b214d384f99dd54ffa7dfd911a2e1f3c035fca1f813db0997568a0465339cfb8

Sharing

Copy URL Twitter E-mail

General

Target
BlurAutoClicker_3.9.5_x64-setup.exe
Size 7.9MB
Sample260822-ypeejstvgw
SHA256 b214d384f99dd54ffa7dfd911a2e1f3c035fca1f813db0997568a0465339cfb8
MD5 b8e86736418fd5dc03ddda698c36c33f
SHA1 2ceebd59ad0013511334709bb3d21a1846efad01
SHA512 8a47aa2ddb45752cbded17cc3bbaa164fefa03cddb601355337e0fecb5a641c4a70dfc6448e6ed89b2c747b57784cfd5cee123f281f94e490a6014857f023af4
SSDEEP 196608:w3aSrJeEpjxcOyJWUTWl6XV/9SfgpYGc7jobew3:w3a+JeGNsJpTLXZ9S4b5qI
TLSH
T1AB8633186F1F0E9BFB541074D5DBC5563F8A0E84BC29B3C34721B929863BA858FB6B14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BlurAutoClicker_3.9.5_x64-setup.exe
- Size 7.9MB
- SHA256 b214d384f99dd54ffa7dfd911a2e1f3c035fca1f813db0997568a0465339cfb8
- MD5 b8e86736418fd5dc03ddda698c36c33f
- SHA1 2ceebd59ad0013511334709bb3d21a1846efad01
- SHA512 8a47aa2ddb45752cbded17cc3bbaa164fefa03cddb601355337e0fecb5a641c4a70dfc6448e6ed89b2c747b57784cfd5cee123f281f94e490a6014857f023af4
- SSDEEP 196608:w3aSrJeEpjxcOyJWUTWl6XV/9SfgpYGc7jobew3:w3a+JeGNsJpTLXZ9S4b5qI
- TLSH
  T1AB8633186F1F0E9BFB541074D5DBC5563F8A0E84BC29B3C34721B929863BA858FB6B14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 be695eb3732a94e181f008ab5cf6ee650f8644676e87f9e02b6ab0d02f2ea08e
- MD5 ec85be242f7016c1d8d917660481ed78
- SHA1 61838956cb8257ddb9d95247e68e9517e7f787b9
- SHA512 e966afb44fd2c38a590525ec73970a4bf3ee9f9aca4fd52feed33e8c33ab2a78d898c15cd5a69de3f5327a3fddfce73907ad81515b0de3e976a1373eedf85523
- SSDEEP 49152:ZPiGk3dYVwnRn0k+xxW+YwPr+cmcIW2TfqYLsP1URN:diPR0k+xx6wycmTl/gCRN
- TLSH
  T1D5852200B6E48072F2B31E316EF481B21A7DFD725B3599CB23541A6D1A34AD1EA353A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral13 behavioral14
- Target
  BlurAutoClicker.exe
- Size 18.9MB
- SHA256 886b8f57a8041f30764aa6796916c7c02c5c85ab9179a9a921bb30a8682ec984
- MD5 2d309e11f42de3c403e7a8384ad85f6d
- SHA1 ce3ea03214ee8f542e1508643d0f34f30265be78
- SHA512 00e0bcce829aab3bc33b8f55e63f08f5b5573094ba8d1dff4c60e2481fdde1d80e7b6ac6e28c893a659722f52c2843af0984177b810dba24df3392081eca7b75
- SSDEEP 196608:o3JuGisJFgbXcvozsVJjnadm/WdZiU3xw9WMnYjE8ymFwjlpcN:DGisJFgoE5369WMnYXhFKlY
- TLSH
  T129171A916F5B95A8F196C8F082964D7FAF2038CB0A3575AB0494613C3F7B7E06B39349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral15 behavioral16
- Target
  concrt140.dll
- Size 365KB
- SHA256 54716f0738af891f283d213b5c8d11b25896bb8ee3097d301eae718560cf974e
- MD5 e6d97cbdba1cbff8a5f48648839d3e99
- SHA1 e9999d2d3c0ec93c6dfcbe59f05269fb947f9973
- SHA512 7dd4516e5f3f611bfd875d97d2fe3fa8b811537854d1b5ce366dd370921f2454fa7188dc440d5aaf99991f985cdf9d8f292540dd834930080df1c81a3cf5698e
- SSDEEP 6144:5MSmCGGmbaY0dDZAdJUX7uEwtiXAPfionWzgVqdJz/:5F3mbaYaedJUruczbJz
- TLSH
  T1E2844B9A72680CE5E523D07DC693C60AF6F7B9001352C6DB0660865E7F23FD5DA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  crashpad_handler.exe
- Size 537KB
- SHA256 6ba74597b41ed54f7576c01ec2145c8869d160fedfb6382f0d555c0ea850fa73
- MD5 9b3d46c4a81436473ab1f03c7928b5b5
- SHA1 2e616328fb730a812bf975039f6be975ecdc9a68
- SHA512 f24914a0cd6e59c8c9f30d6e5879e958d81be193af0bcd7625f793645765063f0481e2e3fe5632d4ff5b85a5bc0e574ca3969533dfc50aa42f82a012b9964bb7
- SSDEEP 12288:oBodwPcTwS4dFPgzrt8MlN7VXEN5efZjHNtBNDCnr6CB:rdwk8fd5gXtXZVXEN5efZjHNtBNDCnrx
