abba4a5b2d9340fa42f8375a46f0fd66426d9246e47d32c208ad4613812885eb

Sharing

Copy URL Twitter E-mail

General

Target
Setup.exe
Size 94.8MB
Sample260820-szn4vaeq2w
SHA256 abba4a5b2d9340fa42f8375a46f0fd66426d9246e47d32c208ad4613812885eb
MD5 435e99017d2b0e6aa26212c3ad81a513
SHA1 46ae78905056aa0bd6f5a3b1c58cf61a817df6ba
SHA512 8394878427e4e8bd95cc7254a0a19ab005885ee2ec4ba55aa9b77f9cebcae4764eed9d139c584ea45f3e357c9a3b25a0a3b7ba16b290d391d6bc7b76769d2f18
SSDEEP 1572864:rmUSLHpfo4hRDsz78wCFN8qYz3VsCtaYqSQyOnIhXvrtGWWm7L3rGGUfT+5/gTI7:rmDLJwxzowCH+F6oQsRrtr9zrqicI7
TLSH
T11D2833E46FE787A9EA0E41B353E072F205FF47E258958C07550EA39DBB15998C29308F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  Setup.exe
- Size 94.8MB
- SHA256 abba4a5b2d9340fa42f8375a46f0fd66426d9246e47d32c208ad4613812885eb
- MD5 435e99017d2b0e6aa26212c3ad81a513
- SHA1 46ae78905056aa0bd6f5a3b1c58cf61a817df6ba
- SHA512 8394878427e4e8bd95cc7254a0a19ab005885ee2ec4ba55aa9b77f9cebcae4764eed9d139c584ea45f3e357c9a3b25a0a3b7ba16b290d391d6bc7b76769d2f18
- SSDEEP 1572864:rmUSLHpfo4hRDsz78wCFN8qYz3VsCtaYqSQyOnIhXvrtGWWm7L3rGGUfT+5/gTI7:rmDLJwxzowCH+F6oQsRrtr9zrqicI7
- TLSH
  T11D2833E46FE787A9EA0E41B353E072F205FF47E258958C07550EA39DBB15998C29308F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 b4befc2b9acf8b9f0fee8c437166d5c6e22f77530de157e27008dbc571c12ab2
- MD5 d32e6fbd9599f9fa63069fcd1effd6c0
- SHA1 d75f370d1bfcb8c69abe82f3be4669a0171224b9
- SHA512 bdd8b151aa450ab689cfdb5345bba3514db90d4b80352660b35649758e4e7ff148e048317efdc3ae879af96784f0332d43fd1ee48ad95bbed90e893fdff5ebf5
- SSDEEP 196608:UWxkDUHlgJWwgvYtoexSGkJ+ccXP2BPUNkiAqAN+nN3bR:UEkDUHl4Wwg2xSFJ6XP2BPUNpQN+hR
- TLSH
  T1974729122646D49DC099C879C7678B268A6C30E73FA7B9DFC0F451252B79EBC4B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 25c2906d4bc8f1135149123b9ddbb7a1347fa8e6a4b7199e968c30e4047ed5ba
- MD5 06aa695f302360c757b139e4a7cea4e4
- SHA1 dca9bb7b6b88f78cb6e84b2c166fd612c462f82f
- SHA512 ded9f9e641b16ff79eb1c76dcf4f25bbd242509f81dcf7d662256cbb4da58c43a5724e81cd52662ea023fe635eafe501c344c841a4dd370844a55fa3c994a7ee
- SSDEEP 49152:1D4JOs9bUAtjcqOEYcvDb199aPLKIbH7k6Q4gNoJqFfwYd7f:1D9+UAdcqbvDdRNoJ23
- TLSH
  T11BE59E02F6D651DDD029C03497AF9213F631380A4F205AEB1A905A263F67FD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  libEGL.dll
- Size 496KB
- SHA256 72842b1dd36591f14cf328dec4ce6ac84081fff30d674691e38e9a05d669eb0d
- MD5 942d87a9df1e99dc1cd8f9aad5b85dba
- SHA1 984766b04ecb64da717843226c13336cc9afaa8d
- SHA512 95a52270e8f66a5ba09523a04e299920e9523ed474fe53d7576aec384e5494f8c9ca65357d3b6f3151f4eb2ec67569d14c8ed7f860ea89a63855ad8d76bd78b8
