0947f5c57beb70982c7da8d2ad0c3d0e80fbb22f8f462209472dfa8c6caac033

Sharing

Copy URL Twitter E-mail

General

Target
EvilInnerLauncher.exe
Size 136.9MB
Sample260822-1tebfsge92
SHA256 0947f5c57beb70982c7da8d2ad0c3d0e80fbb22f8f462209472dfa8c6caac033
MD5 b224c57f20009ee023b032592b3cf1b0
SHA1 90908327a58018ae53034ce90f4d1032540a6d43
SHA512 a08683f0dd9a13ae1842b7bf21e537fd602484c35c0283ca95ee5661bd5fc76f0f803564009cb61f563ad09d2111c8ca2b16733786ad7106a46e5cf81b0b6203
SSDEEP 3145728:dsdBGr4UG9+iGG7bSPisJaiMgNQFc3JdlsZyXDtN6d86efqVahe7:SdAr4UG4QbSPi6MgnJ7sZy5eXeSVy+
TLSH
T1206833B107D6039382E7E17A5E94C359C4EBFE557212A3ABD52C71CC9C94D2C026ACFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  EvilInnerLauncher.exe
- Size 136.9MB
- SHA256 0947f5c57beb70982c7da8d2ad0c3d0e80fbb22f8f462209472dfa8c6caac033
- MD5 b224c57f20009ee023b032592b3cf1b0
- SHA1 90908327a58018ae53034ce90f4d1032540a6d43
- SHA512 a08683f0dd9a13ae1842b7bf21e537fd602484c35c0283ca95ee5661bd5fc76f0f803564009cb61f563ad09d2111c8ca2b16733786ad7106a46e5cf81b0b6203
- SSDEEP 3145728:dsdBGr4UG9+iGG7bSPisJaiMgNQFc3JdlsZyXDtN6d86efqVahe7:SdAr4UG4QbSPi6MgnJ7sZy5eXeSVy+
- TLSH
  T1206833B107D6039382E7E17A5E94C359C4EBFE557212A3ABD52C71CC9C94D2C026ACFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/app-64.7z
- Size 136.5MB
- SHA256 a98984701f03a1621c830c346ba6c16d782dcb022f77d953e81d37645acd9c8d
- MD5 74c41ce15df462272683b1a74dc288f7
- SHA1 007d7ad8bdad49f3265c1d276ca5632db600fc51
- SHA512 8816d6c82a7ad8bd24a38876f56bd4f6009259dcde68cd4f84b39e18ee60502feb4e0993e6056c58ab72cc1e1104f9fe3fe817cc2ec0782666175caa1c9b65cf
- SSDEEP 3145728:ssdBGr4UG9+iGG7bSPisJaiMgNQFc3JdlsZyXDtN6d86efqVahA:XdAr4UG4QbSPi6MgnJ7sZy5eXeSVyA
- TLSH
  T16F6833B107D6039302E7E17A5E94C359C5ABEE567312A3ABD42C71CC9D94D3C026ACFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral5
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 d76fe8fa3a14cd73e4c858746e2ab2d2fa6f2df38a906fa5814b50a8a895fc96
- MD5 37c48e66c39832d32fa2e926ac503c4a
- SHA1 2400135b49193c9786f1faa8d00169ce3d38ca98
- SHA512 e1b631c3834fb84e96ab9fe44b12a8fa6c6b3c767e00a17ed8c3d8f8fbe7bc2dfe83fe33e7aca4f32439bdbad21d25af6b9e263d412922e40d09d4e421f12941
- SSDEEP 3072:Kw4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:UYWFUbGz8LI1TdjQBQCrC
- TLSH
  T19AC3E0E773B0AD7DCA464BB743560070FCB30B2D06C2170A4A9AE479652AF98D9D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b74ad439f3d3762657f3ba533a6af3ac63315c838ed46519891366f43d834a0e
- MD5 e6a75313c720a6ebe3182b4e1db48328
- SHA1 d60a503cf4604c816d9146d7fe4041018d445888
- SHA512 3c8699b998c53c0414933ba18e0cf561488b9e209523a9b4093b68d38393e9a6bc683cdffc32a8050be25b473153b71743acf9c33f070166f1e15f2a453e8eb4
- SSDEEP 3072:+FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:+IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1D01401D723B4AD3DDA530BB3A26710E0FD7A20291EB3514A569FD8397925E88C9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
- MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
- SHA1 18ff020331534d21f24d922d4da3c253668e44d8
- SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
- TLSH
  T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  locales/af.pak
- Size 599KB
- SHA256 dcf39c3edbb6b0a625baee0263a9b426eadd1a6d1bfbf03a209501a18bc4b0e4
- MD5 f351564453e36318d0442e29db7bd5c2
