e6bde571d21189cc66bb1e6db2b03d878484ac68f6d80467b44dd6e4089ffcab

Sharing

Copy URL Twitter E-mail

General

Target
Excalibur-Setup.exe
Size 102.6MB
Sample260826-gdnqeaseng
SHA256 e6bde571d21189cc66bb1e6db2b03d878484ac68f6d80467b44dd6e4089ffcab
MD5 a41bb6dc8e8ef27b99a3256d1925dde7
SHA1 4f5e39857c38cb57b11175005a60b76f4f44563c
SHA512 a6e1c4645cb70d13bf8d9299b6a3229a584cd54700c063f9ff140aaefe89296d0edc0a6604ffa88d3a65e58a75bf2de9c9d07bfc2f600a9378be0d894ddaac60
SSDEEP 1572864:qdu/U1RESsuvKLGxFZp37LrqB5QMxN0y23b1+ga+24UOIOxXZNJV4ACC/ZgXAUMw:qdqkvFZpLLJkCX3kgRMANJV4sZgAIO7c
TLSH
T14B3833AB91A296F1CC132038DB71EC7CA9662ED6836CCB6365F5FC8F71307990613952
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Excalibur-Setup.exe
- Size 102.6MB
- SHA256 e6bde571d21189cc66bb1e6db2b03d878484ac68f6d80467b44dd6e4089ffcab
- MD5 a41bb6dc8e8ef27b99a3256d1925dde7
- SHA1 4f5e39857c38cb57b11175005a60b76f4f44563c
- SHA512 a6e1c4645cb70d13bf8d9299b6a3229a584cd54700c063f9ff140aaefe89296d0edc0a6604ffa88d3a65e58a75bf2de9c9d07bfc2f600a9378be0d894ddaac60
- SSDEEP 1572864:qdu/U1RESsuvKLGxFZp37LrqB5QMxN0y23b1+ga+24UOIOxXZNJV4ACC/ZgXAUMw:qdqkvFZpLLJkCX3kgRMANJV4sZgAIO7c
- TLSH
  T14B3833AB91A296F1CC132038DB71EC7CA9662ED6836CCB6365F5FC8F71307990613952
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  Excalibur.exe
- Size 172.8MB
- SHA256 eff636525dfd62a2c94cd770c9af133ea16a6a3b0d9db68653776f4777c76b5d
- MD5 9b880876a6659a907237d0a793e72a67
- SHA1 daf0299d5b53a7acea9213470ae67ac8311302a7
- SHA512 beb0b426716b25964eea63aed6b8e04af22b1d0851091c98006092a176a01c834b29fa9f895e4e4cd1e29ae59f0d218bd53c236f666380664c46a87c4d11c0a3
- SSDEEP 1572864:o7NR7Rm1DKEM9Lx4vpOzDE0Yyb5IcIZBVAM9gjMdCjWqgXVbRgTsndR0aL/9eOE:BVxsOcY7TR79TE
- TLSH
  T149888B03E29A40D9E01DD1B58B9B9233EE71BC494729B6DF26540B522F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral6
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
- MD5 11ee9d008e924e19b33e0b45fdf145df
- SHA1 140773241b15513e9d7a7aff4d1c1d8f7e0b7e41
- SHA512 4acd065ffee81972fb1cfbe11507aab75c883aa94e359f3c455f87813925bb2d3416ce440561b430d6dedcc2f566d5cb74de139e181da68507ad36e69a672662
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmf36k6T6W6r656+eGj/dBIp+:oABeGLp
- TLSH
  T15796A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
- MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
- SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
- SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
- SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
- TLSH
  T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  libEGL.dll
- Size 470KB
- SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
- MD5 b12e3c1e72935273492da1daee50eef1
- SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
- SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
- SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
- TLSH
  T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
- MD5 5082e41d7a57506fe6b4bd58f87276b4
- SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
- SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
- SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
- TLSH
  T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/app.asar.unpacked/electron/media-agent.ps1
