af940e9aecf1c148a0456f30840716511e74b13075907ffce5d6644f6f55cc38

Sharing

Copy URL Twitter E-mail

General

Target
OpenNOW-v0.5.5-portable-x64.exe
Size 186.2MB
Sample260821-nb5z8syelc
SHA256 af940e9aecf1c148a0456f30840716511e74b13075907ffce5d6644f6f55cc38
MD5 b945dfba2a5bacc7ca14deb80129275e
SHA1 e6e52428f468b5e01587f618d844d4897eb30593
SHA512 cf61a1531ce4385f518bb25e1af487d5596d75dc57f9758c76a2d6acb5975912bd1003399415a767356b14144cea8cdb88ef5c783db55457554b44b03e527460
SSDEEP 3145728:doFDJPC/zvx0jiYP2l+MHXqIvQjHfzJBkD5XxbT4fU45lVksbTIKpl4zCBq++Y2y:doFNCbvx0buEoqp/NB+5XxP45ks3pIZI
TLSH
T1C49833E24C9D25F6C4C47C1589788BD5B53952BBA7B8B3A048B1D591330C6BB4EB3EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  OpenNOW-v0.5.5-portable-x64.exe
- Size 186.2MB
- SHA256 af940e9aecf1c148a0456f30840716511e74b13075907ffce5d6644f6f55cc38
- MD5 b945dfba2a5bacc7ca14deb80129275e
- SHA1 e6e52428f468b5e01587f618d844d4897eb30593
- SHA512 cf61a1531ce4385f518bb25e1af487d5596d75dc57f9758c76a2d6acb5975912bd1003399415a767356b14144cea8cdb88ef5c783db55457554b44b03e527460
- SSDEEP 3145728:doFDJPC/zvx0jiYP2l+MHXqIvQjHfzJBkD5XxbT4fU45lVksbTIKpl4zCBq++Y2y:doFNCbvx0buEoqp/NB+5XxP45ks3pIZI
- TLSH
  T1C49833E24C9D25F6C4C47C1589788BD5B53952BBA7B8B3A048B1D591330C6BB4EB3EC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.node
- Size 147KB
- SHA256 983f26de8c9fa01ed8cb32b986e0890c161a7640f60653547bc890ece3418028
- MD5 b308aab15a86b4976944598b3f6d4983
- SHA1 869d4f61ccd85db8be10ee5660330c3069675823
- SHA512 7cfc335b00afc8b130bea415c855f10192765754d87c4db97524067ea6606b3dd1e7181e2b215200b73a957fc8d04840a1a279ef9a00ac56d1de0f08fef64182
- SSDEEP 3072:s7C4Frvm90f0+aYpdkUlHsTf5ht5r2l8MCXL5:N2ThpPxsTffdMQ5
- TLSH
  T145E36C5BB2A100BBE5779238CD635A46F772781207609BDF03A843792F233D19D7AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/index.js
- Size 91B
- SHA256 9740d6b8f1290751808b9474175259aabd1cce2064ea6496b900b8bd9e1a6cb3
- MD5 72c672f572f5bc3185b3dc87a245123d
- SHA1 dcd3be3fcfcdb2bfb4e4ed04ec8b04d430ea5833
- SHA512 bb2569d1a9a8d41350058863ee8cb8c066a2046092d93e7268b48574dfc4b9bc54513b3ca9dce10a75a71400ab9c2149334f243e44b62700b0f11e1bef9f1cc4
- TLSH
  T130B0124DD046E2DB27C420C8AC625403894EC111803045C1A304D7C40CA64C05102960
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  resources/native/opennow-streamer/concrt140.dll
- Size 365KB
- SHA256 a5b9af428829ab7b61ceae9d88a37ce1053551379ee007d8df53a7ba4d33c251
- MD5 3beb41635864f6b8ef76c551f8987f3d
- SHA1 c7bab59945bfeb5cadb0db1e7e8f82a9f72e1e03
- SHA512 ccf98e079076cb176e17eb4b2fd59208377a294ad476e4aa8bc24f58abc67c0d525f6571fa50217bacfe4aaa61d365785268e388cca27f9a8ea2a0c14d26aa1e
- SSDEEP 6144:+HS1mlSm9WiUUWg0dvUX7uEwSN6ninQPfB4nWzgbqdJz2P:+fIm9Wi2NdvUruImzpJE
- TLSH
