562da2c47b0da9b1dc45edb30cc72978b33394507890705a0eb3af9038bc398c

Sharing

Copy URL Twitter E-mail

General

Target
Heeph-Client-Setup-0.0.30.exe
Size 81.5MB
Sample260822-c5l9fazgnc
SHA256 562da2c47b0da9b1dc45edb30cc72978b33394507890705a0eb3af9038bc398c
MD5 22211032ac091ce28013c4f44f7dff46
SHA1 398115a6e57c644818728a24d11b8c2e59c4246f
SHA512 ee9ee6e81bd4bcd6fd48c31baebe3686761303d6ff5aeab0f63b7f6be3bdda43b1708dc1d03f0c186db3e1e241d3fd4582e553d0559dcf2563147ab9e7e7ce05
SSDEEP 1572864:r+e4hdV6xf7sl6vsH4ynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJ5B:r+e4DoxfWMW3I/0A/3/vHLosELB
TLSH
T121183363AD7E08ADC0D577BDE16F04A58A0B284F1A8E509973AE55EFF4F58014E221CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://corretto.aws/downloads/latest/amazon-corretto-21-x64-windows-jdk.zip
exe.dropper
https://corretto.aws/downloads/latest_sha256/amazon-corretto-21-x64-windows-jdk.zip

Targets

- Target
  Heeph-Client-Setup-0.0.30.exe
- Size 81.5MB
- SHA256 562da2c47b0da9b1dc45edb30cc72978b33394507890705a0eb3af9038bc398c
- MD5 22211032ac091ce28013c4f44f7dff46
- SHA1 398115a6e57c644818728a24d11b8c2e59c4246f
- SHA512 ee9ee6e81bd4bcd6fd48c31baebe3686761303d6ff5aeab0f63b7f6be3bdda43b1708dc1d03f0c186db3e1e241d3fd4582e553d0559dcf2563147ab9e7e7ce05
- SSDEEP 1572864:r+e4hdV6xf7sl6vsH4ynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJ5B:r+e4DoxfWMW3I/0A/3/vHLosELB
- TLSH
  T121183363AD7E08ADC0D577BDE16F04A58A0B284F1A8E509973AE55EFF4F58014E221CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  Heeph Client.exe
- Size 168.6MB
- SHA256 b0574ebdaadb4c8fd2055cf6b0ffb579f449361fd8f6577de4c131247bdd28f4
- MD5 6bd1d3ee9b0c99da1c0acc2332d86387
- SHA1 0238dc86ba3d5187fea1952107148ea1200ead78
- SHA512 ec24b61f00169b56d4d18c046a7205044c38eb7e453b95300320a506615ae4224a929f0f9874dfb4413e6384289574903321acfa53264234eb3c476a4766a9a6
- SSDEEP 1572864:cOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:ugmeNxNNZxqV
- TLSH
  T18B887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
- MD5 1ca87d8ee3ce9e9682547c4d9c9cb581
- SHA1 d25b5b82c0b225719cc4ee318f776169b7f9af7a
- SHA512 ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810
- SSDEEP 24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ
- TLSH
  T1D296A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/7x.sh
- Size 235B
- SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
- MD5 8a65a1ab93601ddecb93af2a310dd68b
- SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
- SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
- TLSH
  T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
- MD5 9fe8a485038be54d687ad7dd9dff80d3
- SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
- SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
- TLSH
  T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm/7za
- Size 983KB
- SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
- MD5 601642dc448c3b398e92ec0d19e447a1
- SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
- SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
- SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
- TLSH
  T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm64/7za
- Size 1.1MB
- SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
- MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
- SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
- SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
- SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
- TLSH
  T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/ia32/7za