- SSDEEP 6144:eVjuHfNwVk2IcwksKrkL6xIdjZwL5/Q5Tmcql3JeLBo6IXtOqoQ29OSM:e1WFj22k86x+U/Q5TmcqveL+6Na1S
- TLSH
  T1CEB49D15F3E946A9E07AC1348A538643EB75B4820F65FAEF03E052752F37BE45A3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 ac17cb6686ec501476afcef06f0af356b8c2c99fa99911634d8d61e7bac5c27e
- MD5 eadccb7f82896999fdffc17924f0e34d
- SHA1 17438c34bd6731e6b064e3cfed710cef4dd40b30
- SHA512 29068cc19e304220aacdff00b956158dfc6efe70cef9f8294c88f792aba22d583c452019e5b7930da0b431ed4b1c3f5b926334fa7533079a1590d9985cb71309
- SSDEEP 98304:krJ/ioHTS9xMZWw2J8Iu1aaIxcj5SLto:q/pOuRBaycxo
- TLSH
  T162867B03F69641D9C05DE2784757A223FB34B8450724B7DF2BA453152F6ABE0AB3EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/app.asar
- Size 14.0MB
- SHA256 c0dd98e1fde7ad08ba82c537037065c3d7345d1f1b2657fb053979b54f37d6e5
- MD5 9d1f737b34ffb6ee8a08897f1ae6e7a4
- SHA1 093fcf393e227fea066361d94d291f3101ed5c7b
- SHA512 b8621e73045dd3af6da57fb3a84b7658bbec0e0ab10534a56c6543b9bb45a95d9125b47d188e94ff785a0ace0ce2c431b84d43efbc0025bc31d7e353dbec3e87
- SSDEEP 49152:Wr2YUQeMzwfBfn+vyDCu4AOKBBay1DXlOzwq1Ht4pP2M7F6viVhDYayQBJ73B7NT:X9dPGdPa
- TLSH
  T119E65310D3D0685012A79FB9F71FBDE5EA195ABD3555088BD005BFB0BEB9602EAD0E30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/dist/electron/assets/build/Release/registry.node
- Size 203KB
- SHA256 1f38e611baa264cdb6efa68e3ca4441be307d30cbf1944ff3e3ed0f1ee9799e8
- MD5 171013472c2c80c5dd65337d70c60d3e
- SHA1 a2c5e764874857211ca2d7061da5f2abe703e15b
- SHA512 84917123f51632e32fe028030af9ce2d46c0697ac37aedfa52170c60e647caa19b3cb2cd11fa4918040a9ead246d4e53de4e33d11ba6f563eed1ab3f9902c22f
- SSDEEP 3072:IrvPjkwEnroGIQGEbYLLp0dDbucvMvk4Gwg7EI:SjfgrVPj4w/v4koI
- TLSH
  T1C7147D49B2E101B9FDB7C178C9938A02E67278510770EADF479043799F2B7E1893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/dist/electron/assets/build/koffi/win32_x64/koffi.node
- Size 2.3MB
- SHA256 bfed04c099c8ff28f2bf35431126e32a6ae7d86c708bff041946b0d11af56d88
- MD5 cd630eea4e980e9d07a47a12ee590fdf
- SHA1 bad2ac33acf45800e9fbb7ea06df75de6735fdf3
- SHA512 440b5ecb0bd8ed1dadb66c460c0cca76580364a9478fa6e8704ca2b06ae8b6ed38706e467ab3d0744b8607cffab9d5da7941df158dc5beecf81333f05e59c450
- SSDEEP 24576:ErGKJ+nQpxBn2ESwpB3T3Asqa45Jv6oDLkqKxf2vboSCkuyU3cGIe1UuCDw3X8um:EIvboJTyUMGIuTAw3X8sg
- TLSH
  T1EBB5BD064658C8E9D83EB032B417777AE56A221B083D52DF04F58D61082EBBD5DAFFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/dist/electron/assets/impit-node.win32-x64-msvc.node
- Size 6.9MB
- SHA256 c4e00339b678831311484eeab4ddf3f96e29c15eefb4d6df01086de644524553
- MD5 cd5cae3e196f392a3a75f3f5958aa115