- SHA1 d8dbe32c5656468b4f96a799dc7de3bab37b41e2
- SHA512 07050f6b0c484d07b345200fdc6d2394201d3d1befa7310d15decfa2e67ed27724c53da2175148588f27822f28b31dff75e44b99658c141392e08a7d8be82789
- SSDEEP 12288:ayyCh2E1FPQ6tRGtAM9q+ZRwBgNYChF+plGnVbi4H2JynDNsmpiALjKrFozv2nIX:nmyPftRGtAM9PZRwBgNYChF+plibi4HV
- TLSH
  T112D40A0BEB81173D09A06697FB0845B7FB5D626CD770B2BADDA982310966DFC10BD0D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  locales/am.pak
- Size 971KB
- SHA256 b1d444f2346105a6e15f9b14fc5653e1edaa2b435290fb8f1238347a4d4ca8f9
- MD5 79fad5635b13538c17b92b87df28ac9e
- SHA1 81e142d7dd601f69d2f9b8c63b998adc926e8286
- SHA512 3158dd5daaf08933549694bf952ebcc14c3db91afc2fac3a942b8d1d30892ab57e4dce966dbaa7dc323c2deca1f1145e7517be25020b48a2ea9bf7f7de5575d2
- SSDEEP 24576:LtXGVoTx1A5t7hTCKPyaEVxsxHjnwvxehz/dIXV6sciy4VdeZtP9oPYOH+:LBGVr
- TLSH
  T13225AA547EF9F7570F8E8A1994320E4E9594AE4652802C38C35AE3FC2B2DF1B4DDE219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  locales/ar.pak
- Size 1.0MB
- SHA256 ab4941fbb89fb14f045bd54edbff7158e2d7fd0b5f2687ada0b1df9ad84c0e2a
- MD5 a7b789b8c7941e9d36a508e7b7aa0ccd
- SHA1 731824a80fa96657664a095c9b628d40cdb4b121
- SHA512 793db7d9c7a25cde3dffd239ae5d03fd97becb16e02988b5abd77cf227b279ce7aae69648b30e27298ae0812c72276e9af38fa97d112d332bba52e1b46a726ef
- SSDEEP 12288:1yWqo8bA52BmdpLFB62Ga9mwj3o0oCbv4UGPFk82/SLGNj6EuDb6NP+:1Ko8bA5kEG
- TLSH
  T139358AE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 e4a5bea23a26a06af611a7cb518b22a1d53ec5df45a6322f0e264b99c7318441
- MD5 077df43e5adc6bf502d5bbf057a0afe5
- SHA1 6e608c0a0f3a3e19f63840c35ffc7d8c7dd0cf47
- SHA512 b1996aab50923361c352acfd92c177d53e2336656e6ee29312227e685bf3d1202336ec51c9b757752b199f2c69a4d5185a5db05a600fe5b26f145e58da4191dd
- SSDEEP 24576:81oSpWclYLYAgCzQkECRUPVb6nNo7j373ZKmiv3p1K4UfVDiiJw74uOVnaJcuSMQ:5SpWclYLYAmUUPVb6nNo7j373ZKmy3pG
- TLSH
  T1B83525A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/7za-ia32.exe
- Size 773KB
- SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
- MD5 dfd1cf824c781069def1d239a626d43e
- SHA1 bbe24cbae89166de829a7cf91eebfb518d8f45be
- SHA512 0413adecc5560ddb18133eec70b3a717d82738f304bdbe6eb6e2dad9ada57314c60bbd48ac0aa948af77ae76f7d522ada4f6089fffab88f882872c56bd12ca20
- SSDEEP 24576:fq79Al2Gp6BXGyja9hicoZ6ijJhyHiJT:yS2WUda9vy3dT
- TLSH
  T129F48E227AF5D0BBC24211328A1D7BF691F9E3190B3048C763908F6D6B359D5DA3AE1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  resources/7za.exe
- Size 1.2MB
- SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
- MD5 b7b7473472c9806bee3e7ae6c1adda23
- SHA1 2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
- SHA512 544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
- SSDEEP 24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
- TLSH
  T110452A56F6788375D073C0B9C5D2AB9AEE72308517308ACB1246876D3F17BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/app.asar
- Size 34KB
- SHA256 9c92aabf1bbd140a0516b8603ac572da844ced7cdcaa8f72fabd52c8cfc5e5cc
- MD5 c605bc4e3c604d21eda1d9b9b53ef122
- SHA1 401d706e9a01d1d30a01833f849666e9b8a500a5
- SHA512 90104fb7f5a0c6e8a543b4bc9c5ec9448d13ef08c479c6c49b75573d55c81145f1298a24d58e7d3b8c91e7f6669296e35f9c28294b67809daee7afe9a6ac438c
- SSDEEP 768:EwPWw2sGebByu0pF2JTfmcHXArHRjvt5EiRpU4BaOJac:fP12sGoJ032tfmcHkHFt5eeJac
