2d17b9994918f33a324f327e3e20d610fe8ddd06255e58717635ef4c21dd4a79

Sharing

Copy URL Twitter E-mail

General

Target
IGL-1000-LightBar-3.8.29.exe
Size 68.5MB
Sample260825-j2nresgd45
SHA256 2d17b9994918f33a324f327e3e20d610fe8ddd06255e58717635ef4c21dd4a79
MD5 7c4ef99f25b58a7872be53a5a6df82d0
SHA1 85d84b814d44d4f04dd1efe0756ffcca6887ae6f
SHA512 26f847920386f684cf984e2c1068f7cdd02e25c811784c09b09aab91d51b77ffd39c8e2907ffea83edf7d94304ef5248d6a7d92d4ec505943cf1f16390d35391
SSDEEP 1572864:ysv5kJoH4ng13570/vi2N8CREpNz0M7xS+c8NFGOSK4IBqfYHlJql:pZeg1R0/B+CRuNz0M7xhc8yK47YHKl
TLSH
T144F733208BEE1C16DD97CE7DA5CBDEA0B5BA295C5C01503A80DC39A74F46C54AB3DF88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  IGL-1000-LightBar-3.8.29.exe
- Size 68.5MB
- SHA256 2d17b9994918f33a324f327e3e20d610fe8ddd06255e58717635ef4c21dd4a79
- MD5 7c4ef99f25b58a7872be53a5a6df82d0
- SHA1 85d84b814d44d4f04dd1efe0756ffcca6887ae6f
- SHA512 26f847920386f684cf984e2c1068f7cdd02e25c811784c09b09aab91d51b77ffd39c8e2907ffea83edf7d94304ef5248d6a7d92d4ec505943cf1f16390d35391
- SSDEEP 1572864:ysv5kJoH4ng13570/vi2N8CREpNz0M7xS+c8NFGOSK4IBqfYHlJql:pZeg1R0/B+CRuNz0M7xhc8yK47YHKl
- TLSH
  T144F733208BEE1C16DD97CE7DA5CBDEA0B5BA295C5C01503A80DC39A74F46C54AB3DF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution persistence adware ransomware spyware
- Adds Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID-linux-arm/node-napi-v4.node
- Size 144KB
- SHA256 355bdcf77100e5c032b78ed6f1111cf4b85b2302e950348a60e70ae0cd17b220
- MD5 7e1a420c44a9f977489b89eea774d38a
- SHA1 4bc8274d3e0b03192b6eabfbec19bfac01e70abf
- SHA512 97d0c1fe0b593bb4d91ec008aaa2055002e8926b5c8f4b5a0a3885495818e9cd688360b5252c4f662c8df83d18013d427f2f0433805dc70b2e16daac343cf1ec
- SSDEEP 3072:HB41D7SdnKV3wVT7+se9dEpzmie+Iozat2B93OQoghgP:HB41D7Sm3wt49dEpzfIorB931oghgP
- TLSH
  T16FE37EC9F54D8E92CC81F6F638238D7988959CA4EC74C752C5810E3C8EC75BA893DBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID-linux-arm64/node-napi-v4.node
- Size 215KB
- SHA256 ea625403a8759a2954a6471a625b3b2ebd39f2740f4b289221ab33000ead9c7c
- MD5 1eb4357905841337aea036166bfb0676
- SHA1 7d69abbd17c3248ba20468f084b147eaea1849e6
- SHA512 8c8e9ce86e332b366533c211580707b722a4aea58f125858af752a3d2d0c80c4e1d6d19d5a39ba03cf2fb41bd6389f1b0b61d8de0e516d0071b8df260880e7c1
- SSDEEP 3072:FB4exXWJv642EVNMEThnJf0HPfquKQlL95PXBPPB:FB4exXWL2EV9gquKQlzXp
- TLSH
  T1D524280AFB9DEC11D046F7BE5E4A8393F22B5C8CD32881EA3521132DFF9658D8A75950
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13 behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID-linux-x64-musl/node-napi-v4.node