- Size 1.6MB
- SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
- MD5 dba8ad5c0f1a27e9e387817df9ceebbd
- SHA1 33b7ae00c218a250c30588fa134dc9946665147b
- SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
- SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
- TLSH
  T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/7za
- Size 1.4MB
- SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
- MD5 6a2e4039a2f56265369f22ecb1a19fd5
- SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
- SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
- SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
- TLSH
  T146657C43F9B6547DCE9AC775821E9232F678F44906309F37B284EB302A52E60DF69B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
- Size 266B
- SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
- MD5 08025b57ddf3df9bc3e2844d86e4135f
- SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
- SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
- TLSH
  T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/do-build.sh
- Size 646B
- SHA256 4304f90e9b9266cccf357b212c6a8ea3b0816b68c39a4d4691d638c9e2f07286
- MD5 2f48a9c98543108edadedcbf4d45b4ae
- SHA1 a7b0bafdfb070e0cc6fdfa2977648b8d07593f5e
- SHA512 cd17c759b1e7800260eb70befd37c273c78b34c44280290d60d406efe0a174cb34a727bc2cf42e8fb80bb65924ac405175bff69f34c115527ebc573a6a430b42
- TLSH
  T1D8F02380C864B031D5C8CE0373B69B28BC2658858FE8F95CDDA90CB8C104952B71ABCE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/mac/arm64/7za
- Size 965KB
- SHA256 6f4dd78a82cf574f49118d99be620fd3edcfa9e48971d8523816b7ed20419c47
- MD5 d8257aa0b1eb873e9ee8f89e97ed9b26
- SHA1 0b3be717f56ad4ab2c1745da8be7a7833b47d3f6
- SHA512 b850de0e1e85dae63ea4b857129ec1eb0bcb7eae3c2100a9fa600d2d5f4d9bc8daa0d07e148a2a57079e5496a68013c03725ac8dd3a39311e51660f27d29d1de
- SSDEEP 12288:tfzSbxCCUWOQfK4okeJSdieTD76s88y2fFvNZSxrvOWwy5BpAGcKB:FSMCUWOQNYJde32ZkfFvN0x7ycAGcKB
- TLSH
  T1B5253901F91C6C22F2C6B1BE9E850FA5352BB57041B0C2DA7877525CEC96AE1983D7B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/mac/x64/7za
- Size 2.8MB
- SHA256 434075f6ff5ea9250571033ca06b95d464efcad87a528dd0b224816c86b1a444
- MD5 335361d7f6faf13cadbf116bfdb97226
- SHA1 d6cba0f2e221d1061261767ec38ddd7c550015a3
- SHA512 5fa86f6ec50e0f2fa87ec7cfa0e98cf2bfe158035e5af024e017cce4ddb33aea631008e43328e6049e0f95e8c63dac8b1e03d3c949b34ad2a3e94ab979cad0e0
- SSDEEP 49152:VxV0AtX4EEf/Gf80I+qnyVUdbU1t4t1zCtmf3ybzh2uI1I+wwBV2Lg800h/E2zz8:Vf54EEf/Th0VEHf3yb5U0h/ELGCTZ5
- TLSH
  T1D0D59E17A6B0A568E082C07427CF97729670B9B62A29324F37C4E6293F7ACD1F715353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/win/arm64/7za.exe
- Size 1.0MB
- SHA256 81f67048b7366870e5d49f00a8c570570c6a0dd11c05df7a09a8c52870cc83bd
- MD5 738047f69da7d4489bc085909a68e532
- SHA1 094c83b994177f3bac13f8d9320abca5c85b8839
- SHA512 d6bec8d71b6716a28e1c399e39c1652b354711d8081ecc09746184dcf0a28aab11144c5b893cd3d975564411929358d7a8af8c11ab45d415e864b5cbe5bf14c1
- SSDEEP 12288:eeJk5mmhxMpYcHwTR9rjJf19RVlGVYG4YQTukMef5vxW/gR5HD:zojYYcUlcY99AK18oR5j
- TLSH
  T1B3355B416E4CE891F1C6E2BC6DB78F61363775288A548287B127432CFCE2AD4CDB55E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/win/ia32/7za.exe
- Size 773KB
- SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
- MD5 dfd1cf824c781069def1d239a626d43e
- SHA1 bbe24cbae89166de829a7cf91eebfb518d8f45be
- SHA512 0413adecc5560ddb18133eec70b3a717d82738f304bdbe6eb6e2dad9ada57314c60bbd48ac0aa948af77ae76f7d522ada4f6089fffab88f882872c56bd12ca20
