iD5dmdrvBnDkJ/uujfBbOr7+xqahNE4qhz+cn6QIxOx2vun0VSAN4UundU:Sc5hrUluy5PNom1nZwlfTi3QMamY0E
- TLSH
  T1B6B62757F8A505E8C4AEC134C96692237BB17C494B3167D71B60B6383F72BE0AEB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/hooks/dc-creator-vk.js
- Size 2KB
- SHA256 dc36051d7cc11ccd850d5719bd0bdb2aa6db61c21f4abdc8923bdd816f6db99c
- MD5 4a42cf081e3ea52de8b64097c3e73ce7
- SHA1 1ae51a4c8ed780becbefd0bcb696306303f66bab
- SHA512 3d0ad290165ae522dfd85ab45bbf822abbd63b3abe64e0085b40567fd49ba40a6235b20f9f3159395d3490ea1c72ba735561e056836459f9a2220294866ccc56
- TLSH
  T11151468977F33035532330255B9B91A9372038932209CAA47B4DD355AFB02A999F6FCE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/hooks/video-telemost.js
- Size 16KB
- SHA256 5064ee3a957024c2fde09af503a1de7c15416842990a8c3193d651ce4a0bef7a
- MD5 cdb7c0008c6a800c9979307eac710ecf
- SHA1 23b1d96a5e7d5bd3f7e5c8751749aefdec79dea6
- SHA512 86003fdbac2ff1b7a394b528c9137e3be7e02c8dea06643e5e9363ec36a3a30b0bff1532fe463653a4b9f0e16baab92fb80983a280cb662fefe900b8a1e5018d
- SSDEEP 192:YCfpth04uCuu2Pml2c+MuSGB/ACxMYDqFLCSCWC6CqeM1tmFcMTfa367TyBds1gl:2xFpctOHMo2JdciCVx5gN0aH
- TLSH
  T132725449BEE73002865330368FAF9009753A54873108D714BE6CDAD56F75AACA07EFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/hooks/video-vk.js
- Size 15KB
- SHA256 de58ba4ed3fa0fc928620b32db604d69508756a8fc76cedf41c686cbf7c370e0
- MD5 d0fff30d1daec4af6f957fe311ef20d0
- SHA1 d4c518d7706007ab1b49f53cab31918e697f4b9b
- SHA512 74dd8e4d147133d7ca89109a8e28a1226e6d8d9ae59455fe5aad4fa77d629c8047cddd96b23bef39afd332b4a7d003aadd1eaa7fee8161b367a62e69af422c0e
- SSDEEP 192:YCfpth0BCuF6SLmt2c+7luSFauHq0EW9E4wxMYDqpNjlCSCWC6CV9g/TyBRedgmi:yESQxFpyDPsoMoz/1Yx5MSNIafV
- TLSH
  T18C724289BDF73002C69330368EAF5115313A50472208CB64BAAC9BD16F759AC95BEFD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/relay.exe
- Size 13.9MB
- SHA256 b0e1fa8bc7796ed317ae953a745fafc319257f43ceaf482f322b7ad27b9bd209
- MD5 f7566e0a0100c511419121bf770263cd
- SHA1 b86251b96313402819d29f21dc8089740d477164
- SHA512 3bc7c90b83db555fddaceafc154a197b05bb756285cb7516da8cd305b1415d6052dffba8d7c278f5b7fb9f21ee5dd0790fca9746cab282740b55a18febb83eff
- SSDEEP 98304:dcwijxckfSKdVUboHzIIZ6WeBnEX/t5H4QOSb9QhmUpS9E:d0shb06WOU5H4QOCagUpR
- TLSH
  T19BE65A43EC6605E8C4ADC170897296527BB1BC4A5B3123D71BA0F6287F72BE06EBD750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 409a0fa76f055a87ae70434414586d144502beb25fa3004866ee70abd9a8547e
- MD5 5633d5211bfbbbd2b0493fcbd492f5fa
- SHA1 9ad2466751880fa0acc1dc6af2693d975dd9e307
- SHA512 8eb5ab1ddb1dc42eb323a163af6b4521acea5194909ed39933710bf3fecec5f50f070c20df57a89f4528076fbddb0fa0c27de3faa7b4a249637be00ec3bf396d
- SSDEEP 49152:YaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+B:762naMskwtEMaQPJnymh
- TLSH
  T1AB463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32