- TLSH
  T124F2D0234EF5619729F1E81056EA7726206E17320094B7D5BC8EDE0EC70A897752B36F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/7x.sh
- Size 235B
- SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
- MD5 8a65a1ab93601ddecb93af2a310dd68b
- SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
- SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
- TLSH
  T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
- MD5 9fe8a485038be54d687ad7dd9dff80d3
- SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
- SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
- TLSH
  T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm/7za
- Size 983KB
- SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
- MD5 601642dc448c3b398e92ec0d19e447a1
- SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
- SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
- SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
- TLSH
  T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm64/7za
- Size 1.1MB
- SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
- MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
- SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
- SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
- SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
- TLSH
  T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/ia32/7za
- Size 1.6MB
- SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
- MD5 dba8ad5c0f1a27e9e387817df9ceebbd
- SHA1 33b7ae00c218a250c30588fa134dc9946665147b
- SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
- SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
- TLSH
  T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/7za
- Size 1.4MB
- SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
- MD5 6a2e4039a2f56265369f22ecb1a19fd5
- SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
- SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
- SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
- TLSH
  T146657C43F9B6547DCE9AC775821E9232F678F44906309F37B284EB302A52E60DF69B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
- Size 266B
- SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
- MD5 08025b57ddf3df9bc3e2844d86e4135f
- SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
- SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
- TLSH
  T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/do-build.sh
- Size 646B
- SHA256 4304f90e9b9266cccf357b212c6a8ea3b0816b68c39a4d4691d638c9e2f07286
- MD5 2f48a9c98543108edadedcbf4d45b4ae
- SHA1 a7b0bafdfb070e0cc6fdfa2977648b8d07593f5e
- SHA512 cd17c759b1e7800260eb70befd37c273c78b34c44280290d60d406efe0a174cb34a727bc2cf42e8fb80bb65924ac405175bff69f34c115527ebc573a6a430b42
- TLSH
  T1D8F02380C864B031D5C8CE0373B69B28BC2658858FE8F95CDDA90CB8C104952B71ABCE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/mac/arm64/7za
- Size 965KB
- SHA256 6f4dd78a82cf574f49118d99be620fd3edcfa9e48971d8523816b7ed20419c47
- MD5 d8257aa0b1eb873e9ee8f89e97ed9b26
- SHA1 0b3be717f56ad4ab2c1745da8be7a7833b47d3f6
- SHA512 b850de0e1e85dae63ea4b857129ec1eb0bcb7eae3c2100a9fa600d2d5f4d9bc8daa0d07e148a2a57079e5496a68013c03725ac8dd3a39311e51660f27d29d1de
- SSDEEP 12288:tfzSbxCCUWOQfK4okeJSdieTD76s88y2fFvNZSxrvOWwy5BpAGcKB:FSMCUWOQNYJde32ZkfFvN0x7ycAGcKB
