7a0d488e54283c0e0e20864b8734580d7057e190601fd97463df8e9a6b5a1192

Sharing

Copy URL Twitter E-mail

General

Target
ModsHubSetup.exe
Size 113.5MB
Sample260825-t58k4scl8x
SHA256 7a0d488e54283c0e0e20864b8734580d7057e190601fd97463df8e9a6b5a1192
MD5 9abbb33be69409b6103351301c0497ba
SHA1 bbec8980fa0ebb60c08954901421f50f53702654
SHA512 bb8e33162392b698b1cdc4e6f0c63be35aa06a5fb831acedc91d56d5d42abe2295825c22712f36d11be82d37b17a9674e36251ee6fd381b509404bc3cfab5032
SSDEEP 3145728:StT+LCDok2cJf+f1P7+qoTrQBZmRLkxDtvGpKeFqTSkV4pL/o:W+Lyok9t+tP7UixB+nqTwp0
TLSH
T10A483352D57CDA6CC41AD8B44DB8D32849BC17C326DB80DFAD0D6A2E7E792D07E222D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ModsHubSetup.exe
- Size 113.5MB
- SHA256 7a0d488e54283c0e0e20864b8734580d7057e190601fd97463df8e9a6b5a1192
- MD5 9abbb33be69409b6103351301c0497ba
- SHA1 bbec8980fa0ebb60c08954901421f50f53702654
- SHA512 bb8e33162392b698b1cdc4e6f0c63be35aa06a5fb831acedc91d56d5d42abe2295825c22712f36d11be82d37b17a9674e36251ee6fd381b509404bc3cfab5032
- SSDEEP 3145728:StT+LCDok2cJf+f1P7+qoTrQBZmRLkxDtvGpKeFqTSkV4pL/o:W+Lyok9t+tP7UixB+nqTwp0
- TLSH
  T10A483352D57CDA6CC41AD8B44DB8D32849BC17C326DB80DFAD0D6A2E7E792D07E222D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/index.js
- Size 1KB
- SHA256 04a22ae517a8f93453097ed636dee04a7635f928eef73cbc003916d091d0bbce
- MD5 e4f4ed46cbf7884a2227a07d47907ab9
- SHA1 7b9e4d9904b4468c101b121cf47e4c2816ac77e5
- SHA512 4ba3d99629d983c2b073a584c58ad1d54fc3d2c55eed3e704a18e5db2c8625dc3fd5ffbffe8c56fbe5b096448eddf14b808dc97be9cf73c554095c1d842398f7
- TLSH
  T1CE31165E2873A2D15BB7A1A1E38B825259E3C05B754180203B8F87C5EFA2E658BC7DD0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/lib/checkGrowl.js
- Size 550B
- SHA256 01c807bd9f273f09ffd87bab13473865bbf321071513f5c487dd1b6e7fbdaf10
- MD5 fa7d81bc020ec4ef6c8055083876fcd0
- SHA1 d3c62e48427f39dc613bca96997d38a06c966283
- SHA512 4fb0844820363199ad78f0a667e0f945114e9d65d86283fb5bb79a1b97be25dbe8ebd2ce85a9dc40545630f3146b3897433e1d23e9117027d2c74fa698df3f1a
- TLSH
  T14DF08B25E8B6A832627376F6C0435A523D21C4172585CD8F839DCBF07EC708C800BB9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/lib/utils.js
- Size 14KB
- SHA256 bd5ed859adeda193e15672e769551966b31cecaa6294fc52297533d835af3702
- MD5 46b0f23f133ba1bd568e5cbdde8e7502
- SHA1 fa3154cd92cb2c398e8b324e6b8a2402e46c4a32
- SHA512 198ea2cb626be8ed7ded3188489952ae6a424da8a9294a507345bc23fd14ccbd4715dc472e4febf25f2ece460492ee3d3dceef394a79e79ea8e91950016380fd
- SSDEEP 384:lgQtxf7vKWXU5sli8m4q95W+V0TYVRvQliYqG5sYaLhG:ZH1q4ihG
- TLSH
  T18F521C5D24F7335202F372F6A68F9449777AC323205CEA51B68D83D4AF94530E6E7A88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/notifiers/balloon.js
- Size 4KB
- SHA256 ef68f4d2e8dfcd1443843d81707a3e0e7a2e01d9573100710736eb1990306220
- MD5 22e0b5a21107a340bd37f034e88be79a
- SHA1 cfa46acdefbfb08542ac890d8de2fd007e343355
- SHA512 0c45207ec1875459355a01a8ce163811f267a95546171f2837dfd09a9587bd2888add14c4c0f868a67a66b56e6a15fcc8bbfb713141311bb8df737c8a23a91c1
- SSDEEP 96:EaKoSVm5cv9SRMRTvgkKAyJBVNL/wm/1Go/WB6EiTyaugNN2Jv:rKzmGKoEk0JBVB/3/woDzy9Kgv
- TLSH
  T11391ED0C39F363610AB373E6464F9219727FC2137148A962B6CE83E09F915A4C7DBA50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/notifiers/growl.js
- Size 1KB
- SHA256 922eecd40262c26337901479de95b0960c719df76fd3b53dfa3fc3aaed95823f
- MD5 b899ef0e83aee19a163ce8ee249ac392
- SHA1 b729bd63844cb485a8cb183725d8c6720633c23e