- Size 249KB
- SHA256 5c8a93bc3e62fc6f6c755c92cb59ee9c42d90e32bd1068132f9eb5089ab9410f
- MD5 cd31c3bdb8b8ce640b50c620fbc67ea5
- SHA1 467a19dd5a6cbffbcc1fa7f68f6e8c71ab03a4d2
- SHA512 77f7b45733058022b41d2da0a2f4f53bb19d1ffae14d82ffea9a6b6dcd42518f5122a9d76c3791f532c2face6ae170eab8ef33cd3b9ffee52e6552b1474c8f24
- SSDEEP 6144:SxcB45qJAHwqtqEiSpjX3SnuthPdQdRe:SLhtqE51njthF
- TLSH
  T16444182B73548C7CE86280B11DDB83920262B5FDDA31941F36D9677A1E938B14B0E7DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID-linux-x64/node-napi-v4.node
- Size 235KB
- SHA256 2551979edad9dd566e0e7b213aeab9e8293bed711c6ae4d3af7cfbbfea61c727
- MD5 3e430d98a01dd707f0800b27dbcceb8c
- SHA1 9998bdb423fdbb8bbae4590038130afef9252c9a
- SHA512 13a4856a2008ed7732305833b6fb62264ae2fa9ff20b262ec2bcc20203862e0bf042960e99107bd6cfa8c6b59f7fd9e62b2a6c31970ae1d3b94672fd599928f6
- SSDEEP 6144:gB4kZX8D6pJpY4Yf/GmGNVuZa24KcaxNCWFGnaAg:xQI8g
- TLSH
  T1C0342A3BA2144C7DEC6181B109EB42E212A1F5FDDA30E51F37C4977A1E938A14B1E7DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID-win32-ia32/node-napi-v4.node
- Size 477KB
- SHA256 547fb5dd105a3f0fcb835575217fa3278aa28f421b372d5d74591fc09a362e6b
- MD5 110a623883647298cf3abed74881b89a
- SHA1 d7b7bea76315f71bcaa7c6fb6d355dd3591e76fe
- SHA512 e98207ba731a2c65dffa9be109ee64a9469d24e65cc374ecee9d79210af488dc28d11361cac5adf3611c9b2638b77f4a0bf2c1043364f67b5d56858087239ffb
- SSDEEP 12288:dZcxWM3Zj+/IalJ5GzVnyyvMQeCZYjcF9amgD84:EAM3Zj+/IalJIyE1eCZ2Kama84
- TLSH
  T141A49E217482C077E86E05B15929D76B9A3EBC710F74A8CBA3D86D7B4AF04C25739B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID-win32-x64/node-napi-v4.node
- Size 591KB
- SHA256 c1781adce3fbf61a4d7addd8aea052a6cc162da6bbc48e476086a9e2b4ea43f8
- MD5 125001f7fc444a128921390fa377dbd6
- SHA1 bcb56ab52aa6f718e1d6a8f045431813ef3d7a5b
- SHA512 63a1df6cf78a95ac7e0bc63d16a6d2eda86f9c981d4f2c5274eeb63063d66c5925b0d24e12859409e833f0f07bfefeb73c67c4a9bf19275f6b53936a2acc1e3a
- SSDEEP 6144:kb4R1ScvlEJs/u79i44c3KoKdwNY+tlJ5JRgeKD0o3TFd6aIfOdYQvwg0/wBaHsf:rvP7ipnJRhXEOfhQvxSWku
- TLSH
  T1FAD47D16A6A801B9E1BBD178C9970917FBB278061371A6CF43E05B972F277E1473E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID_hidraw-linux-arm/node-napi-v4.node
- Size 138KB
- SHA256 86ebb430c10ede0af8a09146c8da5350117ba038c7bb9d001bc0227e8e7afa65
- MD5 505bc3eef6fd78301f1e94f6801fb5ab
- SHA1 157b62278f27f39f25a65b487245aae3fc82c9e1
- SHA512 9d01a6d8804bdba75be02de48d710e2cfcbe382a65f6c040427f4428711bb31ae43bd39dd42fa16115c3085efa494e81a2205c9570dcffc0f065d8e97f375bcd
