aa7d3ae41c22e5cc35f9473ca831f2793fce949f5bc6935d5441da234d434902

Sharing

Copy URL Twitter E-mail

General

Target
Trezor-Suite-26.8.0-win-x64.exe
Size 147.1MB
Sample260825-zwppjaygnb
SHA256 aa7d3ae41c22e5cc35f9473ca831f2793fce949f5bc6935d5441da234d434902
MD5 ac1914a5c163f8ecb7ef852ca9c14e22
SHA1 46270b638ddc7a181853dd59648c6d4574b68dd6
SHA512 f00158bee6182b4e53844e5f68a7b83bfe6caa17f6f63ba2e94e3bd0cde2fdde0dd443f9bbbe30b226711303bb1ec5ae93e3cf1ecb65f86666fa77bb07221487
SSDEEP 3145728:0MXL4i84pEFLgeK2bb8WxLlOKvH09LL+35WjO0Og3XXpJ5OLma80k:r4b9nfLT8LKYjggH5JEqak
TLSH
T12B7833E1D43AA025FBC8567F47D168B6B60A7FE1C5502487AC0434B6F27EADC6D086E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Trezor-Suite-26.8.0-win-x64.exe
- Size 147.1MB
- SHA256 aa7d3ae41c22e5cc35f9473ca831f2793fce949f5bc6935d5441da234d434902
- MD5 ac1914a5c163f8ecb7ef852ca9c14e22
- SHA1 46270b638ddc7a181853dd59648c6d4574b68dd6
- SHA512 f00158bee6182b4e53844e5f68a7b83bfe6caa17f6f63ba2e94e3bd0cde2fdde0dd443f9bbbe30b226711303bb1ec5ae93e3cf1ecb65f86666fa77bb07221487
- SSDEEP 3145728:0MXL4i84pEFLgeK2bb8WxLlOKvH09LL+35WjO0Og3XXpJ5OLma80k:r4b9nfLT8LKYjggH5JEqak
- TLSH
  T12B7833E1D43AA025FBC8567F47D168B6B60A7FE1C5502487AC0434B6F27EADC6D086E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 146.6MB
- SHA256 304a7a10c7d3493c93c47947b47e747ae8a2bc852440a0bdecec9edcef88d86a
- MD5 846be77481e55902d73ed482efea84e0
- SHA1 13b5993429c5170232c6ced77ddc440b811401f8
- SHA512 7df8164be8b943450fe50a77cd74a1938323bda6cef74541359da29882f265dbbc6d42d5df996f023529faf7eb3890c0e0d1370e7f5faad5da6b3c10945299f0
- SSDEEP 3145728:GXL4i84pEFLgeK2bb8WxLlOKvH09LL+35WjO0Og3XXpJ5OLma80+:s4b9nfLT8LKYjggH5JEqa+
- TLSH
  T13B7833E1C43AB0353BC8567F47D168B5BA0A7FE1C5502487AC0474B6E37EADD6A086E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
- MD5 750913d55e87def9108e55728ba67d00
- SHA1 a5944bc170d1f6c3223195c043134566471dae1d
- SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
- SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
- TLSH
  T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
- MD5 d476c19d21b3c2861f08c1c82fffddcb
- SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
- SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
- SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
- MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
- SHA1 18ff020331534d21f24d922d4da3c253668e44d8
- SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
- TLSH
  T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/af.pak
- Size 605KB
- SHA256 d990f4ced39e31a1149d2a1842ce2504706885e6ab05957ee2f338c77d94c16b
- MD5 38fc876717fd2811593b8e1f5932685d
- SHA1 3dcb3222e420713d6d731ff6bab7783dcd75c16d
- SHA512 b98358fbb30f988b67edca4e7d608665ba10ba2b9c3230bee6adc9c040f974464b9e26eb72bf9a45b58d677419d8a2ed7f99d84cc1c22eefe496ec634bfa1c74