- SHA512 cfc0ab6a0ab5111da7759868d4478043688f6eccd261d4f5fdaa74ffb4422956fe1cfe94974fbf3b08f1405ddd505053ee4ca3102c7182ae1e4ac5006ee2f882
- TLSH
  T12E41104878F3AB1155F372F5D2575149B07EC302259CE855B58A03E1AF910E8C2EFB20
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/notifiers/notificationcenter.js
- Size 2KB
- SHA256 10dc099d7164133959a61c70ed2951921ef591738c327dbd76d7338f1c9630b4
- MD5 09de38e77abd206cd405aa6ea70bda26
- SHA1 f91eb550baf3378e63086160100fbc82e88a6c1e
- SHA512 0dff587aedc93fd315b1b6f8001ef33973cbea5b416b5103da80dbb54e8182ceffa00402b3e6affd5193ddbac3b9c3d00210b052e8f1ee0ae91bb306552c056e
- TLSH
  T18551DC0C25F366A55AF3F2F5465B920AB03FC602254DA85173CE07E09FC62E4C7E7A58
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/notifiers/notifysend.js
- Size 2KB
- SHA256 29fe357ee97ad29245f55bfcfee3ce75bc86375910d9b9709105a11d28f287de
- MD5 9792dbfec85c053f46582638e9c8a966
- SHA1 35ab80ae67cabc161aa3b91c2539de8c4a00035a
- SHA512 16347295888393ab2cae5730cb5f54fa87cc19fb1f745302cb0132eee1c5326ba15d651f81980fc8568e34fe4a935e0926e31b528ed9ccfc480b2468d53564f9
- TLSH
  T14341695C26E7A7511AF3B2E246879215F23BC316648DE8A273CB07E1AF918B4D7D3C14
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/notifiers/toaster.js
- Size 4KB
- SHA256 3dc551eb4aa9f5ef5a2d983336e8e52714b16ad044a6e29435300299058823ed
- MD5 5930863c25cd9d285e91ff10cbe7a947
- SHA1 4d1a2e9942335d16b8af07b26d780dd2e1dd30cb
- SHA512 3b60cfb76634e60ae57a147d65930ecc5826b45f82c749bbadb16183cbbcc74faf8bad46a34058e13896f49a24d50492bcb9b1fa67e0e618bfb87d9715fb5d60
- SSDEEP 96:XJu9LBshFyQlgf0KkZxHtKEIeBb/rHb9ujBCdDdNnu/O9yPoj:5uRBaYQSf0xxH7Ie1/rHbAMdDHu/Ojj
- TLSH
  T14991414C19F262200BB3B1F54B8B641AB22BD113319CE804B58E4BD16F966E4E7E7F94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/vendor/notifu/notifu.exe
- Size 250KB
- SHA256 43ab3c4eac18a2d5cf05c5aa25f7d4b2c7b8d6b0b956aa039b5b135049e57475
- MD5 7a05a50048c8240ba29f2c8c78776e2e
- SHA1 d251c5ae028f2974783601d6160b1ec45c6e5b47
- SHA512 8c39b81655c3d34e180f005cbc9342ff7445fbb8721387df971513177764b613ec74c4f016c0d03f44685789170a82e6863153ee17514e6b291f04b7ced30ef2
- SSDEEP 3072:WqBnKutGyzlMoDNoq7ZlQ18geiZE1Jk+ibqB82MdYQrYnf:Wq0utGyzlM/rpeiZpywY5
- TLSH
  T180448E1176E1C035E5B3027349BD8B29557DBC628B759ACBE3C84E1E8A305C2AB32777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/vendor/notifu/notifu64.exe
- Size 299KB
- SHA256 3c9b686cb83e381805dd19a9ff469c8c59787a0661806c2efe372589fd48abfa
- MD5 c7016dc8ea668b75e79618b1ae6da2a6
- SHA1 d15dac459afdd61e774f5198790b8a5476a9801f
- SHA512 434dd44bb852db42468796d0664287c8070c656f5fbccf821b1c26aae4ca8a044ef46e4f290ed5a70b30f6c8d66ccf50eb090fcdd30404ccc99fa53d00b4e42a
- SSDEEP 6144:JyXuL7nGyV8EmwzLkFp7BQIoo5tTMH8PiBH0QcPskEbQ:JyXajGgkFp7Bgo5isPsk
- TLSH
  T1F1644A4573A848F4ECB7927C89A58546E772BC564B70D7CF13A0426E1F33AE15E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/vendor/snoreToast/snoretoast-x64.exe
- Size 2.4MB
- SHA256 2c43158afcf46b2baad832c27691784ab102f51a9d87088af3bb3c9caee9f7b5
- MD5 d6cbcb9b5f2251e062cf1e3dacb873ed
- SHA1 26cb3bcfa9088a50c90381d485401348ed1bda75
- SHA512 b7db160ac38553b2b8982f08b1b9af9f6f06147b174e12fb220d4ac4d9a16ca74dde4b1e6a5cf72bcc7ca3cf51737b98364680fbfa1766f08e20de2172e29fba
- SSDEEP 12288:XH8eqe02OxWIYNE9LdQnUkYUkqxXL7FsUnBnkBwAn1cdyRSIoFUsC7N7CBnj9yi:XseqxWIYNkLJF5qxX3FBkBwAn1cipJO
- TLSH
  T1E9C57F4173F90B88F1F78B7899B6A6058976BC2A9B21C7DF1261514E0D32AD48CB1F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral31 behavioral32