c64fb39ed754cef548cd3167098772eedfc4bfb34cb38d4e6b86fc9dbc56fd5b

Sharing

Copy URL Twitter E-mail

General

Target
ascension-setup-1.0.102.exe
Size 151.4MB
Sample260827-mrj72asscx
SHA256 c64fb39ed754cef548cd3167098772eedfc4bfb34cb38d4e6b86fc9dbc56fd5b
MD5 1a2d554d2c13fb6702b50f185384c8dd
SHA1 22202dd78b071245c5128fb924dbb144fb25770a
SHA512 844e8e03423d171b02c49a98811049d096393165c92ea9935bb4d72969509d84b0d5fb42d7abd7160507134c7eecd76da84fafd0d0dd8394f57d0baac098683c
SSDEEP 3145728:41M9NNNv9UrNqd+Xjq29FcmCXjeUO18VseaTRLUQ:19Nbv9INqlScmsyeapv
TLSH
T1B97833B0C9FEEFA9ED61E4BA11808C5288F9BF5F187C904358D675B258341FF44E498A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ascension-setup-1.0.102.exe
- Size 151.4MB
- SHA256 c64fb39ed754cef548cd3167098772eedfc4bfb34cb38d4e6b86fc9dbc56fd5b
- MD5 1a2d554d2c13fb6702b50f185384c8dd
- SHA1 22202dd78b071245c5128fb924dbb144fb25770a
- SHA512 844e8e03423d171b02c49a98811049d096393165c92ea9935bb4d72969509d84b0d5fb42d7abd7160507134c7eecd76da84fafd0d0dd8394f57d0baac098683c
- SSDEEP 3145728:41M9NNNv9UrNqd+Xjq29FcmCXjeUO18VseaTRLUQ:19Nbv9INqlScmsyeapv
- TLSH
  T1B97833B0C9FEEFA9ED61E4BA11808C5288F9BF5F187C904358D675B258341FF44E498A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/DirectX_20190310.exe
- Size 6.6MB
- SHA256 feb83edebe4f9776a1c3d1e679e13bbc9be48b4e0f676c54a86ab733ceefaea0
- MD5 bf030940dd820ed9f8b9a382746c6ce0
- SHA1 4e10a0c8b0ecfa2db08d121b3b110d803cfe359e
- SHA512 afede7ff3e2c87913177c41c967034f1205709e7ef39b307f0db6f5c9923be25f0fde75f0510fc28729744f3d1ab31a82528eef42a514a09652f16c865dbd215
- SSDEEP 196608:Sgm2Vre/HWcnhd9mi1PrLXQVdq1qj+ZtwZdO/3f+Hy:SgTY/HVDRPHgsqqZtqM/3f9
- TLSH
  T1F9663343EBC3863DC35126365247968104BF23A31B79A8DF57A91A1B3E2038E537B75B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/DirectX_9_SDK_Install.exe
- Size 15.5MB
- SHA256 4414efaf78c592ce41cb1995da0ba2f50c129d5a88b5823381d26b0314d2e785
- MD5 e990d6f537e62e0222e33bc68a853785
- SHA1 c2b7b5c5daad384c9dcfb5b953e0db658c7ca0c0
- SHA512 27d942abe690cffe0e3ac5eb249640ce2a50fe6f5135426e2fc5083e864289b4da8715b8c29350966c8f30ef8ec7ab315ae9c7cfdf9250bfe802aa15de194d61
- SSDEEP 393216:gg47JpNg7MoZjhlgve65QCJEnPIR38AvC8Cw4qtUYvRpjyE8VShwDtiPeHoGV66:+QZwvX54PE8iC0DzjyLVShnPaoGQ6
- TLSH
  T1A6F6339570FA9DA9CC8369388089B363D8F2FB8FAF14C6D771409E604D181DF9B35A85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/app-64.7z
- Size 111.2MB
- SHA256 c255995a47ed00819c7e267bd98c1b8740854b934bbe2a6b41f5287a9cc3dc67
- MD5 a228d9a4393871ecbb9f41f99ad767ea
- SHA1 f2fb2f0695783e5d59b38130529741055488c298
- SHA512 f1a79e0741af3f3085d348cf5de9b4df642d55b3586ae24b3c59ad8030e492d722c5e61998844e6d1233a8a6e5fd00efe965ad7acc7b0f9efe5c5cc80318146f
- SSDEEP 1572864:5M9NNXXNv9UmRKX+bOqmKT21hrYRcucMuqZEe0HES86c1cbQDjQ3AuX8jxTkUO1z:5M9NNNv9UrNqd+Xjq29FcmCXjeUO18Vg
- TLSH
  T1974833F08A9EB7F1ED71C8F625808C73D888FF171978914359D671E26A381FE44C4A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Ascension Launcher.exe
- Size 216.3MB
- SHA256 6b76d81a8655e6d84ddc66385b8865390a4b8ffde3b5b433a88159f2978e73f6
- MD5 1eb6ca613dc2f479f2785fedebb86293
- SHA1 07c44c9ba11ddcfdded5979eadc4eef241c7d4b5