- SSDEEP 24576:fq79Al2Gp6BXGyja9hicoZ6ijJhyHiJT:yS2WUda9vy3dT
- TLSH
  T129F48E227AF5D0BBC24211328A1D7BF691F9E3190B3048C763908F6D6B359D5DA3AE1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/win/x64/7za.exe
- Size 1.2MB
- SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
- MD5 b7b7473472c9806bee3e7ae6c1adda23
- SHA1 2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
- SHA512 544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
- SSDEEP 24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
- TLSH
  T110452A56F6788375D073C0B9C5D2AB9AEE72308517308ACB1246876D3F17BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/authlib-injector.jar
- Size 321KB
- SHA256 45336952bbedb5cd848321172abe2c2baf0a864826f27a79fed52e3408c0dbc1
- MD5 cddcfe1c0a268b744570a8376c242ae8
- SHA1 2dd774418ef68d08b7223eeaa4ff6a0ae3edaada
- SHA512 1174e5d828b72ad1b5b02a41577ce56d15b75f98e5fa934b5d6c4d4d833f709c7786ec800d197ea0f2f4141698e5a45a2eb28e9905260f2915cc3f616eda2486
- SSDEEP 6144:8klPzA2kCqZrMMaiLkXTcev692MlvN5P6VPsnoUsrz23BVh43H4:8mpCnLkXTcy6ZlLWPsnfsr6VT
- TLSH
  T1B064D020E891E506F3DBD2F4F0D41613B4B846CBDA4560B92671DAFADCE258D5F082AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  vk_swiftshader.dll
- Size 5.0MB
- SHA256 680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc
- MD5 583b1d71cd7b847ba02d734c508cd92f
- SHA1 d63966aeafa951d51967620c606e9b97399699c4
- SHA512 cbb0659ccac9344ed9bb151443a30c106711fa1b15234e6f1225ef28a679c6b3f0a24a6ca1d9baff46155c39ff4e08e3ac96e1da32d665be9a5728956012f193
- SSDEEP 49152:yO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyD:yLftMUSogaEm5hZdIOlEbRaB3YI7
- TLSH
  T10E363813B2858199F05DD5794B5BA632F632F8801B72B6DF52A00F192E37FE06B39B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  vulkan-1.dll
- Size 925KB
- SHA256 d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2
- MD5 47af18d68dc7cf271f0a92707f783f64
- SHA1 64594e92a1cd7042cf6367b1843abed210db3d78
- SHA512 2e8fefeccc25e5fcb448fd874f99b8d1466a8148ffe80e1f6ac2105d18bb93e529681ff0ba38e515f52ed4df9ac091fee0782afe5e093fd83c3045a60409fc10
- SSDEEP 24576:Ty+lCO+5ia/1DW6pb9MLtX6Z5WdDYsH26g3P0zAk7o34:TymVqXpbId6Z5WdDYsH26g3P0zAk7oo
- TLSH
  T171156D139A94456AD476D034C8C28607CAB178921726B9CF03685B087F6FFF4777EB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  $PLUGINSDIR/install-java21.ps1
- Size 5KB
- SHA256 8ef1b8f309865e2b5a2a32347d7caf02cb83db4b7a1dfebeab37db09f2770df0
- MD5 a22ffe53db47dc3aaf3f408f6e8cf993
- SHA1 cad7edb67e88372cbcb4bf3f9a314190deefc94a
- SHA512 3fbe33c2ba512a3be739a9c924ee1fd1128c97683e5d2bc2309f6213bc786adbfa987435a18318ca6e223c7327d00a67a97931702f78213323e7222f06e7d407
- SSDEEP 96:Ril2mYNyiSfKQKHG84//u20zJSQoFU3VamiPydGE3K0qeQTI0CfKK3b0lDKXsXx:Ril2mYsiSfKQKHG8amppxGP0qxM0bKkT
- TLSH
  T1F6C1640B771661609CF1037AD9890198FF1A80BF01499614BAAFC08DFF759B68B99B87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $R0/Uninstall Heeph Client.exe
- Size 145KB
- SHA256 00f3054007a676fb4c7a5fda7b3f056c5e7cf24a3ec8727243df2ce46117999e
- MD5 cc1b1b18af9eacef2c8df778144a34eb
- SHA1 c82109ec965186f98a67395d86b30c55113a17ff
- SHA512 c54c4d4b685168df542f4c2a9ec13eb6176768a60faea92bb6733ba179c7c877ccc8c7dce199bf93e43b3b363af4a44ebd64101268d13be2973fdadbb7fa6fd5
- SSDEEP 3072:2n77v00hEoDEtauFEzHkddn6n20gzMVbaH2tvhOEA1RJCir86SrSrv6Ia3J:2740I1EzH2nM2pMls2t0EyL+yaZ
- TLSH
  T1DFE3F11476E1C937D6F70F714BB597EB0EB6F11019286F836B80174E3962681EE2E361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral28
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32