- SHA1 72502ebb85bb636a0d7355971704f2f369c2bebe
- SHA512 49ee0aabd9ebe0342e7e0c380b82225ab7c9523d60d3bfa068af96ff9809bf2454059fe6a578d98b023d058024d7a9af859424746160364eda34dc65ede7fdcd
- SSDEEP 98304:9C8jX9vOZmDOIoqUG7z8tSQSkx+7BRhhL:h7DOIodG7zQSkxWBPhL
- TLSH
  T1BE768D026E4A48A9D0DEC874C2478B678E223CDB1A36F5AF45C531253F7EBB55B2C319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/win32_x64/koffi.node
- Size 2.3MB
- SHA256 bfed04c099c8ff28f2bf35431126e32a6ae7d86c708bff041946b0d11af56d88
- MD5 cd630eea4e980e9d07a47a12ee590fdf
- SHA1 bad2ac33acf45800e9fbb7ea06df75de6735fdf3
- SHA512 440b5ecb0bd8ed1dadb66c460c0cca76580364a9478fa6e8704ca2b06ae8b6ed38706e467ab3d0744b8607cffab9d5da7941df158dc5beecf81333f05e59c450
- SSDEEP 24576:ErGKJ+nQpxBn2ESwpB3T3Asqa45Jv6oDLkqKxf2vboSCkuyU3cGIe1UuCDw3X8um:EIvboJTyUMGIuTAw3X8sg
- TLSH
  T1EBB5BD064658C8E9D83EB032B417777AE56A221B083D52DF04F58D61082EBBD5DAFFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  setup.exe
- Size 216.0MB
- SHA256 f83c43b52e4d166638ecac1575f753eaccdbb55ebbca258e0272313a78e78b75
- MD5 85644ab7474fac1749810f5a9a044812
- SHA1 403aadc969dd8c479ebf2f1400e80849142ef28e
- SHA512 fb9b04f676984fc261b3ab727083ffbd9dc5432df350e233a996cdc49c7a277166426a9e77c0f686a2f61724bff909a0bdd68b36a727c13676248edaa18ca2db
- SSDEEP 1572864:PXuGYpqqn71DjiJKfgwVsLc2mHpCavVnbJ81bmHG3ZFsr0Wqbg6WpknAbIZfwWl5:WG6eLjPBI
- TLSH
  T196B88B03E29A02D9C05DD1B59B5A9633FEB1B8454B24B3DF2B5407522F66EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral28
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 89e96a26aded3c8b849ad7fef9b2cc228f6fe3c0591fd34731d5d0dd758ef58f
- MD5 05128b26cb110206be709e565c927420
- SHA1 004681a54388b79e5ad5b3e9116bf2da8b71ca46
- SHA512 2bced69259107b3f45b7ecd8b35337dfaaddfad596fd99cbf949b838a68075b18741df10b5b79fe6306e4d7bdeaed2b38c313f0e6465781374807367dc737428
- SSDEEP 49152:NixHPC/InMj5kgotyssEw/Ga8irpnhQMjQbw9mhBljAAV+afo81gP8XCEQdtXDx:0xHPdNPnyFslWgr+DXu/J
- TLSH
  T1F6463803F28681E9C06DE579875FA623F631F8850B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  vulkan-1.dll
- Size 932KB
- SHA256 5e4f54907236b4732f0fc2f62c5ec422118c1ca3098c01712384dfefc7dd7465
- MD5 dc0390a1d3a547bbfff704ba29e19044
- SHA1 b266890f3eca66f8b856a7c82ecbdd5c68d6fe75
- SHA512 203931ba17abdd765f64e1f34aac5dd2e31abd52ca0fcb690525690959be3dbac771bf5956692cd013ef5355c0ec24dd785afeb23dfbae8157057eaa0f5722bc
- SSDEEP 24576:6g7xfpW1F35jjly/ux7te3MDSozK6Z5WzcxDYsHkDE6g3P0zAk76oOHbRl:rFCh5jjU36SozK6Z5WzcxDYsHkDE6g3r
- TLSH
  T1B2157E22DA948A69D676C074D8D18A038AB074811712B9CF07B81714BF6FFF47B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32