- SHA512 c486daa808d791c8fe95cd45d7fadde9f5eddb1977f8d512253cb481dea519fd6f0069699364591eb2944b4d9641973edbbc6a462da492a7826e8bbc49d9e13b
- SSDEEP 1572864:NWjeeQ23/vX6bFo270duhjeht1vcTo63TqxdFomUVkxFKdijl9IVzQMUa14Ezgid:25E0BluHkInL
- TLSH
  T158B88C03E29A01D9C05DD1B59B5A9733FEB1B8454B24B3DF2B5407922F66EE82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral17
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 9feb01af5460d69042b715dd2dc8d23faa3a409b07b811e07b7195c044aac1c7
- MD5 738d9cdd6a94cff9e941326c6c2ad734
- SHA1 716f6bc8a11dd0940f1b36196ad0a1e32c52a886
- SHA512 6e1e188a6a07fef8ee96e106ffcb90a6dc13ff6fe6b313797e4c746a9a4fb7a0c795a3365a9fcf0a1d8918d1fbd07ff9f583bb4acd17d883b09c8b5348abff97
- SSDEEP 196608:dWxkDUHlgJWwgvYtoexSGkJ+ccXP2BPUNkiAqAN+nNtbR:dEkDUHl4Wwg2xSFJ6XP2BPUNpQN+zR
- TLSH
  T14A4729122646D49DC099C879C7678B268A6C30E73FA7B9DFC0F451252B79EBC4B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 568b4a799381c45e34f7ecdc73d7ffc4340688153766f5e6d15b7d99ca8a47ee
- MD5 054e6f1d8554c25cfe74cd8c625b825a
- SHA1 f50b4d25ecd8ff11a148bcc52e51831130774b84
- SHA512 2b1a7341c09fc75477d62b43a56506bc9417a98db413cf57235f64850138bbe34a9ec30147cd55be648134cde56100524f9a32ab90c84a3b084fdc1ab1f396fb
- SSDEEP 49152:YD4JOs9bUAtjcqOEYcvDb199aPLKIbH7k6Q4gNoJqFfwYd7f:YD9+UAdcqbvDdRNoJ23
- TLSH
  T1F0E59E02F6D651DDD029C03497AF9213F631380A4F205AEB1A905A263F67FD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  resources/AscensionClientServices.exe
- Size 14.2MB
- SHA256 ef8b2b3f75e43a2c076de1a9944d02ee0eb64db531efbda5877542d34a7d9b3d
- MD5 8a0c6b7930696a70ba30a6ed6e7262e6
- SHA1 cc88c0b69fb352b89577164140d245974053e6b7
- SHA512 3dd3595e659edf8a8f5c2b9ec9466c060093216226677b259ef81e5e133fff1fa605b10884dcc02244e1e7b24e6a453ae0537c697a871940344680479392b8a1
- SSDEEP 98304:guc7oAjvEBwoK+uYRUztzz6lENNlU5qnGmw34iAzKAIGLEHPydLoQ6+ZQp+9puZi:fcUuk5roMH4LoQ6wkMk5I
- TLSH
  T126E64B13F6A291E8C16AC074835A6233FB727849073476EB5BE08B213F66F906B3D755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/app.asar
- Size 14.6MB
- SHA256 c6cd21f4f4588c0a6b90e0eae6284f1f919ab88bee665dc989f6872e2c3f4ce7
- MD5 de35fbe997c0945b1cdce3f6ae5310ee
- SHA1 944545a89d85af2b1a1ee352e2fb1e687c47c85c
- SHA512 1f5f2423c2aef30af0cb110c8d1ca81b4bb44f0010f87d7d6629b654174b1c22b08f66d3a8f8f856f163734741374fee7ec507551d1e9738e8e37f8342c933ae
- SSDEEP 196608:4fU1WXNNEE7SHq86dFmHthkUBqnb1Vmn5O6o7BmxXsI9gcDY:D1EEEgZ6mLW4n5O6YBmNsI9L8
- TLSH
  T1A6F6D0427394D637CE6703F581BF620F773708443F0BC30AA5AD87292D62BEA8D9A955
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  resources/native/ascension-client-services.node
- Size 3.2MB
- SHA256 4b18a26d1fc7001f4a16c3de8c1818af9ca3d6617c517925eacc001856213cd0
- MD5 a621babac60a424c4fa98760cba113c5
- SHA1 8d998ba3e20e778665e78309d777aa3a0764f554
- SHA512 bc66099fd1e92b0172149e45db9eb682db5fe4528b8d6777b15ba2efe403505689ef5c9b9b4bcc28931ebf20a847631e467cfd5b611424bc2b7d82cf191a1729
- SSDEEP 49152:a7L6QqfYk72M/x+OA86nsJ2fxTd3JdiJUAiA:qKYKRJ+I8JZ5diJU
- TLSH
  T14AE56CE320C166DDD566C57E4353FD3FCA8FB8394626A8FB9050E3226D16C463629F0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32