  T144844B9A72680CE5F533D07DC6A3C60AF6B7B8101352C6DB0661865D7F23BD4DA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  resources/native/opennow-streamer/gio-2.0-0.dll
- Size 1.8MB
- SHA256 cf8b907afcf352ff15dfff97ef9d66f2d9eec4908f612ff62be8ec4a83da1a82
- MD5 070ac257dfefdce8784b5e100c2b95a5
- SHA1 c70ec596ff500535b44bffa1d6582b2dce4fada8
- SHA512 c9b6560f5af92db8af744355cc81e849e703a711d8661a8c9044ec31cce3233aa9579c63fe16f73f45ae24d3e719aec41fc4e65d0c5502c126fff5fe41f3489f
- SSDEEP 49152:CU+AV5kaH4TgBzT88ok/sF+SILe/IgXnqKjN5uyo3:rkvgB/PsF+SILMXqKWyi
- TLSH
  T1B1952A4AA3691148DBFFD0BCC657AA0BE671704403A066CF5A75C79A5F33BC7223A706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  resources/native/opennow-streamer/glib-2.0-0.dll
- Size 1.4MB
- SHA256 c7d161fa1b0b63587ac30a87acbc2f4930872be5d7d61c79ae49e2bf56326bfc
- MD5 a788aee12bea4dae801844f6b989bba1
- SHA1 a8423f3e9b31eadfbeaa82a51a5a1e388590e88c
- SHA512 f1c0291f0d9deb99fdd75250d3bd9bfc27de58ca859114c6b739916dbfd7f296024ba7b3f9c95676c2b1079aa934625809a63a7eb65d0bdaa2ab6bedb2c0de1f
- SSDEEP 24576:U3NFfKtmFFXzfVWACIhRhhF8PqHHILdDkoWuwO9Huz/aTvv0sWkddMIvA2+UDVkC:E1Ktm3zfVWACChhFyqnIBzwO9Huz/aTJ
- TLSH
  T18465289AB24435A7FBA6DD38C4A29753D27074040F3366DB2E5CC7691A2FAD7123AF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  resources/native/opennow-streamer/gmodule-2.0-0.dll
- Size 25KB
- SHA256 7aa014b3b4dedd52de9c4925f8d15f5d0d087fd370ef860a4091d2ee9cbf055a
- MD5 356f703aee7a062b1877e7c1cae9fd41
- SHA1 6b96099970aca096848f371d6c2c470c3bc0f78b
- SHA512 4e46bf19a8ea4b9341eb8a115428bacecf154e1f577bde5868600f255ee29dfb10fbdd1267a8185f88d4d23543b3a26695b8978c01307228605289c1a833d7fb
- SSDEEP 384:e8EwTHQkXqd91S71kl27rHjkm4Eaq0czhu/Rj8SWCKW84j:uKq/1S71kUkm4EaqjI8TjWj
- TLSH
  T1E2C21A85B39950D5F663C33CC0223F6AD2B6B52523B056CF03B6D1A91F232E1BAB4759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  resources/native/opennow-streamer/gobject-2.0-0.dll
- Size 353KB
- SHA256 fe1ba403ebc4ccdf9061351167a4cc88f6ba33a4e35ae83aeb400b3e102ff83a
- MD5 971a55c9a6eeba47a732f370ffdc2677
- SHA1 cd7e8893c7dc6d68d1c4d238bc7c083fd259e5e3
- SHA512 690461f249c78ad9fed90fa27c254c0c8de7eea6421dc816f8b927ff1d3ae0f57a24f178b13d61f02e8584d27cdddd647ae7aa741697d4e5c83ef145422a6f54
- SSDEEP 6144:fdOlpC7IQqSB1pGkfGqQgdfDXepj1iR9Cmwn9JXkQIJpoqbyqL/ufF+pZZ5/B2iU:FOlpCIQqSB1pGkfGq3dfDXezfmwn9JU6
- TLSH
  T172742A5D73582459EAABC07CC653AA07E2F370181771A6CF0BB483941F37AD5B53AB0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/native/opennow-streamer/gstreamer-1.0-0.dll
- Size 1.4MB
- SHA256 643d2e5d791800ba6c335399f5f7b64eb73fe4b363ff2672525982f9dfc3047e
- MD5 7048418b86db457f7febaa02879eaf62
- SHA1 3d729bd9c1326053c0582cf44744123dad296d22
- SHA512 484ff9d29795e312b09cf9ed8ecb50a79e27f9f80147b1ab06687876514d500cb71f614eadf4365c359c47ff609cd432e8a8dffad6ed0d4b89b1e8368e92547a