- SSDEEP 3072:BkHTB41D7pv1k1ZjTJGDB6m9VX2JAMdvV5014slv:oB41D7pdkdGDBvl2FV61blv
- TLSH
  T1B8D38EC6F54D8F96C881FBF72C238E59C8869CA49E708B5384821E7F4CD68BA4535F94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID_hidraw-linux-arm64/node-napi-v4.node
- Size 203KB
- SHA256 06ea97f377e2246a1e9bf3770186727e72ff3c166579d9c259c6d32a07aeaa60
- MD5 7e10dd896faa1c8909d51588513776b1
- SHA1 383c8eead7d6009d8f3323153195f4f0ed029a28
- SHA512 2e5eab47fa8c19430f33034f6cdc9f7cf617e068ffb4358fc2fc715aa167fb8105f08318b6d9649ba689141cb7bb58a44462472daa8f48c787adbf4f4d9ff91c
- SSDEEP 3072:WB4exXlRax6zqXiE1YcdHLpFBnC35RMEg16995RDjqh7i:WB4exXCx/ZHmXMEg16G9
- TLSH
  T127142906FB5DBD12D047FBBE9E4B8392F20B5C9CD32541EA3521631DDFA6A8E8A71410
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID_hidraw-linux-x64-musl/node-napi-v4.node
- Size 238KB
- SHA256 5fb2a5fc4ba4e5f50239a8ef5f3dda52820f8c3fea87aa6c9666e7aa90904a6d
- MD5 8f2e011bb33befc9d577b3c26fa8214d
- SHA1 c4f46ec1188e0395777aaf28562ce3423d98a3f1
- SHA512 e174f299f1d8b541f6599467df6e626f2b102c73c754f190b18ce7585711d558119d7ac8cae9ffb13647830826c59e30bfc36ff34b0ce6bf312cd5b4146a3391
- SSDEEP 3072:NB45qJAbFR5CQ+j/G/iPuVzQVgxr68S6YPBmfhZLcgb0ydje:NB45qJAX5lzAmQqxG4WkhZIgbVdje
- TLSH
  T107343B2773548C78D466C0B11DEF879201A2F5FDDA31242F36C96B7A0E928B14B1E79B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/node-hid/prebuilds/HID_hidraw-linux-x64/node-napi-v4.node
- Size 219KB
- SHA256 6c7f3b3fcc238a74e7e3237b50b2ff05181e94862b1963e8074ff8fc75885021
- MD5 d8d99e3192426b63d3d3260a8c05ff6f
- SHA1 c4c916bce12c0631f1691c11cdcc4fa16e9c7175
- SHA512 062ec9542936d8eb5eca37150c555d4d5e36aab3dd22e3ea45cb1dc97b87d3cdcf9f0ee67e0c02e94d3c322206c5d116652d328e46d823d86454b1dd50d1870b
- SSDEEP 3072:eJPLB4kZXR+XO8aCay4a+YkTjWEjgya65Svpf8wUd30DWbYsd:e5LB4kZXqO8zazzYkTjWxH6kSd0WUs
- TLSH
  T181244C3AB2144CBDD49281B00AEF82D212B1F5FDDA30655F32C5677B1E92CA14B1E79B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/app.asar.unpacked/node_modules/node-hid/src/show-devices.js
- Size 288B
- SHA256 50b003dbfa1a488eeff3f862d8c0a629aa352d6d166cfe2fdee196673a8e64c5
- MD5 b9ed2863e6e99d66ea81238b4bdf5857
- SHA1 84e86697e09692f2f73c8c56f36b796e4842fb86
- SHA512 eb05500f4ca461191845ce50dfd70bac9700f26ec07aa0f117fb4f43a881be7437d0da88164812126cbd70150ff23860782ec2499d5b8eac73e76642a7e8c75a
- TLSH
  T174D0279074CF493C567214105717100776ED6A944164F750D59DCD2FCFF0479A5077AD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral29 behavioral30 behavioral31 behavioral32