- TLSH
  T11BC44A23F61511FEC49DC0B8A747991279B2B88A47717CDF638087322E66EE46F39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  msvcp140.dll
- Size 628KB
- SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
- MD5 4796bb351c00d47717906bbee4e20837
- SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
- SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
- SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
- TLSH
  T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  msvcp140_1.dll
- Size 34KB
- SHA256 206c931bf90fdad8816de3b5e2ef80b2bcaa9406c89ecc05fe6fddffe251e982
- MD5 d2b43663ed95d09af78bfab3484b1916
- SHA1 52f87dc7563078c0b9f839ecb1f9bea11ad608df
- SHA512 8984cff1c8f6eec407dd4cf7599950f42fc7dc9926e6ed3120cb1a4ab9f4f6ca5b3d040c8451adf2113ecbd4301d21f1ca88c9878618ceb5f3da3b4edce71663
- SSDEEP 384:FtXxBY5SA78zxAXUaWdWcu5gWAJk6St+e2KxaoR9z/bcIH2y4GlN5vEMgYR9ztDh:FtXrAh74RsuJc009zZXdrgE9zRh
- TLSH
  T157F25BD6A7688442ECA6183482E9CE437C7DB7D60F20A6DB12A2E51C0C937C5FA3595E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  msvcp140_2.dll
- Size 268KB
- SHA256 d50d7883f20d1dc6191768d3746f52dd9cac89c346ffaed5be1f110c2f34a838
- MD5 80d633b41909290fccc9cda534ca7128
- SHA1 72d779fdd27916e918ae4c15323d8c336074dac4
- SHA512 ff594e63fabaae58da7383b57d4d90322e6d2b2da42f99e58e3210931e043f8236cc8dd1f437e3d343da63af660b9299dee46a8d6e8aa27a096e8bdebfabd817
- SSDEEP 6144:m7KX1bsaPn3JrdfsUOEw/tpn76cAYQWO0H:iArNdZ9W9
- TLSH
  T1A1441615B94A1EBFC8E6E8B085397402FD2229014765C4CB1BC31D5E6B2BBD77EB341A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  msvcp140_atomic_wait.dll
- Size 56KB
- SHA256 3d0cbfaa1bf3eecf5a3f4491d2960ee803cb994f30292c6adc4a07c498f60e2b
- MD5 cb5404c8773b6a3758d05c9c8b551339
- SHA1 8544021005709c682ce4d2430fba88aff0fc7eb3
- SHA512 691dc781dcfe2ad9f1e324ad31fdd55dfa120a4a56e6dad9f61e62029c9687a7a3806d920a3eca2dd2c8e3fa8a9c420132b342d74d59cdeb3c749be5630a05f9
- SSDEEP 768:E23X0bNO5FEEsn/H2QzRclqoLJcb9zP4s9zW3:raUfcnf2Q1clqoLSxzRz
- TLSH
  T11E435A19CE39E017E74A8D74C616C806FD72BED78B90B5CB67419CCA0DA6BC8DB39205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  msvcp140_codecvt_ids.dll
- Size 30KB
- SHA256 8a65c7596ef2e6938731f5a1058e7e40145b6d97967cc649231a076b9a608d78
- MD5 c6aa14b90f156ceecc4269537df73530
- SHA1 3bb5afd909c5271088a223191f38ca916c7d81f0
- SHA512 3d402af4a1f21542012bbf46f1a94f5e71a37191b94bdd8e30c816f1fb0af9bff938fa9f0f998e784e094afa91059c9120530de390a867b7c226ecfab184ec43
- SSDEEP 384:mwEkrtLNmH9j0jfVWi8EWmJk6St+eScDR9zgzzDD2y4GlNvKMgYR9ztDjPQ+:mwEkhLH+UJcJ9zgfDr3pgE9zR0+
- TLSH
  T130E26CDAD36C8086F996A97092A9DD473C3CB7970F10A6D712A2E01C1C537C5EB3916E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  vccorlib140.dll
- Size 342KB
- SHA256 09f93d5ff96ae09767f3e1af3cdd43a5a58f2598654fc63089429bb6f9f4737f
- MD5 95513ddc9980568940387d16af447ef7
- SHA1 fc827331baac99d775470022fac2b111de24db0d
- SHA512 9b3a7380a0de5a7e5e8bca618d07945dea37d01fc66ce1a8b382c3bd0d6f820f34dedf06c272871c14271c6600b4eb33d69f45f7a44a976fd9eaa3c9caed734d
- SSDEEP 6144:iXKqjR1OmXkRLO1UPTMXhPEbUbeUG1bPQ0D:ipOmXkxHw0D
- TLSH
  T1C874D5277B9C4CC3C935A0794A878309E372789107A1E2CB1194570E9F7B7E8AD3B679
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Checks whether UAC is enabled

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32