- SSDEEP 24576:FIRDSuX65oi0g3PYsq6hp3J1Ob3pmjTj0jQxF+WdvbJJEQff+H1cmcEtempFXt2H:FIReuX65odg3PYsq6HZEzpIP0+FvlJEJ
- TLSH
  T148655B5EA3685189C9B7927CC207A607E6B1F04417607ADF8F6C86981F27ED6223F70D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  resources/native/opennow-streamer/gthread-2.0-0.dll
- Size 13KB
- SHA256 67a709ef37a859da9137a66a0734ace05386aa656ba759f1e36b40883e1a0bc8
- MD5 d6ee5a4bd3f337a04ded9c0047c73cae
- SHA1 e27e946988bac395681dc690ee9a57897e04b6eb
- SHA512 6495c7daf8fbe091caa8814acae15d442571401cadc7fa8c843c0994964fd28d146f59a3e19c18bdda079aaebf7f642c09c41b0ee7946d52e42cfa4ebae3d5d2
- SSDEEP 192:jbCd+p6BgZ/aajjrt8voin7yP8yL4ky5z+zLu6:6dM8A/ygiW8NAu6
- TLSH
  T1A7523956BBD481DAF67782B5C4271F52E037B5200770930F03A2121D2EB6791BA6DF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/native/opennow-streamer/intl-8.dll
- Size 13KB
- SHA256 7fd08ed8337abf48cfa3aa120ed49d3a3f409dbbe8ec450450218708dcda1efe
- MD5 98e0576da9732b4c07bf5a0f3e995da8
- SHA1 ca4a04db2c05843cd0c95f4b73325221ed7e43d9
- SHA512 633776df8404e561e3c86a804e505bef4091a182ee2f385d38c642db3cc2ba55d945d9424f29b43b39a2c211ef680e9e0830a1df1e6559ba5a48802f437dc668
- SSDEEP 192:IDp1EBVb35GDCl7Lo3hR27vonR3bSEOacLHV7Gn7y88yL4npPb:IDKGUpeR3sMF8Nn
- TLSH
  T12052F847F7C48ADAE6B6C6BDC86B1F199237B124131143CF07B252490CAA3D53A3DA68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/native/opennow-streamer/msvcp140.dll
- Size 627KB
- SHA256 639342ea9a67c0009122238ce070a8257e2e04d367d627509fec29f8442afb42
- MD5 6d318c1ba915d3d87f3f59dc6e3de276
- SHA1 6da14daeaf9cf2c20670e83a37c393a94bb4e557
- SHA512 b9ef17cc2ad61807b68d6b80ea8f084c2fa6d422aa73c455017d0992d35dd6f8d284d2a2ffabbf88fe97fc67f7684141a0e685675c017211e9d1327f22031ff7
- SSDEEP 12288:0HyzMcAOctv6pOFoUn0uXptkQpytoJgweiQKW5mUeSOjHWtCje8ACU5bwfDwK4vh:0HyINNkQpyHbApTDwFvHPQEKZm+jWodK
- TLSH
  T187D41823774D02A0D195E2B9A1C74306E7F1BC464323A3C392EADA6D2F5B3D9677B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/native/opennow-streamer/msvcp140_1.dll
- Size 35KB
- SHA256 456aebccb449fcba35f1109c259ba0aa10923e660f4de812a490d35f37f54fc9
- MD5 6d34e1cd21167ff0aa9f32d479cb7610
- SHA1 b652add0bf9e50f936308ae476e48d3fc37db1e2
- SHA512 4b523cfc2a0c41965dfc90c28e873c5a096b095c5d14cb0f9582236c59176d73a360c4981fefd80bcadac4f9e22465b6c201ab83956a9716547957316b26434a
- SSDEEP 768:atXrAh7ARf5w4DYAS79zqq+U1c779zqy+:SXsh7ARf5gRRzKU1CRzH+
- TLSH
  T19EF24BC6B7288483E8A7497092E6DE43BD7DB7D60B1066DB16A1F91C0DE33C1EA3495C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/native/opennow-streamer/msvcp140_2.dll
- Size 268KB
- SHA256 7a403abf753d0bdf09776cf4bcb13b5a6ebe3a47670de124a3c621aa4b952f82
- MD5 c0d58b9c22ac5d37c9644125e7623bb7
- SHA1 e576cc830d7c5b149dfd85474704edbf4e6f767e