- TLSH
  T1B5253901F91C6C22F2C6B1BE9E850FA5352BB57041B0C2DA7877525CEC96AE1983D7B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/mac/x64/7za
- Size 2.8MB
- SHA256 434075f6ff5ea9250571033ca06b95d464efcad87a528dd0b224816c86b1a444
- MD5 335361d7f6faf13cadbf116bfdb97226
- SHA1 d6cba0f2e221d1061261767ec38ddd7c550015a3
- SHA512 5fa86f6ec50e0f2fa87ec7cfa0e98cf2bfe158035e5af024e017cce4ddb33aea631008e43328e6049e0f95e8c63dac8b1e03d3c949b34ad2a3e94ab979cad0e0
- SSDEEP 49152:VxV0AtX4EEf/Gf80I+qnyVUdbU1t4t1zCtmf3ybzh2uI1I+wwBV2Lg800h/E2zz8:Vf54EEf/Th0VEHf3yb5U0h/ELGCTZ5
- TLSH
  T1D0D59E17A6B0A568E082C07427CF97729670B9B62A29324F37C4E6293F7ACD1F715353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/win/arm64/7za.exe
- Size 1.0MB
- SHA256 81f67048b7366870e5d49f00a8c570570c6a0dd11c05df7a09a8c52870cc83bd
- MD5 738047f69da7d4489bc085909a68e532
- SHA1 094c83b994177f3bac13f8d9320abca5c85b8839
- SHA512 d6bec8d71b6716a28e1c399e39c1652b354711d8081ecc09746184dcf0a28aab11144c5b893cd3d975564411929358d7a8af8c11ab45d415e864b5cbe5bf14c1
- SSDEEP 12288:eeJk5mmhxMpYcHwTR9rjJf19RVlGVYG4YQTukMef5vxW/gR5HD:zojYYcUlcY99AK18oR5j
- TLSH
  T1B3355B416E4CE891F1C6E2BC6DB78F61363775288A548287B127432CFCE2AD4CDB55E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/win/ia32/7za.exe
- Size 773KB
- SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
- MD5 dfd1cf824c781069def1d239a626d43e
- SHA1 bbe24cbae89166de829a7cf91eebfb518d8f45be
- SHA512 0413adecc5560ddb18133eec70b3a717d82738f304bdbe6eb6e2dad9ada57314c60bbd48ac0aa948af77ae76f7d522ada4f6089fffab88f882872c56bd12ca20
- SSDEEP 24576:fq79Al2Gp6BXGyja9hicoZ6ijJhyHiJT:yS2WUda9vy3dT
- TLSH
  T129F48E227AF5D0BBC24211328A1D7BF691F9E3190B3048C763908F6D6B359D5DA3AE1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/win/x64/7za.exe
- Size 1.2MB
- SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
- MD5 b7b7473472c9806bee3e7ae6c1adda23
- SHA1 2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
- SHA512 544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
- SSDEEP 24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
- TLSH
  T110452A56F6788375D073C0B9C5D2AB9AEE72308517308ACB1246876D3F17BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 dfd6f3d220e963e5d43dc1f76ddf67796d2ca1b7be1ee291728e3505f700264e
- MD5 522ef299b684ce876866b54c9b782de6
- SHA1 981c107cfa62e30c251f7e69ce653db1ca0a1b64
- SHA512 2627d0d7a8ad1c2cf7d7ddb158b1c4c2df95ac0cd6b0a49334f3dccffef96543a2d113935335887156f3fa85cba71361475e85c0979b0dc6bd54a692aaa362a5
- SSDEEP 49152:8lNxNXcrPXnxidJ+34ZfQ1fzEhZJm/PekA5uOpI8/KGVKA+FpOGehAuMEDuxEPe7:8nXcrAifrg4FO7Hb1Jr78p
- TLSH
  T150463803F28681D9C06DE6798B5FA623F631F8844B2276DF56A00F192E66FE0673D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  vulkan-1.dll
- Size 908KB
- SHA256 dd4f81864cfd0436a93e7a47292bf3ea143ab10d780a1ec85bf89c63bdbc53e3
- MD5 4428ca860a695f5c7780415015d288a7
- SHA1 108f17f634849002242430b4d8817995bf19bd36
- SHA512 877e05382eee0c5055d6395e38862877d101c42cead353cda8e5ac972f6880091dfb554036d1d51c7810d859725994cb089e647a920f2f4fbe7b27b54864e9da
- SSDEEP 24576:3lg7pfgm3WP0ZaB4dS3b7Sr6Z5WzcADYsHkDn6g3P0zAk76oOHQfW4:3m1ommP0UL7Sr6Z5WzcADYsHkDn6g3P4
- TLSH
  T19D156D12DA64CA79D67A8074D8D14A0389F074821723BACF17B817147F6AFF42B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32