- Size 40KB
- SHA256 a9867dc98a8982cbadc41353f1128e10479dd50692b32543be376a311bbb16a5
- MD5 8ab2fde8a0383aa46fa8bbdcafc8f354
- SHA1 f32ee7eac2df63f92fe1aaefbdca601e35efbba7
- SHA512 b48afd315b4ea5e3da1908f76f931e487d694015f8ed0f3536af824a9ff733ee16113a40032437d55e36d2debeb2a45fb130144064f24db72322baaad5bf7d83
- SSDEEP 768:Gu+d4nw9ndxjWv2iqLAl3OAIJwwn3Vu07Whl3QW2v:eyO7yVluwmuhl36
- TLSH
  T1E803C6327646527835B3D33DAE9A5054EB3A607B32A55158B9EEF0803FF99248334EF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/app.asar.unpacked/electron/notification-listener.ps1
- Size 6KB
- SHA256 cc2d4b554832cf320143ea0429b6677c2d6b32f6bff980855b3d3551e7844410
- MD5 2b8bfea962aba45e95e25457521d7077
- SHA1 2eb5a1ee4bbe5aaf966781c66cf2620ea464ee01
- SHA512 229f1de7f66fac085c8fafda9c21895d67db2630dee19800c09b2875300bd4ee1b377d554d5952da97168fd42af8d71792fb9ccb139b87b78a468a77b7530264
- SSDEEP 96:S847P74llzTULdIWOr1YtfYcAXcqAPg6bacF7kLrEmms6ZGQKvfmlWz:SV7PUzIiYtgTdo1bNgLrE9svTHnz
- TLSH
  T13AD1C367764D13B13EF31333A90BA2C8E77790BE4A175110B0AEC1D85B20A59C3679EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/elevate.exe
- Size 120KB
- SHA256 f229350bf77cd8cb222b2db4963456ad1ec3da49b7e91fb0bf64101db2a11a3c
- MD5 dcce6edea2d46153eb1de9d2a5053536
- SHA1 cabd00082936bd73b987e550c4c904517f3f9381
- SHA512 c79799b201a80adfbecce60aa5fb13e92e32b6369276c2c10780ded0ac7a43e77ae640fd53846f2e306a249e977719a5cbe7f7f61815c1be1b3758d1a58f9e44
- SSDEEP 3072:BRbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlQ/Ty:fPrwRhte1XsE1lQLy
- TLSH
  T113C37C0274C0C472E5B32E3555B4CAA15E7DFE710E749EAB2398027A4F602C09B2AF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
- MD5 15d9ca6f1d87f15f5c67740df2bfa874
- SHA1 6d84c52d33249b216223e02cb445b886bea6b45c
- SHA512 24796d3aded0a49713489b285b9d38fd041a7376e900684053c1df106a509a315db9e646c7286fd59c79c664557e6d4e6843a55828abf04fc04d8b307829fc6f
- SSDEEP 49152:IgQpJ5yZBtfCp00oSO8hCsDsbJQk/tJ4q0nLhII1ytiT45z+WEjNHsRLf7OFJOMZ:4n5yZBXLxkf5FJIaye
- TLSH
  T15D463903B2858099F05DD1B9474BA623F632F8801B72B6DF52A41F192E77FE06B39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  vulkan-1.dll
- Size 938KB
- SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
- MD5 8bd643a9f7ef2619b792cf2544f27a8c
- SHA1 8d5aba34d852c9b9f62a4dca5ca138dbc458c931
- SHA512 8a81c4edde9d20ee24d3390338915f096a27956bf57815c443a37f15bdb4072a0c959376721d2354fd565045efb3340922a9a22f3293bb3784cc6df6a0ac353b
- SSDEEP 24576:gawxZ1onv5Sp+D9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:dSSApY90IDWb36Z5W1DYsHq6g3P0zAkw
- TLSH
  T163155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  $R0/Uninstall Excalibur.exe
- Size 501KB
- SHA256 ca774c434b7a9da6f4a1040f968146a2b670f1a5990af642e1eb5789581d10f6
- MD5 a105efd9a34ee6061a935bc4014affda
- SHA1 74bc55061cc6097be99157f595c61cafd35fb911
- SHA512 3bbaefab327fa70ff1b1bc682e5edd4d428f91c61297085581d7b6e7849d6ac5587627d85f33082bd7a2ef12a3db3dc0795226f4fc25b90a49ea19f176232d7d
- SSDEEP 3072:Qn77v00hEoDEtauSztpjq2bN+q/aH2tvhOEA1RJCir86SrSrv6Ia3Wp:Q740Iiztpjf9s2t0EyL+yay
- TLSH
  T127B47B1D3BD2DC13D9725A744A91D2FE1A34BE58282886C336F17F5F3D76382AA4B241
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral22
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23