- SHA512 23c713e24d048c5749c72162782bf4a6843db45c2d77b1db69ce7fffa822c89e83268dbb0c7e12bf08e12a4f7ef1585da70805e7567c175f572aa2c00172bfb1
- SSDEEP 6144:mfdOInaPugeMdDsQuGt1NzXcwcCAdQWO0aCa:mhSjVj9WI
- TLSH
  T15A441614B94A1EBFC8E6E8B045397406FD2229014365C4CB1BC31D5EAB2BBD77EB351A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/native/opennow-streamer/msvcp140_atomic_wait.dll
- Size 56KB
- SHA256 d759dd381bdbd6142372de4cb57acc382e1b80c106b7414a408816564ee1eb6a
- MD5 6a20267c06f1ae5cff540225d66a7155
- SHA1 dc1a0016b9ca33404ee2f25a85297e3b819e81b1
- SHA512 094e9d08221307237906c6e700170863207fa4753f62b629ccb77251dcc21c18dfea3b78a2081b9e341bf50d6e52f024f9f32b7eaed2b1da748b31d6f1082474
- SSDEEP 768:bfZbNO5FcEsn/H2QX7QlqLvw4DY879zq9I2s9zhAB:JUfUnf2QLQlqLvg8RzatkzCB
- TLSH
  T115435B29CE39D057E71E8D74C656C806ED32BEC38B80B5CB6741ACD90EA6BD4DB39205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/native/opennow-streamer/msvcp140_codecvt_ids.dll
- Size 30KB
- SHA256 f781e1e0133c397c3a2c73fd4dbcdb442378ba20fced56a2f7db5822436ddd2a
- MD5 7cd39f0cfc4a2f98854d52d39dc95fa5
- SHA1 5ba0a053d3cda987e358f16039fccd0b8992bd23
- SHA512 05e00faa8714e124c4cff58db8a20a111e8a590c90df2cc08263c389e2a6461bc37f5c8f5cf95ba6c40025693c93e61bc03c025f730260968c8f43ba4612e1d8
- SSDEEP 384:WwEkrtLNmH97saZfVWiPEWaw4himRSt+eGtPrj/R9z0i/QqHRN7r2QR9zhgI20:WwEkhLBuR0w4DYgrjZ9z0Gr2s9zhn
- TLSH
  T130E25AD99A3C40C6EDA75D7092A9ED473C3DA7D31B0062D712A1F8680D937C6EB3862C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/native/opennow-streamer/opennow-streamer.exe
- Size 2.8MB
- SHA256 dc5b1c135285fbbde3b1202b88e2f0f5bb173178b7329d58aa1057bd52a9b5a3
- MD5 0e7817f6ac575cf256b2276f8d03e706
- SHA1 06d38a5e8b53b1cd0426ac4b3adc18a8725729ba
- SHA512 496a0bd9307b87086bd47608b929cac8cfef0ff264e1d2ab07b6bfbaecf8b1ed1e30908cf3ee418ebdec65e22f7eb32033098ee30a1fab4335eea65194a4e4b3
- SSDEEP 49152:MgHOTEBmq2zLLzE/Q0Glfc4WDeXWVR6Vv:wP9l0mV
- TLSH
  T1B2D52811BB4A59EDC19AC470834646725B31B0CB1B36BAFF059886393F69AF41F7839C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/native/opennow-streamer/orc-0.4-0.dll
- Size 481KB
- SHA256 3fc36c4fce0a60eb4ef8aa82791dd1d16cc1e3b06461c9ba6269dfaafd9756b5
- MD5 05990847802c5afeba214ad8cca35106
- SHA1 6d3984f4ae41878623d0f9094823b95409f649c2
- SHA512 ca6166db3877ee61e626e4a20efc4bd6cfab8ecb7291d3ff0769fb7181c570b709bd8c257b150d23b256171f0a8b2c2f928598cee22f296ebc3fcca9d898d803
- SSDEEP 6144:/j0ZFxNtlyGN5qUHpuDMe5hHljwiqxq5UO6f4aHdyaJKynoZE:IZFxNt55ru4ebyd/
- TLSH
  T1A2A42B51F33A25BAC1B7C27A8E92161BE2E8B04503D076DF84B187657F13BC84A77B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  resources/native/opennow-streamer/pcre2-8-0.dll
- Size 341KB
- SHA256 8fa8c7de397662a36511d010b207c10eadc9987d4c4596aa9cbafadb248ff464
- MD5 2508eead3f9d0d097834384911237665
- SHA1 6abef53908d0a76eec42bbc9ae3492506bb70bcd