- SSDEEP 12288:l+Ifrr9xi2tfxgtRGt+TkTnPxxNtEKY+53GmNAn4H2JyneNASgnALzcGfozvhpIX:ZvZtfutRGt+Tk7PxxNtEKY+53pAn4H2b
- TLSH
  T1EED41B0AEB91173D05B07696FB0945B7FB9CA26CC770B2BADDA982310566DFC10BD0D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/am.pak
- Size 983KB
- SHA256 8d3d5dfc64acfbb0c35036d74561d09ddf3b22058eeed0f8d26a2e9c0703248e
- MD5 ca12f04a04bc27a3a5fe78789091ce51
- SHA1 eefa0606bcf3aa65edc124978f731336c60811f9
- SHA512 07fca45e2c99ab93eda0346550f083c0e0fc7abc50d9610869ed9f558cec399a0b88434b4d8cb5a838acdec7e8b3e7a2a6c9b1171050293647977b15fdbdf109
- SSDEEP 24576:Ueb6TG1orqThTCKHyK6ax0hHfjnNWNT5zaAfX8j5xi8bVdwZtPBE:lI
- TLSH
  T18425AA547DF9F7570F8E8A1994320E4EA594AE4692803C38C35AE3FC2B2DF1B4DDA215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/ar.pak
- Size 1.1MB
- SHA256 c54e67e232852d9b14b2bbf4c1a83f0e13a4970c2a83fd26dfb8d8c9eb40e3d6
- MD5 97f2627c9128e950f111b0f4227867b2
- SHA1 525db6fdbb81481e142b8486bafbc912fcf1c6fd
- SHA512 d119016080f09c83d472c662f20c369b4f46915e49906c44ee7f9e44edf9d6be388f4d7a16f52a29b8322199960127ff880261c0b277d3e06eddb504a7b31475
- SSDEEP 12288:XjYc2kTDBGop7mFo2GE5Hwjdfg7P3v4Uzb6kb2QSVmNj1Eio7DAi:XMvWsEv
- TLSH
  T141357BE21B2984720B56DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 2789212aac5f2133ed23c1f84623bc64eb4cfbd93aef7af751d1221e27a21daa
- MD5 ea6519b0214acdfe80b9ceb590ea4dce
- SHA1 49d14345b6baa6939055d7f50bf0984791481706
- SHA512 28a1ddd55b55e792db5a114fd305ec3631579a3e8e5507a629144769bd25c4e2de6ef9e969ddb037f7945330be02e4951a5ba8a27881fc5e413c2a33c436b84f
- SSDEEP 24576:0KWulJLYAgCzQkEC2U5Vb6IqSsl373ZWmKf3p2KuUfVDrzQE74uOVnQxRfkn4wxI:0KWulJLYAmFU5Vb6IqSsl373ZWmS3p0g
- TLSH
  T1863535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/bn.pak
- Size 1.4MB
- SHA256 e72b72977b40fb10472fe1a3fcffcda8b434bf52e2bb2da2935faa80da224812
- MD5 ae6da45169b7a3fd99da8218c92a1e2b
- SHA1 2552cffa1f63012b2fa7ef6209869f3eeae207c7
- SHA512 8328e598f9c30636d60547a1d31e909b46ab6f92b3c210274c95886294af7ef20552718a536ee55c0a58d7947d2932061fea8e3113b8b331b4ca084501f51c4b
- SSDEEP 3072:Y2M24emMNfpp1pomjwuquXCg/V7hq2XOUU9qygEfK8tRs3F+IBEBbaUqQsjkwgw0:Y2q+Nfcm00yg/V7hJF+IBEBbjwg/H
- TLSH
  T10165EF209C6E81B6A8C5CDC9434C6370C523AE9B9B65F74DDC17A24538ADC3C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/ca.pak
- Size 683KB
- SHA256 bc72ff7dd7c4286c1abb52da11c4dfdc42c917cdb267004eb2a906201850bca6
- MD5 9c41cd6ca7b5423e60b40226e5e7fae6
- SHA1 1f070aaa95377fbab2d558d0b3ce47f1999b1b58
- SHA512 c1ff06fc4fb156a1dd015552024ba20cabcdbed97fefd23046304daa3e758bf9af3efffaa7b6ad9ac0bf314d49bf83b957b1c836d514dddae8e97351de6d2a72
- SSDEEP 12288:R4sPQE4viqMz7hjzlCiG78lpGa8D5PsF4N3Mw2juwwPR9zejm0t3l7C7ThALDq9w:R4sYoQf0LltOZIM0s5JZusQ
- TLSH
  T1F1E4F8239FC93B7704D2330EFB46C253A48CA9847A16D254F4AE1B1622CCADCD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32