26a956fb2e1a3f19424777ba424365d7b125acc1106229fdafedaa9096921436

Sharing

Copy URL Twitter E-mail

General

Target
ValoDaiv.Setup.v1.0.exe
Size 79.3MB
Sample260822-j5k5psfp51
SHA256 26a956fb2e1a3f19424777ba424365d7b125acc1106229fdafedaa9096921436
MD5 57cb8c52a5fa24ada2c8d4e237bbc6cf
SHA1 e37fb4a64148d0f5636aa7e18e6d8ec9a726d691
SHA512 120c9b50ff7bc6d7f9c8c0aaa6bea97bf7c1e9bb54228bd6cb28851090458a5512ad348da990e6bfc70b597a415b05469bfe0d212a6d198129d54ee623b874b2
SSDEEP 1572864:fTAE8X/xXNkE34yAT+Sxiw4vCbIWmSqxX6uEe+T8TjD2B+73uWE:fMEI5yVT+Sxi5vGBiX6uEe+T8TXxqN
TLSH
T1A90833B18F45B225C092E7F165EBA8B2BBEF3E1D7943539D491810896B68504B01F3FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ValoDaiv.Setup.v1.0.exe
- Size 79.3MB
- SHA256 26a956fb2e1a3f19424777ba424365d7b125acc1106229fdafedaa9096921436
- MD5 57cb8c52a5fa24ada2c8d4e237bbc6cf
- SHA1 e37fb4a64148d0f5636aa7e18e6d8ec9a726d691
- SHA512 120c9b50ff7bc6d7f9c8c0aaa6bea97bf7c1e9bb54228bd6cb28851090458a5512ad348da990e6bfc70b597a415b05469bfe0d212a6d198129d54ee623b874b2
- SSDEEP 1572864:fTAE8X/xXNkE34yAT+Sxiw4vCbIWmSqxX6uEe+T8TjD2B+73uWE:fMEI5yVT+Sxi5vGBiX6uEe+T8TXxqN
- TLSH
  T1A90833B18F45B225C092E7F165EBA8B2BBEF3E1D7943539D491810896B68504B01F3FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 78.6MB
- SHA256 a6aa49481db553f793cf62585594b3218534ef480321368dc62c9a19bcc5f9a8
- MD5 048ce6d6b65fb61e51a8335c9f0c0ee3
- SHA1 89369f01adbe497ae0006d4710642c90edb71f58
- SHA512 e8e6ff4b66f9cae6aebaae3a505cbf59ed44cbf4cae3dffdcc53f9d12d8387d1d718dc16ecf816cee5d4d6ee2b0ee6d2bc6815e0741c7c2484458aee0314bc47
- SSDEEP 1572864:+AE8X/xXNkE34yAT+Sxiw4vCbIWmSqxX6uEe+T8TjD2B+73uWq:JEI5yVT+Sxi5vGBiX6uEe+T8TXxqT
- TLSH
  T1870833C2CF4AE71CC095E6D27DCF3C70AFF47126EE9364E98E5D0099899C919D4207AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSES.chromium.html
- Size 7.9MB
- SHA256 c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
- MD5 312446edf757f7e92aad311f625cef2a
- SHA1 91102d30d5abcfa7b6ec732e3682fb9c77279ba3
- SHA512 dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333
- SSDEEP 24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
- TLSH
  T13886942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  ValoDaiv.exe
- Size 154.9MB
- SHA256 73be0bfdbfa3a29d44ef03f1fc1cc4b46309edb773eb0a2d675d3c97da3038b3
- MD5 9477b8d71c51e802021d5691bb26e63b
- SHA1 832f1dd55bb73d3c6df6aa1cea4ceb2188531c29
- SHA512 682fe4b566c195484bbce3d340d0737aa7b99e88db11531a5d0bf1b3f67ec37945567cf69e4b53eaa5c30889deea23144ff352e103e2d06769983cc8427786cd
- SSDEEP 1572864:rzjHyK65otI5yaNiX6+DGqQhkY28+dnrRIkIwzUBOWX7c5IO59JZV/bVr5+ux7or:zJX5dnr2B
- TLSH
  T10C788B03E29A10D9F05DD1B187979636EA72BC860738A6DF17542B562F37FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 a292b9d263c97a774240cee0b84bb28f81c10124411870fdc24ac47a3bd0a8a3
- MD5 70a8b834b8f57f1fbc8d2b87410dfe7e
- SHA1 517a66c7d6aa302d3b1122a06e3385fbda1a71a2
- SHA512 adccc30ccb0c978b31f946d07e2525c02de9ad02dc4eb6c7a403c0c87eb48a59824c386ac00f32ad527430b0beb69c0b19cfe5d828f3f98aa1bafbdbf7771605
- SSDEEP 49152:tdTodIrn9wbFV6Ps2cA7SJ/W1C1fLPzhkE7hjU7gUxGJwDw3lCQTQY/N3lzl3heG:L79fe/CmP6w3lXQYefK3
- TLSH
  T187D5AE07F2D640D9D019C474879FA233F62138468B24A7EF1A91A9252F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  libEGL.dll