- SHA512 7d5b26d0e338dfea82178b2bb6f1c72138bc37f30a61430d8c524ba8ba69baf0c92f1d9d11b2e05cc857dadb626312daeaa3d21227e93c45ee67878e0d9293a0
- SSDEEP 6144:KOLBVkN2lawOMGqVZl6aW3RfOYCqVPAw:/K6GdaW3RfOYCqiw
- TLSH
  T184740903E2D3D4FBCC5691714851C9A2EE23B50A47484EEB34E0E258FCE35B55A26B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  resources/native/opennow-streamer/vcruntime140.dll
- Size 174KB
- SHA256 19c293ac482fdb882cd29d2b0e6d807419efdcada04068f03e5723670895e17d
- MD5 2e79fe92ea9d573266021a1e0a9b17d3
- SHA1 ddd96f94427ec7a1a43b1ce2eca79a8383ca2457
- SHA512 bd68c5940f8f0756dec6390b4e8020b2a75ce996338e2f7de72b656d91396e22b7b8b0cd0d06bc0962b25aa7d892cf94c17a2229c48405d66d769b9c776f22fe
- SSDEEP 3072:0Qf3XYZst/GrhA4gBSnSX3DQj0yeBrZHecbxvWjVWk:0QPYZsmBnSX3dyeBrZHecbxejt
- TLSH
  T1A6048D51B2CC00B2E52B86748CD6D953D6B5B0057B306ADF47A886782F33FF2A63DA05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  resources/native/opennow-streamer/vcruntime140_1.dll
- Size 49KB
- SHA256 a253a12e4a8e9e23ebfe0ced829f7751e4f42c60066986bf20515ced8dcc68cd
- MD5 0e8274882579fd2cb2b4028d0847e5e4
- SHA1 6359a51dd137998b579dc66876ff4e7abaf0cd7a
- SHA512 8a84b7ceb1d9ae2136b2cf4a2ef8fbe16324a3976597f7025ac9f86210f47c95627ce812ad69307b9fc86418aee41e6354544a324d3f0a7b3773dde49b6a9662
- SSDEEP 768:Vmhyc193JS7ySK0TAinfw4DYlrjZ9z0+Xnarr9zEJeui+:vcjZ0y6/fgpzpXGBz9+
- TLSH
  T1CB334B8497BC4086D8A798B081AAEF07BE3DB762575052DF4EA0E55C2D537C0E73C22A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  resources/native/opennow-streamer/win32-x64/concrt140.dll
- Size 316KB
- SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
- MD5 5fe9a647921ded8a2fad92deb9ec4ab2
- SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
- SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
- SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
- TLSH
  T16C64398A76140CE6F96BE039C553851BE6F2BC416352D3CB0264839E6F637D1E93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  resources/native/opennow-streamer/win32-x64/ffi-7.dll
- Size 31KB
- SHA256 e905b8e7ac781615c29276867bdd3b23f5925c4bdd9f33ebddd15e783e82ca85
- MD5 e77bb4ec20eb265a9609e3a3b1b71682
- SHA1 2cd14741518d9a6d25d98884212bac459e48c7b7
- SHA512 c6c65bd8a036a22ae961a334aef27c81b0232a3a06a61f1d499141dd528e9c6a54cb2ce85e4bc57a90be28d76c19570a6a1e4a6a24e3b9fc208f816971c9e089
- SSDEEP 384:WTlqwiLhnHgIs59Wgv5zS9LZIPl/LA5Dszcvg3wqet1DFW6RCXPP8auzJIV:tsPhulZoS1t1DFWXPsN
- TLSH
  T1D2E21906628481E4E6A3D13DC737DE99C23678751710B6CF02E1D2AF2E1B6D8E67D718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  resources/native/opennow-streamer/win32-x64/gio-2.0-0.dll
- Size 1.8MB
- SHA256 cf8b907afcf352ff15dfff97ef9d66f2d9eec4908f612ff62be8ec4a83da1a82
- MD5 070ac257dfefdce8784b5e100c2b95a5
- SHA1 c70ec596ff500535b44bffa1d6582b2dce4fada8
