290fdcdb6c14958e9134b189d45c52ea8accd0c34ba2ffa013b6305d913a36e6

Sharing

Copy URL Twitter E-mail

General

Target
Soura Main Setup 5.1.3.exe
Size 95.0MB
Sample260826-akrbjsxwe1
SHA256 290fdcdb6c14958e9134b189d45c52ea8accd0c34ba2ffa013b6305d913a36e6
MD5 ea7a4f89d69bb4b2d9e2547741d0df7a
SHA1 8676c29ed5bc0d9f7ed0cedd2f4da0f20de121f2
SHA512 6a8c26ca0c9e5d4388f16fd4599e016111338f8a8fdeb884e2c205b9fe835b44694309c56de5cfce51a24611d9aaef4953321b83872a9e86650ef75e3fa6c772
SSDEEP 1572864:oiBLIwYix5PW9sx7OMUX04ahuf8L6BF7xawM3yMnwB9RASvuoJqrxexSYW8YYyg:okLIwYijD7OMrfO8waiMnEvq38YYyg
TLSH
T1F728336360FE9317C7B6F537D13669B4C40066B0A59A2C9A15D18A99F3BCC8D3B3F680
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Soura Main Setup 5.1.3.exe
- Size 95.0MB
- SHA256 290fdcdb6c14958e9134b189d45c52ea8accd0c34ba2ffa013b6305d913a36e6
- MD5 ea7a4f89d69bb4b2d9e2547741d0df7a
- SHA1 8676c29ed5bc0d9f7ed0cedd2f4da0f20de121f2
- SHA512 6a8c26ca0c9e5d4388f16fd4599e016111338f8a8fdeb884e2c205b9fe835b44694309c56de5cfce51a24611d9aaef4953321b83872a9e86650ef75e3fa6c772
- SSDEEP 1572864:oiBLIwYix5PW9sx7OMUX04ahuf8L6BF7xawM3yMnwB9RASvuoJqrxexSYW8YYyg:okLIwYijD7OMrfO8waiMnEvq38YYyg
- TLSH
  T1F728336360FE9317C7B6F537D13669B4C40066B0A59A2C9A15D18A99F3BCC8D3B3F680
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 94.5MB
- SHA256 d9e37fdce4385618ab7c63eb17003bb1340f8b0d65000af9ac07e2634989338d
- MD5 d009a4df060e35ffc68bf5c54d1cb5a8
- SHA1 e22b804ccd31adadb3390954729e566b81c5c234
- SHA512 de9f26e0a7ac303a56c1590f011b599626ca179bf9aa4966b0c22e7a120c7edaaf501f86ef0ac8a4301a4a84e8d3abcce3901a718dcd5c7953bcd27fffa15284
- SSDEEP 1572864:NBLIwYix5PW9sx7OMUX04ahuf8L6BF7xawM3yMnwB9RASvuoJqrxexSYW8YYyU:7LIwYijD7OMrfO8waiMnEvq38YYyU
- TLSH
  T1F628336360FE9317C7B5F177D13669B4C40066B0A59B2C9950D18A99F3BCC8E3B3EA84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 d76fe8fa3a14cd73e4c858746e2ab2d2fa6f2df38a906fa5814b50a8a895fc96
- MD5 37c48e66c39832d32fa2e926ac503c4a
- SHA1 2400135b49193c9786f1faa8d00169ce3d38ca98
- SHA512 e1b631c3834fb84e96ab9fe44b12a8fa6c6b3c767e00a17ed8c3d8f8fbe7bc2dfe83fe33e7aca4f32439bdbad21d25af6b9e263d412922e40d09d4e421f12941
- SSDEEP 3072:Kw4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:UYWFUbGz8LI1TdjQBQCrC
- TLSH
  T19AC3E0E773B0AD7DCA464BB743560070FCB30B2D06C2170A4A9AE479652AF98D9D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b74ad439f3d3762657f3ba533a6af3ac63315c838ed46519891366f43d834a0e
- MD5 e6a75313c720a6ebe3182b4e1db48328
- SHA1 d60a503cf4604c816d9146d7fe4041018d445888
- SHA512 3c8699b998c53c0414933ba18e0cf561488b9e209523a9b4093b68d38393e9a6bc683cdffc32a8050be25b473153b71743acf9c33f070166f1e15f2a453e8eb4
- SSDEEP 3072:+FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:+IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1D01401D723B4AD3DDA530BB3A26710E0FD7A20291EB3514A569FD8397925E88C9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
- MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
- SHA1 18ff020331534d21f24d922d4da3c253668e44d8
- SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
- TLSH
  T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/af.pak
- Size 599KB