- Size 469KB
- SHA256 ad4fd09b2fdc6fc241ea688be4c81830c7e931aa0d13aed9029ee78de95efdc8
- MD5 242e41208204bdb7ddecd92deed694f8
- SHA1 9a47d083cc78965089099e513b7abfbab5d0678c
- SHA512 eb9c22bd1518dfce853e14154cc9bbcdac7034d6720830e95cc0ee38d17ceaba198833ffe7826479f85cde03bdb68cd195f9c541572cfeaed68f4e57a9454c13
- SSDEEP 6144:jfuE2DT96QHENooSYBjLkt4sasMHemPwlrX+nZiOL7hn:jfuE2DbkGoS2jLku/wWUENn
- TLSH
  T1B4A48C1577A544A8D03BC434CA134652DA76B4860F25FADF02A4E27D2F7BBF85B3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 c458b56614a27c8aed7a35a5a7bbbcec6690eea54e99a7d5c5fa94908bbef414
- MD5 bee688154860dab00e7ae2ebbf222714
- SHA1 4e2bc32b99716cab90af606da401d195618bd14d
- SHA512 55b5eb58da823a2a041fe664f2957d941e3f69692ec85bde16523d2d44c5941a68e2d5cdd2486c11d857eec80189b8fd325417508607cf8c00ad26cf90296e51
- SSDEEP 98304:Wv5oAM9iBuYMTmzJzcqH+aEWdii3pn7gsOMDlAG:8nMTwzzEWDcspqG
- TLSH
  T166766C13F6A941D9D059C2B89B4B9123FA30BC990B24B2DF269877112F77FE06B79710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  locales/af.pak
- Size 368KB
- SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
- MD5 7e51349edc7e6aed122bfa00970fab80
- SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
- SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d
- SSDEEP 6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
- TLSH
  T10A841C0AD780277D09B07696FA0545F7BB9CA26CD770B2BADD9D82321962EFC017D1C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  locales/uk.pak
- Size 688KB
- SHA256 54324671a161f6d67c790bfd29349db2e2d21f5012dc97e891f8f5268bdf7e22
- MD5 ee70e9f3557b9c8c67bfb8dfcb51384d
- SHA1 fc4dfc35cde1a00f97eefe5e0a2b9b9c0149751e
- SHA512 f4e1da71cb0485851e8ebcd5d5cf971961737ad238353453db938b4a82a68a6bbaf3de7553f0ff1f915a0e6640a3e54f5368d9154b0a4ad38e439f5808c05b9f
- SSDEEP 12288:wrccq9nty/KiDswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:HGX35EEK
- TLSH
  T15FE49AA19A9D58DF0105F05BE84C7A0D7DA741FE7FA6871625A43DBF38F20248A3C71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  vk_swiftshader.dll
- Size 5.1MB
- SHA256 172522e145314a78011cca066aaff6c410b1f4420097c1a2cd5e245b2302e48d
- MD5 64bacb0fb7b68de7c63a2e65bb1ad308
- SHA1 f3dd51d631cfd6dd2ed21b50f64f97f684b9ef91
- SHA512 9dbbb0ea6a9665cf15352a9b9116f135dedfaab6ec389b9bcb3fff7e1101a181023555fc443ceb0e4344cb1638fbf790e54419875aaa4470516c6d16230b85cc
- SSDEEP 98304:IaTPSALpajr/PMMPTZTOWvYQ7klZz8Wd4iik:llajr/PMMPTZTOWvCJ4y
- TLSH
  T133363803F2918199F059D179475BA632F632FC801B7272EF46A42F192E77BE02B39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  vulkan-1.dll
- Size 906KB
- SHA256 3aa2abb9f59f34f95ff3ae2c310fc633f2bd814320040e7faa48275bc523830f
- MD5 e46375abcfa9a3fa7ff25e4d583b3e4a
- SHA1 879f68b7fd251828a1f815c4fdd923774d7ef7ae
- SHA512 3e1bb01c1ba2cd83d16f0f2d4207173285411c274dbeea62eb0b21c52d3b5206f76ce572f3829bcf325cc28b9e418f8890a0c29c48fdcbf408535e0e2aca37da
- SSDEEP 24576:BGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7i:dwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu
- TLSH
  T156156D27AA44496AD476C034DD828643C9B178D21725B5CF03A85B19BF6BFF83B3CB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32