- SHA512 c9b6560f5af92db8af744355cc81e849e703a711d8661a8c9044ec31cce3233aa9579c63fe16f73f45ae24d3e719aec41fc4e65d0c5502c126fff5fe41f3489f
- SSDEEP 49152:CU+AV5kaH4TgBzT88ok/sF+SILe/IgXnqKjN5uyo3:rkvgB/PsF+SILMXqKWyi
- TLSH
  T1B1952A4AA3691148DBFFD0BCC657AA0BE671704403A066CF5A75C79A5F33BC7223A706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  resources/native/opennow-streamer/win32-x64/glib-2.0-0.dll
- Size 1.4MB
- SHA256 c7d161fa1b0b63587ac30a87acbc2f4930872be5d7d61c79ae49e2bf56326bfc
- MD5 a788aee12bea4dae801844f6b989bba1
- SHA1 a8423f3e9b31eadfbeaa82a51a5a1e388590e88c
- SHA512 f1c0291f0d9deb99fdd75250d3bd9bfc27de58ca859114c6b739916dbfd7f296024ba7b3f9c95676c2b1079aa934625809a63a7eb65d0bdaa2ab6bedb2c0de1f
- SSDEEP 24576:U3NFfKtmFFXzfVWACIhRhhF8PqHHILdDkoWuwO9Huz/aTvv0sWkddMIvA2+UDVkC:E1Ktm3zfVWACChhFyqnIBzwO9Huz/aTJ
- TLSH
  T18465289AB24435A7FBA6DD38C4A29753D27074040F3366DB2E5CC7691A2FAD7123AF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/native/opennow-streamer/win32-x64/gmodule-2.0-0.dll
- Size 25KB
- SHA256 7aa014b3b4dedd52de9c4925f8d15f5d0d087fd370ef860a4091d2ee9cbf055a
- MD5 356f703aee7a062b1877e7c1cae9fd41
- SHA1 6b96099970aca096848f371d6c2c470c3bc0f78b
- SHA512 4e46bf19a8ea4b9341eb8a115428bacecf154e1f577bde5868600f255ee29dfb10fbdd1267a8185f88d4d23543b3a26695b8978c01307228605289c1a833d7fb
- SSDEEP 384:e8EwTHQkXqd91S71kl27rHjkm4Eaq0czhu/Rj8SWCKW84j:uKq/1S71kUkm4EaqjI8TjWj
- TLSH
  T1E2C21A85B39950D5F663C33CC0223F6AD2B6B52523B056CF03B6D1A91F232E1BAB4759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  resources/native/opennow-streamer/win32-x64/gobject-2.0-0.dll
- Size 353KB
- SHA256 fe1ba403ebc4ccdf9061351167a4cc88f6ba33a4e35ae83aeb400b3e102ff83a
- MD5 971a55c9a6eeba47a732f370ffdc2677
- SHA1 cd7e8893c7dc6d68d1c4d238bc7c083fd259e5e3
- SHA512 690461f249c78ad9fed90fa27c254c0c8de7eea6421dc816f8b927ff1d3ae0f57a24f178b13d61f02e8584d27cdddd647ae7aa741697d4e5c83ef145422a6f54
- SSDEEP 6144:fdOlpC7IQqSB1pGkfGqQgdfDXepj1iR9Cmwn9JXkQIJpoqbyqL/ufF+pZZ5/B2iU:FOlpCIQqSB1pGkfGq3dfDXezfmwn9JU6
- TLSH
  T172742A5D73582459EAABC07CC653AA07E2F370181771A6CF0BB483941F37AD5B53AB0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  resources/native/opennow-streamer/win32-x64/gstaudio-1.0-0.dll
- Size 565KB
- SHA256 306f0a30719132a75b4466d15cad827319781b3808ff8d2d14af69738581fb14
- MD5 f41da54076a12535220d46fd2d9ffb17
- SHA1 aafecb4ac094259c9439f03337b6b9d19c982ae4
- SHA512 c27e752d61bebcb1dbdc31987ea8cb3cb83aab97d78eab969d18d66c7a688cd8b06f2dc5e10582870199545925a647193a070549f355519e613012da072fe8e6
- SSDEEP 6144:j6dobKWitOrVhzAVoIfRLxqaXAv/nco48oARDT/4pn6hiy4e2OcQqx030:jHjiO7zKfR1uvkofF2n6+e2303
- TLSH
  T19EC44B8AE25017C8ECBB917C8217B917F6A1705847A439DB9FB4D6541F23BE2723B708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32