- SHA256 dcf39c3edbb6b0a625baee0263a9b426eadd1a6d1bfbf03a209501a18bc4b0e4
- MD5 f351564453e36318d0442e29db7bd5c2
- SHA1 d8dbe32c5656468b4f96a799dc7de3bab37b41e2
- SHA512 07050f6b0c484d07b345200fdc6d2394201d3d1befa7310d15decfa2e67ed27724c53da2175148588f27822f28b31dff75e44b99658c141392e08a7d8be82789
- SSDEEP 12288:ayyCh2E1FPQ6tRGtAM9q+ZRwBgNYChF+plGnVbi4H2JynDNsmpiALjKrFozv2nIX:nmyPftRGtAM9PZRwBgNYChF+plibi4HV
- TLSH
  T112D40A0BEB81173D09A06697FB0845B7FB5D626CD770B2BADDA982310966DFC10BD0D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/am.pak
- Size 971KB
- SHA256 b1d444f2346105a6e15f9b14fc5653e1edaa2b435290fb8f1238347a4d4ca8f9
- MD5 79fad5635b13538c17b92b87df28ac9e
- SHA1 81e142d7dd601f69d2f9b8c63b998adc926e8286
- SHA512 3158dd5daaf08933549694bf952ebcc14c3db91afc2fac3a942b8d1d30892ab57e4dce966dbaa7dc323c2deca1f1145e7517be25020b48a2ea9bf7f7de5575d2
- SSDEEP 24576:LtXGVoTx1A5t7hTCKPyaEVxsxHjnwvxehz/dIXV6sciy4VdeZtP9oPYOH+:LBGVr
- TLSH
  T13225AA547EF9F7570F8E8A1994320E4E9594AE4652802C38C35AE3FC2B2DF1B4DDE219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/ar.pak
- Size 1.0MB
- SHA256 74bc5cd1c0a5957aa41d719a40f4975ee71023ab6e144660308092d32c86c055
- MD5 c9407f70fe89b63d9e2fbcd835b29c5b
- SHA1 15e428a215a7d05dd67f9d627ab8ec89d5e9ddd7
- SHA512 6b6485f797b2f5a1fa45d77d0860db6929a8bf7ed5a9f2adeaf5434a44b00d0b2d3bcccbf1375caabd5e9b5e01049e0f44305fc52e26b12b49e8dc20015a1f28
- SSDEEP 12288:1yWqoQec/BmdpLFB62Ga9mwj3o0oCbv4UGPFk82/S+GNj6EuDb6NP+:1KotEG
- TLSH
  T14F357AE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 e4a5bea23a26a06af611a7cb518b22a1d53ec5df45a6322f0e264b99c7318441
- MD5 077df43e5adc6bf502d5bbf057a0afe5
- SHA1 6e608c0a0f3a3e19f63840c35ffc7d8c7dd0cf47
- SHA512 b1996aab50923361c352acfd92c177d53e2336656e6ee29312227e685bf3d1202336ec51c9b757752b199f2c69a4d5185a5db05a600fe5b26f145e58da4191dd
- SSDEEP 24576:81oSpWclYLYAgCzQkECRUPVb6nNo7j373ZKmiv3p1K4UfVDiiJw74uOVnaJcuSMQ:5SpWclYLYAmUUPVb6nNo7j373ZKmy3pG
- TLSH
  T1B83525A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/bn.pak
- Size 1.4MB
- SHA256 137cf9cdba13ea7286584c5cac05dd34c6394f89036e367aa032ffb34f17dcc9
- MD5 ab1bdd5b62d9bec69fa2bcb90ac9d584
- SHA1 b0b4446c815b27688f54de71c99cb3f88cf744a9
- SHA512 f68ccd81deff5a13512ba1838e925df7a59e037fd1f1d0086c2d31bd9582990f7f719f0f14f96ab18ef1a1c48077e257738e931fc84d8b820bccd590832c2e61
- SSDEEP 3072:ddX4lzPWbrCCslNmU3IW32C2COUzhqygYfj8tRq+vyQZWUBbIUOQSakwi0NdZGAM:diebrmP3TeyQZWUBbswdTM
- TLSH
  T15A65EF209C6E81B6A8C5CDC9434C6370C123AE9B9B61F74DDC17A15938ADC7C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/ca.pak
- Size 676KB
- SHA256 8a472eabdc3f30d94c56367d526f6d345ad65732827097aac747438f233a536f
- MD5 d9fcb1db7e6b754a8ce0fa3a6820171f
- SHA1 d08d78e30eaa0ca60fb26e04726d9bd1f2116748
- SHA512 37407233c0ec069de89eeef6998a1b4ce372ce8c02f79f0f246acaf63f7ef60b6c469213177f93aec9b55d86a8690691d73c74d640db48495ecdcc2f58d78a4e
- SSDEEP 12288:Y5llu0PrR7IO4yCiX76gpFa8H5PsFBN3Mw2juwwPR9zejm0t3l76FTZKmXCRYJim:SXDre/yoLnl18IM0ahfilziQ
- TLSH
  T186E408239FC93B7704D2330EFB46C257B48CA9847A16D254F4AF1B1622CCA9CD673A95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32